Ruflo v3.32.37: Complete Reports, Consistent Initialization

Ruflo v3.32.37 closes the follow-up defects found while verifying v3.32.36 against older open bug reports. MetaHarness readiness verdicts remain machine-readable even when a repository is blocked, memory initialization uses the same configured database path as every later operation, and dual Claude Code/Codex initialization now installs both native surfaces.

The release also removes unbacked Codex skill placeholders, makes ADR indexing idempotent, repairs legacy live-memory row visibility, and bounds the quadratic work in session-end intelligence consolidation.

Install or upgrade

npm install --global [email protected]
ruflo doctor

Existing projects remain compatible. The stable train still contains exactly the three supported packages: @claude-flow/cli, claude-flow, and ruflo.

MetaHarness readiness is data

ruflo metaharness genome --path . --format json

Upstream MetaHarness intentionally uses exit 1 for needs-work and exit 2 for blocked. Ruflo now preserves those valid reports instead of replacing them with a generic subprocess error:

{
  "risk_score": 0.72,
  "verdict": "blocked",
  "verdictExitCode": 2
}

The Ruflo wrapper exits successfully for a valid report so CLI and MCP callers can consume it. --alert-on-risk-above still exits 1 when its policy threshold is crossed, and malformed or missing reports still fail with exit 2.

Initialization and portability

• memory init honors CLAUDE_FLOW_DB_PATH, completing the shared-path contract used by dual-mode bootstrap and background workers.
• init --dual runs both native initializers, preserving the full Claude Code scaffold while adding Codex assets.
• Root .gitignore protection covers .env secrets in initialized projects.
• Codex full init installs canonical skill implementations only; it no longer generates more than one hundred placeholder skills that appear usable but have no implementation.
• Every tracked shell and Windows hook shim now resolves the same stable Ruflo dist-tag.

ADR and memory correctness

• ADR metadata parsing accepts the bullet-prefixed Date, Tags, and relationship format emitted by adr-create.
• ADR records use explicit upsert semantics and stable keys.
• ADR relationships use deterministic semantic keys and are deduplicated within an import, while verification remains compatible with legacy keys.
• ADR creation guidance uses the real AgentDB key/value contract.
• Native memory CRUD treats legacy NULL status rows consistently as live.
• Intelligence consolidation deduplicates by content before graph creation and caps similarity comparisons while preserving temporal edges.

Validation

• Blocked-genome CLI and MCP fixtures preserve the complete verdict.
• ADR smoke: 22/22; hook-shim smoke: 12/12.
• Release gates: 12 CLI contract, 238 Codex, 559 security, and 640 federation tests pass.
• All 23 buildable V3 workspace packages compile successfully.
• Focused MetaHarness, memory-path, dual-init, canonical-skill, ADR parser, ADR idempotency, memory visibility, and consolidation regressions pass.
• The stable release workflow builds immutable archives, tests the bundled policy/Codex/federation runtimes, installs all three archives, publishes the same bytes, and installs them again from the npm registry.

This patch resolves #2626, #2629, #2600, #2634, #2636, #2637, #2660, #2659, #2651, #2628, and the remaining active-row visibility defect in #2652.