Files
ruflo/plugins
558f194506 fix(witness): support pinned signing keys and label legacy signatures (#4326)
* fix(witness): support pinned signing keys and label legacy signatures

The default witness seed is derived from the public git commit, so anyone can re-sign a modified manifest; verify.mjs still called the result cryptographically valid. Add RUFLO_WITNESS_SEED for external-key signing and RUFLO_WITNESS_PUBLIC_KEY for pinned verification (fail closed on external-key manifests without a pin), tag legacy manifests as self-attested, and stop describing the default as authorship proof.

* fix(witness): make --public-key win over the env pin

The env-var precedence audit requires a CLI flag for RUFLO_WITNESS_PUBLIC_KEY. Add --public-key, document that it takes precedence, and cover both precedence directions in the auth test.

* fix(ci): exclude witness-auth test from vitest ratchet (uses node:test)

plugins/ruflo-core/scripts/witness/__tests__/witness-auth.test.mjs imports
from node:test, not vitest, matching the same miscategorization pattern as
pod-tick.test.mjs and probe-mod-guards.test.mjs. vitest's glob picks it up
but can't parse node:test's API, so the ratchet reports "No test suite
found" even though `node --test` passes all 3 cases cleanly.

Co-Authored-By: RuFlo <ruv@ruv.net>

---------

Co-authored-by: r <r@x>
Co-authored-by: RuFlo <ruv@ruv.net>
2026-10-20 10:59:26 -04:00
..

Ruflo Plugins

32 Claude Code plugins for agent-powered development workflows. Load with --plugin-dir.

Quick Start

# Load specific plugins
claude --plugin-dir plugins/ruflo-core --plugin-dir plugins/ruflo-swarm

# Load all plugins
claude $(ls -d plugins/ruflo-*/ | sed 's|^|--plugin-dir |' | tr '\n' ' ')

Plugin Catalog

Core & Coordination

Plugin Description
ruflo-core MCP server, status, doctor, coder/researcher/reviewer agents
ruflo-swarm Swarm topologies (hierarchical, mesh), Monitor streaming
ruflo-autopilot Autonomous /loop task completion with prediction
ruflo-loop-workers 12 background workers via /loop or CronCreate
ruflo-workflows Workflow templates, parallel execution, branching

Memory & Intelligence

Plugin Description
ruflo-agentdb AgentDB with HNSW vector search (150x-12,500x faster)
ruflo-rag-memory SOTA RAG — hybrid search, Graph RAG, MMR diversity, memory bridge
ruflo-rvf Portable RVF memory format, session persistence
ruflo-ruvector ruvector — FlashAttention-3, Graph RAG, hybrid search, 103 MCP tools, Brain AGI
ruflo-knowledge-graph Entity extraction, relation mapping, pathfinder traversal
ruflo-intelligence SONA neural patterns, trajectory learning, model routing
ruflo-daa Dynamic Agentic Architecture, cognitive patterns

Architecture & Methodology

Plugin Description
ruflo-adr ADR lifecycle — create, index, supersede, compliance checking
ruflo-ddd DDD scaffolding — bounded contexts, aggregates, domain events
ruflo-sparc SPARC methodology with 5 phases and quality gates

Quality & Security

Plugin Description
ruflo-security-audit CVE scanning, dependency vulnerability checks
ruflo-aidefence Prompt injection detection, PII scanning
ruflo-protector Project Anatole: optional learning watchdog for unattended agents (default off)
ruflo-testgen Test gap detection, TDD London School workflow
ruflo-browser Playwright browser automation and testing
agentic-qe-fleet External (Agentic QE, pinned in the marketplace): QE agents, coverage, chaos, TDD skills, agentic-qe MCP server. Install with /plugin install agentic-qe-fleet@ruflo; not in this folder, so --plugin-dir does not load it. Install it from one marketplace only (agentic-qe or ruflo), not both: enabled from both, its mod and commands load twice

Development Tools

Plugin Description
ruflo-jujutsu Diff analysis, risk scoring, reviewer recommendations
ruflo-docs Doc generation, drift detection, API docs
ruflo-ruvllm Local LLM inference, MicroLoRA, chat formatting
ruflo-agent WASM agent sandboxing and gallery
ruflo-plugin-creator Scaffold and validate new plugins
ruflo-migrations Database schema migration management
ruflo-observability Structured logging, tracing, metrics correlation
ruflo-cost-tracker Token usage tracking, budget alerts, cost optimization

Domain-Specific

Plugin Description
ruflo-goals GOAP planning, deep research, horizon tracking
ruflo-federation Zero-trust cross-installation agent federation
ruflo-iot-cognitum Cognitum Seed IoT — trust scoring, anomaly detection, fleet management
ruflo-neural-trader neural-trader — 4 agents, LSTM/Transformer, Rust/NAPI backtesting, 112+ MCP tools
ruflo-market-data Market data ingestion, OHLCV vectorization, pattern matching
Use Case Plugins
Feature development ruflo-core + ruflo-swarm + ruflo-testgen + ruflo-ddd
Security audit ruflo-core + ruflo-security-audit + ruflo-aidefence
Architecture work ruflo-core + ruflo-adr + ruflo-ddd + ruflo-sparc
Deep research ruflo-core + ruflo-goals + ruflo-rag-memory + ruflo-intelligence
Vector search ruflo-core + ruflo-ruvector + ruflo-rag-memory + ruflo-knowledge-graph
IoT development ruflo-core + ruflo-iot-cognitum + ruflo-agentdb
Trading systems ruflo-core + ruflo-neural-trader + ruflo-market-data + ruflo-ruvector
Full stack All 32 plugins

npm Package Integration

Several plugins wrap standalone npm packages for deeper functionality:

Plugin npm Package What It Adds
ruflo-neural-trader neural-trader 112+ MCP tools, Rust/NAPI engine, LSTM/Transformer models
ruflo-ruvector ruvector 103 MCP tools, FlashAttention-3, Graph RAG, Brain AGI
# Install backing packages
npm install neural-trader ruvector

# Add as MCP servers (optional, for direct tool access)
claude mcp add neural-trader -- npx neural-trader mcp start
claude mcp add ruvector -- npx ruvector mcp start

Plugin Structure

Each plugin follows the Claude Code plugin specification:

ruflo-<name>/
  .claude-plugin/plugin.json    # Plugin manifest
  agents/<name>.md              # Agent definitions (frontmatter: name, description, model)
  commands/<name>.md            # CLI command mappings
  skills/<name>/SKILL.md        # Interactive skills (frontmatter: name, description, argument-hint, allowed-tools)
  README.md                     # Plugin documentation

Creating a Plugin

claude --plugin-dir plugins/ruflo-plugin-creator
# Then: /create-plugin my-new-plugin

Or manually: copy any existing plugin directory and modify.

Validation

claude plugin validate plugins/ruflo-<name>

Verification & Discoverability

Every MCP tool description across the 32 plugins must answer "use this over native (Bash/Read/Grep/Glob/Task/TodoWrite) when?" per ADR-112. The rule is enforced by CI:

# Run the audit (scans all MCPTool definitions across all plugins)
node scripts/audit-tool-descriptions.mjs

# Gates: every description must include "Use when …" guidance,
# be ≥ 80 chars, and be unique. Baseline at verification/mcp-tool-baseline.json
# is monotone-decreasing — CI fails on any regression.

Combined with verification/ (Ed25519-signed witness manifest, 103+ documented fixes attested), the plugin surface is regression-protected at three layers: install smoke (npm i), behavioral smoke (paired-tool round-trips), and presence attestation (every load-bearing line of every documented fix). See verification/README.md for the full stack.

License

MIT