ruv f897ac627b fix(federation): ADR-125 env-var precedence — URL config takes a flag/arg, credentials registered env-only ...

The env-var-precedence audit correctly flagged the new process.env reads.
Config URLs now have a precedence path: `ruflo federation --gateway` feeds a
`gatewayUrl` tool arg (and Seraphina takes `metaLlmUrl`/`gatewayUrl`) that
wins over RUFLO_X_GATEWAY_URL / SERAPHINA_METALLM_URL, documented per ADR-125.
Credentials (RUFLO_X_ADMIN_TOKEN, SERAPHINA_METALLM_KEY) are registered as
env-only escape hatches with rationale: a secret must never be a CLI flag.
+1 test (arg precedence, arg not forwarded upstream). Audit passes locally.

Co-Authored-By: RuFlo <ruv@ruv.net>
Claude-Session: https://claude.ai/code/session_013u4pmL9ZUAXb6usVQgNo67

2026-09-09 21:42:55 -04:00

..

__tests__

fix(release): enforce CI and idle assignment safety

2026-08-15 11:14:06 -04:00

audit-better-sqlite3-override.mjs

fix: #2219 #2221 #2222 #2215 #2226 — memory/routing/statusline bug cluster (3.10.6) (#2227)

2026-05-29 08:52:31 -04:00

audit-cli-mcp-tools.mjs

fix(#1916): register agent_logs + hive worker resolution + all 20 dangling CLI↔MCP tools — published 3.7.0-alpha.26 (#1924)

2026-05-12 00:40:47 -04:00

audit-codex-integration.mjs

fix(codex): ship stable Windows-safe Ruflo integration

2026-07-16 18:48:10 -04:00

audit-env-var-precedence.mjs

fix(federation): ADR-125 env-var precedence — URL config takes a flag/arg, credentials registered env-only

2026-09-09 21:42:55 -04:00

audit-exit-bypass-antipattern.mjs

v3.11.0 — router ADR-148/149 + cost-tracker observability + fleet audits (#2398)

2026-06-16 12:10:35 -04:00

audit-fix-invariants.mjs

fix(#2679): sync statusline-generator with committed helper (read+substitute pattern) (#2680)

2026-07-14 16:11:18 -04:00

audit-hook-commands.mjs

fix(#1921): plugin hooks use a resilient shim, not bare npx @alpha per fire (#1923)

2026-05-12 00:51:18 -04:00

audit-hook-handler-prompt.mjs

fix(hooks): pre-bash TypeError + global-install MODULE_NOT_FOUND (#1944, #1943) (#1957)

2026-05-13 09:02:51 -04:00

audit-neural-trader-safety.mjs

fix(neural-trader): mitigate upstream fork-bomb on install + CI guard (#1974) (#1976)

2026-05-14 08:03:31 -04:00

audit-package-dep-overlap.mjs

fix(embeddings): #2018 — drop @huggingface/transformers from optionalDependencies (npx Invalid Version)

2026-05-15 21:44:39 -04:00

audit-plugin-hooks-cross-platform.mjs

fix(hooks): Codex hooks.json schema + PreToolUse verdict compat (#2857)

2026-07-29 21:36:20 -04:00

audit-plugin-manifest.mjs

v3.11.0 — router ADR-148/149 + cost-tracker observability + fleet audits (#2398)

2026-06-16 12:10:35 -04:00

audit-plugin-mcp-prefix.mjs

test(plugins): preserve standalone MCP catalog assertions

2026-07-16 23:20:35 -04:00

audit-plugin-packages.mjs

fix(plugins): #1902/#1903/#1904 install-safety + plugin-package CI guard (#1925)

2026-05-12 00:44:57 -04:00

audit-skill-frontmatter.mjs

fix(release): harden hooks, statusline, security, and plugin MCP integration

2026-07-16 23:06:29 -04:00

audit-supply-chain.mjs

fix(security): patch CVEs, shell injection, SSRF in ruflo (#2114)

2026-05-23 04:52:41 -04:00

audit-tool-descriptions.mjs

feat(mcp): ADR-112 — 285/285 tool descriptions have 'Use when …' guidance + CI guard + #1892 statusline (#1897)

2026-05-11 00:29:58 -04:00

audit-umbrella-version-lockstep.mjs

fix(release): #2151 — three-way version lockstep + CI guard (#2153)

2026-05-26 07:43:34 -04:00

audit-vector-dim.mjs

fix(memory): schema vector_indexes dim 768→384 + CI guard (#1947, #1942, #1952) (#1956)

2026-05-13 09:02:02 -04:00

audit-wrapper-dep-ranges.mjs

chore(release): prepare stable 3.38.10 train

2026-08-14 17:35:47 -04:00

auto-retrain-router.mjs

v3.11.0 — router ADR-148/149 + cost-tracker observability + fleet audits (#2398)

2026-06-16 12:10:35 -04:00

bench-agenticow.mjs

feat(mcp): integrate agenticow@~0.2.3 — COW memory branching (4 MCP tools) (#2500)

2026-06-29 11:59:20 -04:00

bench-skill-distillation.mjs

darwin-core iter 4 — skill-distillation: promote all successful traces Δ=0.1429

2026-06-27 11:42:23 -04:00

benchmark-graph.mjs

fix(ci): graph benchmark process.exit — eliminate 40-min hang (#2148)

2026-05-26 00:14:53 -04:00

benchmark-intelligence.mjs

darwin-core infra: add --only=<dim> flag to benchmark-intelligence.mjs

2026-06-27 11:41:06 -04:00

benchmark-models-midtier.mjs

v3.11.0 — router ADR-148/149 + cost-tracker observability + fleet audits (#2398)

2026-06-16 12:10:35 -04:00

benchmark-models.mjs

v3.11.0 — router ADR-148/149 + cost-tracker observability + fleet audits (#2398)

2026-06-16 12:10:35 -04:00

benchmark-multiagent.mjs

darwin: iter 11 advance — nfcorpus bm25 weight 0.7→0.4, ndcg10 0.3372→0.3443 (+0.71%)

2026-06-26 16:58:54 -04:00

benchmark-router.mjs

v3.11.0 — router ADR-148/149 + cost-tracker observability + fleet audits (#2398)

2026-06-16 12:10:35 -04:00

benchmark-seed-corpus.mjs

v3.11.0 — router ADR-148/149 + cost-tracker observability + fleet audits (#2398)

2026-06-16 12:10:35 -04:00

bulk-fix-tool-descriptions.mjs

feat(mcp): ADR-112 — 285/285 tool descriptions have 'Use when …' guidance + CI guard + #1892 statusline (#1897)

2026-05-11 00:29:58 -04:00

calibration-check.mjs

v3.11.0 — router ADR-148/149 + cost-tracker observability + fleet audits (#2398)

2026-06-16 12:10:35 -04:00

check-fingerprint-schema.mjs

test(metaharness): fingerprint-schema compat tripwire (iter 81)

2026-06-16 22:42:19 -04:00

check-mcp-scan-format.mjs

fix: resolve current runtime and verification defects for v3.32.36 (#2850)

2026-07-29 15:08:51 -04:00

check-metaharness-compat.mjs

ci(metaharness): CI gates + ADR-150 constraint-#4 enforcement (iter 2)

2026-06-16 13:14:49 -04:00

check-metaharness-pins.mjs

feat(metaharness): pull in @metaharness/turn-credit + fix stale router/darwin pins (#2958)

2026-08-10 15:08:06 -02:30

ci-test-baseline.txt

fix(release): enforce CI and idle assignment safety

2026-08-15 11:14:06 -04:00

ci-test-ratchet.mjs

fix(release): enforce CI and idle assignment safety

2026-08-15 11:14:06 -04:00

cleanup-v3.sh

…

gen-seed-corpus-v2.mjs

v3.11.0 — router ADR-148/149 + cost-tracker observability + fleet audits (#2398)

2026-06-16 12:10:35 -04:00

gen-seed-corpus.mjs

v3.11.0 — router ADR-148/149 + cost-tracker observability + fleet audits (#2398)

2026-06-16 12:10:35 -04:00

install.sh

…

inventory-capabilities.mjs

chore(verification): regenerate inventory + fix CRLF bug in extractor

2026-05-05 22:18:18 -04:00

loop-checkpoint.mjs

fix(bridge): wire bridgeRecordFeedback to real intelligence.recordTrajectory (#2786 fix-3)

2026-07-26 18:47:59 -04:00

metaharness-clean-install-test.mjs

feat(metaharness): pull in @metaharness/turn-credit + fix stale router/darwin pins (#2958)

2026-08-10 15:08:06 -02:30

prepare-root-publish.mjs

fix(release): ship Capability Brain as a self-contained 3.32.30 train (#2829)

2026-07-29 01:30:53 -04:00

probe-nested-spawn-depth.mjs

feat(agents): ADR-147 nested subagent (depth=5) infrastructure + P2 stage 1 (#2336)

2026-06-09 12:15:03 -04:00

refit-calibrator-from-production.mjs

v3.11.0 — router ADR-148/149 + cost-tracker observability + fleet audits (#2398)

2026-06-16 12:10:35 -04:00

regen-statusline-artifact.mjs

fix(statusline): real model name from stdin + worktree version resolution

2026-07-20 15:58:21 -04:00

regen-witness.mjs

feat: per-OS verification cognitive containers + tutorial README

2026-05-09 10:47:43 -04:00

sign-witness-from-inventory.mjs

feat(verification): per-source-file MCP witnesses (task #25, iteration #51)

2026-05-03 21:47:15 -04:00

smoke-adr104-transport.mjs

fix(verification): unblock ADR-104 and witness source checks

2026-07-09 10:40:08 -04:00

smoke-agent-execute-providers.mjs

fix(agent): propagate explicit provider/model config into agent execution (#2962) (#3007)

2026-08-12 18:28:25 -04:00

smoke-agentbbs.sh

test(agentbbs): allow lazy runtime loading

2026-07-16 19:10:33 -04:00

smoke-agenticow.sh

feat(mcp): integrate agenticow@~0.2.3 — COW memory branching (4 MCP tools) (#2500)

2026-06-29 11:59:20 -04:00

smoke-all-plugins.mjs

v3.11.0 — router ADR-148/149 + cost-tracker observability + fleet audits (#2398)

2026-06-16 12:10:35 -04:00

smoke-attribution-opt-in.mjs

feat(init): #2089 ADR-127 Phase 4 — attribution opt-in across 19 github command files + last-updated stamps

2026-05-21 14:19:35 -04:00

smoke-browser-rvf-create-flags.mjs

ci: #2041 ADR-122 — make browser rvf smoke tolerant of missing dist

2026-05-18 20:55:31 -04:00

smoke-cli-npx-install.mjs

fix(embeddings): #2018 — drop @huggingface/transformers from optionalDependencies (npx Invalid Version)

2026-05-15 21:44:39 -04:00

smoke-deprecated-actions.mjs

fix(github): #2089 — complete Phase 3 (5 init-template agents missed) + strengthen smoke + alpha.75

2026-05-21 14:37:43 -04:00

smoke-github-actions-pins.mjs

feat(ci): #2089 ADR-127 Phase 1 — github-safe injection smoke + uses: pin smoke + supply-chain allowed-deps actions block

2026-05-21 14:03:29 -04:00

smoke-github-safe-injection.mjs

fix(smoke): #2089 — accept E2BIG as valid rejection in github-safe injection smoke

2026-05-21 14:23:31 -04:00

smoke-graph-pathfinder.mjs

feat(graph): ADR-130 — unified graph intelligence backend (P1-P6) (#2129)

2026-05-24 23:46:50 -04:00

smoke-graph-plugin-adapter.mjs

feat(graph): ADR-130 — unified graph intelligence backend (P1-P6) (#2129)

2026-05-24 23:46:50 -04:00

smoke-graph-query-dispatch.mjs

feat(graph): ADR-130 — unified graph intelligence backend (P1-P6) (#2129)

2026-05-24 23:46:50 -04:00

smoke-graph-schema-migration.mjs

fix(ci): graph schema smoke — checkpoint WAL before sql.js re-read

2026-06-25 18:32:28 -04:00

smoke-helper-signing-security.mjs

fix: resolve current runtime and verification defects for v3.32.36 (#2850)

2026-07-29 15:08:51 -04:00

smoke-init-bundle-invariants.mjs

feat(ci): #2095 ADR-128 Phase 5 — init-bundle-invariants smoke (no orphans, no plugin-init overlap)

2026-05-21 15:41:47 -04:00

smoke-init-scaffold-references.mjs

fix(scaffold): add dead-reference guard + deterministic CLI remap (ADR-382 Part C) (#2974)

2026-08-11 18:39:17 -04:00

smoke-kg-extract-type-imports.mjs

fix(kg-extract): #2049 — separate import type from value imports + drop disabled semantic-route + CI guard

2026-05-19 12:19:16 -04:00

smoke-memory-db-path.mjs

feat: #2105 CLAUDE_FLOW_DB_PATH + #2058 team gateway checklist (#2146)

2026-05-26 00:01:46 -04:00

smoke-memory-no-stray-db.mjs

chore: project-wide quality sweep — no dead code, no slop, witness-validated (#2139)

2026-05-25 22:44:55 -04:00

smoke-memory-stats-legacy-db.mjs

fix(memory): #2120 — accept NULL status in memory_entries (legacy DBs) + 3.7.0 stable

2026-05-24 11:13:50 -04:00

smoke-neural-trader-backtest-signing.mjs

feat(neural-trader): #2068 ADR-126 Phase 4 — Ed25519-signed backtest artifacts

2026-05-19 22:39:21 -04:00

smoke-neural-trader-feature-attribution.mjs

feat(neural-trader): #2068 ADR-126 Phase 6 — feature attribution via single-entry PR

2026-05-19 23:04:14 -04:00

smoke-neural-trader-pipeline.mjs

feat(neural-trader): #2068 ADR-126 Phase 5 — SendMessage risk-gate pipeline

2026-05-19 22:44:34 -04:00

smoke-neural-trader-portfolio-cg.mjs

test(plugins): align namespace and stable hook shims

2026-07-16 23:14:09 -04:00

smoke-plugin-registry-signature.mjs

fix(security): #1922 — verify plugin-registry Ed25519 signature properly (CWE-347)

2026-05-19 16:39:54 -04:00

smoke-pre-bash-hook.mjs

fix(hooks): #2017 — defensive pre-bash + new CI gate against silent-swallow shape

2026-05-15 22:29:21 -04:00

smoke-router-regex.mjs

release: 3.10.33 + CI regression guards for #2267 / #2257 / #2256

2026-06-02 03:59:36 -04:00

smoke-ruflo-hook-cjs.mjs

fix: complete reports and consistent initialization for v3.32.37 (#2851)

2026-07-29 15:40:17 -04:00

smoke-ruvllm-wasm-auto-init.mjs

fix(mcp): #2086 — auto-init ruvllm WASM in loadRuvllmWasm + CI regression guard

2026-05-21 12:36:22 -04:00

smoke-statusline-generator-delegation.mjs

fix(#2679): sync statusline-generator with committed helper (read+substitute pattern) (#2680)

2026-07-14 16:11:18 -04:00

smoke-tool-output-guardrail.mjs

fix(plugins/ruflo-core/hooks): #2155 — wrap 3 unwrapped .sh hooks in /bin/bash -c (#2161)

2026-05-27 09:00:35 -04:00

smoke-trajectory-graph-edges.mjs

fix(graph): migrate agentdb-tools.ts db.exec(sql, params) to better-sqlite3 API; checkpoint trajectory WAL

2026-06-25 19:22:58 -04:00

smoke-wasm-gallery-crud.mjs

feat(rvagent): #ADR-129 — full rvagent integration (4 phases) (#2123)

2026-05-24 14:32:43 -04:00

smoke-wasm-plugin-bridge.mjs

feat(rvagent): #ADR-129 — full rvagent integration (4 phases) (#2123)

2026-05-24 14:32:43 -04:00

smoke-wasm-provider-bridge.mjs

feat(rvagent): #ADR-129 — full rvagent integration (4 phases) (#2123)

2026-05-24 14:32:43 -04:00

smoke-wasm-rvf-compose.mjs

feat(rvagent): #ADR-129 — full rvagent integration (4 phases) (#2123)

2026-05-24 14:32:43 -04:00

smoke-windows-hook-execution.mjs

fix(ci): bump cold-cache timeouts (iter 131)

2026-06-17 14:10:27 -04:00

smoke-windows-init-hooks.mjs

fix(ci): bump cold-cache timeouts (iter 131)

2026-06-17 14:10:27 -04:00

smoke-witness-marker-drift.mjs

fix(witness): #2021 — refresh stale markers, regen signed manifest, add fast drift CI guard

2026-05-16 19:20:26 -04:00

smoke-witness-verify-precondition.mjs

fix: resolve current runtime and verification defects for v3.32.36 (#2850)

2026-07-29 15:08:51 -04:00

smoke-workflows-yaml.mjs

fix(ci): 5 CI failures — Build V3, Static guards, ADR-112, witness verify, supply-chain audit

2026-06-25 18:18:19 -04:00

stage-internal-runtime-bundles.mjs

fix(release): align bundled runtime metadata

2026-08-14 19:21:33 -04:00

track-clones.mjs

fix(security): patch CVEs, shell injection, SSRF in ruflo (#2114)

2026-05-23 04:52:41 -04:00

train-bundled-fastgrnn.mjs

v3.11.0 — router ADR-148/149 + cost-tracker observability + fleet audits (#2398)

2026-06-16 12:10:35 -04:00

train-bundled-krr.mjs

v3.11.0 — router ADR-148/149 + cost-tracker observability + fleet audits (#2398)

2026-06-16 12:10:35 -04:00

train-calibrator.mjs

v3.11.0 — router ADR-148/149 + cost-tracker observability + fleet audits (#2398)

2026-06-16 12:10:35 -04:00

train-from-trajectories.mjs

v3.11.0 — router ADR-148/149 + cost-tracker observability + fleet audits (#2398)

2026-06-16 12:10:35 -04:00

tune-cost-ceiling.mjs

v3.11.0 — router ADR-148/149 + cost-tracker observability + fleet audits (#2398)

2026-06-16 12:10:35 -04:00

tune-ensemble-threshold.mjs

v3.11.0 — router ADR-148/149 + cost-tracker observability + fleet audits (#2398)

2026-06-16 12:10:35 -04:00

tune-quality-bar.mjs

v3.11.0 — router ADR-148/149 + cost-tracker observability + fleet audits (#2398)

2026-06-16 12:10:35 -04:00

verify-appliance.sh

…

verify-federation-plugin.sh

verify(federation): unblock Checks 2/3 by pinning cookies@0.9.0 (#1949) (#1965)

2026-05-13 11:11:25 -04:00