rUvandr
45bf52cd86
- ruflo-mods guard (tool.check): read-only fast path on e.isReadOnly (2.1.304) that skips the policy-projection stat while a full check found none in the last 2 s (web tools excluded so the research ask still fires); a chain deny returns without file reads; decider "person" on every ask ruflo raises; agentId names the subagent on ruflo's reason; the chain's ceiling survives a tightening; .catch documented for 2.1.301 semantics, still fails closed. - ruflo-console: console_state and console_run registered with isDeferred: false (2.1.293); console_open/console_set stay deferred. - console + swarm: Text bold -> weight (2.1.299 deprecation), codemodded; bold: true -> weight: "semibold" (what the host already maps bold to). Engines before 2.1.299 refuse a tree with an unknown Text prop, so the kit maps weight back to bold there (text-weight.ts, via $.session.version()). - tests for 2.1.318's kit: $.tool.call now raises tool.check first (guidance test); stub answers are validated (swarm prompt.fill stub); stale expectations fixed (probe session.compact, learning-loop handshake). - console kit tests: timeoutMs 30_000 (the 5 s default timed out 19-58 end-to-end tests under load, on 2.1.289 and 2.1.318 alike), and the mock clock advanced past runner.ts's VERIFY_RETRY_MS in actions/settings tests. Co-authored-by: r <r@x>
Ruflo Plugins
32 Claude Code plugins for agent-powered development workflows. Load with --plugin-dir.
Quick Start
# Load specific plugins
claude --plugin-dir plugins/ruflo-core --plugin-dir plugins/ruflo-swarm
# Load all plugins
claude $(ls -d plugins/ruflo-*/ | sed 's|^|--plugin-dir |' | tr '\n' ' ')
Plugin Catalog
Core & Coordination
| Plugin | Description |
|---|---|
| ruflo-core | MCP server, status, doctor, coder/researcher/reviewer agents |
| ruflo-swarm | Swarm topologies (hierarchical, mesh), Monitor streaming |
| ruflo-autopilot | Autonomous /loop task completion with prediction |
| ruflo-loop-workers | 12 background workers via /loop or CronCreate |
| ruflo-workflows | Workflow templates, parallel execution, branching |
Memory & Intelligence
| Plugin | Description |
|---|---|
| ruflo-agentdb | AgentDB with HNSW vector search (150x-12,500x faster) |
| ruflo-rag-memory | SOTA RAG — hybrid search, Graph RAG, MMR diversity, memory bridge |
| ruflo-rvf | Portable RVF memory format, session persistence |
| ruflo-ruvector | ruvector — FlashAttention-3, Graph RAG, hybrid search, 103 MCP tools, Brain AGI |
| ruflo-knowledge-graph | Entity extraction, relation mapping, pathfinder traversal |
| ruflo-intelligence | SONA neural patterns, trajectory learning, model routing |
| ruflo-daa | Dynamic Agentic Architecture, cognitive patterns |
Architecture & Methodology
| Plugin | Description |
|---|---|
| ruflo-adr | ADR lifecycle — create, index, supersede, compliance checking |
| ruflo-ddd | DDD scaffolding — bounded contexts, aggregates, domain events |
| ruflo-sparc | SPARC methodology with 5 phases and quality gates |
Quality & Security
| Plugin | Description |
|---|---|
| ruflo-security-audit | CVE scanning, dependency vulnerability checks |
| ruflo-aidefence | Prompt injection detection, PII scanning |
| ruflo-protector | Project Anatole: optional learning watchdog for unattended agents (default off) |
| ruflo-testgen | Test gap detection, TDD London School workflow |
| ruflo-browser | Playwright browser automation and testing |
| agentic-qe-fleet | External (Agentic QE, pinned in the marketplace): QE agents, coverage, chaos, TDD skills, agentic-qe MCP server. Install with /plugin install agentic-qe-fleet@ruflo; not in this folder, so --plugin-dir does not load it. Install it from one marketplace only (agentic-qe or ruflo), not both: enabled from both, its mod and commands load twice |
Development Tools
| Plugin | Description |
|---|---|
| ruflo-jujutsu | Diff analysis, risk scoring, reviewer recommendations |
| ruflo-docs | Doc generation, drift detection, API docs |
| ruflo-ruvllm | Local LLM inference, MicroLoRA, chat formatting |
| ruflo-agent | WASM agent sandboxing and gallery |
| ruflo-plugin-creator | Scaffold and validate new plugins |
| ruflo-migrations | Database schema migration management |
| ruflo-observability | Structured logging, tracing, metrics correlation |
| ruflo-cost-tracker | Token usage tracking, budget alerts, cost optimization |
Domain-Specific
| Plugin | Description |
|---|---|
| ruflo-goals | GOAP planning, deep research, horizon tracking |
| ruflo-federation | Zero-trust cross-installation agent federation |
| ruflo-iot-cognitum | Cognitum Seed IoT — trust scoring, anomaly detection, fleet management |
| ruflo-neural-trader | neural-trader — 4 agents, LSTM/Transformer, Rust/NAPI backtesting, 112+ MCP tools |
| ruflo-market-data | Market data ingestion, OHLCV vectorization, pattern matching |
Recommended Stacks
| Use Case | Plugins |
|---|---|
| Feature development | ruflo-core + ruflo-swarm + ruflo-testgen + ruflo-ddd |
| Security audit | ruflo-core + ruflo-security-audit + ruflo-aidefence |
| Architecture work | ruflo-core + ruflo-adr + ruflo-ddd + ruflo-sparc |
| Deep research | ruflo-core + ruflo-goals + ruflo-rag-memory + ruflo-intelligence |
| Vector search | ruflo-core + ruflo-ruvector + ruflo-rag-memory + ruflo-knowledge-graph |
| IoT development | ruflo-core + ruflo-iot-cognitum + ruflo-agentdb |
| Trading systems | ruflo-core + ruflo-neural-trader + ruflo-market-data + ruflo-ruvector |
| Full stack | All 32 plugins |
npm Package Integration
Several plugins wrap standalone npm packages for deeper functionality:
| Plugin | npm Package | What It Adds |
|---|---|---|
ruflo-neural-trader |
neural-trader |
112+ MCP tools, Rust/NAPI engine, LSTM/Transformer models |
ruflo-ruvector |
ruvector |
103 MCP tools, FlashAttention-3, Graph RAG, Brain AGI |
# Install backing packages
npm install neural-trader ruvector
# Add as MCP servers (optional, for direct tool access)
claude mcp add neural-trader -- npx neural-trader mcp start
claude mcp add ruvector -- npx ruvector mcp start
Plugin Structure
Each plugin follows the Claude Code plugin specification:
ruflo-<name>/
.claude-plugin/plugin.json # Plugin manifest
agents/<name>.md # Agent definitions (frontmatter: name, description, model)
commands/<name>.md # CLI command mappings
skills/<name>/SKILL.md # Interactive skills (frontmatter: name, description, argument-hint, allowed-tools)
README.md # Plugin documentation
Creating a Plugin
claude --plugin-dir plugins/ruflo-plugin-creator
# Then: /create-plugin my-new-plugin
Or manually: copy any existing plugin directory and modify.
Validation
claude plugin validate plugins/ruflo-<name>
Verification & Discoverability
Every MCP tool description across the 32 plugins must answer "use this over native (Bash/Read/Grep/Glob/Task/TodoWrite) when?" per ADR-112. The rule is enforced by CI:
# Run the audit (scans all MCPTool definitions across all plugins)
node scripts/audit-tool-descriptions.mjs
# Gates: every description must include "Use when …" guidance,
# be ≥ 80 chars, and be unique. Baseline at verification/mcp-tool-baseline.json
# is monotone-decreasing — CI fails on any regression.
Combined with verification/ (Ed25519-signed witness manifest, 103+ documented fixes attested), the plugin surface is regression-protected at three layers: install smoke (npm i), behavioral smoke (paired-tool round-trips), and presence attestation (every load-bearing line of every documented fix). See verification/README.md for the full stack.
Per-turn footprint: user-invoked skills and short descriptions
Claude Code keeps the name and description of every skill, command and agent the model can invoke in context on every turn, used or not (ADR-507). Measure it with node scripts/measure-plugin-footprint.mjs (--write saves a report under v3/docs/validation/).
Which skills are user-invoked. A skill gets disable-model-invocation: true in its frontmatter when its job is something a person asks for by name, not something the model should reach for by itself. It still runs as /<plugin>:<skill>; it just leaves the model's listing. The kinds that qualify:
- release, publish and submission flows;
- dashboards, status pages and reports;
- benchmark runners and spend-gated learning or evolution runs;
- one-shot setup and install skills;
- sub-reports that a plugin command already reaches (for example the cost-tracker reports under
/ruflo-cost).
A skill stays model-invoked when the model must find it on its own: memory search, swarm init guidance, safety scans, a gate another agent calls before it starts work (such as cost-budget-check), or anything an agent, command or hook in this repository tells the model to invoke. Before marking a skill, grep plugins/*/agents, plugins/*/commands, plugins/*/skills and plugins/*/hooks for its name: a model blocked by disable-model-invocation is told not to do the skill's work any other way.
Every user-invoked skill is listed under a "User-invoked skills" heading in its plugin README.
Description ceiling. A skill or command description is at most 300 characters: one sentence of what it does and one of when to use it ("Use when …"). node scripts/audit-skill-frontmatter.mjs (CI: all-plugins-smoke) enforces both rules.
License
MIT