ruflo updates — week of 2026-07-05 (41 new commits, tip a5f86ad0a)

[github-actions]

ruvnet/ruflo — last 7 days

Window: since 2026-06-28 · Upstream tip: a5f86ad0a

feat (11)

• 802b75b4e feat(memory): nightly vector-DB backup — WAL-safe snapshot, rotation, daemon worker (#2571) (rUv)
• cd8a9c098 feat: memory distillation self-learning loop (ADR-174) + page-agent browser intent (ADR-175) (#2570) (rUv)
• d759af6d6 feat(agenticow): COW memory substrate + governed distillation loop (ADR-170..173) (#2562) (rUv)
• 66ba80925 feat(neural): training flywheel + @ruvector/ruvllm 2.6.0 (resume, val-split, checkpoint auto-load) (#2557) (rUv)
• 4bea342e0 feat(neural): route neural train through the native TrainingPipeline (#2549 final follow-up) (#2556) (rUv)
• 8547df986 feat(neural): use @ruvector/ruvllm 2.5.7 native checkpoints end-to-end (#2549 follow-up) (#2555) (rUv)
• d01204280 feat: review-driven upgrades — perf, security, SOTA capabilities (6-agent concurrent implementation) (#2547) (rUv)
• e0d0af1ce feat(gaia): pre-submission exploit audit + signed attestation (ADR-167) (#2543) (rUv)
• ae9bba523 feat(metaharness): learn + gepa integration — metaharness@0.3.0 / darwin@0.8.0 (15 MCP tools) (#2540) (rUv)
• 19e4277e1 feat: ADR-164 agentbbs business autopilot — Phases 1-4 (4 MCP tools, 7 pods, http_fetch, atomic budget tracker) (#2503) (rUv)
• 35ac888eb feat(mcp): integrate agenticow@~0.2.3 — COW memory branching (4 MCP tools) (#2500) (rUv)

fix (7)

• 5e29dc1a0 fix(statusline): real vector count + self-heal missing vector_indexes on init (#2569) (rUv)
• 51085bf68 fix(memory): restore keyword+semantic recall in memory search (#2558) (#2567) (rUv)
• 46228841d fix(init): wire self-learning memory bridge on the npx path (#2545) (#2564) (rUv)
• 9b504d229 fix(neural): #2549 — status no longer misreports native ruvllm training path as Unavailable (#2554) (rUv)
• d07ec824a fix(ci): regenerate v3/pnpm-lock.yaml for the #2540 metaharness pin bumps (#2552) (rUv)
• 402b701a9 fix(security): ADR-165 Phase 1 — close 5 critical CVEs + refresh registry + audit CI gate (#2508) (rUv)
• 016eba0c9 fix(daemon): hold lockfile through spawn lifecycle (#2484) (#2505) (rUv)

perf (1)

• a1767fc8f perf: optimize memory-search hot loop, agenticow label lookup, and npm packaging (#2568) (rUv)

docs (3)

• 6f89c7640 docs(claude): metallm ask-vs-delegate rule + $0.26 delegate floor warning (#2538) (rUv)
• 0810d3b8c docs(claude): enforce gateway-delegated development via meta-llm dev-bridge (#2535) (rUv)
• 840ee5a72 docs(adr): ADR-165 security CVE posture review (#2507) (rUv)

chore (17)

• a5f86ad0a chore: sync repo dogfood helpers to 3.23.0 + gitignore auto-refresh runtime stamp (ruv)
• 05c554512 chore(release): 3.22.0 → 3.23.0 (nightly vector-DB backup) (ruv)
• 1bbdeb9e5 chore(release): 3.21.1 → 3.22.0 (ruv)
• cc354c6e2 chore(release): 3.21.0 → 3.21.1 (memory-search recall #2558 + init self-learning #2545) (ruv)
• a5a48fafb chore(release): 3.20.0 → 3.21.0 (agenticow governed loop, ADR-170..173) (ruv)
• d0e77d844 chore(release): 3.19.0 → 3.20.0 (training flywheel + ruvllm 2.6.0) (ruv)
• 1155b42fa chore(release): 3.18.2 → 3.19.0 (native training pipeline routing) (ruv)
• feb6ecb8d chore(release): 3.18.1 → 3.18.2 (native ruvllm checkpoints end-to-end) (ruv)
• 7770ce2ab chore(release): 3.18.0 → 3.18.1 (#2549 neural status fix) (ruv)
• dc82e7f6a chore(release): 3.17.0 → 3.18.0 (review-driven upgrades + GAIA integrity family) (ruv)
• 78810360b chore(release): 3.16.3 → 3.17.0 (metaharness learn + gepa) (ruv)
• 4eb807aa7 chore(release): 3.16.2 → 3.16.3 (security) (ruv)
• 4e18ad84c chore(data): clone snapshot ruflo updates — week of 2026-06-14 (38 new commits, tip 28c81c03e) #8 — 0 clones (14d) (ruflo-bot)
• 1a8879695 chore(release): 3.16.1 → 3.16.2 (#2509) (rUv)
• f995b696d chore(release): 3.16.0 → 3.16.1 (#2506) (rUv)
• 8f6351f90 chore(release): 3.15.0 → 3.16.0 (#2504) (rUv)
• 0b20e7c3f chore(release): 3.14.4 → 3.15.0 (#2501) (rUv)

ci (1)

• 5def666d3 ci: fast lockfile-drift guard — catch pnpm-lock↔manifest mismatch early (#2562) (#2563) (rUv)

other (1)

• d00a0a40c security(mcp-bridge): ADR-166 unauthenticated RCE — Phase 1-3 remediation + CI lock (#2521) (rUv)

---

Inspect a commit: git fetch upstream && git show <sha>
Diff a path: git diff upstream/main -- path/to/file
Port a commit: git cherry-pick <sha> (expect conflicts — no shared history)