ruflo updates — week of 2026-08-23 (26 new commits, tip 3c99b1c84)

[github-actions]

ruvnet/ruflo — last 7 days

Window: since 2026-08-16 · Upstream tip: 3c99b1c84

fix (9)

• 3c99b1c84 fix: repin root claude-flow package.json's @claude-flow/mcp (hygiene) (ruv)
• 8a8500194 fix: Windows CI build, dead agentdb controller exports, memory driver doctor check (ruv)
• 02eae9c11 fix(hooks): persist real session-end state (#3077) (Wu Shuwen)
• f7aab6860 fix: resolve Claude Code launches on Windows (#3076) (Wu Shuwen)
• 3a1b2257f fix(cli): honor MCP tool selection when listing (#3060) (Wu Shuwen)
• 703e7741d fix(memory): #3051 memory_store tags lost via write-through cache (3.38.14) (#3079) (rUv)
• 0f3c45101 fix: address #3045 #3064 #3065 + new ruflo-deepseek-harness plugin (3.38.13) (#3078) (rUv)
• a38647e1f fix(flywheel): compute receipt statistics from encoded scale-12 values (ruflo#3072) (ruv)
• 7d0bb9c53 fix(flywheel): reject unknown fields in receipt and commit verification (ruv)

docs (5)

• c31327644 docs: correct MCP-server-registration claims, refresh catalog/helpers metadata (retry) (ruv)
• b5b12a751 docs: correct MCP-server-registration claims, refresh catalog/helpers metadata (ruv)
• 34f11dbd4 docs(spec): bound signatureBase64 to the exact Ed25519 base64 length (ruv)
• 66fbe7ce1 docs(adr): make ADR-322C recomputation reproducible from the spec alone (ruv)
• a914ebdc6 docs(spec): witness/receipt contract extracted from ADR-322C (ruv)

chore (5)

• 68a9c9f6a chore(release): 3.38.18 -> 3.38.19 (supersedes broken 3.38.17/3.38.18) (ruv)
• 127a6546c chore(release): 3.38.17 -> 3.38.18, @claude-flow/memory 3.0.0-alpha.22 -> alpha.23 (ruv)
• 16b0dc4d5 chore(release): 3.38.16 → 3.38.17 (ruv)
• 5234333c3 chore(release): 3.38.15 → 3.38.16 (#3081) (rUv)
• 87bacd558 chore(release): 3.38.14 → 3.38.15 (#3080) (rUv)

other (7)

• b291ac404 dream(intelligence): #3048 discounted Thompson sampling for model-router bandit (evaluated, ACCEPT-scoped) (#3049) (rUv)
• 41efca8be dream(memory): #3056 hybridSearch reachable via explicit opt-in (evaluated, ACCEPT-scoped) (#3057) (rUv)
• dcea520b4 dream(swarm): #3061 bound MessageBus retry attempts, fix unreachable message.failed (evaluated, ACCEPT) (#3062) (rUv)
• 0e50fe7f5 dream(security): #3043 advisory scanner for untrusted settings.json hooks/allow-rules (evaluated, ACCEPT) (#3044) (rUv)
• df0c98219 Merge pull request #3067 from ruvnet/feat/pir-322c-contract-spec (rUv)
• e43f8b975 Merge pull request #3073 from ruvnet/fix/322c-receipt-roundtrip (rUv)
• 15a4aac1f Merge pull request #3070 from ruvnet/fix/322c-reject-unknown-fields (rUv)

---

Inspect a commit: git fetch upstream && git show <sha>
Diff a path: git diff upstream/main -- path/to/file
Port a commit: git cherry-pick <sha> (expect conflicts — no shared history)