Replicate it: install, run, publish

Prerequisites

Need	Version used	Note
Node	20 (CI) · 22 (local)	Install with scripts so better-sqlite3 compiles; otherwise Ruflo falls back to sql.js and warns that persistence is not guaranteed
Python	3.11 (CI) · 3.13 (local)	sgit-ai needs ≥ 3.11
ruflo	3.56.10	= claude-flow = @claude-flow/cli; the library engine is `@claude-flow/security`
@ruvector/wasm	0.2.1	reports `version()` 2.3.1 at runtime
ruvector (native)	0.3.3	installed, not required by any POC tonight
metaharness	0.4.17	POC5
sgit-ai	0.21.0	`pip install sgit-ai==0.21.0`; an SG/Send access token for writes
A browser	Chromium	POC4; served over HTTP (a file:// origin cannot load the WASM module)

Six steps

Clone the repository

git clone https://github.com/SGit-AI/SGit-AI__Website__Ruv.git ruv-x-sgit-pocs
cd ruv-x-sgit-pocs

Read CLAUDE.md (the builder's own mandate) and BRIEF.md first.

Install the pinned npm packages, with install scripts

npm ci                      # uses package-lock.json; builds better-sqlite3
npm ls ruflo @ruvector/wasm ruvector metaharness --depth=0

Install sgit

pip install sgit-ai==0.21.0
sgit --version              # sgit-ai v0.21.0
sgit help all               # the full surface; the commands used here: create clone write commit push publish history branch vault

Run the POCs that need no secrets

npm run abp:gate            # ABP gaps: 0  (exit 1 on any gap: the policy is a test)
npm run poc1                # legacy vs enforce + receipts → out/poc1/
npm run poc3                # RVM rights per role → out/poc3/rvm-caps.md
npm run poc4:build          # browser app → out/app/
npm run poc5                # MetaHarness scaffold → ABP + diff → out/poc5/
npm run cleanup             # stops the Ruflo daemon it auto-starts

Outputs under out/ are ignored by git; the recorded ones are under evidence/.

Create the two vaults and store the keys

export SGIT_TOKEN=…                                   # your SG/Send access token, never in argv of anything you log
sgit --token "$SGIT_TOKEN" create ruv-pocs-public     # prints the vault key and the read key ONCE
sgit --token "$SGIT_TOKEN" create ruv-pocs-memory
# save both vault keys as SGIT_VAULT_KEY_PUBLIC and SGIT_VAULT_KEY_MEMORY (repo secrets, or your keychain)
# seed each with a first commit: a vault with zero commits cannot be cloned
cd ruv-pocs-memory && echo "# memory" > README.md && sgit commit -m init && sgit push && cd ..

Keys are secrets. sgit create prints the key once; there is no reset. Pass keys on stdin (printf '%s' "$KEY" | sgit clone - dir), mask them in CI (::add-mask::), and run git diff before every commit. Publishing with --visibility public reveals the read key for ever: only the public vault.

Write the outputs to the public vault, publish, serve; run the memory roundtrip

VAULT_KEY="$SGIT_VAULT_KEY_PUBLIC" scripts/vault_write.sh out "runs/local-$(date +%Y%m%dT%H%M)" "pocs: local run" .vault-public
cd .vault-public && sgit publish --visibility public --yes && sgit vault serve --open && cd ..

export VAULT_KEY="$SGIT_VAULT_KEY_MEMORY"
ROLE=coder  bash poc/poc2-agent-memory-in-vault/run.sh write
ROLE=tester bash poc/poc2-agent-memory-in-vault/run.sh write
rm -rf .vault-memory && bash poc/poc2-agent-memory-in-vault/run.sh read

CI and secrets

.github/workflows/pocs.yml runs on every push to dev or main, on pull requests (without the vault jobs) and on demand.

build: Node 20, Python 3.11, npm ci, ABP gate, POC1, POC3, POC4 build, POC5, daemon cleanup, upload out/.
publish-to-vault: in the protected environment vault (a named person approves: that is the ABP's approval row for create.record.world), writes out/ to ruv-pocs-public under runs/<run_id>/, publishes with the read key.
poc2-write (matrix coder, tester, serial) then poc2-read on a different, fresh runner.

Secrets (Settings → Secrets and variables → Actions): SGIT_TOKEN, SGIT_VAULT_KEY_PUBLIC, SGIT_VAULT_KEY_MEMORY. Environment (Settings → Environments): vault, with a required reviewer.

.github/workflows/deploy-pages.yml builds the POC outputs, copies them into site/data, validates the site and deploys site/ to GitHub Pages at ruv.sgit.ai (Settings → Pages → Source: GitHub Actions; DNS for the subdomain already points at GitHub).

flowchart LR
  P["push to dev"] --> B["build
npm ci · abp:gate · poc1 · poc3 · poc4 · poc5"]
  B --> U["upload out/"]
  U --> H{"environment: vault
human approves"}
  H --> W["sgit write runs/run_id --push
sgit publish --visibility public"]
  B --> C1["poc2-write coder"] --> C2["poc2-write tester"] --> C3["poc2-read
fresh runner"]
  P --> D["deploy-pages
sync data · validate · deploy site/"]
  classDef h fill:#fdeedb,stroke:#b45309,color:#1a1917
  class H h

This website

Hand-written static HTML under site/, one stylesheet, one script. No framework, no build step for the pages. Diagrams are Mermaid, rendered in the browser from the page source; tables are rendered from the POC output files in site/data/, which site/build/sync.sh copies from out/ and evidence/. site/build/validate.py refuses a broken internal link, a missing image, or anything shaped like a key.

npm run poc1 && npm run poc3 && npm run poc4:build && npm run poc5
bash site/build/sync.sh                 # out/ + evidence/ → site/data, out/app → site/app
python3 site/build/validate.py          # links, images, secrets
python3 -m http.server -d site 8080     # http://localhost:8080

The infographics

Twelve images, generated through OpenRouter's image-output chat models with site/build/gen_infographics.py from the prompts in site/build/infographics.json. Model per job follows newsroom.sgit.ai's bake-off: labelled diagrams on Gemini 3 Pro Image, concept slides on the cheapest Gemini image model, Nano Banana 2.1 first when it is not rate-limited upstream. Every prompt ends with the aspect ratio and "No other text"; invented values are the known failure mode, which is why the facts are in the tables and the images only illustrate.

image	model	seconds	cost

export OPENROUTER_API_KEY=sk-or-v1-…
python3 site/build/gen_infographics.py              # skips images that exist; --force to redo; --only id,id

Build notes: where the tools differed from their docs

loading…

Risks and unknowns we kept in view

Third-party versions move fast (14 new rUv repos in Aug and Sep). Pin, and trust --help over any doc, including this page.
Ruflo auto-starts a background daemon; stop it in every script and CI job.
Ruflo policy administration requires an interactive terminal by design. Do not bypass it; use the library engine (POC1) or your own terminal (POC6).
The native ruvector CLI needs platform binaries; POC4 uses the WASM build, which is verified.
Claims about rUv's projects: "per its README", with a link. Star counts are snapshots.

Repository layout

BRIEF.md · CLAUDE.md · README.md          the brief, the builder's mandate, the pack's readme
abp/        schema/ vocabulary/ mapping.json examples/{ruflo-sparc-swarm,builder-agent}.abp.json
poc/        poc1-abp-to-ruflo-policy/ poc2-agent-memory-in-vault/ poc3-abp-to-rvm-caps/
            poc4-browser/ poc5-metaharness-abp/ poc6-swarm-run-in-vault/
docs/       00 context · 01 sgit cheatsheet · 02 ABP format · 03 CI · 04 browser · 05 Claude sessions · 06 demo script · 07 risks
evidence/   recorded outputs of every run (never invented numbers)
scripts/    vault_write.sh
site/       this website (index, ruv-stack, use-cases, architecture, pocs, replicate, demo, app/, data/, assets/, build/)
.github/workflows/  pocs.yml (the POCs + vault) · deploy-pages.yml (this site)