mirror of
https://github.com/ruvnet/ruflo.git
synced 2026-11-09 05:35:21 +09:00
rUvandClaude
7387295568
* dream(memory): wire ControllerRegistry.set() so MutationGuard/AttestationLog activation stops being dead code
memory-bridge.ts's post-init controller-activation wiring (reasoningBank,
learningSystem, skills, semanticRouter, gnnService, rvfOptimizer,
mutationGuard, attestationLog, guardedVectorBackend) has always gated
registration on `typeof reg.set === 'function'`, falling back to an
unread `reg._controllers` property otherwise. ControllerRegistry never
implemented a public set() method, so every external activation silently
took the dead fallback: registry.get('mutationGuard')/get('attestationLog')
always returned null, permanently disabling write-mutation validation
(fail-open "no guard installed = allow") and audit logging (silent no-op)
on the real store/delete/purge paths. Same bug shape as the already-fixed
#3327 Finding A (reasoningBank.store never existed, so its own
typeof-guard was dead too).
Adds ControllerRegistry.set<T>(name, instance) mirroring the shape
initController() already produces internally. Zero changes needed at any
of the 9 memory-bridge.ts call sites.
5 new discriminating tests reproduce memory-bridge.ts's exact activation
pattern; stash-isolated baseline fails all 5 (TypeError: registry.set is
not a function), candidate passes all 5. Full @claude-flow/memory suite:
650/651 both ways (1 pre-existing environmental failure, byte-identical,
unrelated chmod/root-bypass test). tsc --noEmit: 0 errors.
Evaluated, pending independent adversarial critique.
* dream(memory): close prior instance on ControllerRegistry.set() (post-critique)
Independent adversarial critique of afe2cdd found set() silently dropped
a reference to any pre-existing resource-holding instance on overwrite,
reintroducing the exact leak class #2432 fixed for initController()'s own
replacement path (unclosed sql.js/WASM resources, ~36GB over 6 weeks in
production per that commit's own account). Not currently triggerable
through the shipped memory-bridge.ts wiring (every real call site guards
with `if (!reg.get(name))` first), but the set() API itself offered no
protection.
Fix: dispatch the existing closePriorIfAny(name) before overwriting the
map entry, same as initController() does. Intentionally not awaited, so
get(name) still reflects the new instance synchronously; the old
instance's close()/dispose() (best-effort, errors swallowed) runs in the
background — matches every other call site's synchronous-looking
registration contract.
1 new discriminating test added. Full @claude-flow/memory suite:
651/652 (1 pre-existing environmental failure, unchanged). tsc --noEmit:
0 errors.
Known, disclosed, not-fixed-tonight limitation (out of scope, needs a
human call on correct init ordering): `causalRecall` is the one
ControllerName absent from every INIT_LEVELS entry, so shutdown()'s
by-static-list lookup would never find/close a controller registered
under that name via set() — unexercised today (no call site uses it).
Flagged for a future night rather than guessed at here.
* dream(memory): add 2026-10-28 SOTA research gist (gist publishing unavailable, FALLBACK)
No gh CLI / gist-creation tool reachable this session — same disclosed
FALLBACK as every night since 2026-09-30. Full SOTA report committed to
docs/dream-cycle/ instead of a gist.github.com URL.
* dream(memory): #4549 update LEDGER for 2026-10-28
* dream(memory): bump @claude-flow/memory to 3.1.0 (CI: leaf-package-publish audit)
CI's "Plugin package install-safety" job (scripts/audit-leaf-package-publish.mjs,
guarding ruvnet/ruflo#3335 and #3390/#3327 Finding A) correctly failed: this PR's
source change to v3/@claude-flow/memory/src/controller-registry.ts is publishable
(adds a new public method) but @claude-flow/memory's own package.json version was
unchanged at 3.0.9 — @claude-flow/memory is not bundled into the release train, so
publishing cli/claude-flow/ruflo without also bumping+publishing this leaf would
ship the OLD copy and this fix would reach nobody.
Bumped @claude-flow/memory 3.0.9 -> 3.1.0 (MINOR: backward-compatible new public
method). Updated the two exact pins in v3/@claude-flow/cli/package.json
(dependencies + optionalDependencies) to match, and regenerated v3/pnpm-lock.yaml
via `pnpm install` (never hand-edited) so the lockfile's specifier stays in sync.
Verified locally: node scripts/audit-leaf-package-publish.mjs --base origin/main
now reports "ok: every non-bundled leaf is covered by the CLI range and carries a
bump if changed". Full @claude-flow/memory suite re-confirmed 651/652 (same
pre-existing environmental failure), tsc --noEmit 0 errors.
Note for a future release: per CLAUDE.md's publishing rules, @claude-flow/memory
must be published standalone alongside the next @claude-flow/cli release for this
fix to actually reach consumers — not done as part of this draft PR.
---------
Co-authored-by: Claude <noreply@anthropic.com>