mirror of
https://github.com/ruvnet/ruflo.git
synced 2026-11-10 06:23:28 +09:00
ReuvenandRuFlo
21f668c550
ADR-094 — transformers loader (try-prefer-fallback): - New v3/@claude-flow/embeddings/src/transformers-loader.ts exposes loadTransformersPipeline() that prefers @huggingface/transformers (clears protobufjs <7.5.5 critical RCE chain), falls back to legacy @xenova/transformers for backwards compat. Caches the resolved source so repeated callers don't re-import. - Updated v3/@claude-flow/embeddings/src/embedding-service.ts:387 to use the loader instead of direct @xenova import. - Updated v3/@claude-flow/cli/src/memory/memory-initializer.ts:1539 with inlined try-prefer-fallback (avoids circular optional-dep at install time). - v3/@claude-flow/embeddings/package.json: added @huggingface/transformers to optionalDependencies (^4.2.0) and peerDependenciesMeta.optional. Both packages build clean. The loader uses a string-variable specifier in dynamic import so tsc doesn't try to resolve types at compile time (both packages are runtime-optional). ADR-095 — architectural gap tracking from April audit (@roman-rr): - Documents the 7 gaps the May audit/ADR-093 honesty work didn't address: G1 agent_spawn no subprocess, G2 single-process consensus, G3 workflow runtime missing, G4 WASM echo stub, G5 transformers CVE chain (now ADR-094), G6 auto-memory graph 100MB bloat for 20 unique entries, G7 6 disabled AgentDB controllers. - Reserves ADR-096..ADR-107 numbers for the per-gap follow-up ADRs. - Explicit "tracking only — no decisions" status so gaps don't dilute through the issue tracker. Co-Authored-By: RuFlo <ruv@ruv.net>