The walker dropped input past its node, character and per-string budgets
silently, so 32 guards passed a secret placed after the cap. textsOf now
appends a TRUNCATED marker; names/hasSecretIn treat it as a finding. Regenerated
the 38 copies, bumped the 39 plugins, emptied the known-holes baseline.
Co-Authored-By: RuFlo <ruv@ruv.net>
Extend scripts/sync-mod-screen.mjs to a second kit: the flag() helper in hooks/options.ts of 38 mods now sits between SHARED FLAG markers and is
rewritten/checked from ruflo-agentdb. Drift, a lost marker or zero copies fails --check. Bump the 39 touched plugin versions and their version pins.
Co-Authored-By: RuFlo <ruv@ruv.net>
Replaces 37 copy-pasted recursive walkers with a shared breadth-first one (keys as key=value, overlapping windows for long strings, node and char budgets) and widens INVISIBLE (soft hyphen, bidi isolates, Mongolian separator, more). Probe holes 788 -> 0.
Co-Authored-By: RuFlo <ruv@ruv.net>
One canonical region in ruflo-agentdb/hooks/screen.ts, regenerated into the 37 copies by sync-mod-screen.mjs. 'key assignment' is now decided by
the value (not a call/env/path/placeholder/UUID/name; two character classes; >=2.5 bits entropy). Adds stripe, npm, huggingface, sendgrid, twilio,
slack webhook and credentialed DB URL rules; bearer and DB URL placeholders are rejected. 40 new agentdb tests; 20 KB ReDoS probe 0.57 -> 0.68 ms.
Co-Authored-By: RuFlo <ruv@ruv.net>
full-system-test surfaced 23/32 plugin smoke contracts failing on a
single drifted assertion: the smoke gate greps ADR-0001 for
`status: Proposed`, but those ADRs were long since promoted to
`Accepted` without updating the gate. Flip the assertion (label, grep,
message) Proposed -> Accepted only where the ADR is genuinely Accepted.
ruflo-core additionally had a stale version assertion (0.2.0 -> 0.2.2).
Left untouched: ruflo-adr, ruflo-browser, ruflo-intelligence — their
ADR-0001 is genuinely Proposed, so their smokes correctly assert it.
No plugin source or ADR changed — only the drifted test assertions.
All 32 plugin smoke contracts now pass; full-system-test is 4/4 green.
Co-Authored-By: RuFlo <ruv@ruv.net>
Closes the 16% gap (7 of 43 plugin agents) flagged by the ADR-098
audit: agents that completed tasks without feeding the SONA learning
loop, costing the system long-term improvement signal.
Each affected agent gets the canonical 5-line tail:
### Neural Learning
After completing tasks, feed the <role-specific-context>:
```bash
npx @claude-flow/cli@latest hooks post-task --task-id "TASK_ID" --success true --train-neural true
```
The "<role-specific-context>" is per-agent so the tail reads native
rather than copy-pasted:
ruflo-daa/daa-specialist adaptive-agent learning loop
ruflo-goals/goal-planner planner trajectory store
ruflo-intelligence/intelligence-spec pattern-discovery learning loop
(next RETRIEVE benefits from this run)
ruflo-iot-cognitum/telemetry-analyz telemetry baseline learning
(Z-score thresholds adapt)
ruflo-ruvllm/llm-specialist router outcome learning
(provider/model picks compound)
ruflo-sparc/sparc-orchestrator phase-quality learning loop
(quality gates self-tune)
ruflo-swarm/coordinator coordination outcome learning
(topology + role choices compound)
Re-audit confirms 0 of 43 plugin agents missing the hook (was 7 of 43).
ADR-098 acceptance-criteria item closed: "All 43 plugin agents include
a `hooks post-task --train-neural true` invocation."
Parts 1 (capability sync), 2 (token diet), 3 (model rightsizing), and
5 (worker dispatch) remain as separate iterations.
ruv