The walker dropped input past its node, character and per-string budgets
silently, so 32 guards passed a secret placed after the cap. textsOf now
appends a TRUNCATED marker; names/hasSecretIn treat it as a finding. Regenerated
the 38 copies, bumped the 39 plugins, emptied the known-holes baseline.
Co-Authored-By: RuFlo <ruv@ruv.net>
Extend scripts/sync-mod-screen.mjs to a second kit: the flag() helper in hooks/options.ts of 38 mods now sits between SHARED FLAG markers and is
rewritten/checked from ruflo-agentdb. Drift, a lost marker or zero copies fails --check. Bump the 39 touched plugin versions and their version pins.
Co-Authored-By: RuFlo <ruv@ruv.net>
Replaces 37 copy-pasted recursive walkers with a shared breadth-first one (keys as key=value, overlapping windows for long strings, node and char budgets) and widens INVISIBLE (soft hyphen, bidi isolates, Mongolian separator, more). Probe holes 788 -> 0.
Co-Authored-By: RuFlo <ruv@ruv.net>
One canonical region in ruflo-agentdb/hooks/screen.ts, regenerated into the 37 copies by sync-mod-screen.mjs. 'key assignment' is now decided by
the value (not a call/env/path/placeholder/UUID/name; two character classes; >=2.5 bits entropy). Adds stripe, npm, huggingface, sendgrid, twilio,
slack webhook and credentialed DB URL rules; bearer and DB URL placeholders are rejected. 40 new agentdb tests; 20 KB ReDoS probe 0.57 -> 0.68 ms.
Co-Authored-By: RuFlo <ruv@ruv.net>
Found by driving each plugin's mod live (/SHORT-mod status ran for all 19; status.json parsed, version 1) and probing the guards.
- 13 guards (jujutsu, knowledge-graph, loop-workers, market-data, metaharness, rag-memory, ruvector, ruvllm, rvf, security-audit, sparc,
workflows, x-gateway): textsOf dropped the key name, so {"api_key": "abcdef1234567890abcdef"} was never an assignment; and one long
field (a 40 KB base64 blob) used the whole 20 KB budget so a key in the next field was never read. Strings now lead with their key and
each is charged at most 20 KB of a 100 KB budget.
- neural-trader: the live-order gate matched execute_trade only; the package's execute_multi_asset_trade and place_prediction_order_tool
went through unconfirmed. Paper/simulated tools stay ungated.
- tsconfig.json for knowledge-graph, loop-workers, market-data, metaharness (the host writes it on load; jujutsu already commits it).
- Patch bump for the 14 plugins; smoke step 1 pins updated.
Co-Authored-By: RuFlo <ruv@ruv.net>
This iter-4 edit was made by the headless agent but its commit step
didnt land in the branch (rate-limit at end of workflow). Cleanly
landing it now alongside the lockfile fix.
full-system-test surfaced 23/32 plugin smoke contracts failing on a
single drifted assertion: the smoke gate greps ADR-0001 for
`status: Proposed`, but those ADRs were long since promoted to
`Accepted` without updating the gate. Flip the assertion (label, grep,
message) Proposed -> Accepted only where the ADR is genuinely Accepted.
ruflo-core additionally had a stale version assertion (0.2.0 -> 0.2.2).
Left untouched: ruflo-adr, ruflo-browser, ruflo-intelligence — their
ADR-0001 is genuinely Proposed, so their smokes correctly assert it.
No plugin source or ADR changed — only the drifted test assertions.
All 32 plugin smoke contracts now pass; full-system-test is 4/4 green.
Co-Authored-By: RuFlo <ruv@ruv.net>
Adds ADR-095/096 + audit_1776853149979 references to ruflo-aidefence
and ruflo-security-audit. End users installing either plugin now see
the host hardening features that pair with the plugin's threat
detection / scanning, not just the plugin's own surface.
ruflo-aidefence/README.md:
New "Defense-in-depth pairing (ruflo 3.6.25+)" section listing:
- validateEnv() loader-hijack denylist (LD_PRELOAD, NODE_OPTIONS,
DYLD_*, etc.) at the terminal_create MCP boundary
- File mode 0600 / dir mode 0700 on session/terminal/memory stores
via fs-secure
- Encryption at rest (CLAUDE_FLOW_ENCRYPT_AT_REST=1, AES-256-GCM,
RFE1 magic-byte sniff)
Threat scoring should account for whether the host is a denylist-
enforcing / encrypted-at-rest install.
ruflo-security-audit/README.md:
New "Patterns to scan for (audit_1776853149979 follow-up)" section
with six concrete antipatterns + remediation pointers:
- execSync(string) with template-literal args (4 closed sites cited)
- Numeric MCP inputs cast as `number` without runtime check
- Untrusted package specs flowing into npm install
- Loader-hijack env vars
- Plaintext at-rest secrets paired with ADR-096
- MCP stdin DoS (10MB cap reference)
Plus a `ruflo verify` reference confirming 55 witnesses on disk.
Plugin versions:
ruflo-aidefence 0.1.0 → 0.2.0 (minor — capability sync)
ruflo-security-audit 0.1.1 → 0.2.0 (minor — capability sync,
was patch from iter #55 model
fix)
Two more slices remain for Part 1:
- slice 2: ruflo-rag-memory + ruflo-rvf — encryption-at-rest gate
notes
- slice 3: ruflo-cost-tracker — federation budget breaker pairing,
federation_spend events
- slice 4: ruflo-agentdb + ruflo-knowledge-graph — G7 controllers
Drops the security-auditor agent from model:opus to model:sonnet.
Bounded-scope security review (CVE check, dependency audit, input-
validation review, secret scan, severity-ranked report) is sonnet-
tier work in practice — opus's long-context advantage isn't load-
bearing for the audit pattern this agent runs.
Cost delta: ~5x cheaper per token for the model call. Quality delta
expected to be small; documenting the override path so users can
flip back to opus when the audit truly needs deep cross-file taint
tracing or architectural reasoning.
Added a one-line note in the agent prompt explaining the trade-off
and when to override, so the cost-vs-quality decision is visible
to users rather than buried in an ADR.
Plugin version: 0.1.0 → 0.1.1 (patch — model rightsizing only,
no surface change).
Re-audit: 2 of 43 plugin agents on model:opus, both justified —
federation-coordinator (multi-phase trust + audit-grade logging)
and neural-trader/trading-strategist (real-money trading
decisions). Down from 3 of 43.
ADR-098 acceptance-criteria item closed: "ruflo-security-audit/
security-auditor.md is on model: sonnet."
Trial period: monitor security-audit output quality across one
release cycle. Revert to opus if regression detected.
Parts 1 (capability sync), 2 (token diet), and 5 (worker dispatch)
remain.
ruv