rUvandr
828a8d78d9
* feat(plugins): ADR-507 cut the per-turn plugin footprint - scripts/measure-plugin-footprint.mjs: per-plugin skills/commands/agents, listing characters and estimated tokens, from the tree or a git ref; before/after reports in v3/docs/validation/. - 27 operational skills get disable-model-invocation: true (cost-tracker sub-reports reached by /ruflo-cost, metaharness bench/learn/evolve/mint/ oia-audit, GAIA submission + comparison, init-project, ruflo-status, vector-setup, federation-init, agntcy-status). Each is listed in a "User-invoked skills" table in its plugin README; the choosing rule is in plugins/README.md. - 20 skill descriptions over 300 characters cut to one sentence plus "Use when". - audit-skill-frontmatter: 300-char ceiling on skill and command descriptions (measured unfolded) and a README check for every user-invoked skill. - skillTrim (§2.4) not built: the engine has no skill-listing hook. Listing with every plugin enabled: 47,743 -> 39,402 chars (about 11,936 -> 9,851 tokens per turn). Co-Authored-By: RuFlo <ruv@ruv.net> * docs(adr): ADR-507 status names PR #4588 Co-Authored-By: RuFlo <ruv@ruv.net> * docs(plugins): ADR-507 cost-analyst points users at /ruflo-cost for user-invoked reports The engine's refusal for a disable-model-invocation skill says not to replicate its workflow by other means, so the agent names the subcommand instead of running the report script. After-report now cites the pushed commit. Co-Authored-By: RuFlo <ruv@ruv.net> * fix(scripts): ADR-507 audit runs through symlinked paths; test the gate's wiring The import guard compared argv[1] with import.meta.url, which Node realpaths for the entry module. Run through a symlinked path, main() was skipped and the audit exited 0 having checked nothing. Both scripts now compare realpaths. audit-skill-frontmatter takes --plugins-dir so tests can run the real CLI on a fixture: a 304-char folded description, an unlisted user-invoked skill and a 311-char literal command description must exit 1 with those findings, and adding the README row must clear only the user-invoked one. The repo-wide test now also asserts skillsScanned > 100. Disabling any of the three checks, or restoring either old guard, fails a test. Co-Authored-By: RuFlo <ruv@ruv.net> * chore(plugins): version bumps for ADR-507 footprint changes Co-Authored-By: RuFlo <ruv@ruv.net> --------- Co-authored-by: r <r@x>
9.3 KiB
Ruflo Plugins
32 Claude Code plugins for agent-powered development workflows. Load with --plugin-dir.
Quick Start
# Load specific plugins
claude --plugin-dir plugins/ruflo-core --plugin-dir plugins/ruflo-swarm
# Load all plugins
claude $(ls -d plugins/ruflo-*/ | sed 's|^|--plugin-dir |' | tr '\n' ' ')
Plugin Catalog
Core & Coordination
| Plugin | Description |
|---|---|
| ruflo-core | MCP server, status, doctor, coder/researcher/reviewer agents |
| ruflo-swarm | Swarm topologies (hierarchical, mesh), Monitor streaming |
| ruflo-autopilot | Autonomous /loop task completion with prediction |
| ruflo-loop-workers | 12 background workers via /loop or CronCreate |
| ruflo-workflows | Workflow templates, parallel execution, branching |
Memory & Intelligence
| Plugin | Description |
|---|---|
| ruflo-agentdb | AgentDB with HNSW vector search (150x-12,500x faster) |
| ruflo-rag-memory | SOTA RAG — hybrid search, Graph RAG, MMR diversity, memory bridge |
| ruflo-rvf | Portable RVF memory format, session persistence |
| ruflo-ruvector | ruvector — FlashAttention-3, Graph RAG, hybrid search, 103 MCP tools, Brain AGI |
| ruflo-knowledge-graph | Entity extraction, relation mapping, pathfinder traversal |
| ruflo-intelligence | SONA neural patterns, trajectory learning, model routing |
| ruflo-daa | Dynamic Agentic Architecture, cognitive patterns |
Architecture & Methodology
| Plugin | Description |
|---|---|
| ruflo-adr | ADR lifecycle — create, index, supersede, compliance checking |
| ruflo-ddd | DDD scaffolding — bounded contexts, aggregates, domain events |
| ruflo-sparc | SPARC methodology with 5 phases and quality gates |
Quality & Security
| Plugin | Description |
|---|---|
| ruflo-security-audit | CVE scanning, dependency vulnerability checks |
| ruflo-aidefence | Prompt injection detection, PII scanning |
| ruflo-protector | Project Anatole: optional learning watchdog for unattended agents (default off) |
| ruflo-testgen | Test gap detection, TDD London School workflow |
| ruflo-browser | Playwright browser automation and testing |
| agentic-qe-fleet | External (Agentic QE, pinned in the marketplace): QE agents, coverage, chaos, TDD skills, agentic-qe MCP server. Install with /plugin install agentic-qe-fleet@ruflo; not in this folder, so --plugin-dir does not load it. Install it from one marketplace only (agentic-qe or ruflo), not both: enabled from both, its mod and commands load twice |
Development Tools
| Plugin | Description |
|---|---|
| ruflo-jujutsu | Diff analysis, risk scoring, reviewer recommendations |
| ruflo-docs | Doc generation, drift detection, API docs |
| ruflo-ruvllm | Local LLM inference, MicroLoRA, chat formatting |
| ruflo-agent | WASM agent sandboxing and gallery |
| ruflo-plugin-creator | Scaffold and validate new plugins |
| ruflo-migrations | Database schema migration management |
| ruflo-observability | Structured logging, tracing, metrics correlation |
| ruflo-cost-tracker | Token usage tracking, budget alerts, cost optimization |
Domain-Specific
| Plugin | Description |
|---|---|
| ruflo-goals | GOAP planning, deep research, horizon tracking |
| ruflo-federation | Zero-trust cross-installation agent federation |
| ruflo-iot-cognitum | Cognitum Seed IoT — trust scoring, anomaly detection, fleet management |
| ruflo-neural-trader | neural-trader — 4 agents, LSTM/Transformer, Rust/NAPI backtesting, 112+ MCP tools |
| ruflo-market-data | Market data ingestion, OHLCV vectorization, pattern matching |
Recommended Stacks
| Use Case | Plugins |
|---|---|
| Feature development | ruflo-core + ruflo-swarm + ruflo-testgen + ruflo-ddd |
| Security audit | ruflo-core + ruflo-security-audit + ruflo-aidefence |
| Architecture work | ruflo-core + ruflo-adr + ruflo-ddd + ruflo-sparc |
| Deep research | ruflo-core + ruflo-goals + ruflo-rag-memory + ruflo-intelligence |
| Vector search | ruflo-core + ruflo-ruvector + ruflo-rag-memory + ruflo-knowledge-graph |
| IoT development | ruflo-core + ruflo-iot-cognitum + ruflo-agentdb |
| Trading systems | ruflo-core + ruflo-neural-trader + ruflo-market-data + ruflo-ruvector |
| Full stack | All 32 plugins |
npm Package Integration
Several plugins wrap standalone npm packages for deeper functionality:
| Plugin | npm Package | What It Adds |
|---|---|---|
ruflo-neural-trader |
neural-trader |
112+ MCP tools, Rust/NAPI engine, LSTM/Transformer models |
ruflo-ruvector |
ruvector |
103 MCP tools, FlashAttention-3, Graph RAG, Brain AGI |
# Install backing packages
npm install neural-trader ruvector
# Add as MCP servers (optional, for direct tool access)
claude mcp add neural-trader -- npx neural-trader mcp start
claude mcp add ruvector -- npx ruvector mcp start
Plugin Structure
Each plugin follows the Claude Code plugin specification:
ruflo-<name>/
.claude-plugin/plugin.json # Plugin manifest
agents/<name>.md # Agent definitions (frontmatter: name, description, model)
commands/<name>.md # CLI command mappings
skills/<name>/SKILL.md # Interactive skills (frontmatter: name, description, argument-hint, allowed-tools)
README.md # Plugin documentation
Creating a Plugin
claude --plugin-dir plugins/ruflo-plugin-creator
# Then: /create-plugin my-new-plugin
Or manually: copy any existing plugin directory and modify.
Validation
claude plugin validate plugins/ruflo-<name>
Verification & Discoverability
Every MCP tool description across the 32 plugins must answer "use this over native (Bash/Read/Grep/Glob/Task/TodoWrite) when?" per ADR-112. The rule is enforced by CI:
# Run the audit (scans all MCPTool definitions across all plugins)
node scripts/audit-tool-descriptions.mjs
# Gates: every description must include "Use when …" guidance,
# be ≥ 80 chars, and be unique. Baseline at verification/mcp-tool-baseline.json
# is monotone-decreasing — CI fails on any regression.
Combined with verification/ (Ed25519-signed witness manifest, 103+ documented fixes attested), the plugin surface is regression-protected at three layers: install smoke (npm i), behavioral smoke (paired-tool round-trips), and presence attestation (every load-bearing line of every documented fix). See verification/README.md for the full stack.
Per-turn footprint: user-invoked skills and short descriptions
Claude Code keeps the name and description of every skill, command and agent the model can invoke in context on every turn, used or not (ADR-507). Measure it with node scripts/measure-plugin-footprint.mjs (--write saves a report under v3/docs/validation/).
Which skills are user-invoked. A skill gets disable-model-invocation: true in its frontmatter when its job is something a person asks for by name, not something the model should reach for by itself. It still runs as /<plugin>:<skill>; it just leaves the model's listing. The kinds that qualify:
- release, publish and submission flows;
- dashboards, status pages and reports;
- benchmark runners and spend-gated learning or evolution runs;
- one-shot setup and install skills;
- sub-reports that a plugin command already reaches (for example the cost-tracker reports under
/ruflo-cost).
A skill stays model-invoked when the model must find it on its own: memory search, swarm init guidance, safety scans, a gate another agent calls before it starts work (such as cost-budget-check), or anything an agent, command or hook in this repository tells the model to invoke. Before marking a skill, grep plugins/*/agents, plugins/*/commands, plugins/*/skills and plugins/*/hooks for its name: a model blocked by disable-model-invocation is told not to do the skill's work any other way.
Every user-invoked skill is listed under a "User-invoked skills" heading in its plugin README.
Description ceiling. A skill or command description is at most 300 characters: one sentence of what it does and one of when to use it ("Use when …"). node scripts/audit-skill-frontmatter.mjs (CI: all-plugins-smoke) enforces both rules.
License
MIT