v3.32.37

# Ruflo v3.32.37: Complete Reports, Consistent Initialization

Ruflo v3.32.37 closes the follow-up defects found while verifying v3.32.36
against older open bug reports. MetaHarness readiness verdicts remain
machine-readable even when a repository is blocked, memory initialization
uses the same configured database path as every later operation, and dual
Claude Code/Codex initialization now installs both native surfaces.

The release also removes unbacked Codex skill placeholders, makes ADR indexing
idempotent, repairs legacy live-memory row visibility, and bounds the
quadratic work in session-end intelligence consolidation.

## Install or upgrade

```bash
npm install --global ruflo@3.32.37
ruflo doctor
```

Existing projects remain compatible. The stable train still contains exactly
the three supported packages: `@claude-flow/cli`, `claude-flow`, and `ruflo`.

## MetaHarness readiness is data

```bash
ruflo metaharness genome --path . --format json
```

Upstream MetaHarness intentionally uses exit 1 for `needs-work` and exit 2 for
`blocked`. Ruflo now preserves those valid reports instead of replacing them
with a generic subprocess error:

```json
{
  "risk_score": 0.72,
  "verdict": "blocked",
  "verdictExitCode": 2
}
```

The Ruflo wrapper exits successfully for a valid report so CLI and MCP callers
can consume it. `--alert-on-risk-above` still exits 1 when its policy threshold
is crossed, and malformed or missing reports still fail with exit 2.

## Initialization and portability

- `memory init` honors `CLAUDE_FLOW_DB_PATH`, completing the shared-path
  contract used by dual-mode bootstrap and background workers.
- `init --dual` runs both native initializers, preserving the full Claude Code
  scaffold while adding Codex assets.
- Root `.gitignore` protection covers `.env` secrets in initialized projects.
- Codex full init installs canonical skill implementations only; it no longer
  generates more than one hundred placeholder skills that appear usable but
  have no implementation.
- Every tracked shell and Windows hook shim now resolves the same stable Ruflo
  dist-tag.

## ADR and memory correctness

- ADR metadata parsing accepts the bullet-prefixed Date, Tags, and relationship
  format emitted by `adr-create`.
- ADR records use explicit upsert semantics and stable keys.
- ADR relationships use deterministic semantic keys and are deduplicated
  within an import, while verification remains compatible with legacy keys.
- ADR creation guidance uses the real AgentDB `key`/`value` contract.
- Native memory CRUD treats legacy `NULL` status rows consistently as live.
- Intelligence consolidation deduplicates by content before graph creation and
  caps similarity comparisons while preserving temporal edges.

## Validation

- Blocked-genome CLI and MCP fixtures preserve the complete verdict.
- ADR smoke: 22/22; hook-shim smoke: 12/12.
- Release gates: 12 CLI contract, 238 Codex, 559 security, and 640
  federation tests pass.
- All 23 buildable V3 workspace packages compile successfully.
- Focused MetaHarness, memory-path, dual-init, canonical-skill, ADR parser,
  ADR idempotency, memory visibility, and consolidation regressions pass.
- The stable release workflow builds immutable archives, tests the bundled
  policy/Codex/federation runtimes, installs all three archives, publishes the
  same bytes, and installs them again from the npm registry.

This patch resolves
[#2626](https://github.com/ruvnet/ruflo/issues/2626),
[#2629](https://github.com/ruvnet/ruflo/issues/2629),
[#2600](https://github.com/ruvnet/ruflo/issues/2600),
[#2634](https://github.com/ruvnet/ruflo/issues/2634),
[#2636](https://github.com/ruvnet/ruflo/issues/2636),
[#2637](https://github.com/ruvnet/ruflo/issues/2637),
[#2660](https://github.com/ruvnet/ruflo/issues/2660),
[#2659](https://github.com/ruvnet/ruflo/issues/2659),
[#2651](https://github.com/ruvnet/ruflo/issues/2651),
[#2628](https://github.com/ruvnet/ruflo/issues/2628), and
the remaining active-row visibility defect in
[#2652](https://github.com/ruvnet/ruflo/issues/2652).