Starstruk Logo MarkStarstruk

v3.33.0

rajnandan1/kenerv3.33.0Jul 30, 2026by ruvnet

AI Summary

Implements a comprehensive security layer for AgentDB to defend against memory poisoning, including retrieval guards, forensics, and caller identity tokens.

Key Highlights

  • AgentDB Retrieval Security Layer (ADR-377) to defend against memory poisoning.
  • `AgentDbRetrievalGuard` for OWASP LLM pattern scanning on retrieval results.
  • `MemoryPoisonForensics` using rolling-window z-score anomaly detection on write sequences.
  • `McpCallerIdentity` providing Ed25519 per-invocation capability tokens.

New Features

  • AgentDbRetrievalGuard module implementation.
  • MemoryPoisonForensics module implementation.
  • McpCallerIdentity module implementation.
  • Consolidation of stale dream-cycle research proposals (ADR-334 to ADR-376).

Full Release Notes

## AgentDB Retrieval Security Layer (ADR-377)

Closes #2516 / tracked in #2873: AgentDB's retrieval and write paths had zero certified defenses against memory poisoning (undefended attack success 93–100% per SMSR, arXiv:2606.12703). Full 3-phase implementation shipped in #2874, all off by default until independently benchmarked.

- **`AgentDbRetrievalGuard`** (`@claude-flow/memory`) — filters HNSW retrieval results through `ToolOutputGuardrail`'s OWASP LLM01/LLM08 pattern scan before context assembly. `CLAUDE_FLOW_RETRIEVAL_GUARD` / `_STRICT`.
- **`MemoryPoisonForensics`** (`@claude-flow/hooks`) — rolling-window z-score anomaly detection on AgentDB write sequences (write-interval, content-length). `CLAUDE_FLOW_POISON_FORENSICS=0` to disable.
- **`McpCallerIdentity`** (`@claude-flow/security`) — Ed25519 per-invocation capability tokens. `CLAUDE_FLOW_MCP_CALLER_AUTH`, off by default pending a follow-on key-distribution ADR.

Also in this release:
- **#2871** — consolidated 49 stale dream-cycle research proposals (open since 2026-05-29, never merged) into ADR-334 through ADR-376, resolving the ADR-147/ADR-179/ADR-320 numbering collisions along the way.
- **#2872** — recovered ADR-377 itself from an abandoned dream-cycle branch that never got a PR opened for it.

31 new tests across the three touched packages, zero regressions (memory 451, hooks 145, security 570 full suites re-run clean).

## Packages
- `@claude-flow/cli@3.33.0`
- `claude-flow@3.33.0`
- `ruflo@3.33.0`

🤖 Generated with [Claude Code](https://claude.ai/code)