Local /<short>-mod command, status file, tighten-only secret guard where the plugin has write tools, tests, smoke steps M1-M3, README section.
Co-Authored-By: RuFlo <ruv@ruv.net>
Adds ADR-096 references to ruflo-rag-memory and ruflo-rvf — the two
plugins whose write surfaces (.swarm/memory.db and
.claude-flow/sessions/*.json) are now opt-in encrypted at rest.
ruflo-rag-memory/README.md:
New "Encryption at rest (ruflo 3.6.25+)" section before "Memory
Namespaces". Covers:
- Each .swarm/memory.db write encrypted with fresh 12-byte IV via
writeFileRestricted({encrypt:true})
- Reads use readFileMaybeEncrypted(path, null) — RFE1 magic-byte
sniff for backward compat (legacy plaintext memory.db still works)
- Embeddings encrypted along with the SQLite blob — no separate
column-level encryption needed for Phase 1
- Tamper detection: flipped byte fails GCM auth, throws on read
- ruflo doctor -c encryption reports gate state
ruflo-rvf/README.md:
New section between Features and Commands explaining session
persistence's relationship to the encryption gate:
- Off-by-default: plaintext JSON at mode 0600 (legacy behavior)
- On: AES-256-GCM session saves, transparent decrypt on restore
- Important caveat: when exporting RVF files for cross-machine
transfer, the gate doesn't apply to the exported bytes — that's
transport security, separate from at-rest. Sealed-box backups
are the next phase per ADR-096.
Plugin versions:
ruflo-rag-memory 0.1.0 → 0.2.0 (minor — capability sync)
ruflo-rvf 0.1.0 → 0.2.0 (minor — capability sync)
ADR-098 Part 1 progress: 2/4 slices done. Remaining:
- slice 3: ruflo-cost-tracker — federation budget breaker pairing,
federation_spend events
- slice 4: ruflo-agentdb + ruflo-knowledge-graph — G7 controllers
ruv