Add ruflo doctor components for the MiniLM picker (CLAUDE_FLOW_ROUTER_EMBEDDER) and MCP governance (RUFLO_MCP_ENFORCE_POLICY) #3418

Activity

1. pacphi commented on Sep 28, 2026

   

   pacphi

   on Sep 28, 2026

   ContributorAuthor

   More actions

   Re-checked on 3.47.0: versions, how to see the gap, and a sketch

   This adds the details the original request was missing, checked against the newest release.

   System info

   • macOS 27.0 (26A428), arm64; Node v26.4.0; npm 11.17.0
   • ruflo 3.47.0 (@claude-flow/cli 3.47.0); main at b14c79e6f7 (2026-09-27)

   How to observe it (disposable HOME and project)

   T=$(mktemp -d); mkdir -p "$T/home" "$T/p"; cd "$T/p"
   rf() { env -i PATH="$PATH" HOME="$T/home" TMPDIR="$T" TERM=dumb RUFLO_DAEMON_AUTOSTART=0 "$@"; }
   rf ruflo doctor --help | grep component      # ... auth, typesafe, metaharness   (no minilm, no governance)
   rf ruflo doctor -c minilm | head -4          # prints the full check list, exit 0
   rf ruflo doctor -c governance | head -4      # same
   rf env CLAUDE_FLOW_ROUTER_EMBEDDER=minilm ruflo hooks route --task "write unit tests for the parser" | grep embedder

   Actual:

   ✓ Version Freshness: v3.47.0 (up to date)
   ✓ Node.js Version: v26.4.0 (>= 20 required)
   ✓ npm Version: v11.17.0
   ⚠ Claude Code CLI: Not installed
   [hooks] Semantic router initialized: native VectorDb (HNSW, 16k+ routes/s), embedder=minilm
   

   Two things stand out:

   • An unknown -c value quietly runs every check instead of reporting that the component doesn't exist.
   • The only MiniLM signal is the hooks route line, and that probe is not read-only: it created .claude-flow/ in the empty project.

   Proposed approach (suggestion)

   • A minilm component that reports the configured embedder (CLAUDE_FLOW_ROUTER_EMBEDDER), whether the model can load, and which embedder hooks route would actually use. That would mirror the existing typesafe component, which reports "installed; disabled (set CLAUDE_FLOW_ROUTER_TYPESAFE=1)".
   • A governance component that reports RUFLO_MCP_ENFORCE_POLICY, whether .harness/mcp-policy.json parses, and where the audit log goes. Once PR fix(mcp): isolate and bound governance audit logs #3472 (merged on main, not yet in 3.47.0) ships, that is .claude-flow/logs/mcp-audit.jsonl, auditLogPath or RUFLO_MCP_AUDIT_LOG_PATH. With MCP policy enforcement (RUFLO_MCP_ENFORCE_POLICY / .harness/mcp-policy.json) is not reached by the stdio MCP entry points (follow-up to #3138) #3415 now closed, it could also report whether the running stdio entry point routes tools/call through the enforcer.
   • For unknown component names, fail with a list of the valid ones.

   Impact

   • Ruflo users: one read-only command would answer "is my picker and my policy actually on?" Today it takes a routing call that writes files, plus an audit log that stays empty until a tool call happens.
   • Downstream: agentic-kit's component panel could report these as proven rather than inferred. The JSON form (Add --json output to ruflo doctor #3416) would make them machine-readable.
2. ruvnet commented on Oct 7, 2026

   

   ruvnet

   on Oct 7, 2026 – with Claude

   Owner

   More actions

   @/tmp/claude-0/-home-user-ruflo/99a198e7-2058-59ed-a922-018777f60b76/scratchpad/triage/i3418.md

   ---

   Generated by Claude Code