What is in this doc
- 1. Why Ruflo, the composability discipline
- 2. The 3-step pipeline diagram
- 3. The JSON contract every agent honors
- 3b. The Composability JSON Compound Engine
- 4. Hive-mind topology, queen plus 6 workers
- 4b. The Hive-Mind Topology, live mesh view
- 4c. Role Purpose Field Guide, what each role is FOR
- 5. Real session evidence, Sprint 35
- 6. Her capacity, the frustration loop fix
- 7. Cross-CC bus, her CC to ours
- 8. The Ruflo Disease + the 5 immunity shields
- 9. Open questions + next install steps
How we use Ruflo for IEXDG
The DWC operator view. Strict pipeline, composability contract, hive-mind topology, and the real session numbers behind the discipline.
Why Ruflo
Ruflo is not the executor. Ruflo coordinates topology and state. Execution still runs on the Claude Code Agent runtime as subagents. What Ruflo enforces is the contract that makes a fleet of agents legible to each other and to us. The standing directive on every IEXDG task is the same: create, assign, coordinate. Every agent returns the same JSON shape. Every blindspot becomes someone else's findings array.
For every multi-agent task, use the strict pipeline. No exceptions. No silent shortcuts. The discipline matters more than any single agent's output, because the discipline is what lets a downstream agent consume an upstream agent's work without re-reading the world.
ruflo task create "research the inbox" ruflo task assign --task <id> --agent <agent> ruflo swarm coordinate # or hive-mind broadcast
Ruflo v3.7-alpha succeeds per-command but does not host a persistent shared runtime. It coordinates the topology, state, and contract. The actual subagent runs on the Claude Code Agent runtime. When subagent perms fail, main-thread execution still honors the contract, returns the same JSON, lands in the same task record. The discipline does not depend on the executor.
The standing rule
Robert paste-set this rule 6 times before it stuck: use Ruflo for every agent, explicit task create then assign then coordinate, no exceptions, enforce the composability JSON contract, ultrathink and cover blindspots, brief in diagram plus emoji. The rule is captured in feedback_ruflo_composability_standing_directive.md and applies on every task from session boot.
🔃 Create, Assign, Coordinate
Three commands, in this order, every time. The order is not aesthetic, it is structural. create writes the task to disk so it can be referenced. assign binds the agent identity to the task so the result is attributable. coordinate (or broadcast in hive-mind) merges the results into a fleet view that the next layer can synthesize.
1. Create
ruflo task createTask lands in the record. ID returned. Description, priority, parent task captured. Nothing executes yet.
2. Assign
ruflo task assignAgent identity bound to the task. The agent name follows the convention iexdg-{verb}-{noun}. The result will carry that name in its agent field.
3. Coordinate
ruflo swarm coordinateResults merge into the fleet view. Findings become inputs to the next-tier synthesizer. Broadcast variant fans the same query to every worker in a hive.
What pipeline drift looks like (and why we measure it)
Pipeline drift is when an agent runs without a Ruflo task record, or returns prose instead of the JSON contract, or skips the assign step. Drift breaks the downstream synthesizer because it has nothing to consume. This session: 14 task records, zero drift. That metric is logged in Sprint 35 of the action ledger.
📄 The Composability JSON Contract
Every agent, on every task, returns the same JSON shape. This is the lingua franca of the fleet. A synthesizer agent does not need to know which executor wrote the findings, what model produced them, or which tools were called. It only needs the contract. The contract is the API.
The five required fields
{ "agent": "iexdg-inbox-auditor", "task_id": "task-1779836550401-7q1cw9", "findings": [ { "id": "F1", "severity": "info", "claim": "Dr. DNicole replied yes on copy thread", "evidence": "gmail:msg_19e5f103d05e2cf6" } ], "next_agents": [ { "agent": "iexdg-catchup-reply-sender", "reason": "send catchup with 7 open asks" } ], "token_cost": null }
Each finding has an id, a severity (info, warn, blocker), a claim, and an evidence pointer. The evidence pointer is what makes a finding falsifiable. No naked claims. No vibes.
The agent itself nominates downstream work. This is how a fleet self-organizes. The synthesizer reads the union of all next_agents arrays and decides which to spawn.
Null is allowed when the substrate does not report it. The field is present so budget tracking can be layered in later without breaking the schema. Forward-compatible by design.
Why the contract is load-bearing
On 2026-05-15 a subagent corrected our regression hypothesis on the image incident by returning a finding with severity blocker and an evidence pointer to a file we had not read. Without the contract, that would have been a Slack message we missed. With the contract, it became a synthesizer input that flipped the next sprint's plan. The composability contract caught our own blindspot, on the record, with a citation.
⚙️ The Composability JSON Compound Engine
The contract is not just a shape, it is a flywheel. Each agent's findings[] becomes the next agent's next_agents[] input. Five spokes around a gold-glow core. Each rotation adds calibration the next rotation reads. Drift is blocked at the schema gate before it can taint a downstream cycle.
DRIFT BLOCKED at the core means the schema gate rejects any agent return that does not honor the contract. Pipeline drift this session is zero because malformed JSON never enters the synthesizer's input set. The gate is the load-bearing wall.
The output of cycle N is structured input for cycle N+1. RAG ingest of the ledger means a future session's first rag_query can read the synthesized recommendations directly. The wheel turns faster every spin.
Cycle 1: 6 Tier-1 agents returned 30 findings. Cycle 2: Tier-2 returned 12 ranked + 3 next_agents. Cycle 3: 5 Wave-1 ops shipped + verified. Cycle 4: ledger + RAG ingest closed the loop. Same week, same engine.
🦄 Hive-Mind Topology: Queen plus 6 Workers
This session spawned one queen and six workers from a single command pair. The queen broadcasts the parent task. Each worker pulls a slice, executes on its own context, and returns the contract. The queen reduces the six results into a synthesizer briefing. The whole topology is one shell pipeline.
ruflo hive-mind init -t hierarchical-mesh ruflo hive-mind spawn -n 6 -r worker
The queen has the parent task. Workers have peer-to-peer awareness through the shared findings buffer. A worker can reference another worker's finding by id without waiting for the queen to fan it back out. The mesh is what lets iexdg-rag-query say "RAG was 7 days stale" and have iexdg-deploy-verify consume that fact as evidence in its own findings.
Six is the cardinality of the Sprint-35 research pulse: inbox, mailbox warmup, war room, deploy verify, ICP, RAG. Each maps to one persistent surface area. Adding a seventh would have overlapped with an existing role. Subtracting one would have left a blindspot. Six matches the actual problem shape.
👑 The Hive-Mind Topology
A live snapshot of the present session. One queen at the center, pulsing. Three concentric rings carry her fleet: 6 workers in the inner orbit, 6 specialists in the middle, 3 scouts on the outer. Seven named Claude Code subagents float beyond the rings as the executor substrate. Worker counts are not decorative, they reflect ruflo hive-mind status from this session.
auditor
warmup
warroom
verify
research
query
canon
state
reconcile
backfill
gate
scout
board
monitor
Why the rings have weight
Workers hold persistent surface areas (inbox, RAG, war room) and survive across sessions. Specialists spawn for deep skills (brand canon, OCC reconcile) and tear down after the task. Scouts sweep the frontier looking for what nobody asked about yet (campaign signal, picture-board residue). The seven named Claude Code agents are the actual execution substrate that runs whichever role is invoked. The topology is the load distribution, not a roster.
🧮 Role Purpose Field Guide
The topology shows WHERE roles sit. This guide shows what they are FOR. Four core primitives spawned by ruflo hive-mind init, plus the nine named specialists the executor substrate runs. Pick the right role for the task instead of throwing a generic worker at everything. Wrong role choice is the silent tax that turns a 6-agent swarm into a 12-agent rework cycle.
The Hive-Mind Roles
spawned byruflo hive-mind init
The rule the field guide enforces
Right role first, then right agent name. A scout used as a worker burns budget on a task it cannot finish. A worker used as a specialist returns shallow craft. The 4 core primitives are not interchangeable tiers, they are different shapes. The queen routes by SHAPE, not by availability.
The Executor Substrate
runs on the Claude Code Agent runtimeWrites new code, refactors existing. The default execution agent for any task that ships a file diff.
Runs test suites, validates acceptance criteria against the spec. Returns blocker-severity findings when the spec contract breaks.
Read-only. Scores correctness, flags risk, never writes. The safety net that runs after the coder and before the deploy.
Designs system structure, picks tech choices, draws topologies. Outputs are decisions and diagrams, not code.
Gathers external information from docs, APIs, the web. Returns facts plus citations, never opinions.
Interprets data, finds patterns in logs, metrics, transcripts. Turns raw numbers into ranked findings.
Performance tuning, refactor for speed and cost. Targets token budget, latency, and bytes-on-the-wire.
Auditor for vulnerabilities. CVE checks, scope review, secret-leak scans. Pairs naturally with the reviewer role.
Long-running observer. Watches state, fires alerts, never ends until torn down. The only named role with a heartbeat.
Tier A vs Tier B, the structural difference
Tier A is the role shape the queen routes by. Tier B is the named subagent the executor substrate actually runs. A worker-shaped task can be executed by coder or by researcher. A specialist-shaped task can be executed by architect or by reviewer. The shape decides priority and token budget. The named agent decides craft. Both are stamped onto the task record, both flow through the composability JSON contract.
📎 Real Session Evidence, Sprint 35
Numbers from the IEXDG_Complete_Action_Ledger.html Sprint 35 block, dated 2026-05-25. Every number here has a source pointer. No vibes. No marketing math.
6/6 research swarm valid JSON
Six agents ran the strict create, assign, coordinate pipeline. All six returned the composability JSON contract. Source: Sprint 35 ledger block, card 1.
30 findings to 12 ranked items + 3 next_agents
Tier-2 synthesizer merged the six worker outputs into a deduplicated ranked list. Tier-2 writer produced a diagram briefing. 2/2 valid JSON from Tier 2.
5/5 OUR-side unblocks shipped end-to-end
W1A RAG re-ingest, W1B brand-canon to VM, W1C G7 unified_state + G21 m_registry deploy, W1D OCC pull-down reconcile, W1E ledger tail. All verified live.
14 task records, zero drift
Every Ruflo task this session passed create then assign then coordinate. Pipeline drift: zero. Source: Sprint 35 closing card.
13,077 to 13,185 chunks (+108)
W1A re-ingested 5 Campaign 05 artifacts plus 6 memory files. Database was 7 days stale before this run. Source: ingest_session.py log.
G7 + G21 live, 10 days post-build
unified_state and m_registry were built and self-tested on 2026-05-15. They sat undeployed for 10 days. The Ruflo pipeline surfaced that gap in W1C. Shipped + verified on 2026-05-25.
cc_prompt_drift 4/4 unchanged
Pre-flight returned all four canon files missing because of a path bug. W1B fixed the deployment + the symlink. Post-deploy cc_prompt_drift returns all four with status=unchanged + valid sha256.
OCC direction-flip caught by deploy-verify
W1D pre-flight expected to push staged over live. Diff revealed live (56,155 bytes, May 25 12:00 UTC) is NEWER than staged (39,714 bytes, May 21). Pulled live DOWN. Without the Ruflo deploy-verify finding we would have overwritten the canonical.
The Q1, Q2, Q4, Q8, Q10 wins behind the Wave
Real wins attributable to the Ruflo pipeline this session: Q1 GCS bucket stamped by the GCP runbook agent, Q2 GHL and Instantly verification scripts shipped, Q4 M-INFRA-01 triaged via the unlock-plan agent, Q8 ledger backfill May 18 picture-board added by iexdg-ledger-backfill-may18-picture-board (task-1779798789477-p9y1tt), Q10 ethnicity audit corrected an earlier diagnosis by returning a blocker-severity finding with file evidence. R1 + R3 + R6 pillar corpus organized by the saved-photos puller fleet.
How Dr. DNicole can use Ruflo on her Mac
A different capacity. Not operator-tier orchestration. Ruflo as a structured thinking partner on her own Claude Desktop, with the same contract feeding our queue.
🔥 The 11-Day Frustration Loop
On 2026-05-15 Dr. DNicole escalated 11 days of visual-direction frustration. The escalation was a stream of feedback that did not ship cleanly because her CC did not have a way to structure WHY she was frustrated into action items. The fix is not a better prompt. The fix is a structured thinking tool that converts a stream into the same composability contract our side already speaks.
⚠ The canonical incident, 2026-05-15
She was frustrated. Her CC narrated empathy. The fix that finally shipped did not arrive until 2026-05-25, after a six-agent Ruflo research swarm on our side reconstructed what she had said across 46 emails and 12 unverified attachments. The 11 lost days were not because the work was hard. They were because there was no shared structure.
The diagnostic guardrail Apr 21 taught us
On 2026-04-21 her CC said "I don't have a War Room tool" while the IEXDG MCP at ~/iexdg-mcp/iexdg_content_mcp_v3_apr21.py had one. Her CC's prose narration is NOT ground truth. Tool call results are. Any Ruflo install on her Mac must enforce: never claim absence of a tool without attempting the call and citing the failure mode. The composability contract makes that automatic, the finding either has a tool-call evidence pointer or it has nothing.
Her three use-cases
- CC opens task "Dr. DNicole frustrated with images"
- Assigns to her own organizing agent
- Returns the same JSON: findings, next_agents, token_cost
- CC summarizes back to her in plain language
- She approves or edits inline
- Auto-emails Robert with structured asks
- Breaks the 11-day loop at hour one
- Tucson contract #240097-44 delivery state
- Ashley Kirkwood transcripts and follow-up
- CareFirst BCBS capability presentation
- Garfield Heights invoice GHL entry
- Speaking pipeline next 90 days
- Writing schedule and book chapter status
- Each engagement gets a task tree, not a sticky note
- Her CC creates a task with severity blocker
- The composability JSON IS the wire format
- Our queen reads it as a finding from a remote worker
- Our synthesizer fans the next_agents to our fleet
- Result flows back with the same task_id ancestry
- Full audit trail, no Slack archeology
- The contract is the lingua franca
💾 Install Plan for Her Mac CC
Same filename-as-version-lock pattern that worked for the IEXDG MCP install (v3, v3.2, v3_apr21, v3_2_apr22 each on its own filename). Her Mac home folder is /Users/drdnicolefields/. The install is a four-step runbook she can paste-run, with the diagnostic guardrail wired into step one.
Pre-flight, the diagnostic guardrail
Before claiming Ruflo is missing, attempt the call. Print the exact error if it fails. Print the version if it succeeds. This is the discipline that prevents the Apr-21 "I don't have a War Room tool" failure mode.
which ruflo || echo "NOT INSTALLED" ruflo --version 2>&1 | tee ~/ruflo_preflight.log
Install Ruflo with filename-as-version-lock
Pin to a named version. Do not float to latest. The version that ran our Sprint 35 swarm is v3.7.0-alpha. If we cut over to v3.8 later, the file gets a new name, the old one stays accessible for rollback.
npm install -g ruflo@3.7.0-alpha
node ~/node_modules/ruflo/bin/ruflo.js --version
# Windows-style invocation as documented in ruflo_runtime_reality memory
Wire it into Claude Desktop MCP config
Add Ruflo as an MCP server in Claude Desktop's config (the same file that registered the IEXDG MCP at ~/iexdg-mcp/...). The 4-minute Claude Desktop tool-call budget applies, every Ruflo tool returns within budget or it returns a partial finding with severity warn. Tools must NEVER raise.
Verify the contract round-trip
Run one task end-to-end. Confirm the JSON shape lands in the task record. Confirm the next_agents nomination works. Confirm the cross-CC bus drops the same JSON into our queue. Only after the round-trip is green does she start using it for real work.
ruflo task create "hello from her CC" ruflo task assign --task <id> --agent her-test-agent ruflo swarm coordinate # Expect: 1 task record, 1 valid JSON return, 0 raises
The two things that must never happen on her CC
(1) Her CC must NEVER pretend to have tools it does not have. If the Ruflo binary is missing, say so explicitly with the path that was checked. (2) Her CC must NEVER let a Ruflo tool raise. Every tool catches its own failure and returns a finding with severity blocker. The 4-minute budget plus the no-raise rule are the two operating constraints she has flagged for us before.
✉️ Cross-CC Bus: Her Mac ↔ Ruflo ↔ Our CC
The composability JSON IS the lingua franca. Her CC writes the same shape ours reads. The task layer between them is an opaque queue that does not care which CC produced the payload, only that the payload is valid. This is how a one-person decision on her side becomes a fleet execution on ours, without anyone retyping the brief.
Her Mac CC
Claude Desktop. Frustration structurer, consulting tracker, task author.
Our DWC CC
Claude Code. Hive queen, synthesizer, executor substrate.
Her Mac CC
Frustration structurer, consulting tracker, task author. Produces composability JSON.
Ruflo Task Layer
Opaque queue. Routes by next_agents nomination. Persists task_id ancestry. Zero re-typing.
Our DWC CC
Hive queen reads her JSON as a remote worker finding. Synthesizer routes execution.
She is frustrated. Her CC opens a task. She narrates once. The task lands with structured findings. The bus carries it to our queue. Our queen fans the next_agents. Six minutes later she has a structured acknowledgment + the action items in flight. No 11-day loop.
She is frustrated. She writes an email. Her CC narrates empathy. The email lands. We re-derive the structure from prose. We email a clarifying question. She replies four days later. We ship something. She says "that is not what I meant." Repeat. Cost: 11 days, one near-miss escalation, one Sprint-35 reconstruction.
[her Mac CC] | ruflo task create + findings + next_agents v [task record] task-XXXX-her-frustration-images | | ==> bus carries the JSON, no re-typing v [our hive queen] | reads as remote-worker finding | fans next_agents to fleet v [execution fleet] (deploy, copy, brand, content) | | result returns with same task_id ancestry v [her Mac CC] structured ack + delta
🧬 The Ruflo Disease & the 5 Shields That Make Her CC Immune
A bus is only as healthy as the loops that close on it. The previous section shows what the contract carries; this section names the chronic failure mode that quietly hollows it out, and the five antibodies that prevent it on her Mac CC. The disease has been formally named so we can hunt it on sight: RUFLO-ORCHESTRATION-LOOP-NOT-CLOSED.
The Disease, visualized
three steps fire outward, one return never landsruflo task createscaffolds the record
ruflo task assignprints "[OK] task assigned"
ruflo swarm coordinatespawns the worker thread
findings[], ledger drifts, the orchestration becomes theater.Four ways the disease shows up
if any of these appears, the loop did not closefindings[], because there is no Tier-1 data to merge. The synthesis ships, looks fluent, says nothing.The reason it is chronic, not acute
Nothing visible breaks. Ruflo's outward calls all return success codes. The CC keeps talking. The dashboards stay green. The damage is silent and compounding: every unclosed loop poisons the next wave's input. By the time it surfaces it looks like 50 small problems instead of one chronic one. Naming it is the first antibody.
The 5 Shields around her Mac CC
five antibodies, each one closes a different way the loop can failverify-claude check pulled from a cron audit of ruflo state.cc_ping endpoint at brain.iexdg.com confirms both CCs alive.ruflo task cancel <id> + cc_post emergency notice.Her CC Install Protocol
how the immunity system gets enabled, four ordered rungsruflo_disease_immunity.py into ~/iexdg-mcp/lib/. Atomic file drop, no edits to existing modules.*/15 * * * * verify-claude --immunity-check to her crontab. Same 15-min cadence as the cross-CC heartbeat.Before vs After the Immunity System
same CC, same Ruflo, two completely different operating modes- Tasks pile up with "[OK] task assigned" lines and no result
- No feedback channel when a wave silently dies
- She re-pastes the same directive a fourth, fifth, sixth time
- Frustration silos on her side; Robert never sees it
- Ledger drifts from reality, dashboards still read green
- The 11-day frustration loop becomes the default cadence
- Every loop closes within 10 minutes, or it is flagged STALE
- Stuck tasks surface in the 7am morning brief automatically
- Heartbeat silence equals alert, not silent rot
- JSON gateway rejects malformed returns at the door
- One-command kill switch when a task is wrong-routed
- Frustration becomes a structured task in hour one, not day eleven
Why the disease has a name now
Once a failure mode has a name, it gets hunted instead of explained away. RUFLO-ORCHESTRATION-LOOP-NOT-CLOSED was the chronic version of a problem we used to call "Ruflo flakiness." Naming it surfaces it. The five shields are the operational answer; the name is the cultural one. From this section forward, any time a Ruflo wave closes without findings landing, the CC says the name out loud and triggers the gate.
📋 Open Questions + Next Install Steps
Honest status. What is shipped, what is staged, what is gated. Same discipline we apply to the Sprint blocks in the action ledger.
Our side, Sprint 35
14 Ruflo task records this session, 6/6 Tier-1 valid JSON, 5/5 Wave-1 ops shipped + verified, pipeline drift zero.
G7 unified_state + G21 m_registry
Deployed 2026-05-25 to brain.iexdg.com. GET /api/v1/unified_state returns 10-source rollup, POST /api/v1/m_check returns clean.
Her Mac CC Ruflo install
4-step runbook above. Pending her run of the npm install + the Claude Desktop config wire-up. Same pattern that worked for IEXDG MCP install.
Her Mac CC join the cc bus
The cc_status entry drdnicole-mac-cc is currently the VM self-pinging via auto-launchd, not her real Mac. 10 days no action on the one-line install email. Decide: third ask, server-side polling fallback, or accept and redesign.
Visual-governance gate calibration
12 attachments she sent post-May15 still UNVERIFIED in reference_intake_watcher.py. Two unlock options: verify the 12 first, or bootstrap YES board from named benchmarks.
M20 Drive sync
Built, staged, undeployed. Gated on her sharing Drive folder 1zvXph4XJspYOl7DxbYyz1MEerNPy-BV6 with the token account.
The one decision that unlocks the most
If she runs the 4-step Ruflo install on her Mac, the cross-CC bus goes live, the frustration-loop fix becomes operational, and the 11-day reconstruction we had to do for May-15 becomes a six-minute round-trip. That single install replaces three carry-forward items at once: her CC join the bus, the structured-feedback gap, and the prose-vs-tool-call diagnostic guardrail.