The Plugin install-safety job (#1902/#1903/#1904) on v3-ci.yml has a
new failure surface now that the lockfile fix unblocks it: the
audit-env-var-precedence.mjs script (ADR-125/130 "CLI flag wins"
gate) flags 28 router env vars in
v3/@claude-flow/cli/src/ruvector/neural-router.ts and
router-trajectory.ts as missing CLI flag overrides.
These vars are all router operator knobs that are intentionally
env-only:
- Most are CI/benchmark knobs (KNN_K, LATENCY_BUDGET_MS,
COST_CEILING) not user-typed inputs.
- Several are feature flags (NEURAL=1, BANDIT_PER_MODEL=1,
TRAJECTORY=1) baked into settings by ruflo init.
- SEED_CORPUS / CALIBRATOR_PATH / MODEL_PATH are file-path inputs
to long-running daemons, not transient CLI flags.
Per the audit script's own Option B remediation, register them as
KNOWN_ESCAPE_HATCHES with a comment explaining the design choice.
Audit before:
FAIL — 28 env var reads have no CLI flag precedence
Audit after:
ok: all CLAUDE_FLOW_* / RUFLO_* env var reads have documented
CLI-flag precedence or are registered as known escape-hatch
env vars (CI/test/credential use)
Also registers CLAUDE_FLOW_SWARM_DIR (set by ruflo init / inter-process)
and CLAUDE_FLOW_ROUTER_PARALLEL_LOG_PATH (parallel-recorder file path).
If any router knob graduates to user-facing surface, add a CLI flag
override per ADR-125 and remove its entry from the escape-hatch list.
Co-Authored-By: RuFlo <ruv@ruv.net>
ruv
dd669b3eb7