ruflo updates — week of 2026-06-21 (180 new commits, tip 9c28fe038)

[github-actions]

ruvnet/ruflo — last 7 days

Window: since 2026-06-14 · Upstream tip: 9c28fe038

feat (32)

• 38767da86 feat(metaharness): generatedAt timestamp on all --format json outputs (iter 112) (ruv)
• 1e856ab96 feat(metaharness): drift-from-history table surfaces path + wall (iter 96) (ruv)
• b87d2b58f feat(metaharness): drift-from-history exposes derived timing.path label (iter 95) (ruv)
• f7383595e feat(metaharness): weekly cron uses iter-78 alert-on-new-severity (iter 79) (ruv)
• 0c5782a92 feat(metaharness): drift-from-history --alert-on-new-severity gate (iter 78) (ruv)
• 78a7ef54c feat(metaharness): MCP tool exposes baselineKey + baselineFile fastpaths (iter 71) (ruv)
• 97728793d feat(metaharness): drift-from-history exposes parallel-batch timing (iter 65) (ruv)
• 6ba915ac5 feat(metaharness): metaharness_drift_from_history MCP tool (iter 54) (ruv)
• be1401d8a feat(metaharness): drift-from-history — one-command drift detection (iter 53) (ruv)
• a4fd2b12f feat(metaharness): parseMcpScanText closes iter-49 dead-code gap (iter 50) (ruv)
• 650568b64 feat(metaharness): MCP success-semantic footnote + audit_trend file inputs (iter 46) (ruv)
• ca8741f4c feat(doctor): integration-layer health check distinct from upstream (iter 45) (ruv)
• 55b6934dc feat(metaharness): oia-audit bundles fingerprint + audit-trend computes structural distance (iter 38) (ruv)
• 0b6ac8ff9 feat(metaharness): ADR-152 §3.1 production — _similarity.mjs + skill + MCP tool + dispatcher (iter 36) (ruv)
• 9de004b3f feat(metaharness): ADR-152 spike landed — similarity invariants pass, ADR Accepted (iter 35) (ruv)
• 5acc51d74 feat(metaharness): .harness/manifest.json — fingerprint security-critical files (iter 32) (ruv)
• 32c469c23 feat(metaharness): MCP audit-list + audit-trend tools (iter 21) (ruv)
• 2cb4142d4 feat(metaharness): MCP tool registry — 5 first-class mcp__claude-flow__metaharness_* tools (iter 20) (ruv)
• d6911f82e feat(metaharness): surface metaharness through init + hooks discovery (iter 18) (ruv)
• 01694d961 feat(metaharness): top-level dispatch for audit-list + audit-trend (iter 17) (ruv)
• 011a8f9bc feat(metaharness): audit-list — enumerate metaharness-audit records (iter 16) (ruv)
• 70b859dae feat(metaharness): audit-trend — diff two oia-audit snapshots (iter 15) (ruv)
• 625493062 feat(doctor): MetaHarness check in standard health-check flow (ADR-150 iter 14) (ruv)
• 2a06c3e2b feat(metaharness): wire recordPair() into model-router.ts route() — ADR-150 last mile (iter 12) (ruv)
• bbbea9df4 feat(metaharness): SelfEvolvingRouter recorder primitive (iter 11) (ruv)
• 473d2fcc8 feat(metaharness): SelfEvolvingRouter promotion-gate analyzer (iter 10) (ruv)
• 6f33662fe feat(metaharness): oia-audit reachable via ruflo metaharness oia-audit + weekly cron (iter 8) (ruv)
• 88bff4759 feat(metaharness): oia-audit composite worker — Phase 2 worker #13 (iter 7) (ruv)
• d941846e7 feat(metaharness): harness type in ruflo plugin registry (iter 6, Phase 2) (ruv)
• 42bda4874 feat(metaharness): npx ruflo eject — Phase-2 differentiator (iter 4–5) (ruv)
• 9a517606a feat(metaharness): top-level ruflo metaharness CLI command + wrapper wiring (iter 3) (ruv)
• a4c2755c8 feat(metaharness): Phase 1 MVP plugin — 5 skills + ADR-150 constraint enforcement (iter 1) (ruv)

fix (42)

• 04f474450 fix(memory): reject 128-dim bridge results — MCP no longer emits mock embeddings (#2395) (ruv)
• 05b0e92be fix(security): cve subcommand delegates to npm audit (#2403) (ruv)
• 7cafd268f fix(daemon): atomic lockfile + drop init.ts:424 shell & (#2407) (ruv)
• b0e4a4558 fix(release): bundle plugins/ruflo-metaharness in @claude-flow/cli pkg (3.12.1) (ruv)
• fb057d445 fix(metaharness-ci): npm fetch-retry env so postinstall blips don't fail (iter 139) (ruv)
• 5c47de352 fix(metaharness-ci): explicit npm install for sharp in pnpm store (iter 138) (ruv)
• daf39efa1 fix(bench): bench-recordpair-overhead emits markdown header in JSON mode (iter 137) (ruv)
• c0276b6fb fix(metaharness-ci): rebuild sharp postinstall after pnpm install (iter 134) (ruv)
• b5dc6896e fix(umbrella): align @claude-flow/mcp + shared pins with workspace (iter 133) (ruv)
• f2f17d9cd fix(mcp-tools): ADR-112 "Use when..." guidance on all 9 metaharness tools (iter 132) (ruv)
• 95dc43be2 fix(ci): bump cold-cache timeouts (iter 131) (ruv)
• db1e965e1 fix(test-mcp-tools): audit_list also a chain-tool — 60s → 90s (iter 130) (ruv)
• 8df666e6d fix(smoke): 17z17 accepts isChainTool refactor (iter 129) (ruv)
• bc38e3810 fix(eject + mcp-tools-test): context.flags + oia_audit chain budget (iter 128) (ruv)
• 53f0ee67e fix(metaharness-ci): tolerate cli TS6305 + assert dist emitted (iter 127) (ruv)
• c4fc017f8 fix(smoke): 17z15 accepts test-mcp-tools SKIPPED-on-missing-dist (iter 126) (ruv)
• 14c36a408 fix(smoke): tolerate CI degraded paths in 17z28 + 17z15 (iter 125) (ruv)
• 0215e7b63 fix(metaharness): 5 smoke contract failures (iter 124) (ruv)
• b76afb2e7 fix(smoke): bump Windows ruflo init timeout 60s → 180s (iter 123) (ruv)
• 21d0435e7 fix(smoke): bump Windows ruflo init timeout 60s → 180s (iter 123) (ruv)
• 35d1c57b0 fix(audit): register router env vars as known escape hatches (iter 120) (ruv)
• dd669b3eb fix(audit): register router env vars as known escape hatches (iter 120) (ruv)
• 02a79ff01 fix(ci): bump smoke-all-plugins --timeout 60s → 300s (iter 119) (ruv)
• caf1a2635 fix(metaharness-ci): build cli's workspace deps first via pnpm -F ... (iter 119) (ruv)
• 86da78433 fix(metaharness-ci): use pnpm not npm for v3 workspace install (iter 117) (ruv)
• f5707b374 fix(ruflo-core): commit .mcp.json + exempt plugin-shipped templates from gitignore (ruv)
• 36ef4922e fix(ruflo-core): commit .mcp.json + exempt plugin-shipped templates from gitignore (ruv)
• 6ad8e4f36 fix(cost-tracker): add Windows shim ruflo-hook.cjs (#1902/#1903/#1904, #2132) (ruv)
• 147145c8b fix(cost-tracker): add Windows shim ruflo-hook.cjs (#1902/#1903/#1904, #2132) (ruv)
• 4ef9f36f1 fix(metaharness): bench scripts emit valid JSON + iter-86 wired to CI (iter 87) (ruv)
• 96b436706 fix(metaharness): current subcommand list + mint anti-MCP guard (iter 73) (ruv)
• 96d1bb212 fix(ci): weekly cron drift detection fires on audit failure (iter 70) (ruv)
• b4ec73194 fix(metaharness): SEVERITY_RANK now covers iter-50 parser output (iter 62) (ruv)
• 280c6bce9 fix(doctor): integration check covers iter-53 + iter-56 surfaces (iter 61) (ruv)
• 2378c8425 fix(metaharness): close iter-55 gaps B + C (iter 57) (ruv)
• f0400fef0 fix(metaharness): oia-audit fingerprint uses metaharness CLI shape (iter 47) (ruv)
• 644b718b3 fix(metaharness): MCP wrapper success now derives from exitCode (iter 44) (ruv)
• 2eac79042 fix(metaharness): dispatcher propagates flags to subprocess (iter 42) (ruv)
• 8d3900a93 fix(metaharness): close no-policy HIGH finding — ruflo gets an mcp-policy.json (iter 30) (ruv)
• f5036f54b fix(metaharness): _harness.mjs npx invocation + mint cwd-based scaffolding (iter 27) (ruv)
• e7783f2f0 fix(hooks): reconcile diverged CLI-package helper copies (FIX 2/4/5) (tjaiyen)
• cb1e93e8d fix(hooks): harden memory/hook helpers (timeout, signals, truncation, cross-platform slug) (tjaiyen)

perf (7)

• 16894cfe7 perf(metaharness): bench-parse-mcp-scan — iter-50 parser characterization (iter 86) (ruv)
• d1cdd2d54 perf(metaharness): drift-from-history --baseline-file fastest path (iter 67) (ruv)
• 7790df478 perf(metaharness): --baseline-key fast-path skips audit-list (iter 66) (ruv)
• 662bdc968 perf(metaharness): expose parallelization metrics + gate against serial regression (iter 59) (ruv)
• 2ab7a3765 perf(metaharness): drift-from-history parallelizes audit-list + oia-audit (iter 58) (ruv)
• 00dbcf1d1 perf(metaharness): parallelize oia-audit's 5 subprocess calls (iter 56) (ruv)
• 99cffbd77 perf(metaharness): bench-similarity.mjs — sub-μs baseline + CI regression gate (iter 41) (ruv)

refactor (1)

• 5be1876a8 refactor(metaharness): SEVERITY_RANK consolidated to _harness.mjs (iter 63) (ruv)

docs (17)

• b7423693a docs(adr): ADR-154 — @metaharness/kernel platform binaries gap (ruv)
• a56f021c8 docs(adr): ADR-153 — @metaharness/darwin (Darwin Mode) integration (ruv)
• 2f115f8e7 docs(readme): plain-English metaharness blurb + refresh badge counts (ruv)
• 8a8b20c21 docs(readme): drop ADR-150 + ADR-152 references from metaharness mentions (ruv)
• d36d99152 docs(readme): add ruflo-metaharness to the 33→34 plugin list (ruv)
• 9c192497a docs: metaharness user guide + README links (v3.12.1 follow-up) (ruv)
• 3b3018b48 docs(adr): 100-iter milestone — ADR-150 reflects iters 83-99 (iter 100) (ruv)
• a4d1878df docs(adr): ADR-150 notes catch up through iter 82 (iter 83) (ruv)
• cf22b3fb9 docs(adr): ADR-150 implementation notes reflect iters 13-59 (iter 60) (ruv)
• 06852f991 docs(adr): ADR-152 — Genome Similarity Search (Phase 3 §3.1 critical path, iter 34) (ruv)
• e3fcb2a29 docs(adr): ADR-151 — Harness Intelligence Layer (Phase 3 scope shell, iter 33) (ruv)
• d98dac3f6 docs(metaharness): mint.mjs comment — upstream ruflo updates — week of 2026-06-21 (180 new commits, tip 9c28fe038) #9 fixed in 0.1.13 (iter 29) (ruv)
• 025f3d358 docs(claude-md): MetaHarness Integration section — make ADR-150 discoverable (iter 22) (ruv)
• ad9a89d2c docs(adr): ADR-150 status → Accepted + implementation notes (iter 9) (ruv)
• 4f47d64f4 docs(adr): ADR-150 review-round-1 — architectural constraint + tightened SelfEvolvingRouter gates + Phase 3 (8.9/10 review) (ruv)
• 5551dc270 docs(adr): ADR-150 — link tracking issue #2399 + gist (ruv)
• 04826eaf3 docs(adr): ADR-150 — MetaHarness integration surfaces (Proposed) (ruv)

chore (13)

• e2b48c32c chore(marketplace): register ruflo-metaharness and ruflo-arena plugins (ruv)
• 5ab8d35a1 chore(release): bump 3.12.3 → 3.12.4 — CWE-78 agentic-flow security patch (ruv)
• d51d56930 chore(deps): bump agentic-flow ^2.0.13 → ^2.0.14 for CWE-78 fix (ruv)
• f8fbb0060 chore(release): bump 3.12.2 → 3.12.3 (#2395 mock-embedding fix) (ruv)
• 1b788705b chore(release): bump 3.12.1 → 3.12.2 (ruv)
• 42b3bfbcf chore(release): bump 3.11.0 → 3.12.0 for ADR-150 metaharness integration (ruv)
• 6180dfbbc chore: regenerate package-lock.json for umbrella dep bump (iter 135) (ruv)
• 9a31bd387 chore: regenerate v3/pnpm-lock.yaml for metaharness branch pinned specs (ruv)
• 5e10704e4 chore: regenerate v3/pnpm-lock.yaml to match @claude-flow/cli specifiers (#2400) (ruv)
• f84273308 chore(deps): pin 8 unpinned-deps flagged by harness mcp-scan (iter 31) (ruv)
• ec8fa84dc chore(deps-dev): bump @types/node in /v3/@claude-flow/browser (dependabot[bot])
• 5378e1fae chore(deps-dev): bump vitest in /v3/@claude-flow/browser (dependabot[bot])
• 2bf24eba9 chore(deps-dev): bump vitest in /plugins/ruflo-graph-intelligence (dependabot[bot])

test (42)

• 1de69daa9 test(metaharness): anchor oia-audit-weekly iter-108 hard-fail + iter-109 dispatch inputs (iter 116) (ruv)
• b851f849a test(metaharness): metaharness-ci.yml contains all 6 expected jobs (iter 115) (ruv)
• c712f4973 test(metaharness): bench JSON has results[] with numeric meanUs (iter 114) (ruv)
• 05b8e2f54 test(metaharness): oia-audit startedAt + finishedAt timestamp pair (iter 113) (ruv)
• 82c8bacbc test(metaharness): pin versions consistent across 3 package.json files (iter 111) (ruv)
• c1bc0c740 test(metaharness): tilde-pin gate prevents caret regression (iter 110) (ruv)
• 6638530ba test(metaharness): ADR-152 refs resolve + ADR-151 scope-refs documented (iter 107) (ruv)
• f80977b56 test(metaharness): ADR-150 cross-references resolve (iter 106) (ruv)
• d36c90213 test(metaharness): SKILL.md description + argument-hint populated (iter 105) (ruv)
• 5ca3c857c test(metaharness): SKILL.md allowed-tools must be non-empty + known (iter 104) (ruv)
• 3c9eed9e6 test(metaharness): SKILL.md frontmatter name ↔ directory name (iter 103) (ruv)
• 9bf72af58 test(metaharness): orphaned-script detector — every .mjs referenced (iter 102) (ruv)
• 196b06496 test(metaharness): JSON-output gate covers all 10 scripts (iter 101) (ruv)
• 3bcebcfb3 test(metaharness): every CLI subcommand documented in CLAUDE.md (iter 94) (ruv)
• f79ba66f4 test(metaharness): every MCP tool documented in CLAUDE.md (iter 93) (ruv)
• 45c965051 test(metaharness): MCP enum + SEVERITY_RANK vocabulary aligned (iter 92) (ruv)
• 8b3d11215 test(metaharness): SKILL.md script refs point at existing files (iter 91) (ruv)
• 0212ec969 test(metaharness): MCP-tool runScript() refs point at existing scripts (iter 90) (ruv)
• c6ecf1423 test(metaharness): SUBCOMMANDS map points at existing script files (iter 89) (ruv)
• 95bacf8e8 test(metaharness): family-wide JSON-output contract gate (iter 88) (ruv)
• 3a0033df1 test(metaharness): MCP-layer alertOnNewSeverity Phase 4 assertions (iter 85) (ruv)
• a6113fe8e test(metaharness): positive-presence guard for all 3 compat tripwires (iter 84) (ruv)
• b0ac5998e test(metaharness): fingerprint-schema compat tripwire (iter 81) (ruv)
• ca56902b2 test(metaharness): upstream mcp-scan text-format compat tripwire (iter 80) (ruv)
• a9c518249 test(metaharness): roundtrip Stage 11 — diff symmetry + dedup (iter 77) (ruv)
• 1a4fe374a test(metaharness): roundtrip Stage 10 — introduced/cleared findings diff (iter 76) (ruv)
• 6ace68c0e test(metaharness): roundtrip Stage 9 — drift-from-history fastpath catches mutation (iter 75) (ruv)
• 45c0f9bd3 test(metaharness): three more architectural-constraint negative guards (iter 74) (ruv)
• 1be259d44 test(metaharness): parseMcpScanText edge-case unit tests (iter 72) (ruv)
• a5540a0db test(metaharness): roundtrip exercises drift-from-history end-to-end (iter 68) (ruv)
• f1f20b59c test(metaharness): unit tests for iter-63 rankSeverity + rollup (iter 64) (ruv)
• f859d4d3d test(metaharness): lock iter-50 parser at MCP layer + doctor (iter 52) (ruv)
• e722508ad test(metaharness): roundtrip catches REAL drift, not just self-match (iter 51) (ruv)
• 6f9d1bd58 test(metaharness): roundtrip covers non-similarity schemas + flags mcp-scan gap (iter 49) (ruv)
• 076912b1f test(metaharness): Phase 4 positive-case shape validation (iter 43) (ruv)
• cddab17a7 test(metaharness): _similarity.mjs unit tests — library-grade contract (iter 39) (ruv)
• 15afefbe0 test(metaharness): MCP runtime contract enrolls similarity tool (iter 37) (ruv)
• df3d195f0 test(metaharness): regression guards for iter-27 npx-argv + cwd-scaffold fixes (iter 28) (ruv)
• f1331e6db test(metaharness): GCP-secret × scaffold × lifecycle × OpenRouter e2e (iter 26) (ruv)
• 3ce5a6c89 test(metaharness): MCP tool runtime contract — 65 assertions across 7 tools (iter 23) (ruv)
• 040652cec test(metaharness): local-runnable graceful-degradation drill (ADR-150 rule ruflo updates — week of 2026-05-10 (243 new commits, tip 5f0c8455c) #3, iter 19) (ruv)
• 94dcaf3b9 test(metaharness): e2e integration test for parallel-logging pipeline (iter 13) (ruv)

ci (13)

• 61e5a3f9f ci(metaharness): bump router-compat + no-metaharness-smoke timeouts (iter 136) (ruv)
• 51db9b381 ci(metaharness): weekly cron exposes policy thresholds via workflow_dispatch inputs (iter 109) (ruv)
• 08757d2db ci(metaharness): weekly cron hard-fails on slow-path regression (iter 108) (ruv)
• 16150fd11 ci(metaharness): dispatcher round-trip enforces wall budget (iter 99) (ruv)
• fccee2848 ci(metaharness): drift-from-history dispatcher CI cross-check (iter 98) (ruv)
• de8b3e44e ci(metaharness): weekly cron summary surfaces timing.path (iter 97) (ruv)
• e49124e68 ci(metaharness): bench-similarity artifact + per-run summary (iter 82) (ruv)
• 1a18c190e ci(metaharness): weekly cron computes structural drift vs prior week (iter 69) (ruv)
• b71b56820 ci(metaharness): extend graceful-degradation drill + flag 3 latent gaps (iter 55) (ruv)
• 42721b84b ci(metaharness): metaharness-real-data CI gate (iter 48 — locks iter-47 fix) (ruv)
• ab745decf ci(metaharness): similarity-tests job + CLAUDE.md surface docs (iter 40) (ruv)
• 853586bfe ci(metaharness): promote bench-recordpair-overhead to a CI regression gate (iter 25) (ruv)
• 0560a6b70 ci(metaharness): CI gates + ADR-150 constraint-ruflo updates — week of 2026-05-17 (86 new commits, tip f8ab5a325) #4 enforcement (iter 2) (ruv)

other (13)

• 9c28fe038 Merge pull request #2416 from ruvnet/chore/marketplace-add-metaharness-arena (rUv)
• da901d06c Merge pull request #2415 from ruvnet/security/cwe-78-agentic-flow-bump (rUv)
• 5482fe7f9 Merge pull request #2387 from ruvnet/dependabot/npm_and_yarn/v3/claude-flow/browser/types/node-20.19.43 (rUv)
• da72b97de Merge pull request #2385 from ruvnet/dependabot/npm_and_yarn/v3/claude-flow/browser/vitest-4.1.9 (rUv)
• 11fee2a7a Merge pull request #2383 from ruvnet/dependabot/npm_and_yarn/plugins/ruflo-graph-intelligence/vitest-4.1.9 (rUv)
• 774c6e2e4 Merge pull request #2397 from tjaiyen/harden-helpers-upstream (rUv)
• 82331a88f Merge pull request #2408 from ruvnet/fix/2407-daemon-race (rUv)
• 9e26dc343 Merge pull request #2405 from ruvnet/feat/metaharness-integration-research (rUv)
• 408082f26 Merge remote-tracking branch 'origin/main' into feat/metaharness-integration-research (ruv)
• 353df232f Merge pull request #2404 from ruvnet/fix/2400-lockfile-regen (rUv)
• 10649125f Add CodeQL analysis workflow configuration (rUv)
• 64db9451d bench(metaharness): prove iter-12 "zero default-path overhead" with measured numbers (iter 24) (ruv)
• 5625d5641 v3.11.0 — router ADR-148/149 + cost-tracker observability + fleet audits (#2398) (rUv)

---

Inspect a commit: git fetch upstream && git show <sha>
Diff a path: git diff upstream/main -- path/to/file
Port a commit: git cherry-pick <sha> (expect conflicts — no shared history)