v3.42.0 — Swarm, Memory & Security Reliability Batch

This release lands 14 fixes produced by Ruflo's own nightly "Dream Cycle" research pipeline — each one found a real bug or gap in the codebase, built a fix, proved it with before/after tests, and (in several cases) survived an independent adversarial review before merging. Nothing here is speculative: every change below has a passing regression test that failed before the fix and passes after it.

What's new for you

🐝 Swarm consensus actually uses trust weights now

When multiple agents vote on a decision, Ruflo has long computed a "trust weight" for each voter — but that number was silently discarded before it ever reached the vote count. Every strategy (Raft, Byzantine, gossip) was voting as if every agent were equally trustworthy. Now the weight is actually used, so a vote from an agent with a strong track record counts for more than a vote from an untested one.

🔍 Vector search is faster and more accurate

• HNSW product-quantization (a memory-compression technique for embeddings) was built and tested but never actually wired into the search path — searches were running on meaningless data. It's now dispatched correctly, more than doubling search accuracy (recall) in our benchmark.
• MMR re-ranking (used to diversify search results so you don't get 10 near-duplicate hits) was re-tokenizing every candidate on every pass, even when it didn't need to. It's now ~6x faster with byte-identical results.
• Memory deduplication used to only catch exact byte-for-byte duplicates. It now also catches near-duplicates (paraphrases, reformatted text) using the embeddings Ruflo already computes — no extra cost, same-quality matching.
• Fixed a bug where a memory pattern's retrieval score (how well it matched your query) was overwriting its learned reliability (how trustworthy that pattern has proven to be over time) — which meant the "only trust high-confidence patterns" safety check was silently checking the wrong number.

🔐 Security hardening

• MCP tool governance is now enforceable. Ruflo has shipped a governance policy file (audit logging, per-session call limits) for a while, but nothing in the running server ever actually read it. It's now wired in as an opt-in flag (RUFLO_MCP_ENFORCE_POLICY=1) — off by default, so nothing changes unless you turn it on.
• The call-limit for that policy now resets properly. It used to be a lifetime cap that, once hit, locked a session out permanently until restart. It's now a rolling time window, matching how every other rate limiter (Cloudflare's, etc.) does it.
• Hive-mind voting can no longer be Sybil-attacked. Previously, any caller could cast a vote under a made-up agent name and it would count toward quorum — meaning one caller could out-vote everyone else with fabricated identities. Votes are now checked against the actual roster of agents that joined the hive.
• Joining or leaving a hive-mind now requires proof you're allowed to. This closes the gap the vote-fix above left open — previously anyone could add or remove "members" from a hive-mind with no credentials at all. It's now capability-token-gated: hive-mind_init mints a token, and only callers holding it can join, leave, or vote. Existing CLI usage (ruflo hive-mind join/leave/consensus) keeps working automatically — the CLI reads the token for you.
• Identity verification is properly bound in. A signed-identity check (Ed25519) that existed in the codebase but wasn't actually being used to authorize MCP tool calls is now live at the real chokepoint.

🧠 Learning that actually learns

• Ruflo's reward-based learning loop was rewarding every completed task the same fixed amount, regardless of whether it went well or poorly — so the system couldn't actually distinguish good outcomes from bad ones. It now reads the real, per-outcome confidence and adjusts accordingly.
• A related EWC ("don't forget old lessons while learning new ones") gate was only checking 1 of 384 signal dimensions due to a data-shape mismatch. It now correctly weighs the full signal.
• A pooled-agent health check was resetting its own "last healthy" timestamp on every check — which meant an agent could never actually be detected as unhealthy, because the check was always refreshing its own evidence.

🧹 Housekeeping

• Removed ~375 lines of dead code (an unused vector-index backend) and corrected a stale, unverifiable "150,000x faster" performance claim in the docs Ruflo generates for new projects — it now points to a runnable benchmark instead.

Upgrading

:::bash
npx ruflo@latest --version   # should print 3.42.0
# or, if you use the scoped packages directly:
npx @claude-flow/cli@latest --version
npx claude-flow@latest --version

No action needed for most users — everything above is either an internal correctness fix or opt-in. The one behavior change that could affect you if you use hive-mind's MCP tools directly (not through the ruflo CLI) is the new hiveToken requirement for hive-mind_join, hive-mind_leave, and voting — call hive-mind_init first and pass along the token it returns.

🤖 Generated with RuFlo