v3.34.0

ruvnet/ruflov3.34.0Jul 31, 2026by ruvnet

AI Summary

Integrates AGNTCY/Outshift runtime with optional augmentation, introduces CASA authorization with Ed25519 receipts, and establishes an npm Trusted Publishing release workflow.

Key Highlights

New CLI verbs including `ruflo transport use slim`, `ruflo agent publish`, and `ruflo swarm join`.
CASA (Continuous Agentic Semantic Authorization) for deterministic free-text-objective to bounded envelope compilation.
Companion Rust crate `v3/crates/ruflo-agntcy` and npm package `@metaharness/agntcy`.
npm Trusted Publishing workflow for immutable, tag-pinned package releases.

Breaking Changes

`security scan --type container` is now rejected instead of silently reporting clean.

New Features

AGNTCY OTel span attributes for coordination and authorization.
Fail-closed security scan validation for `--depth` and `--target` flags.
Deprecation of `--depth full` in favor of `--depth deep`.

Full Release Notes

## AGNTCY/Outshift runtime integration (ADR-378/379/380)

Optional, removable augmentation per ADR-150's pattern — the kernel stays fully
operational with these packages absent.

- **New CLI verbs**: `ruflo transport use slim`, `ruflo agent publish`, `ruflo swarm join <namespace>`.
  All exit 0 with a clear message when `RUFLO_AGNTCY_SLIM_ENDPOINT` is unset — no fake success paths.
- **CASA** (Continuous Agentic Semantic Authorization) — deterministic free-text-objective →
  bounded allow/deny/budget/expiry envelope compiler, deny-by-default enforcement gate,
  Ed25519-signed decision receipts (`.swarm/casa-receipts.jsonl`).
- **AGNTCY OTel span attributes** — `coordination.episode`, `authorization.decision`.
- Companion Rust crate `v3/crates/ruflo-agntcy` mirrors the TS enforcement logic (real
  in-process `LocalTransport`, `SlimTransport` stub behind a non-default `slim` Cargo feature).
- Companion package **[`@metaharness/agntcy`](https://www.npmjs.com/package/@metaharness/agntcy)**
  (build-time half — identity, OASF export, Directory publish, semantic observability) published
  for the first time from the sibling `metaharness` repo.
- See it in action: [AGNTCY showcase — a real trace](https://claude.ai/code/artifact/98702103-d881-4d2e-85a0-7ac8189933a5)
  and the [presentation deck](https://claude.ai/code/artifact/d5361d99-4aaa-4d34-a25d-5ff9af294d53).

## npm Trusted Publishing release workflow (ADR-378)

`.github/workflows/stable-npm-release.yml` publishes the three-package stable train
(`@claude-flow/cli`, `claude-flow`, `ruflo`) from an immutable, tag-pinned checkout with a full
test/build/pack/install smoke-test gate before any registry write, verifies published-package
integrity against the locally-built archive, and rolls out `latest`/`alpha`/`v3alpha` dist-tags
together. This release is the first real run of that workflow.

## Fixed

- **`@agntcy/slim-bindings` pinned to the confirmed-working alpha** (`2.0.0-alpha.5`) — the SLIM
  maintainers moved off `uniffi-bindgen-react-native` (incompatible with plain Node) onto
  `@ubjs/core`/`@ubjs/node`; verified live end-to-end.
- **`security scan` failed open** on unvalidated `--depth`/`--type`/`--target` — all three now fail
  closed before anything is scanned or written.

## Changed / Removed

- `security scan --depth full` deprecated (normalises to `deep` with a warning).
- `security scan --type container` now rejected instead of silently reporting clean (**breaking**
  for pipelines passing `--type container`).

Full changelog: [CHANGELOG.md](https://github.com/ruvnet/ruflo/blob/main/CHANGELOG.md#3340---2026-07-31)

---

Install: `npx ruflo@latest doctor` · `npx ruflo@latest agent publish --help`