ruflo updates — week of 2026-09-06 (9 new commits, tip 277c7bc03)

[github-actions]

ruvnet/ruflo — last 7 days

Window: since 2026-08-30 · Upstream tip: 277c7bc03

fix (4)

• 4dcfa0fad fix(aidefence): bound two ReDoS patterns, stateless PII regexes, O(P) confidence pass (#3177) (rUv)
• efadf92b9 fix(ci): add v3/@claude-flow/mcp to the root npm workspaces so npm ci resolves the unpublished alpha.10 pin (#3203) (rUv)
• b3db01801 fix(test): stop asserting strict-positive task duration in agentic-flow-agent tests (#3059) (rUv)
• d413297dd fix(memory): stop seeding the bridge's ControllerRegistry with the sql.js dbPath (ruv)

chore (1)

• db4991967 chore(release): 3.38.20 -> 3.38.21 (ruv)

test (1)

• 66e4a1236 test/hooks: fix two stale main-tree Test Suite failures exposed by #3203 (embedding width; hook-handler exports) (#3204) (rUv)

other (3)

• 277c7bc03 dream(memory): #3168 wire embedding-cosine into SmartRetrieval's MMR step (evaluated, ACCEPT) (#3169) (rUv)
• 33a2c3ed0 dream(performance): #3183 wire real cold-start measurement, remove fabricated V2-vs-V3 benchmark (evaluated, ACCEPT-scoped) (#3184) (rUv)
• 4d0134e59 Merge pull request #3156 from ruvnet/fix/mcp-http-bridge-rehydrate-3155 (rUv)

---

Inspect a commit: git fetch upstream && git show <sha>
Diff a path: git diff upstream/main -- path/to/file
Port a commit: git cherry-pick <sha> (expect conflicts — no shared history)