The walker dropped input past its node, character and per-string budgets
silently, so 32 guards passed a secret placed after the cap. textsOf now
appends a TRUNCATED marker; names/hasSecretIn treat it as a finding. Regenerated
the 38 copies, bumped the 39 plugins, emptied the known-holes baseline.
Co-Authored-By: RuFlo <ruv@ruv.net>
Extend scripts/sync-mod-screen.mjs to a second kit: the flag() helper in hooks/options.ts of 38 mods now sits between SHARED FLAG markers and is
rewritten/checked from ruflo-agentdb. Drift, a lost marker or zero copies fails --check. Bump the 39 touched plugin versions and their version pins.
Co-Authored-By: RuFlo <ruv@ruv.net>
Found by driving each plugin's mod live (/SHORT-mod status ran for all 19; status.json parsed, version 1) and probing the guards.
- 13 guards (jujutsu, knowledge-graph, loop-workers, market-data, metaharness, rag-memory, ruvector, ruvllm, rvf, security-audit, sparc,
workflows, x-gateway): textsOf dropped the key name, so {"api_key": "abcdef1234567890abcdef"} was never an assignment; and one long
field (a 40 KB base64 blob) used the whole 20 KB budget so a key in the next field was never read. Strings now lead with their key and
each is charged at most 20 KB of a 100 KB budget.
- neural-trader: the live-order gate matched execute_trade only; the package's execute_multi_asset_trade and place_prediction_order_tool
went through unconfirmed. Paper/simulated tools stay ungated.
- tsconfig.json for knowledge-graph, loop-workers, market-data, metaharness (the host writes it on load; jujutsu already commits it).
- Patch bump for the 14 plugins; smoke step 1 pins updated.
Co-Authored-By: RuFlo <ruv@ruv.net>
Each gets a tighten-only tool.call guard on its own tools, a status file
(.claude-flow/<short>-mod/status.json), a local /<short>-mod command, userConfig,
tests, smoke steps M1-M3, and a README 'As a mod' section. Minor version bumps.
Co-Authored-By: RuFlo <ruv@ruv.net>
full-system-test surfaced 23/32 plugin smoke contracts failing on a
single drifted assertion: the smoke gate greps ADR-0001 for
`status: Proposed`, but those ADRs were long since promoted to
`Accepted` without updating the gate. Flip the assertion (label, grep,
message) Proposed -> Accepted only where the ADR is genuinely Accepted.
ruflo-core additionally had a stale version assertion (0.2.0 -> 0.2.2).
Left untouched: ruflo-adr, ruflo-browser, ruflo-intelligence — their
ADR-0001 is genuinely Proposed, so their smokes correctly assert it.
No plugin source or ADR changed — only the drifted test assertions.
All 32 plugin smoke contracts now pass; full-system-test is 4/4 green.
Co-Authored-By: RuFlo <ruv@ruv.net>
Real bug fix: kg-extract skill and graph-navigator agent referenced
mcp__claude-flow__embeddings_embed, but no such MCP tool exists. The
correct tool name is embeddings_generate (defined at
v3/@claude-flow/cli/src/mcp-tools/embeddings-tools.ts:260). Invocations
of the old name would fail silently as "tool not found".
Functional fixes:
- skills/kg-extract/SKILL.md allowed-tools: embeddings_embed → embeddings_generate
- agents/graph-navigator.md tool list: same rename
Contract additions:
- ADR-0001 (Proposed) at docs/adrs/0001-knowledge-graph-contract.md
- README adds Compatibility (pin v3.6), Namespace coordination (claims
kg-graph; defers to ruflo-agentdb ADR-0001) with explicit "NOT
embeddings_embed" callout, Verification + Architecture Decisions
- plugin.json keywords add mcp, pathfinder-traversal, entity-extraction
(already at v0.2.0)
- scripts/smoke.sh — 10 structural checks: version + keywords, both
skills + agent + command present, **regression check** that
embeddings_embed is NOT referenced at any tool-call site (ADR +
README's "NOT" call-outs are excluded), embeddings_generate referenced,
5 /kg subcommands, v3.6 pin, namespace coordination, ADR Proposed,
no wildcard tools
Verification: bash plugins/ruflo-knowledge-graph/scripts/smoke.sh → 10/10
Co-Authored-By: RuFlo <ruv@ruv.net>
ruv