skills/ruvnet__ruflo
1
0
Fork 0
mirror of https://github.com/ruvnet/ruflo.git synced 2026-09-14 14:01:28 +08:00
Code Issues Packages Projects Releases Wiki Activity
7,438 Commits 580 Branches 1,645 Tags
docs/x-gateway-github-style-metadata
Commit Graph

3 Commits

Author SHA1 Message Date
ruvnet e332689b8c fix(release): harden hooks, statusline, security, and plugin MCP integration 2026-07-16 23:06:29 -04:00
ruv 6198abfab7 fix(plugins): reconcile stale smoke contract assertions across 23 plugins 
full-system-test surfaced 23/32 plugin smoke contracts failing on a
single drifted assertion: the smoke gate greps ADR-0001 for
`status: Proposed`, but those ADRs were long since promoted to
`Accepted` without updating the gate. Flip the assertion (label, grep,
message) Proposed -> Accepted only where the ADR is genuinely Accepted.

ruflo-core additionally had a stale version assertion (0.2.0 -> 0.2.2).

Left untouched: ruflo-adr, ruflo-browser, ruflo-intelligence — their
ADR-0001 is genuinely Proposed, so their smokes correctly assert it.
No plugin source or ADR changed — only the drifted test assertions.

All 32 plugin smoke contracts now pass; full-system-test is 4/4 green.

Co-Authored-By: RuFlo <ruv@ruv.net>
 2026-05-29 15:00:34 -04:00
Reuven c203bc5d88 feat(ruflo-security-audit): adopt plugin contract — AIDefence static/runtime layered integration (ADR-0001) 
Plugin already at v0.2.0 with 1 agent + 2 skills + 1 command. The
contract pieces were missing.

Notable: this plugin's static analysis layer complements ruflo-aidefence's
runtime 3-gate pattern. ADR-0001 documents the layered story:

| Layer            | Owner                  | What it catches                                                  |
|------------------|------------------------|------------------------------------------------------------------|
| Static analysis  | ruflo-security-audit   | Shell-injection patterns, CVEs, plaintext secrets, loader-hijack |
| Runtime 3-gate   | ruflo-aidefence ADR-1  | PII pre-storage, sanitization, prompt-injection                  |

Static analysis finds the patterns; the runtime gates catch what slipped
through. The audit_1776853149979 pattern catalog (already in README) is
the regression-prevention contract for the shell-injection class the
3.6.25 release closed.

- ADR-0001 (Proposed) at docs/adrs/0001-security-audit-contract.md
- README adds Compatibility (pin v3.6), AIDefence integration block
  (static/runtime layered table; cross-reference to ruflo-aidefence
  ADR-0001), Namespace coordination (claims security-findings; defers to
  ruflo-agentdb ADR-0001), Verification + Architecture Decisions
- plugin.json keywords add mcp, cve-monitoring, policy-gates,
  shell-injection (already at v0.2.0)
- scripts/smoke.sh — 10 structural checks: version + keywords, both
  skills + agent + command present, v3.6 pin, namespace coordination,
  security-findings claimed, AIDefence 3-gate cross-reference,
  audit_1776853149979 pattern catalog intact (execSync, execFileSync,
  loader-hijack, isSafePackageSpec), ADR-096 encryption cross-reference,
  ADR Proposed, no wildcard tools

Verification: bash plugins/ruflo-security-audit/scripts/smoke.sh → 10/10

Co-Authored-By: RuFlo <ruv@ruv.net>
 2026-05-04 20:37:35 -04:00