Ruflo, rUv's stack, and ruv.sgit: where a swarm meets the harness
1. The names
"Ruflow" and "RuFlow" are third-party spellings. The upstream project is Ruflo, formerly Claude Flow, by Reuven Cohen: npm ruflo (also claude-flow and @claude-flow/cli), 3.62.0 published 24 Oct 2026, MIT. The sgit.ai network's integration is ruv.sgit.ai: "a Ruflo hive + sgit vaults + Agent Behaviour Policies", built 14 to 15 October 2026 for Agentic Engineering Live: rUv in London and since 21 October also the site of the ruv.sgit service, with two founding providers, Dinis Cruz and Mondweep Chakravorty. It says of itself: "This is not rUv's offer, and it does not speak for him."
2. rUv's projects, in SHarness terms
| Project | What it is (as published) | Version, date, licence | What matters here |
|---|---|---|---|
| Ruflo | "agent meta-harness for Claude Code and Codex": swarms and a hive-mind (a queen and workers, Raft, Byzantine or gossip consensus), memory, federation, guardrails; 98 agents, 314 MCP tools, 26 CLI commands | 3.62.0, 24 Oct 2026, MIT | the orchestrator the design calls "the harnessed app": it routes, spawns and remembers. Its policy engine (ADR-324) has modes legacy (allow all, the default), observe and enforce, allow/deny/approval rules, budgets and hash-chained receipts; its hooks (tool:pre-call, agent:pre-spawn, file:pre-write, Claude Code PreToolUse and SessionStart) are the plug-in points; its plugins "run with your account's permissions and are not sandboxed" (its README); its hive bootstrap secret is, per its docs, "a speed bump, not a boundary" |
| agentic-flow | a cost-optimal model router, self-learning hooks (pre-command assesses a command's risk before Bash), 213 MCP tools | 2.1.4, 9 Oct 2026, MIT | hooks as routing: the same shape as Agents §2 |
| ruv-swarm | Rust and WASM neural swarm orchestration with an MCP server | 1.0.20, 10 Sep 2025, MIT or Apache-2.0 | the ancestor of Ruflo's swarm commands |
| RuVector | Rust vector and graph memory with a hash-linked witness log, WASM build, MCP server | 0.3.3, 23 Sep 2026, MIT | its README says filters "are not a complete authorization boundary" and recommends treating retrieved context as untrusted: exactly the case for sharness.fs as the sole writer and for the dual-LLM split |
| MetaHarness | mints a harness (CLI, agents, skills, scoped memory, .claude/settings.json permissions) from a repository, with a signed witness manifest | 0.4.17, 26 Sep 2026, MIT | a generator of the agent's own settings: a Setting, in ABP's terms, that a PBP could be compiled into and a launcher could make a Boundary |
| RVM | a bare-metal Rust microhypervisor for agents: capability tokens with seven rights (READ, WRITE, GRANT, REVOKE, EXECUTE, PROVE, GRANT_ONCE) and monotonic attenuation | no release stated; Apache-2.0 or MIT | the closest thing in rUv's stack to a kernel-enforced boundary; ruv.sgit's POC3 maps ABP rows to its rights and finds them "coarser than ABP primitives" |
| flow-nexus | a hosted platform: cloud sandboxes, swarms, credits | 0.1.128, 18 Sep 2025; npm says proprietary | a provider in the outer-boundary row, not verified further |
| SPARC, the ADRs | a method (specification, pseudocode, architecture, refinement, completion) and numbered architecture decision records | method, not a control; ADR-346, a "multi-layer agent security stack", is proposed, not shipped |
Nothing rUv publishes is a kernel-enforced sandbox for the agent process itself, except RVM (bare metal, not used by Ruflo at runtime) and a WASM runtime for untrusted guest agents. That is the gap SHarness fills, and the reason the two stacks fit rather than compete.
3. What ruv.sgit integrated, from its own pages
Two things were added to rUv's stack: a written mandate per agent (an Agent Behaviour Policy, six roles, 36 rows, a vocabulary of 23 verb.object.reach primitives) compiled into Ruflo's policy engine, and agent memory with history, encrypted client-side in sgit vaults, one ephemeral vault per run with a branch per worker, measured at close and then deleted, with a public ledger of runs. Seven proofs of concept:
| POC | What it showed | Result, as published |
|---|---|---|
| 1 | the ABP compiled into Ruflo's engine (36 rules and a budget) and run against 11 traced actions | legacy mode allowed all 11 (legacy-default-allow); enforce mode stopped 6: 4 denied (email.send, network.fetch.world, a tester's file.write, a researcher's credential.read of ~/.aws/credentials), 2 sent for approval (repo.push, deploy); receipts valid, 14 Oct 2026 |
| 2 | Ruflo's memory database per role on a branch per role in a vault, restored on a fresh runner | identical memory list; run locally |
| 3 | the ABP mapped to RVM capability rights | rights coarser than the primitives: "the argument for compiling tokens from a mandate" |
| 4 | a browser app on RuVector's WASM build answering "can the coder send email?" offline | published |
| 5 | MetaHarness's generated settings.json rendered as ABP rows and diffed | 8 of 10 coder rows not covered by the harness |
| 6 | a runbook for a real Ruflo MCP session in observe mode | written, not run (needs a terminal) |
| 7 | the studio: a hierarchical-mesh hive with Byzantine consensus, eight specialists, seven tasks | 31 Ruflo calls in 15.3 s; the workers were Claude Code subagents, not hive-mind work; Ruflo's tamper check fired when a folder was recreated and was not bypassed |
Its own rule for agents working on it is the same as this site's: "Do not weaken a security control to make a demo work." Its runs "were not policy-gated. Enforcement was shown separately, in POC1." And its planned next steps are Ruflo's claims as the allowed-primitives list, compiling CLAUDE.md guidance into a policy bundle, and RuVector allow and deny lists. It does not mention SHarness or Process Behaviour Policies anywhere.
4. Where the two halves meet
Read with ABP's barrier kinds: everything ruv.sgit enforces is enforced by Ruflo, in the agent's own process, under the agent's own uid, with the ledger anchored in the agent's home directory. That is a Setting for the agent (POC1's enforce mode is real, and the same uid could edit the state file). SHarness's job is to make the same 36 rows a Boundary, enforced below the agent, without changing the mandate.
| Point in Ruflo | Today (its documentation; "inferred" where so) | What SHarness adds | How the mandate maps |
|---|---|---|---|
the hooks ruflo init writes into Claude Code's settings, and ruflo-mods' in-process function hooks | routing and learning inside the harness process, unsandboxed | one PreToolUse hook rewriting Bash to sharness-bash-client --profile <p> and checking the policy hash; the launcher, not the hook, stops bypass | execute.process.self with its instances becomes a sharness.bash profile; write.file.project instances become Landlock paths |
| the policy engine (ADR-324): rules on caller-emitted strings, receipts, legacy/observe/enforce | the ABP compiled into it (POC1); a Setting by ABP's own test | a PBP manifest hashed in canonical JSON, supplied out of band, checked by the launcher and by each component; Ruflo's receipts stay as the application audit, SHarness's audit lines carry the hash | the same rows: the ABP is the mandate; Ruflo's rules are layers L4 and L5; kernel and component locks are L1 to L3; the effective policy is the intersection |
| the MCP registry (314 tools, one server process as the harness user) | every MCP server runs with the account's permissions | each MCP server as a harnessed app with its own uid, Landlock, seccomp and certificate; the built-in Bash denied so sharness.bash is the only shell | the pinned tools list, hashed, in the sharness.llm policy; per-tool edges in the manifest |
the spawn path (Task subagents; hive-mind spawn, spawn --claude, hive-mind work, which skip permission prompts by default; nesting to depth 5) | children inherit the parent's uid, environment and keys (inferred) | agent:pre-spawn becomes a request to the launcher: each worker a harnessed process under its own PBP, uid and certificate | one ABP role (queen, coder, tester, reviewer, researcher, documenter) is one PBP; the queen's PBP may request launches and never grant more than its own layer |
API keys (ANTHROPIC_API_KEY in the environment or settings) | visible to the harness, every hook, every MCP server, every subagent (inferred from inheritance) | ANTHROPIC_BASE_URL to sharness.llm, the real key sealed in sharness.kms, a dummy in the agent, the secret filter on tool results, model allowlist, token budget | the ABP's read.credential.host: no, with its barrier "secrets only via the supervisor", becomes a Boundary; write.budget.tenant becomes the llm budget |
memory (.swarm/memory.db, RuVector; a vault per run in ruv.sgit) | SQLite files writable by the agent; RuVector's own README on filters not being a boundary | sharness.fs as the sole writer of the memory folder; vault keys only in sharness.kms, re-sealed to sharness.net | memory:pre-store becomes data; the memory folder is a write.file.project instance; vault ids go in the net policy |
| networking between agents (federation: Ed25519 identities, a trust ladder, optional WireGuard; the hive over stdio or WebSocket) | application-level trust; "network connectivity is the integrator's problem" | sharness.net as the only client, allowlisted hosts and vault ids, an empty namespace for everything else, mutual TLS between components | send.endpoint.allowed instances (npm, PyPI) become the net allowlist; send.endpoint.world: no becomes default-deny egress |
the policy's anchor (Ruflo's ledger under ~/.config; MetaHarness's signed witness manifest) | anchored where the agent can reach | one manifest hash from the person, out of band, or signed by the root key; the launcher refuses mismatches | the ABP's owner and valid_until ride along; the hash covers the session CA |
5. A swarm under the harness
A Ruflo hive is already the shape the design assumes: many agents with distinct roles, each a candidate for its own process and policy. Today they share one uid, one key and one filesystem. Under the harness, the launcher sits above the queen: the platform starts the launcher; the launcher starts the queen's harness under the queen's PBP; every agent:pre-spawn or Task call becomes a request to the launcher for a worker under the worker's PBP. The orchestrator keeps routing, consensus and memory; it loses the ability to widen any worker's grant, because each layer only narrows the one above it.
A worker's policy, taken from ruv.sgit's coder role, would say: read and write src/ and tests/ through sharness.fs; run build-profile commands through sharness.bash; reach registry.npmjs.org and pypi.org only, through sharness.net; call the model through sharness.llm under a daily budget with the tool list pinned; no credential in its environment; push and deploy need a person, enforced outside the worker. Federation across machines is topology C with mutual TLS between net components and Ruflo's trust ladder as the application layer above it. The vault-per-run and branch-per-worker pattern gives the audit record a place the worker cannot alter.
This is the spectrum's profile P3, the newsroom agent, with a concrete mandate already written: ruv.sgit's abp.json is the first real policy file for it, and compiling it to a PBP is the first thing to try.
6. What to do first
- Compile ruv.sgit's ABP (36 rows) to v0 PBPs, one per role, and run each role's commands under
sharness-ai runin a child subtree: the rows that are files and network become Boundaries today; the rows that are tools and approvals stay in Ruflo's engine untilsharness.llmandsharness.bashexist. - Translate the same policy to Claude Code's sandbox settings (
policy translate --to claude-code) and compare with what POC5 found in MetaHarness's settings: which of the 36 rows each covers. - Propose the
agent:pre-spawnhook as a launcher call to Ruflo, as data (a policy per role), not code. - Ask ruv.sgit's providers whether a run under the harness is an offer: "no internet from the run" is already in their task-run offer; the harness is how that becomes a Boundary.
7. Not verified
- Star counts and performance claims (self-reported, varying between pages).
- Whether Ruflo's enforce mode intercepts Claude Code's built-in tools or only MCP calls and
claude-code.*actions throughruflo-mods: inferred from its issue tracker and plugin README, not from the ADR text. - Whether
hive-mind workspawns children with the inherited environment and keys: inferred from "skip permission prompts by default". - RVM's runtime behaviour and whether anything in Ruflo calls it.
- The ruv.sgit repository's tree was read through the site's published data files; the GitHub API was refused from the research session.
Sources (all read 25 Oct 2026): ruv.sgit.ai/llms.txt, the POCs, architecture, the rUv stack, Article No. 9, data/abp.json, data/report.json, data/rvm-caps.md, data/notes.md; ruvnet/ruflo (README 3.62.0, docs/USERGUIDE.md, docs/federation/README.md, the plugin READMEs for ruflo-mods, ruflo-agent, ruflo-aidefence and ruflo-sparc, SECURITY.md, the ADR index, ADR-444, issue 3164); agentic-flow, ruv-FANN, ruvector, flow-nexus, rvm, the metaharness README; the npm registry for every version and date; riskmandate.ai/abp.