build: estate pin upgrade (ruflo 3.51.1, Claude Code 2.1.288, agentic-qe, wrangler, solid-pod-rs alpha.12; mermaid/web-researcher held)

[jjohare]

Three commits. Do not merge before the host rebuild (./agentbox.sh rebuild) materialises both FODs. Nix was not evaluated here, so the image is unverified.

Pins

	before	after
ruflo / @claude-flow/cli	3.47.0	3.51.1 (published 2026-10-02T16:17Z, inside the 72 h window)
Claude Code	2.1.285 (stable)	2.1.288 (latest; ~1 day old, inside the 3-day cool-off)
ruvector	0.3.3	unchanged (npm latest)
mcp/ruvnet-brain lock	—	unchanged (npm audit: 0 findings)

Both freshness exceptions are deliberate: ruflo-console (the 3.51 mods) needs Claude Code 2.1.287+.

Hash method (proved on the existing pins first)

• ruflo tarball, flat sha256 → SRI: 3.47.0 sha256-3uiMa…ZxM= reproduces the pin; 3.51.1 sha256-vKkzPdeUUxh1cvtDUMuvdjIbJI3I44CQEr4JavXLpB4=
• ruflo nodeModulesHash: NAR sha256 of the FOD tree (unpacked tarball + lock, npm ci --production --ignore-scripts --legacy-peer-deps, npm 10.9.9). 3.47.0 sha256-Wd//…YEg= reproduces the pin; 3.51.1 sha256-NMX4U+qBrQ+1P87EBlBp+QeBGBPRoXShqpcgV31CXCw=, identical on two clean installs
• Claude Code: 2.1.285 x64 sha256-M9rR…PSk= and arm64 sha256-JPrH…Fz0= reproduce the pins. For 2.1.288, x64 sha256-ApgGi2…ZAw= and arm64 sha256-NZq2oF…udU= each equal the checksum in Anthropic's manifest.json.

Regression (3.47.0 vs 3.51.1, each run in a scratch prefix)

All identical exit codes. Calls: --version (ruflo and the claude-flow alias), hooks route (match and no-match, text and JSON), hooks pre-command, hooks post-command, hooks pre-edit, hooks post-edit, hooks session-restore, hooks session-end, swarm status, memory stats --format json, memory list --format json --limit 5, init --help, mcp start --help.

• hooks route text output is unchanged, so the adapter's ROUTE_SIGNAL filter still matches. The JSON form only gains matched.
• hooks_route MCP now returns matched:false at 30% when nothing matches. Nothing in the repo thresholds on it: the adapter uses the CLI, and the orchestration proxy denies hooks_*.
• Orchestration proxy, live, with the real createOrchestrationProxy (swarm,agent): 21 tools forwarded, no denied tool leaked, and swarm_status/agent_list answer on both versions. The 11 unit tests pass.
• Model-router console --dry-run (it imports ruvector/model-router.js, neural-router.js and agent-execute-core.js from the closure): every import resolves and it picks the same model. Confidence moves 0.599 → 0.507 (upstream calibration). Nothing gates on that value.
• .claude/helpers memory/router/session become .cjs. hook-handler.cjs, which registered-hooks.txt prunes, is unchanged.
• Behaviour change: ruflo init now enables the mods by default. It writes project enabledPlugins ×3, extraKnownMarketplaces.ruflo and env.CLAUDE_CODE_ENABLE_FUNCTION_HOOKS=1, then runs claude plugin install. That bypasses the manifest gate on function hooks. cf-init and agentbox-init now pass --no-mods, and tests/config/ruflo-init-no-mods.test.sh guards both (negative control fails as it should).
• npm audit --omit=dev: 8 high both before and after (sharp/libvips, braces, toml, all transitive upstream). No new findings.

Gates

adr-index-gen --check and --check-index are OK, and adr-ratchet is OK. 13 stale ADRs were re-verified with dated notes; for ADR-2093/2121, the factrail plugin passes claude plugin validate --strict under 2.1.288 with an unchanged hook surface.

🤖 Generated by Claude Code