Starstruk Logo MarkStarstruk

v3.40.0

ruvnet/ruflov3.40.0Sep 9, 2026by ruvnet

AI Summary

This release introduces Cross-Host Federation and Claims functionality, enabling users to coordinate agents across machines using signed, verifiable messages and work claims. It features a local mesh protocol for secure coordination over various networks, a Slack integration, and enhanced security measures like Ed25519 verification and registry-anchored pinning.

Key Highlights

  • New Cross-Host Federation capabilities via the local mesh (agentbbs) protocol using Ed25519-signed messages and pinned keys.
  • Zero-infrastructure Slack integration for coordinating agents via channel threads.
  • Resource Claims system allowing one owner per resource with tools for claiming, releasing, and handoff.
  • Enhanced security with registry-anchored pinning to prevent identity hijacking and MITM attacks.
  • Bug fixes including restored `memory search` recall and a green CLI test suite.

New Features

  • Cross-host coordination using federation_bbs commands (identity, peer_add, serve, register, sync).
  • Claims management tools (claims_claim, claims_release, claims_handoff, claims_status).
  • Slack-based message coordination and thread management.
  • Ed25519 signature verification for all mesh messages.
  • Memory search recall functionality restored.

Full Release Notes

## 🕸️ Cross-Host Federation + Claims

Coordinate agents across machines with **signed, verifiable messages** and **work claims**. Two coordinators — use either alone or together:

- **Local mesh (agentbbs):** HTTP pull, Ed25519-signed, pinned keys. Works over Tailscale, LAN, VPN, or loopback — no Tailscale required.
- **Slack:** coordinate in a channel thread with structured messages. Zero infrastructure.

### Install
```bash
npx ruflo@latest --version   # 3.40.0
```

### Quick start — join the mesh (run on each host)
```
1. federation_bbs_identity {}                              → your nodeId + publicKey
2. federation_bbs_peer_add { nodeId, publicKey, url }      → pin every other node
3. federation_bbs_serve { bindHost:"<your routable IP>", port:7777 }
4. federation_bbs_register { roomLabel:"#coordination" }
5. federation_bbs_sync { roomId:"<from step 4>" }          → on a 15–30s timer
```
Unsigned, misattributed, oversize, or over-hop messages are dropped and counted — a hostile or looping peer can't corrupt the log.

### Claims — coordinate who owns what
Runtime tools: `claims_claim`, `claims_release`, `claims_handoff`, `claims_status`.
Cross-host, publish claim events:
```json
{ "type":"ClaimIssued", "from":"nodeA", "resourceId":"deploy-api", "ttlSeconds":3600 }
```
**One owner per resource. Claim → wait for the coordinator's ClaimAck → then do the work.**

### Security
Every mesh message is Ed25519-verified against a pinned key. **Registry-anchored pinning** refuses any endpoint presenting a different key for a known node (identity-hijack / MITM protection). Private keys never leave the host. Don't put secrets in message payloads.

### What's also in 3.40.0
- Restored `memory search` recall (a real regression: the default threshold made keyword recall impossible) — #3252
- Full CLI test suite green (69 → 0 failures)

📖 **Full step-by-step guide, protocol reference, GCP-secret bootstrap, and troubleshooting:** https://gist.github.com/ruvnet/2fbad4d0e3bc02cc7d47b4f6fdd2c205

🤖 Generated with [RuFlo](https://github.com/ruvnet/ruflo)