v3.6.26

13 commits on top of [3.6.25](https://github.com/ruvnet/ruflo/releases/tag/v3.6.25). Test baseline: **1938 / 1938 passing**, 0 failures, 46 intentionally skipped. Build clean (tsc --noEmit: 0 errors).

## What's new

### ADR-098: Plugin capability sync + 5-part remediation pass

[ADR-098](v3/docs/adr/ADR-098-plugin-capability-sync-and-optimization.md) audited all 32 plugins under `plugins/ruflo-*` and shipped four of the five remediation parts:

**Part 1 — Capability sync (4 slices, 7 plugins)**:
- `ruflo-aidefence` 0.1.0 → 0.2.0 — defense-in-depth pairing with `validateEnv`, file-mode 0600, encryption-at-rest gate
- `ruflo-security-audit` 0.1.0 → 0.2.0 — patterns to scan for from audit_1776853149979
- `ruflo-rag-memory` 0.1.0 → 0.2.0 — encryption-at-rest gate notes
- `ruflo-rvf` 0.1.0 → 0.2.0 — session encryption + cross-machine transfer caveat
- `ruflo-cost-tracker` 0.1.0 → 0.2.1 — federation budget breaker pairing (ADR-097)
- `ruflo-agentdb` 0.1.0 → 0.2.0 — G7 controller table (gnnService, rvfOptimizer, mutationGuard, attestationLog, GuardedVectorBackend)
- `ruflo-knowledge-graph` 0.1.0 → 0.2.0 — G7 controllers from a graph-traversal angle

**Part 2 — Token diet (4 slices)**:
- `iot-cognitum/device-coordinator`: 69 → 30 lines (~470 tokens saved per spawn)
- `ruflo-ddd/domain-modeler`: 93 → 54 lines (~565 tokens saved)
- `ruflo-adr/adr-architect`: 96 → 45 lines (~600 tokens saved)
- `ruflo-cost-tracker/cost-analyst`: 105 → 41 lines (~770 tokens saved)

Cumulative: **~2,400 tokens saved per spawn** across the 4 agents. Reference content moved to per-plugin `REFERENCE.md` files, loaded on-demand.

**Part 3 — Model rightsizing**:
- `ruflo-security-audit/security-auditor` from `model: opus` → `model: sonnet`. ~5× cheaper per token; bounded-scope security review is sonnet-tier work.

**Part 4 — Neural-learning hook standardization**:
- 7 plugin agents that were missing `hooks post-task --train-neural true` got the canonical 3-line tail with role-appropriate context. Re-audit confirms 0/43 missing (was 7/43).

Part 5 (worker dispatch on completion) remains for a future iteration.

### ADR-096 Phase 5 — `ruflo doctor` encryption status

`ruflo doctor` (and `ruflo doctor -c encryption`) now reports encryption-at-rest status:
- Gate state (off / on / fail-closed for missing key)
- Key fingerprint (truncated SHA-256 of resolved key, **never the key itself**)
- Per-store breakdown: `sessions/=enc terminals=plain memory.db=enc` etc.

5 new tests pin the 4 states + on-disk encrypted-blob detection.

### Verification: per-source-file MCP witnesses

`verification.md.json` extended from 27 fix witnesses to **55 total**: 27 regression-fix + 28 capability witnesses (one per source file under `src/mcp-tools/`). `ruflo verify` now confirms the 300-tool surface byte-for-byte against signed dist hashes, not just the recently-fixed slice.

New helpers:
- `scripts/sign-witness-from-inventory.mjs` — appends `CAP-MCP-*` entries from `verification-inventory.json`
- `scripts/regenerate-witness.mjs` — re-hashes + re-signs the manifest after a release bump

## Verify

```bash
ruflo verify
```

55 fixes / 55 verified for `ruflo@3.6.26`.

## Packages

| Package | Version |
|---|---|
| `@claude-flow/cli` | 3.6.26 |
| `claude-flow` (umbrella) | 3.6.26 |
| `ruflo` (umbrella) | 3.6.26 |
| `@claude-flow/plugin-agent-federation` | 1.0.0-alpha.5 (unchanged from 3.6.25) |

## Marketplace plugins bumped

| Plugin | Before | After |
|---|---|---|
| `ruflo-aidefence` | 0.1.0 | 0.2.0 |
| `ruflo-security-audit` | 0.1.0 | 0.2.0 |
| `ruflo-rag-memory` | 0.1.0 | 0.2.0 |
| `ruflo-rvf` | 0.1.0 | 0.2.0 |
| `ruflo-cost-tracker` | 0.1.0 | 0.2.1 |
| `ruflo-agentdb` | 0.1.0 | 0.2.0 |
| `ruflo-knowledge-graph` | 0.1.0 | 0.2.0 |
| `ruflo-iot-cognitum` | 0.1.0 | 0.1.1 |
| `ruflo-ddd` | 0.1.0 | 0.1.1 |
| `ruflo-adr` | 0.1.0 | 0.1.1 |

## Install

```bash
npx ruflo@latest init --wizard
# or
npm install -g ruflo@3.6.26
```

The `flo.ruv.io` MCP bridge picks up 3.6.26 automatically on next container rebuild (`npm install -g ruflo` resolves `latest`).