Recall folds each retrieved item with NFKC (bounded, never throws) and screens the folded text, so fullwidth, circled, mathematical and ligature spellings of an injection phrase or a secret are dropped. Structured fields are judged as name=value pairs with the guard's extras(). The shared screen region is untouched.
Co-Authored-By: RuFlo <ruv@ruv.net>
The guard saw only inputPath. It now stats then reads the file (regular, 1 MB max, under the project root or home, no traversal) and screens it; it fails open on any problem.
Co-Authored-By: RuFlo <ruv@ruv.net>
Verified the claim-10 tools against the MCP registry schemas: agentdb_feedback
(patterns[]), agentdb_session-end (summary), hive-mind_memory (value) and
session_save (description) persist free text, so they join WRITERS.
memory_import (file path), rvf_ingest and hooks_compress_store (vectors) take no
text and stay unguarded.
Co-Authored-By: RuFlo <ruv@ruv.net>
The walker dropped input past its node, character and per-string budgets
silently, so 32 guards passed a secret placed after the cap. textsOf now
appends a TRUNCATED marker; names/hasSecretIn treat it as a finding. Regenerated
the 38 copies, bumped the 39 plugins, emptied the known-holes baseline.
Co-Authored-By: RuFlo <ruv@ruv.net>
Extend scripts/sync-mod-screen.mjs to a second kit: the flag() helper in hooks/options.ts of 38 mods now sits between SHARED FLAG markers and is
rewritten/checked from ruflo-agentdb. Drift, a lost marker or zero copies fails --check. Bump the 39 touched plugin versions and their version pins.
Co-Authored-By: RuFlo <ruv@ruv.net>
Review item 1: a { key: 'api_key', value } or ['token', value] write held the name and the value in two strings, so the
key-assignment rule never saw them together; inputs past the walker's node or character budget were silently half read.
Pairs are now joined as name=value, and an oversize input is refused instead of passed.
Co-Authored-By: RuFlo <ruv@ruv.net>
Run against a real initialised AgentDB with real MCP servers and headless haiku
(v3/docs/validation/agentdb-recall-live-2026-10.md, scripts/live-agentdb-recall.sh).
Defects found by the live run and fixed:
- status.json only flushed on attach/block: skipped, timed-out, cached and error
counters were invisible; add lastReader and lastError
- a permission-refused or failing reader call was swallowed and read as "nothing
relevant"; now counted in errors/lastError
- memory_search (the only semantic reader) was never used; it is now the first
reader, whole prompt only, and its 60-character value cut is completed with
memory_retrieve before the screen and the frame
- ruvector scores arrive as strings and are noise (-0.10..0.10); read numeric
strings and skip results scoring under 0.25
- an all-unsafe answer ended the search, hiding a clean memory behind a poisoned
one; the walk continues and dropped counts each note once
- readers were cached even when none was connected
- add directed-at-the-assistant phrasing rules (plugin-local): haiku followed 6 of
10 injected directives that passed the shared screen, whatever the frame said
41 plugin tests (was 26), smoke 19/19, claude plugin validate passes.
Co-Authored-By: RuFlo <ruv@ruv.net>
Replaces 37 copy-pasted recursive walkers with a shared breadth-first one (keys as key=value, overlapping windows for long strings, node and char budgets) and widens INVISIBLE (soft hyphen, bidi isolates, Mongolian separator, more). Probe holes 788 -> 0.
Co-Authored-By: RuFlo <ruv@ruv.net>
One canonical region in ruflo-agentdb/hooks/screen.ts, regenerated into the 37 copies by sync-mod-screen.mjs. 'key assignment' is now decided by
the value (not a call/env/path/placeholder/UUID/name; two character classes; >=2.5 bits entropy). Adds stripe, npm, huggingface, sendgrid, twilio,
slack webhook and credentialed DB URL rules; bearer and DB URL placeholders are rejected. 40 new agentdb tests; 20 KB ReDoS probe 0.57 -> 0.68 ms.
Co-Authored-By: RuFlo <ruv@ruv.net>
A markdown /agentdb cannot be hooked or re-registered (session.start aborted, no status file); the
tier recall matches substrings so sentences never matched. Live: recall attached, guard denied.
Co-Authored-By: RuFlo <ruv@ruv.net>
Reads .claude-flow/agentdb-mod/status.json (version-checked), shows install state, recall/guard
settings, counters and the last attached items. Help guide agentdb-mod. ADR-445 accepted with results.
Co-Authored-By: RuFlo <ruv@ruv.net>
Opt-in safe recall into the prompt (per-prompt context, deadline-bounded, screened as
untrusted), a write guard that keeps secrets out of memory, /agentdb, a status file.
Plugin 0.4.0; 20 hook/unit tests; bench; smoke steps M1-M3.
Co-Authored-By: RuFlo <ruv@ruv.net>
Closes Part 1 of ADR-098. Documents the 5 AgentDB controllers
activated in 3.6.23+/3.6.24 (G7 from ADR-095) so end users of
ruflo-agentdb and ruflo-knowledge-graph know they're available.
ruflo-agentdb/README.md:
New "G7 controllers (activated in ruflo 3.6.23+ / 3.6.24)" section
with a 5-row table (controller / role / source). Each entry cites
the dist file inside the agentdb npm package so users can verify
the wiring locally:
gnnService — GNN embeddings + relational scoring
rvfOptimizer — quantize + dedupe vector blocks
mutationGuard — WASM proof generation for state mutations
attestationLog — hash-chained audit log (.swarm/attestation.db)
GuardedVectorBackend — wraps vectorBackend with guard + log
Notes graphAdapter still pending external graph-DB connection.
Pointers to agentdb_controllers / agentdb_health for runtime
inspection.
ruflo-knowledge-graph/README.md:
Targeted G7 section explaining which controllers help this plugin
specifically:
gnnService — augments pathfinder semantic_similarity
with structural relational scoring
rvfOptimizer — collapses near-duplicate entity vectors
(same class re-exported from multiple
modules)
mutationGuard +
attestationLog +
GuardedVectorBackend — proof-gated writes for federated knowledge
import; .swarm/attestation.db audit trail
Notes graphAdapter as a future improvement that would replace the
current flat-causal-edge view with a real graph-DB backend.
Plugin versions:
ruflo-agentdb 0.1.0 → 0.2.0 (minor — capability sync)
ruflo-knowledge-graph 0.1.0 → 0.2.0 (minor — capability sync)
ADR-098 Part 1 complete: 6 plugins now reference recent ADR
capabilities. Acceptance: each affected plugin has a paragraph or
bullet list referencing the relevant ADR — done for the 6 plugins
flagged in the Part 1 table.
Remaining ADR-098 work:
- Part 2: token diet (4 fat agent prompts → ≤ 60 lines)
- Part 5: worker dispatch (≥ 8 work-producing agents)
ruv