v3.56.0 - hardening and correctness batch

Minor release. Several fixes change behaviour on purpose; they are listed first. Integrated by merging each PR head, so authorship is preserved. Packages: @claude-flow/cli, claude-flow, ruflo 3.56.0 (tags latest, alpha, v3alpha), plus @claude-flow/memory 3.0.2 and @claude-flow/security 3.0.3 published standalone first.

Behaviour changes (read these)

• Unknown ids and value-less options are errors (#3911, @martinvlad). agent status / task status with an unknown id print "not found" and exit 1. A declared string/number option given no value (for example hooks route --task) now reports Option --task needs a value instead of silently becoming true. Applies to every command.
• Sessions (#3489, [#3490], @rudycelekli). session_save captures the persisted task, agent and legacy memory stores by default (explicit false still excludes). session_import rejects malformed stores before saving and derives counts from the snapshot.
• Backups (#3903). The default project backup snapshots both memory.db and agentdb-memory.db and honors the configured memory directory. --db and a non-blank CLAUDE_FLOW_DB_PATH still select a single file.
• Zero values are honored (#3488, [#3496]). Scaling an agent pool to 0 no longer creates five workers; invalid targets fail before writing; a zero fallback retry budget is respected.
• Path validators (#3504, @claude-flow/security 3.0.3). Sensitive directory names are blocked anywhere under the project root, not only at the leaf, and the blocked-extension check also applies to synchronous validation.
• OAuth callback server (#3507, @claude-flow/security 3.0.3). Retains an early callback and ignores unrelated requests.
• Providers (#3493, [#3494], [#3495]). An explicit execution provider is honored; Anthropic gateway credentials and endpoint (ANTHROPIC_AUTH_TOKEN, ANTHROPIC_BASE_URL) are used (fixes [#3100]); timeouts cover reading the response body.
• Routing (#3904, [#3498]). hooks_route now consults persisted SONA outcome patterns before local routing: only a supported agent at confidence >= 0.6 is used, and useSemanticRouter: false keeps keyword routing. With the opt-in neural router, model selection uses calibrated quality predictions, so calibration can move a pick across the quality bar.
• WAL gate (#3894, @nicholas-ruest; fixes [#3161]). Leftover -wal/-shm files from a closed connection no longer block memory store/list; a genuinely open holder is still refused.
• ruflo init no longer pins a Claude model (#3528, @HF-teamdev; fixes [#3527]).
• ruflo wrapper (#3438). Pins the matching @claude-flow/cli and prints a warning if the resolved CLI version differs. It warns and continues; it does not refuse to run. Fixes [#3306].
• Claims (#3502). CLI and MCP share one lossless claims.json format; unreadable or malformed stores are refused rather than replaced.
• Native immutable conditional append (#3750, @stuinfla). New memory store flags --append-only, --append-conditions, --require-native, --no-embedding. Additive, CLI only.

Fixes

• Shipped .claude/settings.json had unescaped quotes in hook commands and did not parse (#3895, fixes [#3888], @nicholas-ruest). A new test checks that every shipped settings/plugin JSON file parses.
• Remaining better-sqlite3 opens use the shared loader (#3896, @nicholas-ruest; supersedes [#3884] by @drakeo338); RFE1-encrypted stores are reported as encrypted, not broken (#3906, fixes [#2889], @nicholas-ruest); the demo plugin-registry fallback is labelled as unverified (#3897, @martinvlad).
• analyze preserves machine-readable JSON (#3910); doctor rejects unsupported component selections (#3907) and loads MetaHarness via file URLs on Windows (#3523, fixes [#3186]); daemon start honors explicit workers (#3586).
• Unreadable task/agent records are preserved (#3484); async registry updates do not revive retired agents (#3492); fallback learning is attributed per attempted model (#3497).
• Workflow step boundaries are validated (#3491); persisted workflows resume without duplicate executors (#3500) and keep control signals and sibling state across awaits (#3505).
• Memory JSON import reports rejected writes accurately (#3499); export reads all pages only after successful reads (#3501); concurrent rotating-token refreshes coalesce (#3506).
• Test fixtures isolate pnpm's NODE_PATH (#3543, fixes [#3529], @HF-teamdev's report).
• @claude-flow/memory 3.0.2: cache admission accounts for replacement sizes (#3679, fixes [#3678]); invalidation matches each key independently (#3687, fixes [#3686]).
• Handlebars lock entries moved to 4.7.10 after new critical advisories against 4.7.9 (dev tooling only).
• An empty .claude/agents/tmp.json no longer ships in the CLI tarball.

Contributors: @rudycelekli, @nicholas-ruest, @martinvlad, @HF-teamdev, @drakeo338, @stuinfla. Thank you.

Not included, and why

• [#3503] (fail-closed policy envelope): on the real MCP dispatch path nothing supplies cost/token/concurrency, so any envelope with a ceiling would deny every tool call; its own updated test shows concurrency-outside-envelope. Needs the dispatcher to supply metering.
• [#3892] (policy ledger retention): default policy verify would stop covering the archive; needs the archive tip anchored or cross-checked, and the home mirror handled.
• [#3831] (embedding cache dir): needs a rebase and half of it targets @claude-flow/embeddings, which cannot be published from main.
• [#3694] (configurable MCP rate limits): needs a ceiling for non-loopback binds.

• 3879/#3622/#3476 (EWC), [#3835], [#3751], [#3909], [#3905], [#3690], [#3776]: drafts or decisions pending.

Verification

Full CLI suite 5408 passed (4 failures that reproduce identically on unmodified main in the release environment), security 611/611, memory suite passes, ruflo wrapper test, umbrella lockstep and leaf audits, witness manifests 117/117 on linux/macos/windows, pnpm frozen install passes the new lockfile and fails the old one.

Release PR [#3916]: 120 CI checks passed on the final head (3 skipped). Registry check after publish: latest, alpha and v3alpha all point at 3.56.0 for @claude-flow/cli, claude-flow and ruflo; a clean npx ruflo@latest --version reports v3.56.0 with memory 3.0.2 and security 3.0.3, and mcp start -t http --host 0.0.0.0 refuses without a token.