v3.32.30

# Ruflo v3.32.30: Capability Brain, Now Complete in the Public Install

Ruflo can coordinate hundreds of agent, memory, policy, federation, and
MetaHarness capabilities—but users should not have to memorize that surface or
install unpublished internal packages to make it work. v3.32.30 makes the
public install self-contained and teaches newly initialized agents how to use
the system safely.

This is a corrective release for v3.32.29. That package exposed the new policy
runtime through a static `@claude-flow/security` import while declaring the
unpublished package optional. Fresh installs could run `--version`, but policy
and daemon command loading failed with `ERR_MODULE_NOT_FOUND`. v3.32.30 embeds
the reviewed Security, Codex, and federation runtimes in each applicable public
artifact and promotes their public transitive dependencies to the containing
package.

## What this enables

- Ask `guidance_brain` which registered Ruflo capabilities fit a task instead
  of guessing tool names.
- Run the full policy ledger, daemon, MCP, and standard CLI command surface
  from a fresh three-package installation.
- Generate `CLAUDE.md` and `AGENTS.md` instructions that use the Capability
  Brain, the validated implementation loop, isolated concurrent writers,
  source-bound evidence, and non-expanding authority envelopes.
- Initialize Codex projects from the bundled adapter, including its built-in
  skills, without requiring a standalone `@claude-flow/codex` publication.
- Discover the bundled federation foundation without requiring a standalone
  federation package. Production federation still requires deployment-specific
  durable storage, identity, policy, and acceptance testing.

## Install or upgrade

```bash
npm install --global ruflo@3.32.30
ruflo doctor
```

Or run without a global install:

```bash
npx ruflo@3.32.30 --help
```

## Use the Capability Brain

From an MCP client:

```json
{
  "name": "guidance_brain",
  "arguments": {
    "mode": "recommend",
    "task": "Implement, test, benchmark, and review this change with concurrent agents"
  }
}
```

The returned workflow follows:

```text
recall → inspect → route → plan → execute → test → validate
       → benchmark → optimize → receipt → handoff → authorized publish
```

Learning, Darwin, Flywheel, and MetaHarness can propose or evaluate candidates.
They cannot promote themselves or expand tools, network access, secrets,
spending, concurrency, or release authority.

## Concurrent development defaults

Generated guidance now requires:

- one isolated worktree and explicit file scope per writing agent;
- shared checkouts only for read-only research;
- one integration owner for shared manifests, lockfiles, and overlap
  reconciliation;
- continued independent work after spawning agents rather than stopping;
- tests, benchmarks, policy decisions, and handoffs bound to an exact clean
  commit or immutable dirty-worktree snapshot.

## Public package train

The normal release publishes exactly:

- `@claude-flow/cli@3.32.30`
- `claude-flow@3.32.30`
- `ruflo@3.32.30`

The Security, Codex, and federation runtimes are built from the reviewed
monorepo source and carried as npm bundled dependencies inside the CLI and
umbrella artifacts. Their source package coordinates are not published as part
of this release.

## Compatibility

- Existing projects are never overwritten by `init` unless `--force` is used.
- Existing guidance MCP tools remain available when `guidance_brain` is absent.
- Policy migration remains `legacy` by default; operators can move through
  `observe` before `enforce`.
- Optional native keychain, AgentDB, neural, and MetaHarness dependencies retain
  their existing graceful-degradation behavior.
- `ruflo`, `claude-flow`, and `@claude-flow/cli` remain version-locked and
  install through their established command names.

## Validation contract

Release acceptance requires:

- the three-package version lockstep audit;
- focused generated-guidance and Codex adapter tests;
- Security, Codex, and federation builds and tests;
- tarball inspection proving all three internal runtimes are bundled;
- fresh tarball installation with optional dependencies omitted;
- `--version`, `policy status`, daemon start/status/stop, and `init --codex`
  smoke tests;
- `npm ls` without invalid dependency edges;
- registry verification and aligned `latest`, `alpha`, and `v3alpha` tags.