Start from what you want to do, not from a repository
Each one names the problem, the piece of rUv's stack that does the autonomous part, the piece of ours that does the trust part, the flow, and the proof. The first four are built and run; the last two are designed and partly run.
Problem. A Ruflo swarm with queens and eight worker roles will do whatever the task needs. By default its policy mode is legacy: ask whether coder-1 may email.send and the answer is allowed, reason legacy-default-allow. Nobody wrote down that it may not.
His piece. Ruflo's AgenticPolicyEngine in enforce mode: rules with allow / deny / require_approval, budgets, a hash-chained receipt ledger.
Our piece. One ABP for the deployment, one row set per role: 6 roles, 36 rows, 0 gaps. A compiler turns each row into a rule; mandate: yes becomes allow, no becomes deny, approval becomes require_approval; a write.budget.tenant row with daily-model <= $10 becomes setBudget().
Result. Same 11-action trace evaluated twice: 6 actions that legacy allows are stopped by the ABP (4 denied, 2 sent for approval), 5 are allowed with the rule that allowed them named in the reason. Ledger valid, 11 receipts.
sequenceDiagram
participant A as ABP (JSON)
participant C as compile.mjs
participant E as Ruflo engine (enforce)
participant L as Ruflo engine (legacy)
participant V as public vault
A->>C: roles × rows
C->>E: upsertRule × 36, setBudget × 1
loop each action in trace.json
Note over L,E: same request to both
L-->>L: allowed (legacy-default-allow)
E-->>E: allowed | denied | approval_required
end
E->>V: report.json + rules.json + state (receipts)
V-->>V: verifyLedger() = {valid:true}
Problem. Agents learn things during a run. On an ephemeral runner that memory dies with the job; on a shared server the host can read it. RuVector's README is candid about its boundaries: its witness logs “do not encrypt memory content”, filters “are not a complete authorization boundary”, replication runs on “simulated transport”, and a delete “does not automatically remove copies in snapshots, branches, replicas, exports”.
His piece. Ruflo memory (memory init|store|list; AgentDB with HNSW search, better-sqlite3, sql.js as the fallback) or RuVector itself.
Our piece. An sgit vault. Each role writes its memory files on its own branch (mem-coder-<run>), pushes, and merges into the default branch. A fresh machine clones the vault with the key and restores the files. Files are encrypted on the client; the server stores ciphertext under opaque ids.
Result. Two roles wrote, a fresh clone restored both, ruflo memory list returned the same entry on the new machine; the vault history shows who learned what and when.
gitGraph commit id: "init: memory vault" branch mem-coder checkout mem-coder commit id: "coder learned (run A)" checkout main merge mem-coder branch mem-tester checkout mem-tester commit id: "tester learned (run A)" checkout main merge mem-tester commit id: "fresh runner: clone + restore" type: HIGHLIGHT
| RuVector, in its own README | + an sgit vault around its files | |
|---|---|---|
| Memory content | witnesses and hash-linked logs “are tamper evident. They do not encrypt memory content” | encrypted on the client before it leaves the machine (AES-256-GCM); the server stores ciphertext |
| History and branches | snapshots; copy-on-write branching (rvf derive) | a commit history, branches and merges shared across machines and agents |
| Copies elsewhere | file persistence; backups by file copy | clone anywhere with the key; a fresh clone checked file by file in every ruv.sgit run |
| Deleting | “a delete from the live store does not automatically remove copies in snapshots, branches, replicas, exports” | ruv.sgit deletes each run's vault and checks it: 0 store paths left, a clone with the key fails |
| Who may do what | “collections and metadata filters organize memory; they are not a complete authorization boundary” | an Agent Behaviour Policy per role (in POC1, compiled into Ruflo's own policy engine) |
Problem. "The agent did not send that email" is a claim. An auditor wants the decision, the rule that made it, the previous decision it chains to, and the mandate it came from, in a place nobody could have edited.
His piece. The engine's receipts: each decision has a receiptId (sha256), the matched rules, and a link to the previous receipt; verifyLedger() walks the chain. RVM's witness log is the bare-metal version of the same idea.
Our piece. Commit the exported engine state next to the ABP that produced it, in a vault. The commit is the timestamp, the history is the chain of custody, the encryption keeps it private until you hand over the read key.
Result. poc1/state-abp.json in the public vault: 11 receipts, ledger valid, every reason names an ABP row id (abp:coder:send.message.world).
flowchart LR R1["receipt 1
sha256:…"] --> R2["receipt 2
prev = r1"] --> R3["receipt 3
prev = r2"] --> Rn["receipt 11"] Rn --> X["exportState()"] --> V[("vault commit
poc1/state-abp.json")] ABP["ABP row
abp:coder:send.message.world"] -. "reason in each receipt" .-> R3 V --> H["sgit history log --file poc1/state-abp.json"]
Problem. Deploying, publishing a package, pushing to a shared branch: the actions that reach the world. An agent should be able to prepare them and a named human should release them.
His piece. Ruflo's require_approval effect and its approvals queue; MetaHarness host settings.
Our piece. An ABP row create.record.world with mandate: approval and barrier "require_approval rule + CI protected environment". The same row appears in two enforcers: in the engine (the trace shows deploy → approval_required) and in GitHub Actions, where the job that writes to the vault and publishes runs in a protected environment named vault that a person approves.
Result. The CI pipeline: build → ABP gate (fails on any row with reach, no mandate and no barrier) → POCs → human approval → write to vault → publish.
Problem. SONA, ReasoningBank and Darwin mode change what the agents do over time. A learned route that was right in September may be wrong in October, and you need to see what changed and undo it.
His piece. Ruflo hooks (post-task, session-end), ReasoningBank patterns, RuVector snapshots and copy-on-write branches, MetaHarness Darwin mode.
Our piece. Version the learned artefacts in a vault after each session, next to the ABP version in force at the time. sgit history diff shows what a session changed; sgit history revert brings back the pattern set from before; the ABP's valid_until forces a re-sign when behaviour has drifted.
Status. The memory files are versioned (POC2); hooking session-end to a vault write is POC6, which needs an interactive terminal for Ruflo's policy admin and is documented as a runbook.
flowchart TB S1["session 1
ruflo hooks session-end"] --> C1["vault commit
memory + patterns + ABP v1"] S2["session 2 (learned a shortcut)"] --> C2["vault commit
memory + patterns + ABP v1"] C1 --> D["sgit history diff c1..c2
what the swarm learned"] C2 --> D D -->|"wrong lesson"| RV["sgit history revert c1
roll the pattern back"] D -->|"good lesson, outside mandate"| AB["bump the ABP: new row, new owner signature, new valid_until"]
Problem. A policy that only works in one runtime is a policy for one runtime. The same mandate has to hold in a GitHub Actions job, in a page the audience can open, and in a developer's Claude Code session.
His piece. @ruvector/wasm (verified in headless Chromium: VectorDB, insert, search, HNSW), Ruflo as an MCP server inside Claude Code (ruflo mcp start), GitHub Actions as a MetaHarness host.
Our piece. The ABP is JSON, so it goes anywhere; the vault is a static publish target, so the browser app is served from it; the Claude Code session writes its record back to the private vault.
Result. The live app indexes the 36 ABP rows with RuVector WASM and answers "can the coder send email?" offline, showing the row, the engine's decision and the ledger. It is the same app/ folder published in the vault.
