Ruflo v3.32.33: Autopilot Scope Enforcement at the Real CLI Boundary

v3.32.33 completes the Flywheel and Autopilot reliability release by enforcing explicit task-source validation through the same normalized flags users pass to the CLI.

The V3 parser converts kebab-case options such as --task-sources and --max-iterations to taskSources and maxIterations. The initial validation implementation correctly rejected unsupported values at the service and MCP layers but read the legacy kebab-case keys in the CLI action. As a result, the real command ignored the supplied value and persisted the default source set.

This release reads the parser's canonical camelCase keys while retaining the legacy keys for direct action callers. A parser-to-command integration test and an immutable-tarball release smoke now prove that unsupported task sources fail without creating state.

Install or upgrade

bash

npm install --global [email protected]
ruflo doctor

Configure an exact Autopilot scope

bash

ruflo autopilot config \
  --task-sources swarm-tasks,file-checklist \
  --max-iterations 77

Unsupported sources fail and leave the stored configuration unchanged:

bash

ruflo autopilot config --task-sources issues

Flywheel fix included

The release also includes the v2 retrieval safety envelope from #2836. The built-in proposer can evaluate bounded full-policy candidates without gaining promotion authority.

bash

ruflo metaharness flywheel status
ruflo metaharness flywheel run --proposer local

Release lineage

v3.32.31 stopped before npm publication because its helper manifest was signed for the prior version.
v3.32.32 corrected the signed manifest and was published, but independent post-registry validation found the CLI flag-normalization mismatch.
v3.32.33 is the validated release and receives the stable npm tags.