ruflo updates — week of 2026-09-13 (57 new commits, tip b02c0cace)

[github-actions]

ruvnet/ruflo — last 7 days

Window: since 2026-09-06 · Upstream tip: b02c0cace

feat (10)

• b329f0937 feat(gateway): OAuth 2.1 on x.ruv.io/mcp, and no credentials as tool arguments (ruv)
• 25d471800 feat(federation): log the auth mode per call, without token material (ruv)
• 51f3a0a22 feat(federation): OAuth 2.1 resource server, and retract the Cloud Run header claim (ruv)
• 506b3b90e feat(federation): give ChatGPT Federation its own key and its own relay connection (ruv)
• 8485302f1 feat(x-gateway): 0.6.1 — bound Seraphina by budget instead of an admin token (#3275) (rUv)
• a64f8b1ad feat(x-gateway): declare default channels so a quiet one is still discoverable (#3274) (rUv)
• 90bff10f1 feat(x-gateway): public and private swarm channels (ADR-386) (#3261) (rUv)
• dbf450a92 feat(federation): ruflo CLI + MCP integration for x.ruv.io, and Seraphina (swarm queen) (#3256) (rUv)
• 6396ff636 feat(x-gateway): open Nostr swarm federation gateway — MCP + ruv:// + ws proxy (deployed at x.ruv.io) (#3255) (rUv)
• 72df96c29 feat(agentbbs): cross-host federation — signed envelopes, pinned peers, union merge (#3251) (rUv)

fix (22)

• b02c0cace fix(gateway): align review hints with irreversible sends (#3308) (rUv)
• e7aa82b52 fix(plugin): add ChatGPT federation manifest (ruvnet)
• 2821d7bb7 fix(x-gateway): tools declared themselves destructive, and relay text reached the model unlabelled (#3300) (rUv)
• 19e7b32e2 fix(gateway): a refused write names the cause instead of blaming the admin token (ruv)
• d423bd3a6 fix(gateway): tool descriptions that tell the truth about authorisation (ruv)
• 40c1744ec fix(gateway): three bugs that made ChatGPT connector setup fail after sign-in (ruv)
• 005dbf186 fix(federation): point the 401 challenge at the metadata for the requested path (ruv)
• 62609d77a fix(federation): CORS preflight and the RFC 9728 resource identifier (ruv)
• 4bb9ca182 fix(x-gateway): claims reducer honours ttlSeconds — expired leases free the resource (#3292) (rUv)
• 7013988bb fix(federation): make the client-existence probe actually distinguish anything (ruv)
• 3bd12277c fix(federation): bind the access token to the client_id, not the resource URL (ruv)
• f29945e58 fix(federation): name the reason when an unbound access token is refused (ruv)
• 8666c5d74 fix(federation): pin the signing-key version and refuse an unexpected identity (ruv)
• 13880e3aa fix(memory,daemon): stop destroying a user index, honour autoStart:false, and finish the sibling disclosure (#3282) (rUv)
• 2b40aee07 fix(seraphina): stop reporting a truncated reasoning dump as coordination guidance (#3267) (rUv)
• e6f116b5c fix(memory): honour an explicit database path, and stop counting one store as if it were all of them (#3196) (#3271) (rUv)
• 6f29819fe fix(metaharness): bump the darwin pin to 0.10.2 so pin-drift and clean-install go green on main (#3262) (rUv)
• e111bfbd7 fix(memory,tests): restore memory search recall and green the CLI suite (69 → 0) (#3252) (rUv)
• 07f1cf3a3 fix(agentbbs-tools): detect the real CLI-only agentbbs package instead of a nonexistent JS import (#3250) (rUv)
• 498a23879 fix(security): make the fast-uri CVE fix actually reach shipped packages (#3222) — 3.39.2 (#3247) (rUv)
• d55b1bfea fix(memory): stop reporting a gated native bridge as the active backend (#3228) + fast-uri CVE (#3245) (rUv)
• ea2df4726 fix(flywheel): encode candidatePolicy fractions as decimal strings (#3229) (#3235) (rUv)

docs (9)

• 39e0b0540 docs(protocol): publish ANS and Nostr federation governance draft (#3299) (rUv)
• 6814b513d docs(adr): ADR-387 ChatGPT Federation connector, ADR-388 OAuth on x.ruv.io (ruv)
• 6f6824672 docs(federation): record the client-id audience binding and the two traps around it (ruv)
• 9576a1032 docs(federation): teach the skills and gateway docs about channels (#3263) (rUv)
• bd5e22441 docs(ruflo-explained): add federation section — open swarm at x.ruv.io, claims, Seraphina, join flow (ruv)
• ac08e4e02 docs(plugins,skills): surface v3.40.0 cross-host federation + claims (#3254) (rUv)
• a295c6870 docs: replace RuFlo Explained visuals with the source renders (ruvnet)
• 4f77741d9 docs: add RuFlo Explained guide with chapter visuals, link from README (ruvnet)
• 674581294 docs: add Cognitum Media showcase and link it from the README (ruvnet)

chore (8)

• 005a0ed25 chore(x-gateway): 0.7.1 — version label for the claims TTL fix (#3293) (rUv)
• df87b0db3 chore(release): 3.41.2 — memory index protection, daemon consent, sibling disclosure (#3283) (rUv)
• cda8b04f6 chore(release): 3.41.1 — memory path identity and Seraphina truncation (#3273) (rUv)
• cb10bf617 chore(release): 3.41.0 — open swarm federation CLI/MCP, channels, Seraphina (ruv)
• 2629de628 chore(release): 3.39.3 -> 3.40.0 (ruv)
• e855ae2e4 chore(release): 3.39.2 -> 3.39.3 (ruvnet)
• e341ec8c4 chore(release): 3.38.23 -> 3.39.0 (ruv)
• 384b92398 chore(release): 3.38.21 -> 3.38.23 (ruvnet)

test (3)

• c6b825897 test(federation): make e2e correct in the enforced world (ruv)
• 5900dc568 test(federation): repeatable post-deployment e2e for the connector (ruv)
• d9934d55b test(federation): assert the stated acceptance bar for the three token classes (ruv)

other (5)

• 3949f9c50 Merge pull request #3285 from ruvnet/feat/chatgpt-federation-publisher (rUv)
• a598851dc Merge main and restore OAuth on the ChatGPT MCP profile (ruvnet)
• 40878cca3 dream(swarm): #3242 fix AgentPool health checks that could never detect a dead agent (evaluated, ACCEPT-scoped) (#3243) (rUv)
• 7d76560a1 Revert "docs: add Cognitum Media showcase and link it from the README" (ruvnet)
• 6acc68915 dream(intelligence): #3220 gate EnhancedModelRouter's forwarded modelId on tier match (evaluated, ACCEPT-scoped) (#3221) (rUv)

---

Inspect a commit: git fetch upstream && git show <sha>
Diff a path: git diff upstream/main -- path/to/file
Port a commit: git cherry-pick <sha> (expect conflicts — no shared history)