RepoPilot

ruvnet/ruflo

🌊 The leading agent meta-harness for Claude. Deploy intelligent multi-agent swarms, coordinate autonomous workflows, and build conversational AI systems. Features adaptive memory, self-learning swarm intelligence, RAG integration, and native Claude Code / Codex Integration

Mixed

Solo project β€” review before adopting

MixedDependency

single-maintainer (no co-maintainers visible); no CI workflows detected

HealthyFork & modify

Has a license, tests, and CI β€” clean foundation to fork and modify.

HealthyLearn from

Documented and popular β€” useful reference codebase to read through.

MixedDeploy as-is

Scorecard "Branch-Protection" is 0/10; no CI workflows detected

  • ⚠Solo or near-solo (1 contributor active in recent commits)
  • ⚠No CI workflows detected
  • ⚠Scorecard: default branch unprotected (0/10)
  • βœ“Last commit today
  • βœ“MIT licensed
  • βœ“Tests present

What would improve this?

  • β†’Use as dependency Mixed β†’ Healthy if: onboard a second core maintainer
  • β†’Deploy as-is Mixed β†’ Healthy if: bring "Branch-Protection" to β‰₯3/10 (see scorecard report)

Maintenance signals: commit recency, contributor breadth, bus factor, license, CI, tests + OpenSSF Scorecard

Informational only. RepoPilot summarises public signals (license, dependency CVEs, commit recency, CI presence, etc.) at the time of analysis. Signals can be incomplete or stale. Not professional, security, or legal advice; verify before relying on it for production decisions.

Embed the "Forkable" badge

Paste into your README β€” live-updates from the latest cached analysis.

Variant:
RepoPilot: Forkable
[![RepoPilot: Forkable](https://repopilot.app/api/badge/ruvnet/ruflo?axis=fork)](https://repopilot.app/r/ruvnet/ruflo)

Paste at the top of your README.md β€” renders inline like a shields.io badge.

β–ΈPreview social card

This card auto-renders when someone shares https://repopilot.app/r/ruvnet/ruflo on X, Slack, or LinkedIn.

Ask AI about ruvnet/ruflo

Grounded in the actual source code. Pick a starter question or write your own.

Or write your own question β†’

Onboarding doc

Onboarding: ruvnet/ruflo

Generated by RepoPilot Β· 2026-06-20 Β· Source

🎯Verdict

WAIT β€” Solo project β€” review before adopting

  • Last commit today
  • MIT licensed
  • Tests present
  • ⚠ Solo or near-solo (1 contributor active in recent commits)
  • ⚠ No CI workflows detected
  • ⚠ Scorecard: default branch unprotected (0/10)

<sub>Maintenance signals: commit recency, contributor breadth, bus factor, license, CI, tests + OpenSSF Scorecard</sub>

⚑TL;DR

Ruflo is a TypeScript-based agent meta-harness and orchestration framework that enables deployment of multi-agent AI swarms powered by Claude. It provides adaptive memory, self-learning swarm intelligence, RAG integration, and native Claude Code/Codex plugin support for building conversational AI systems and autonomous workflows. Monorepo structure with skills-based plugin architecture: .agents/config.toml defines swarm configuration, .agents/skills/* contains 50+ reusable agent skill modules (each with SKILL.md documentation), and main TypeScript/JavaScript packages (inferred from language distribution) handle core orchestration. Each skill is independently documented and versioned, suggesting a skill marketplace model. Svelte frontend (395KB) powers the UI at flo.ruv.io.

πŸ‘₯Who it's for

AI engineers and full-stack developers building Claude-based multi-agent systems who need production-ready orchestration, coordination protocols, and swarm intelligence without building orchestration from scratch. Also targets enterprises deploying autonomous workflow systems and teams integrating Claude into complex agentic architectures.

🌱Maturity & risk

Actively developed with 8.1M+ ecosystem downloads and 106k+ git clones in 14 days (per badge data), indicating strong adoption. TypeScript-first codebase with 21.7MB of TypeScript code suggests substantial implementation. However, the extensive skill plugins and experimental features (Byzantine coordinator, CRDT synchronizer) suggest ongoing explorationβ€”production-ready for core agent orchestration but advancing rapidly on coordination algorithms.

Risk factors: 50+ agent skills in .agents/skills/ suggests high complexity and potential maintenance burden across loosely-coupled modules. Multi-language implementation (TypeScript, JavaScript, Rust, Go, SQL) increases context switching. Last observable activity patterns suggest active development, but distributed skill ownership could create fragmentation. No visibility into test coverage from file list. Dependency on Claude API means external service dependency.

Active areas of work

Active development on agent coordination primitives (agent-adaptive-coordinator, agent-consensus-coordinator, agent-collective-intelligence-coordinator, agent-byzantine-coordinator, agent-crdt-synchronizer indicate recent focus on distributed coordination). Recent skill additions across code quality analysis, GitHub integration (agent-github-pr-manager), agentic payments, and system architecture design suggest expanding the skill ecosystem. UI beta active at flo.ruv.io.

πŸš€Get running

Clone the repo with git clone https://github.com/ruvnet/ruflo.git && cd ruflo. Install dependencies with npm install (inferred from TypeScript/npm badge prominence). Configure agent swarm via .agents/config.toml. Run dev server with npm run dev (typical for TypeScript projects). For UI, navigate to flo.ruv.io or run locally if dev setup includes Svelte build.

Daily commands: Run npm install to install dependencies, then npm run dev for local development server (inferred from standard TypeScript project setup). For Docker deployment, use provided Dockerfile. Access UI at localhost:PORT (default varies). For agent configuration, modify .agents/config.toml and restart.

πŸ—ΊοΈMap of the codebase

  • .agents/config.toml β€” Central configuration for the agent meta-harness; defines swarm topology, coordination strategies, and runtime parameters.
  • .agents/README.md β€” Explains the .agents skill system architecture and how agents are organized, discovered, and loaded.
  • .agents/skills/agent-coordinator-swarm-init/SKILL.md β€” Documents the swarm initialization coordinatorβ€”foundational for understanding how multi-agent orchestration begins.
  • .agents/skills/agent-adaptive-coordinator/SKILL.md β€” Core adaptive coordination skill; demonstrates how agents dynamically adjust behavior based on swarm state.
  • .agents/skills/agent-collective-intelligence-coordinator/SKILL.md β€” Implements collective intelligence patterns; essential for understanding swarm self-learning and consensus mechanisms.
  • .agents/skills/agent-memory-coordinator/SKILL.md β€” Manages shared memory and context across agents; critical for maintaining conversational state in multi-agent systems.

🧩Components & responsibilities

  • Goal Planner Agent (Claude API, task graph algorithms, .agents skill framework) β€” Decomposes high-level objectives into concrete tasks and orchestrates swarm activation.
    • Failure mode: If goal decomposition fails, swarm cannot initialize; fallback to manual task specification required.
  • Swarm Coordinator (Adaptive/Hierarchical/Consensus) (Raft, Byzantine consensus, gossip protocol, CRDT, config-driven topology) β€” Manages agent registration, task distribution, consensus achievement, and state synchronization.
    • Failure mode: Coordinator failure can fragment swarm; switchover to backup coordinator or gossip-based recovery needed.
  • Memory Coordinator (CRDT, gossip sync, distributed hash table, adaptive eviction policies) β€” Maintains shared context, caches agent decisions, and enables conversational continuity across agents.
    • Failure mode: Memory loss results in context-free agent decisions; agents must re-discover state via consensus queries.
  • Worker Agent Pool (Claude API, skill framework, rate limiting, result caching, error handling) β€” Executes assigned tasks by calling Claude API, invoking GitHub/external APIs, and reporting results.
    • Failure mode: Task failure triggers retry with exponential backoff; persistent failures escalated to coordinator for reassignment.
  • Code Review Swarm (Multiple analysis agent skills, aggregation framework, multi-criteria scoring) β€” Parallelizes code analysis across multiple specialized agents (style, security, performance, logic).
    • Failure mode: Partial analyzer failure skips that analysis dimension; aggregated report notes missing perspectives.
  • Load Balancer (Queue monitoring, round-robin/priority scheduling, health probes) β€” Distributes incoming requests and tasks across worker agents based on queue depth and health.
    • Failure mode: Uneven load distribution reduces swarm efficiency; manual intervention or auto-restart of load balancer.
  • Performance Monitor (Metrics collection, time-series analysis, threshold-based alerts, benchmark comparison) β€” Tracks latency, throughput, and error rates across agents and triggers optimization or alerting.
    • Failure mode: Monitoring blindness results in silent performance degradation; requires external alerting layer for critical thresholds.

πŸ”€Data flow

  • User Goal β†’ Goal Planner Agent β€” User submits objective; planner decomposes into tasks and context requirements.
  • Goal Planner Agent β†’ Swarm Coordinator β€” Task graph and role assignments sent to coordinator for swarm bootstrap.
  • Swarm Coordinator β†’ Memory Coordinator β€” Initial context and agent state registered in shared memory for consistency.
  • Coordinator & Workers β†’ Memory Coordinator β€” Agents continuously update decisions, cached results, and state changes via gossip/CRDT.
  • Worker Agents β†’ Claude LLM API β€” Task details sent to Claude for reasoning, code generation, or analysis; results cached.
  • undefined β†’ undefined β€” undefined

πŸ› οΈHow to make changes

Add a New Coordination Skill

  1. Create a new skill directory under .agents/skills/agent-{skill-name}/ (.agents/skills/agent-{skill-name}/SKILL.md)
  2. Define skill metadata, capabilities, and integration points in SKILL.md following the pattern of agent-adaptive-coordinator/SKILL.md (.agents/skills/agent-{skill-name}/SKILL.md)
  3. Register the skill in .agents/config.toml under the appropriate coordination category (.agents/config.toml)
  4. Implement skill logic with proper error handling, state management, and agent communication protocols (.agents/skills/agent-{skill-name}/implementation)

Add a Code Analysis Agent to the Code Review Swarm

  1. Create a new analyzer skill in .agents/skills/agent-{analyzer-name}/ (.agents/skills/agent-{analyzer-name}/SKILL.md)
  2. Define the analyzer's expertise domain and metrics in SKILL.md (.agents/skills/agent-{analyzer-name}/SKILL.md)
  3. Register analyzer in .agents/config.toml under the code-review-swarm configuration (.agents/config.toml)
  4. Ensure compatibility with agent-code-review-swarm/SKILL.md's aggregation and reporting interface (.agents/skills/agent-code-review-swarm/SKILL.md)

Add a New GitHub Integration Workflow

  1. Create workflow skill in .agents/skills/agent-{workflow-name}/ following patterns in agent-github-pr-manager/ (.agents/skills/agent-{workflow-name}/SKILL.md)
  2. Define GitHub API endpoints, event triggers, and state management in SKILL.md (.agents/skills/agent-{workflow-name}/SKILL.md)
  3. Integrate with agent-multi-repo-swarm for coordinated multi-repository execution if needed (.agents/skills/agent-multi-repo-swarm/SKILL.md)
  4. Register workflow in .agents/config.toml and add necessary OAuth/token configuration (.agents/config.toml)

Add Performance Optimization for a Bottleneck

  1. Profile the bottleneck using agent-performance-benchmarker and agent-performance-analyzer (.agents/skills/agent-performance-benchmarker/SKILL.md)
  2. Create optimization skill in .agents/skills/agent-optimization-{target}/ referencing agent-performance-optimizer patterns (.agents/skills/agent-performance-optimizer/SKILL.md)
  3. Implement caching, parallelization, or algorithmic improvements with monitoring via agent-performance-monitor (.agents/skills/agent-performance-monitor/SKILL.md)
  4. Register optimization in .agents/config.toml and validate improvement with benchmarks (.agents/config.toml)

πŸ”§Why these technologies

  • Claude API + Codex Integration β€” Enables intelligent code generation, analysis, and multi-agent reasoning with state-of-the-art LLM capabilities.
  • Agent Skill Framework (.agents/skills) β€” Modular, composable architecture allows rapid addition of new coordination and domain-specific agents.
  • TOML Configuration β€” Human-readable centralized config supports complex swarm topologies, coordination strategies, and runtime parameters.
  • Distributed Coordination Patterns (Gossip, CRDT, Raft, Byzantine) β€” Ensures reliability, fault-tolerance, and consensus in autonomous multi-agent swarms without single points of failure.
  • Adaptive Memory System β€” Preserves context across agent interactions and enables self-learning by persisting patterns and decisions.

βš–οΈTrade-offs already made

  • Multi-agent coordination over centralized orchestration

    • Why: Enables autonomous, self-healing swarms that scale horizontally and survive component failures.
    • Consequence: Increased complexity in state synchronization and consensus management; potential consistency windows during coordinator failure.
  • Multiple coordination strategies (hierarchical, gossip, consensus, adaptive) coexisting

    • Why: Allows optimization for different problem domains (latency-sensitive, consistency-critical, discovery-heavy).
    • Consequence: Developers must understand multiple patterns; potential inefficiency if wrong strategy is chosen for a use case.
  • LLM-driven agent behavior with deterministic fallbacks

    • Why: Leverages Claude's reasoning while maintaining predictability via skill-based contracts.
    • Consequence: API rate limits and latency from Claude calls; cache strategies essential for performance.
  • Skill modularization with decoupled SKILL.md documentation

    • Why: Enables rapid prototyping and skill composition without core framework changes.
    • Consequence: Skill integration complexity grows; governance needed to prevent incompatible interface evolution.

🚫Non-goals (don't propose these)

  • Does not provide built-in real-time streaming UI (relies on external flo.ruv.io and goal.ruv.io frontends).
  • Does not handle persistent database storage (focuses on in-memory and coordinated state; storage integration deferred to skills).
  • Does not provide native authentication/authorization (delegates to external systems or skill implementations).
  • Does not guarantee global real-time consistency across all agents (acknowledges CAP theorem trade-offs; eventual consistency model).
  • Not a serverless/FaaS platform (assumes agent runtime environment is pre-provisioned).

πŸͺ€Traps & gotchas

Claude API key must be configured (likely via .env file, not shown in file list). .agents/config.toml syntax follows TOML spec but custom schema details are undocumentedβ€”check existing examples. Rust components require cargo alongside npm; ensure Rust toolchain installed if building from source. Skills in .agents/skills/ may have different activation/licensing models (check individual SKILL.md files). PostgreSQL backend assumed for production; development may require local postgres running. Svelte frontend build may require node-sass or specific Node version.

πŸ—οΈArchitecture

πŸ’‘Concepts to learn

  • CRDT (Conflict-free Replicated Data Type) β€” Ruflo uses CRDTs (agent-crdt-synchronizer) for distributed state consistency across swarms without central coordination; essential for understanding eventual consistency in multi-agent systems
  • Byzantine Fault Tolerance β€” Agent-byzantine-coordinator implements BFT consensus allowing swarms to reach agreement even with faulty/malicious agents; critical for resilient autonomous systems
  • Adaptive Memory / Experience Replay β€” Ruflo's 'adaptive memory' feature (mentioned in main description) allows agents to learn from prior interactions; necessary for self-learning swarm intelligence
  • Retrieval-Augmented Generation (RAG) β€” Ruflo integrates RAG to ground agent responses in external knowledge sources; prevents hallucination in production agentic systems
  • Swarm Intelligence / Collective Intelligence β€” Core metaphor of Ruflo (agent-collective-intelligence-coordinator); models emergent problem-solving from agent interactions without central planning
  • Plugin Architecture / Skill-Based System β€” Ruflo's 50+ skills in .agents/skills/ follow plugin pattern; enables extensibility and composition without monolithic codebase
  • Function Calling / Tool Use β€” Claude agents invoke skills (analogous to tool calling) via orchestrated function invocations; central to autonomous agent decision-making in Ruflo
  • anthropics/anthropic-sdk-python β€” Official Anthropic Python SDK for Claude API; Ruflo wraps Claude APIs but users may need raw SDK access for custom integrations
  • run-llm/runllm β€” Alternative agentic framework focused on structured task execution; differs from Ruflo's swarm coordination emphasis but solves similar multi-agent orchestration
  • langchain-ai/langchainjs β€” LangChain JavaScript bindings enable agent building blocks; complementary to Ruflo for RAG and tool integration
  • autogpt-js/autogpt-js β€” Brings AutoGPT patterns to JavaScript/TypeScript; similar multi-step reasoning but Ruflo adds swarm orchestration and Claude-specific integration
  • ruvnet/claude-flow β€” Predecessor or sister project (mentioned in GitHub star badge); likely earlier iteration of agent coordination concepts now in Ruflo

πŸͺ„PR ideas

To work on one of these in Claude Code or Cursor, paste: Implement the "<title>" PR idea from CLAUDE.md, working through the checklist as the task list.

Create comprehensive SKILL.md template and validation schema for agent skills

The repo has 50+ agent skills (e.g., agent-code-review-swarm, agent-byzantine-coordinator, agent-crdt-synchronizer) each with a SKILL.md file, but there's no visible master template or schema. This causes inconsistency across skill documentation. A new contributor could create a canonical SKILL.md template with required sections (inputs, outputs, parameters, examples, error handling) and a validation script that checks all skills conform to it.

  • [ ] Create .agents/SKILL_TEMPLATE.md with standardized sections (Purpose, Inputs/Outputs, Configuration, Error Handling, Example Usage, Dependencies)
  • [ ] Create .agents/scripts/validate-skills.js to parse all SKILL.md files and report missing sections
  • [ ] Document findings in .agents/README.md with a 'Skill Development Guide' section
  • [ ] Update 3-5 existing SKILL.md files (e.g., agent-code-review-swarm, agent-consensus-coordinator) to match template as examples

Add agent skill integration tests and CLI validation suite

With 50+ specialized agent skills (coordinator patterns, code analyzers, memory systems, swarm orchestration), there's no visible test suite validating that skills load correctly, have valid config, and execute without errors. A new contributor could create integration tests that exercise skill initialization and basic operation.

  • [ ] Create .agents/tests/skill-loader.test.js to verify each skill in .agents/skills/* loads without config errors
  • [ ] Create .agents/tests/skill-manifest.test.js to validate agent-* folder naming conventions and required files (SKILL.md exists, config is parseable)
  • [ ] Add CLI command scripts/test-skills.js that runs all tests and outputs a skills health report
  • [ ] Integrate into GitHub Actions workflow (add .github/workflows/skill-validation.yml)

Document the agent skill dependency graph and swarm coordination patterns

The skill names (agent-byzantine-coordinator, agent-consensus-coordinator, agent-hierarchical-coordinator, agent-gossip-coordinator, agent-mesh-coordinator, agent-crdt-synchronizer) suggest complex inter-agent dependencies and coordination strategies, but there's no documented graph or pattern guide. A new contributor could create a visual dependency map and pattern documentation.

  • [ ] Create .agents/COORDINATION_PATTERNS.md documenting when to use each coordinator (hierarchical vs mesh vs gossip vs byzantine vs consensus)
  • [ ] Parse .agents/skills/*/SKILL.md files to extract explicit dependencies and create .agents/dependency-graph.json
  • [ ] Generate .agents/SKILL_MATRIX.md showing a compatibility matrix: which skills work together (e.g., which coordinators pair with which analyzers)
  • [ ] Add a visual diagram in README linking to pattern docs (reference the Live Agents page pattern)

🌿Good first issues

  • Add TypeScript strict type checking to the agent skill plugin interface: many SKILL.md files lack type definitions for skill configuration payloads and return types. Create a shared types package and export from each skill.
  • Document the SKILL.md markdown schema in a central .agents/SKILL_SCHEMA.md file: currently each skill has its own format. Standardize and provide a template to reduce variance and enable automatic skill discovery tooling.
  • Build missing unit tests for coordinator skills: agent-*-coordinator directories lack visible test files. Add vitest/jest tests for Byzantine coordinator consensus, CRDT synchronization, and adaptive coordination edge cases.

⭐Top contributors

Click to expand

πŸ“Recent commits

Click to expand
  • b742369 β€” docs(adr): ADR-154 β€” @metaharness/kernel platform binaries gap (ruvnet)
  • a56f021 β€” docs(adr): ADR-153 β€” @metaharness/darwin (Darwin Mode) integration (ruvnet)
  • f8fbb00 β€” chore(release): bump 3.12.2 β†’ 3.12.3 (#2395 mock-embedding fix) (ruvnet)
  • 04f4744 β€” fix(memory): reject 128-dim bridge results β€” MCP no longer emits mock embeddings (#2395) (ruvnet)
  • 1b78870 β€” chore(release): bump 3.12.1 β†’ 3.12.2 (ruvnet)
  • 5482fe7 β€” Merge pull request #2387 from ruvnet/dependabot/npm_and_yarn/v3/claude-flow/browser/types/node-20.19.43 (ruvnet)
  • da72b97 β€” Merge pull request #2385 from ruvnet/dependabot/npm_and_yarn/v3/claude-flow/browser/vitest-4.1.9 (ruvnet)
  • 11fee2a β€” Merge pull request #2383 from ruvnet/dependabot/npm_and_yarn/plugins/ruflo-graph-intelligence/vitest-4.1.9 (ruvnet)
  • 774c6e2 β€” Merge pull request #2397 from tjaiyen/harden-helpers-upstream (ruvnet)
  • 82331a8 β€” Merge pull request #2408 from ruvnet/fix/2407-daemon-race (ruvnet)

πŸ”’Security observations

  • High Β· Exposed Web UI and API Endpoints β€” README.md - Public documentation. The README reveals multiple publicly accessible web endpoints (flo.ruv.io, goal.ruv.io, goal.ruv.io/agents) without documented authentication mechanisms. This suggests potential unauthorized access to agent management interfaces and APIs. Fix: Implement mandatory authentication (OAuth2, API keys, JWT) for all web endpoints. Document security requirements clearly. Consider IP whitelisting and rate limiting.
  • High Β· Missing Dependency Audit Information β€” Root directory - Missing dependency files. No package.json, requirements.txt, or dependency lock files were provided for analysis. The codebase appears to have significant npm ecosystem usage (8.1M+ downloads), but dependency vulnerabilities cannot be verified. Fix: Provide and audit all dependency files (package.json, package-lock.json, yarn.lock). Run npm audit, yarn audit, or equivalent regularly. Implement automated dependency scanning in CI/CD.
  • High Β· Multi-Agent Architecture Security Model Undefined β€” .agents/skills/agent-byzantine-coordinator/, .agents/skills/agent-mesh-coordinator/, .agents/skills/agent-gossip-coordinator/. The architecture includes multi-agent coordination, Byzantine coordinators, and mesh/gossip protocols, but no explicit security boundaries, inter-agent authentication, or authorization framework is documented. Fix: Implement mutual TLS (mTLS) for agent-to-agent communication. Define clear authorization policies (e.g., RBAC). Validate all inter-agent messages. Document security assumptions for Byzantine fault tolerance.
  • High Β· No Visible Secrets Management β€” .agents/config.toml and payment-related agents. The codebase includes payment processing (agent-agentic-payments, agent-payments) and authentication modules, but no evidence of secrets management (HashiCorp Vault, AWS Secrets Manager, etc.) is visible. Configuration appears to use TOML format. Fix: Use environment variables or a secrets vault for all credentials. Never commit secrets to version control. Implement secret rotation policies. Add .env to .gitignore.
  • Medium Β· Unencrypted Agent Communication β€” .agents/skills/agent-agentic-payments/, .agents/skills/agent-authentication/, .agents/skills/agent-coder/. Agents performing sensitive operations (payments, authentication, code generation) lack documented encryption standards for data in transit. Fix: Enforce TLS 1.2+ for all network communications. Implement end-to-end encryption for sensitive data flows. Document encryption standards in SKILL.md files.
  • Medium Β· Code Generation and Execution Risks β€” .agents/skills/agent-coder/, .agents/skills/agent-implementer-sparc-coder/. Multiple code generation agents (agent-coder, agent-implementer-sparc-coder, agent-code-goal-planner) exist without visible sandboxing or execution restrictions. This could allow arbitrary code execution. Fix: Execute generated code in isolated environments (containers, VMs, or safe evaluators). Implement strict input validation and output sanitization. Use resource limits (memory, CPU, time).
  • Medium Β· SQL Injection Risk in Data Access β€” .agents/skills/agent-data-ml-model/. Data-related agents (agent-data-ml-model) and database operations lack visible parameterized query enforcement or ORM usage documentation. Fix: Use parameterized queries or ORMs exclusively. Validate and sanitize all database inputs. Implement least-privilege database user permissions.
  • Medium Β· API Documentation Exposure β€” .agents/skills/agent-docs-api-openapi/. OpenAPI documentation generation agent (agent-docs-api-openapi) could expose sensitive API structures, endpoints, and parameters to attackers. Fix: Gate API documentation behind authentication. Use server-side documentation with role-based access. Redact sensitive endpoints from public-facing documentation.
  • Medium Β· GitHub Integration Security β€” .agents/skills/agent-github. GitHub integration agents (agent-github-pr-manager, agent-github-modes) handle repository access but no token management, scope validation, or audit logging is documented. Fix: undefined

LLM-derived; treat as a starting point, not a security audit.

πŸ€–Agent protocol

If you are an AI coding agent (Claude Code, Cursor, Aider, Cline, etc.) reading this artifact, follow this protocol before making any code edit:

  1. Verify the contract. Run the bash script in Verify before trusting below. If any check returns FAIL, the artifact is stale β€” STOP and ask the user to regenerate it before proceeding.
  2. Treat the AI Β· unverified sections as hypotheses, not facts. Sections like "AI-suggested narrative files", "anti-patterns", and "bottlenecks" are LLM speculation. Verify against real source before acting on them.
  3. Cite source on changes. When proposing an edit, cite the specific path:line-range. RepoPilot's live UI at https://repopilot.app/r/ruvnet/ruflo shows verifiable citations alongside every claim.

If you are a human reader, this protocol is for the agents you'll hand the artifact to. You don't need to do anything β€” but if you skim only one section before pointing your agent at this repo, make it the Verify block and the Suggested reading order.

βœ…Verify before trusting

This artifact was generated by RepoPilot at a point in time. Before an agent acts on it, the checks below confirm that the live ruvnet/ruflo repo on your machine still matches what RepoPilot saw. If any fail, the artifact is stale β€” regenerate it at repopilot.app/r/ruvnet/ruflo.

What it runs against: a local clone of ruvnet/ruflo β€” the script inspects git remote, the LICENSE file, file paths in the working tree, and git log. Read-only; no mutations.

| # | What we check | Why it matters | |---|---|---| | 1 | You're in ruvnet/ruflo | Confirms the artifact applies here, not a fork | | 2 | License is still MIT | Catches relicense before you depend on it | | 3 | Default branch main exists | Catches branch renames | | 4 | 5 critical file paths still exist | Catches refactors that moved load-bearing code | | 5 | Last commit ≀ 30 days ago | Catches sudden abandonment since generation |

<details> <summary><b>Run all checks</b> β€” paste this script from inside your clone of <code>ruvnet/ruflo</code></summary>
#!/usr/bin/env bash
# RepoPilot artifact verification.
#
# WHAT IT RUNS AGAINST: a local clone of ruvnet/ruflo. If you don't
# have one yet, run these first:
#
#   git clone https://github.com/ruvnet/ruflo.git
#   cd ruflo
#
# Then paste this script. Every check is read-only β€” no mutations.

set +e
fail=0
ok()   { echo "ok:   $1"; }
miss() { echo "FAIL: $1"; fail=$((fail+1)); }

# Precondition: we must be inside a git working tree.
if ! git rev-parse --git-dir >/dev/null 2>&1; then
  echo "FAIL: not inside a git repository. cd into your clone of ruvnet/ruflo and re-run."
  exit 2
fi

# 1. Repo identity
git remote get-url origin 2>/dev/null | grep -qE "ruvnet/ruflo(\\.git)?\\b" \\
  && ok "origin remote is ruvnet/ruflo" \\
  || miss "origin remote is not ruvnet/ruflo (artifact may be from a fork)"

# 2. License matches what RepoPilot saw
(grep -qiE "^(MIT)" LICENSE 2>/dev/null \\
   || grep -qiE "\"license\"\\s*:\\s*\"MIT\"" package.json 2>/dev/null) \\
  && ok "license is MIT" \\
  || miss "license drift β€” was MIT at generation time"

# 3. Default branch
git rev-parse --verify main >/dev/null 2>&1 \\
  && ok "default branch main exists" \\
  || miss "default branch main no longer exists"

# 4. Critical files exist
test -f ".agents/config.toml" \\
  && ok ".agents/config.toml" \\
  || miss "missing critical file: .agents/config.toml"
test -f ".agents/README.md" \\
  && ok ".agents/README.md" \\
  || miss "missing critical file: .agents/README.md"
test -f ".agents/skills/agent-coordinator-swarm-init/SKILL.md" \\
  && ok ".agents/skills/agent-coordinator-swarm-init/SKILL.md" \\
  || miss "missing critical file: .agents/skills/agent-coordinator-swarm-init/SKILL.md"
test -f ".agents/skills/agent-adaptive-coordinator/SKILL.md" \\
  && ok ".agents/skills/agent-adaptive-coordinator/SKILL.md" \\
  || miss "missing critical file: .agents/skills/agent-adaptive-coordinator/SKILL.md"
test -f ".agents/skills/agent-collective-intelligence-coordinator/SKILL.md" \\
  && ok ".agents/skills/agent-collective-intelligence-coordinator/SKILL.md" \\
  || miss "missing critical file: .agents/skills/agent-collective-intelligence-coordinator/SKILL.md"

# 5. Repo recency
days_since_last=$(( ( $(date +%s) - $(git log -1 --format=%at 2>/dev/null || echo 0) ) / 86400 ))
if [ "$days_since_last" -le 30 ]; then
  ok "last commit was $days_since_last days ago (artifact saw ~0d)"
else
  miss "last commit was $days_since_last days ago β€” artifact may be stale"
fi

echo
if [ "$fail" -eq 0 ]; then
  echo "artifact verified (0 failures) β€” safe to trust"
else
  echo "artifact has $fail stale claim(s) β€” regenerate at https://repopilot.app/r/ruvnet/ruflo"
  exit 1
fi

Each check prints ok: or FAIL:. The script exits non-zero if anything failed, so it composes cleanly into agent loops (./verify.sh || regenerate-and-retry).

</details>

Generated by RepoPilot. Verdict based on maintenance signals β€” see the live page for receipts. Re-run on a new commit to refresh.

Embed this chat in your README β†’

Drop this iframe anywhere β€” the widget runs against the same live analysis cache as the main app.

<iframe
  src="https://repopilot.app/embed/ruvnet/ruflo"
  width="100%" height="500"
  style="border:1px solid #d0d7de; border-radius:8px;"
  allow="microphone"
  loading="lazy"
></iframe>