This iter-4 edit was made by the headless agent but its commit step
didnt land in the branch (rate-limit at end of workflow). Cleanly
landing it now alongside the lockfile fix.
full-system-test surfaced 23/32 plugin smoke contracts failing on a
single drifted assertion: the smoke gate greps ADR-0001 for
`status: Proposed`, but those ADRs were long since promoted to
`Accepted` without updating the gate. Flip the assertion (label, grep,
message) Proposed -> Accepted only where the ADR is genuinely Accepted.
ruflo-core additionally had a stale version assertion (0.2.0 -> 0.2.2).
Left untouched: ruflo-adr, ruflo-browser, ruflo-intelligence — their
ADR-0001 is genuinely Proposed, so their smokes correctly assert it.
No plugin source or ADR changed — only the drifted test assertions.
All 32 plugin smoke contracts now pass; full-system-test is 4/4 green.
Co-Authored-By: RuFlo <ruv@ruv.net>
Adds ADR-095/096 + audit_1776853149979 references to ruflo-aidefence
and ruflo-security-audit. End users installing either plugin now see
the host hardening features that pair with the plugin's threat
detection / scanning, not just the plugin's own surface.
ruflo-aidefence/README.md:
New "Defense-in-depth pairing (ruflo 3.6.25+)" section listing:
- validateEnv() loader-hijack denylist (LD_PRELOAD, NODE_OPTIONS,
DYLD_*, etc.) at the terminal_create MCP boundary
- File mode 0600 / dir mode 0700 on session/terminal/memory stores
via fs-secure
- Encryption at rest (CLAUDE_FLOW_ENCRYPT_AT_REST=1, AES-256-GCM,
RFE1 magic-byte sniff)
Threat scoring should account for whether the host is a denylist-
enforcing / encrypted-at-rest install.
ruflo-security-audit/README.md:
New "Patterns to scan for (audit_1776853149979 follow-up)" section
with six concrete antipatterns + remediation pointers:
- execSync(string) with template-literal args (4 closed sites cited)
- Numeric MCP inputs cast as `number` without runtime check
- Untrusted package specs flowing into npm install
- Loader-hijack env vars
- Plaintext at-rest secrets paired with ADR-096
- MCP stdin DoS (10MB cap reference)
Plus a `ruflo verify` reference confirming 55 witnesses on disk.
Plugin versions:
ruflo-aidefence 0.1.0 → 0.2.0 (minor — capability sync)
ruflo-security-audit 0.1.1 → 0.2.0 (minor — capability sync,
was patch from iter #55 model
fix)
Two more slices remain for Part 1:
- slice 2: ruflo-rag-memory + ruflo-rvf — encryption-at-rest gate
notes
- slice 3: ruflo-cost-tracker — federation budget breaker pairing,
federation_spend events
- slice 4: ruflo-agentdb + ruflo-knowledge-graph — G7 controllers
Drops the security-auditor agent from model:opus to model:sonnet.
Bounded-scope security review (CVE check, dependency audit, input-
validation review, secret scan, severity-ranked report) is sonnet-
tier work in practice — opus's long-context advantage isn't load-
bearing for the audit pattern this agent runs.
Cost delta: ~5x cheaper per token for the model call. Quality delta
expected to be small; documenting the override path so users can
flip back to opus when the audit truly needs deep cross-file taint
tracing or architectural reasoning.
Added a one-line note in the agent prompt explaining the trade-off
and when to override, so the cost-vs-quality decision is visible
to users rather than buried in an ADR.
Plugin version: 0.1.0 → 0.1.1 (patch — model rightsizing only,
no surface change).
Re-audit: 2 of 43 plugin agents on model:opus, both justified —
federation-coordinator (multi-phase trust + audit-grade logging)
and neural-trader/trading-strategist (real-money trading
decisions). Down from 3 of 43.
ADR-098 acceptance-criteria item closed: "ruflo-security-audit/
security-auditor.md is on model: sonnet."
Trial period: monitor security-audit output quality across one
release cycle. Revert to opus if regression detected.
Parts 1 (capability sync), 2 (token diet), and 5 (worker dispatch)
remain.
ruvnet