mirror of
https://github.com/ruvnet/ruflo.git
synced 2026-11-09 14:04:06 +09:00
ruv
f8ab5a3255
#2021 (HIGH) fired after the alpha.43 release chain: bumping `@claude-flow/cli`'s `@claude-flow/memory` pin from alpha.14 → 16 removed the literal string `"@claude-flow/memory": "^3.0.0-alpha.14"` from `v3/@claude-flow/cli/package.json`, which was the marker for fix `#1825`. The scheduled cron started reporting `regressed=1` on all 3 OS manifests. Three additional ADR markers were ALSO regressed (pre-existing, not part of #2021's scope) — `ADR-104-transport`, `ADR-107-tls-pinning`, `ADR-104-stream-mux` — all pointing at `v3/@claude-flow/plugin-agent-federation/dist/plugin.js`. Those symbols (`loadQuicTransport`, `agentic-flow/transport/loader`) moved to `dist/transport/midstream-aware-loader.js` in an earlier refactor; the markers never followed. Cleaning them up while in here since they're the same drift class and the new CI guard would block publish on them anyway. ## Marker fixes (verification/{macos,linux,windows}/manifest.md.json) #1825 v3/@claude-flow/cli/package.json marker: "@claude-flow/memory": "^3.0.0-alpha.14" → "@claude-flow/memory": "^3.0.0-alpha. (version-agnostic prefix — survives future bumps) ADR-104-transport was: dist/plugin.js marker: agentic-flow/transport/loader now: dist/transport/midstream-aware-loader.js marker: loadQuicTransport ADR-107-tls-pinning was: dist/plugin.js marker: loadQuicTransport now: dist/transport/midstream-aware-loader.js marker: loadQuicTransport ADR-104-stream-mux was: dist/plugin.js marker: loadQuicTransport now: dist/transport/midstream-aware-loader.js marker: loadQuicTransport Re-signed all 3 OS manifests via plugins/ruflo-core/scripts/witness/regen.mjs. History.jsonl appended for each OS. ## Final manifest state (local verify, built tree) macos: pass=113 drift=0 regressed=0 missing=0 exit=0 linux: pass=113 drift=0 regressed=0 missing=0 exit=0 windows: pass=113 drift=0 regressed=0 missing=0 exit=0 ## New CI guard: witness-marker-drift-smoke (#2021) The slow `witness-verify` job catches drift but runs cross-platform matrix + dist builds — direct pushes to main (e.g. release chains) can land before it surfaces a regression. The scheduled 12h cron then files HIGH-severity issues post-merge. scripts/smoke-witness-marker-drift.mjs is a fast static-only smoke: - No build step - No cryptographic signature check (drift is a markers-vs-source gap, not an integrity gap — separate concern) - No native deps - For every fix in verification/<os>/manifest.md.json: - If cited file exists AND marker string is missing → exit 1 - If cited file doesn't exist → skip (that's #1880's territory, handled by witness-verify-precondition-smoke) Wired into witness-verify's `needs:` so drift blocks publish. Validated with negative test: broke #1825 marker locally, smoke exited 1 and named the regressed id correctly; restored, smoke returned to exit 0. Co-Authored-By: RuFlo <ruv@ruv.net>