fix(release): enforce CI and idle assignment safety (#3037)

Closes #3030 and #3031.

Author: ruvnet

.claude/settings.json

@@ -174,15 +174,15 @@
       "taskListEnabled": true,
       "mailboxEnabled": true,
       "coordination": {
-        "autoAssignOnIdle": true,
+        "autoAssignOnIdle": false,
         "trainPatternsOnComplete": true,
         "notifyLeadOnComplete": true,
         "sharedMemoryNamespace": "agent-teams"
       },
       "hooks": {
         "teammateIdle": {
           "enabled": true,
-          "autoAssign": true,
+          "autoAssign": false,
           "checkTaskList": true
         },
         "taskCompleted": {

.github/workflows/ci.yml

@@ -73,20 +73,18 @@ jobs:
         uses: ./.github/actions/npm-ci-retry
 
       - name: Run all tests
-        run: npm test || echo "⚠️ Some tests failed (Jest teardown issues - non-blocking)"
-        continue-on-error: true
-
-      - name: Generate coverage report
-        if: matrix.os == 'ubuntu-latest'
-        run: npm run test:coverage || echo "⚠️ Coverage generation failed (non-blocking)"
-        continue-on-error: true
+        # #3030: the historical suite has known debt, but new failing files
+        # are release-blocking. The committed file-level baseline may only
+        # shrink; replacing an old failure with a new one still fails.
+        run: node scripts/ci-test-ratchet.mjs
 
       - name: Upload test results
         if: always()
         uses: actions/upload-artifact@v4
         with:
           name: test-results-${{ matrix.os }}
-          path: coverage/
+          path: .test-results/vitest.json
+          if-no-files-found: error
 
   # Documentation generation
   docs:
@@ -314,4 +312,4 @@ jobs:
           echo "✅ CI Pipeline completed"
           echo "Security: ${{ needs.security.result }}"
           echo "Test: ${{ needs.test.result }}"
-          echo "Build: ${{ needs.build.result }}"
+          echo "Build: ${{ needs.build.result }}"

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-flow",
-  "version": "3.38.11",
+  "version": "3.38.12",
   "workspaces": [
     "v3/@claude-flow/codex",
     "v3/@claude-flow/plugin-agent-federation",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "ruflo",
-  "version": "3.38.11",
+  "version": "3.38.12",
   "description": "Ruflo - Enterprise AI agent orchestration platform. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "bin/ruflo.js",
   "type": "module",

ruflo/package.json

@@ -0,0 +1,42 @@
+import { describe, expect, it } from 'vitest';
+import { evaluateTestReport } from '../ci-test-ratchet.mjs';
+
+const root = '/repo';
+
+describe('CI test failure ratchet (#3030)', () => {
+  it('permits only failures already named by the baseline', () => {
+    const result = evaluateTestReport({
+      success: false,
+      testResults: [
+        { name: '/repo/tests/known.test.ts', status: 'failed' },
+        { name: '/repo/tests/green.test.ts', status: 'passed' },
+      ],
+    }, ['tests/known.test.ts'], root);
+
+    expect(result.ok).toBe(true);
+    expect(result.unexpected).toEqual([]);
+  });
+
+  it('fails when a new file starts failing even if the total count is unchanged', () => {
+    const result = evaluateTestReport({
+      success: false,
+      testResults: [{ name: '/repo/tests/new-regression.test.ts', status: 'failed' }],
+    }, ['tests/old-debt.test.ts'], root);
+
+    expect(result.ok).toBe(false);
+    expect(result.unexpected).toEqual(['tests/new-regression.test.ts']);
+    expect(result.fixed).toEqual(['tests/old-debt.test.ts']);
+  });
+
+  it('fails closed when Vitest fails without a file-level result', () => {
+    const result = evaluateTestReport({ success: false, testResults: [] }, [], root);
+
+    expect(result.ok).toBe(false);
+    expect(result.error).toMatch(/without identifying/);
+  });
+
+  it('fails closed for an empty or malformed report', () => {
+    expect(evaluateTestReport({ success: true, testResults: [] }, [], root).ok).toBe(false);
+    expect(evaluateTestReport({}, [], root).ok).toBe(false);
+  });
+});

scripts/__tests__/ci-test-ratchet.test.mjs

@@ -0,0 +1,121 @@
+# Monotone-decreasing file-level failure baseline for .github/workflows/ci.yml.
+# Source: origin/main 45e65b5dae5d2c312e70cd5ba90df0701ea05c28
+# Evidence: GitHub Actions run 31859043593 (116 failing test files).
+# Remove entries when fixed. Never add entries to make a regression green.
+plugins/ruflo-adr/scripts/__tests__/adr-create-schema-2651.test.mjs
+plugins/ruflo-adr/scripts/__tests__/index-idempotency-2660.test.mjs
+plugins/ruflo-adr/scripts/__tests__/parser-bullets-2659.test.mjs
+plugins/ruflo-adr/scripts/__tests__/skip-brain-dir-2911.test.mjs
+plugins/ruflo-business-pods/scripts/pod-tick.test.mjs
+plugins/ruflo-core/scripts/mcp-launch.test.cjs
+plugins/ruflo-workflows/scripts/gaia-audit.test.mjs
+ruflo/src/ruvocal/src/lib/components/chat/MarkdownRenderer.svelte.test.ts
+ruflo/src/ruvocal/src/lib/migrations/migrations.spec.ts
+ruflo/src/ruvocal/src/lib/migrations/routines/09-delete-empty-conversations.spec.ts
+ruflo/src/ruvocal/src/lib/server/__tests__/conversation-stop-generating.spec.ts
+ruflo/src/ruvocal/src/lib/server/api/__tests__/conversations-id.spec.ts
+ruflo/src/ruvocal/src/lib/server/api/__tests__/conversations-message.spec.ts
+ruflo/src/ruvocal/src/lib/server/api/__tests__/conversations.spec.ts
+ruflo/src/ruvocal/src/lib/server/api/__tests__/misc.spec.ts
+ruflo/src/ruvocal/src/lib/server/api/__tests__/user-reports.spec.ts
+ruflo/src/ruvocal/src/lib/server/api/__tests__/user.spec.ts
+ruflo/src/ruvocal/src/lib/server/database/__tests__/rvf.spec.ts
+ruflo/src/ruvocal/src/lib/server/isURLLocal.spec.ts
+ruflo/src/ruvocal/src/lib/server/mcp/clientPool.spec.ts
+ruflo/src/ruvocal/src/lib/server/textGeneration/mcp/wasmTools.test.ts
+ruflo/src/ruvocal/src/lib/utils/generationState.spec.ts
+ruflo/src/ruvocal/src/lib/utils/marked.spec.ts
+ruflo/src/ruvocal/src/lib/utils/messageUpdates.spec.ts
+ruflo/src/ruvocal/src/lib/utils/template.spec.ts
+ruflo/src/ruvocal/src/lib/utils/toolProgress.spec.ts
+ruflo/src/ruvocal/src/lib/utils/tree/addChildren.spec.ts
+ruflo/src/ruvocal/src/lib/utils/tree/addSibling.spec.ts
+ruflo/src/ruvocal/src/lib/utils/tree/buildSubtree.spec.ts
+ruflo/src/ruvocal/src/lib/utils/tree/convertLegacyConversation.spec.ts
+ruflo/src/ruvocal/src/lib/utils/tree/isMessageId.spec.ts
+ruflo/src/ruvocal/src/lib/utils/tree/treeHelpers.spec.ts
+ruflo/src/ruvocal/src/lib/wasm/tests/wasm-capabilities.test.ts
+ruflo/src/ruvocal/src/routes/login/callback/updateUser.spec.ts
+scripts/__tests__/audit-supply-chain.test.mjs
+scripts/__tests__/stage-internal-runtime-bundles.test.mjs
+tests/context-persistence-hook.test.mjs
+tests/hook-handler-runwithtimeout.test.cjs
+tests/rvf-backend.test.ts
+tests/rvf-capability-verify.test.ts
+tests/rvf-embeddings.test.ts
+tests/rvf-event-log.test.ts
+tests/rvf-integration.test.ts
+tests/rvf-learning-store.test.ts
+tests/rvf-migration.test.ts
+v3/@claude-flow/cli/__tests__/adr-323-memory-provenance.test.ts
+v3/@claude-flow/cli/__tests__/agenticow-tools.test.ts
+v3/@claude-flow/cli/__tests__/agntcy/agntcy-commands.test.ts
+v3/@claude-flow/cli/__tests__/cli.test.ts
+v3/@claude-flow/cli/__tests__/config-loading.test.ts
+v3/@claude-flow/cli/__tests__/flywheel-envelope-proposer-contract.test.ts
+v3/@claude-flow/cli/__tests__/guidance-brain.test.ts
+v3/@claude-flow/cli/__tests__/hooks-intelligence-train-2940.test.ts
+v3/@claude-flow/cli/__tests__/hooks-metrics-swarm-backup-2797-2798-2799.test.ts
+v3/@claude-flow/cli/__tests__/hooks-post-task-graph-edge-2961.test.ts
+v3/@claude-flow/cli/__tests__/init-kebab-flags-2952.test.ts
+v3/@claude-flow/cli/__tests__/integration-docker.test.ts
+v3/@claude-flow/cli/__tests__/issue-2733-statusline-model-name.test.ts
+v3/@claude-flow/cli/__tests__/mcp-client-guardrail.test.ts
+v3/@claude-flow/cli/__tests__/mcp-client.test.ts
+v3/@claude-flow/cli/__tests__/mcp-http-foreground-2984.test.ts
+v3/@claude-flow/cli/__tests__/mcp-http-protocol-tools-2990.test.ts
+v3/@claude-flow/cli/__tests__/mcp-tool-filter-2726.test.ts
+v3/@claude-flow/cli/__tests__/memory-bridge-failure-diagnostics.test.ts
+v3/@claude-flow/cli/__tests__/memory-concurrent-write-loss-2878.test.ts
+v3/@claude-flow/cli/__tests__/memory-search-2790.test.ts
+v3/@claude-flow/cli/__tests__/memory-search-recall-2558.test.ts
+v3/@claude-flow/cli/__tests__/memory-store-upsert-default-2594.test.ts
+v3/@claude-flow/cli/__tests__/neural-router.test.ts
+v3/@claude-flow/cli/__tests__/output.test.ts
+v3/@claude-flow/cli/__tests__/planflip-mempoison-2752.test.ts
+v3/@claude-flow/cli/__tests__/plugins-transfer-deep.test.ts
+v3/@claude-flow/cli/__tests__/policy-runtime.test.ts
+v3/@claude-flow/cli/__tests__/pq-validation.test.ts
+v3/@claude-flow/cli/__tests__/proxy-extract-archive.test.ts
+v3/@claude-flow/cli/__tests__/security-scan-enum-validation.test.ts
+v3/@claude-flow/cli/__tests__/security-scan-persistence.test.ts
+v3/@claude-flow/cli/__tests__/security-scan-secret-regex-2931.test.ts
+v3/@claude-flow/cli/__tests__/validate-input-path-2352.test.ts
+v3/@claude-flow/cli/__tests__/version-anv.test.ts
+v3/@claude-flow/embeddings/__tests__/minimal.test.mjs
+v3/@claude-flow/embeddings/__tests__/simple.test.mjs
+v3/@claude-flow/guidance/tests/hooks.test.ts
+v3/@claude-flow/guidance/tests/integration.test.ts
+v3/@claude-flow/hooks/__tests__/channel-guard-worker.test.ts
+v3/@claude-flow/hooks/__tests__/workers.test.ts
+v3/@claude-flow/hooks/src/__tests__/guidance-provider.test.ts
+v3/@claude-flow/hooks/src/__tests__/reasoningbank.test.ts
+v3/@claude-flow/memory/src/agentdb-backend.test.ts
+v3/@claude-flow/memory/src/agentdb-retrieval-guard.test.ts
+v3/@claude-flow/memory/src/consolidator.test.ts
+v3/@claude-flow/memory/src/controller-registry.test.ts
+v3/@claude-flow/memory/src/database-provider.test.ts
+v3/@claude-flow/memory/src/graceful-retrieval.test.ts
+v3/@claude-flow/memory/src/hnsw-persistence.test.ts
+v3/@claude-flow/memory/src/hybrid-backend.test.ts
+v3/@claude-flow/memory/src/index.test.ts
+v3/@claude-flow/plugin-iot-cognitum/__tests__/integration/sdk-client.test.ts
+v3/@claude-flow/plugins/examples/ruvector-plugins/ruvector-plugins.test.ts
+v3/@claude-flow/swarm/__tests__/consensus.test.ts
+v3/@claude-flow/swarm/__tests__/topology.test.ts
+v3/__tests__/appliance/gguf-engine.test.ts
+v3/__tests__/appliance/rvfa-builder.test.ts
+v3/__tests__/appliance/rvfa-distribution.test.ts
+v3/__tests__/appliance/rvfa-format.test.ts
+v3/__tests__/appliance/rvfa-signing.test.ts
+v3/__tests__/integration/swarm-integration.test.ts
+v3/plugins/code-intelligence/tests/mcp-tools.test.ts
+v3/plugins/code-intelligence/tests/types.test.ts
+v3/plugins/cognitive-kernel/tests/bridges.test.ts
+v3/plugins/cognitive-kernel/tests/mcp-tools.test.ts
+v3/plugins/financial-risk/tests/mcp-tools.test.ts
+v3/plugins/healthcare-clinical/tests/types.test.ts
+v3/plugins/legal-contracts/tests/mcp-tools.test.ts
+v3/plugins/legal-contracts/tests/types.test.ts
+v3/plugins/quantum-optimizer/tests/mcp-tools.test.ts
+

scripts/ci-test-baseline.txt

@@ -0,0 +1,122 @@
+#!/usr/bin/env node
+
+import { spawnSync } from 'node:child_process';
+import { existsSync, mkdirSync, readFileSync, rmSync } from 'node:fs';
+import { dirname, isAbsolute, relative, resolve, sep } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+
+function normalizeTestPath(name, repoRoot) {
+  const normalized = isAbsolute(name) ? relative(repoRoot, name) : name;
+  return normalized.split(sep).join('/').replace(/^\.\//, '');
+}
+
+export function evaluateTestReport(report, baselineEntries, repoRoot = REPO_ROOT) {
+  if (!report || !Array.isArray(report.testResults)) {
+    return { ok: false, error: 'Vitest JSON report is missing testResults[]' };
+  }
+  if (report.testResults.length === 0 && report.success !== false) {
+    return { ok: false, error: 'Vitest JSON report contains zero test files' };
+  }
+
+  const baseline = new Set(
+    baselineEntries.map((entry) => entry.trim()).filter((entry) => entry && !entry.startsWith('#')),
+  );
+  const failed = new Set(
+    report.testResults
+      .filter((result) => result?.status === 'failed' && typeof result.name === 'string')
+      .map((result) => normalizeTestPath(result.name, repoRoot)),
+  );
+  const unexpected = [...failed].filter((name) => !baseline.has(name)).sort();
+  const fixed = [...baseline].filter((name) => !failed.has(name)).sort();
+
+  if (report.success === false && failed.size === 0) {
+    return {
+      ok: false,
+      error: 'Vitest failed without identifying a failing test file',
+      failed: [],
+      unexpected: [],
+      fixed,
+    };
+  }
+
+  return {
+    ok: unexpected.length === 0,
+    failed: [...failed].sort(),
+    unexpected,
+    fixed,
+    baselineCount: baseline.size,
+  };
+}
+
+function parseArgs(argv) {
+  const args = { report: '', baseline: resolve(REPO_ROOT, 'scripts/ci-test-baseline.txt'), run: true };
+  for (let i = 0; i < argv.length; i += 1) {
+    if (argv[i] === '--report' && argv[i + 1]) {
+      args.report = resolve(argv[++i]);
+      args.run = false;
+    } else if (argv[i] === '--baseline' && argv[i + 1]) {
+      args.baseline = resolve(argv[++i]);
+    } else {
+      throw new Error(`Unknown or incomplete argument: ${argv[i]}`);
+    }
+  }
+  return args;
+}
+
+function main() {
+  const args = parseArgs(process.argv.slice(2));
+  const reportPath = args.report || resolve(REPO_ROOT, '.test-results/vitest.json');
+  const vitestBin = resolve(REPO_ROOT, 'node_modules/vitest/vitest.mjs');
+
+  if (args.run) {
+    mkdirSync(dirname(reportPath), { recursive: true });
+    // A killed runner must not accidentally reuse a prior green-enough report.
+    rmSync(reportPath, { force: true });
+    const run = spawnSync(process.execPath, [
+      vitestBin,
+      'run',
+      '--reporter=json',
+      `--outputFile=${reportPath}`,
+    ], {
+      cwd: REPO_ROOT,
+      env: { ...process.env, CI: '1' },
+      stdio: 'inherit',
+    });
+    if (run.error) throw run.error;
+    if (run.signal || (run.status !== 0 && run.status !== 1)) {
+      console.error(`CI test ratchet: Vitest terminated abnormally (${run.signal ?? run.status})`);
+      process.exit(1);
+    }
+  }
+
+  if (!existsSync(reportPath)) {
+    console.error(`CI test ratchet: report was not produced: ${reportPath}`);
+    process.exit(1);
+  }
+  if (!existsSync(args.baseline)) {
+    console.error(`CI test ratchet: baseline is missing: ${args.baseline}`);
+    process.exit(1);
+  }
+
+  const report = JSON.parse(readFileSync(reportPath, 'utf8'));
+  const baselineEntries = readFileSync(args.baseline, 'utf8').split(/\r?\n/);
+  const result = evaluateTestReport(report, baselineEntries);
+
+  if (!result.ok) {
+    console.error(`CI test ratchet: FAILED — ${result.unexpected?.length ?? 0} unexpected failing file(s)`);
+    for (const name of result.unexpected ?? []) console.error(`  + ${name}`);
+    if (result.error) console.error(`  ${result.error}`);
+    process.exit(1);
+  }
+
+  console.log(
+    `CI test ratchet: PASS — ${result.failed.length}/${result.baselineCount} known failing files remain; `
+      + `${result.fixed.length} baseline file(s) are now green`,
+  );
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
+  main();
+}

scripts/ci-test-ratchet.mjs

@@ -1 +1 @@
-3.32.29
+3.38.12

v3/@claude-flow/cli/.claude/helpers/.helpers-version

@@ -1,13 +1,13 @@
 {
   "manifest": {
-    "version": "3.38.11",
+    "version": "3.38.12",
     "files": {
       "auto-memory-hook.mjs": "85fe05c757421c52137c0bc8545a0896bab6b4714538c2a11d1d0835bfcc8c1c",
       "hook-handler.cjs": "dae295fb9ae2626b89899c19a20cc911541af82b52d2eeb9b214d618b96e9a86",
       "intelligence.cjs": "30e42ed7ec4ca5a94ac54fdb1330d2d47ac5f3fdeeef207753574723a9e77b5c",
       "statusline.cjs": "0457fe53f8cd2c56458ff178392536a5868efd1a573665fa43bc01d2d95ca677"
     }
   },
-  "signature": "rNkivgIb+R5mwQcChrNF+m4lsfPPlKBn4oizP9Q7nuuIi8en/J3NJYf5l6mPRfEc4vdlqnnf0+Oid/007092Dw==",
+  "signature": "8JINtA8uubiBqNQbsz8OL2fcc4xmKGk6gKPGoa1ib7/21nYDaYWiWrZB/4xli8AGUdmQuMS9GT6ANbpPjqAcCw==",
   "algorithm": "ed25519"
 }