Home / Articles / The policy guards the door; the command line uses the window / Versions / v1.1.0
The policy guards the door; the command line uses the window: what changed in v1.1.0
From v1.0.0 (2026-10-17, c3c97c54d) to v1.1.0 (2026-10-17, 04eef66c8), paragraph by paragraph.
3 paragraphs added, 3 removed, 21 changed in place, 19 unchanged. About 264 words added and 93 removed. Insertions are marked like this, deletions like this; unchanged runs are folded to one line; figures appear as their file names.
# The policy guards the door; the command line uses the window: in the SGit × Ruflo run, the ABP checksis compiled into Ruflo's own rules and enforced on the adapter's tools, while Ruflo's own command line reaches the same memory file without it, and five other questions foras the authorauthor's own README says
Summary: The third piece on Mondweep Chakravorty's SGit × Ruflo proof of concept is about a path, not a failure. TheHis adapter compiles the four Agent Behaviour Policy rows into Ruflo rules and checks every one of its tools with a pinned copy of Ruflo's own policy evaluator, in enforce mode. In the runvideo isthose enforcedchecks by the adapter, on its three tools: checkpoint, close run and restore. Those arecover steps 4, 5, 6, 8 and 11, and every one of them behaved as the policy said. But in steps 3, 9 and 10, Ruflo's own command line writes and reads the same SQLite memory file directly, and that path does not pass the policygate. His README states the limit in one line: "Only adapter tools pass through this gate. OnOther screenshell/network thistools isare simply how the test was built. By inference, an agent with shell access could change its memory without an ABP check.unaffected." It is the same lesson this site keeps learning about its own agent: a policy holds only on the paths that pass through its enforcer. The addendumfix suggestsis compilingon thehis rowslist intoof Ruflo'sfollow-ups, ownnative policyplugin engine in enforce mode,registration, so the commandsame linecompiled isrules coveredrun too.where AlongsideRuflo itruns. His code also answers the other questions the video left open: why every error reads the same, whether decisions are five smaller questions from the analysis: whether each decision is recorded, the same error text for different causes, where the vault goes afternext, thiswhy machine, athe file name that changes between steps,changes, and anwhy approval pathmeans that was not tested with an approver. They are questions, not findings, and Mondweep has agreed to their publication.stop.
!shot rf-gap.webp | images/ | Two ways into the same memory: the adapter's tools pass the ABP's policy gategate, a pinned copy of Ruflo's evaluator running the compiled ABP rules, on their way to SGit and the vault, in steps 4, 5, 6, 8 and 11; Ruflo's own command line reads and writes the memory file directly, in steps 3, 9 and 10, with no ABP check. SolidThe arrowsauthor arestates shownthis onlimit screen;in thathis an agent could use the second path is an inference.README. | architecture
2 unchanged paragraphs, under In short {#in-short}
• The rules run in Ruflo's own evaluator. Compiled from the ABP, checked in enforce mode, inside the adapter.
1 unchanged paragraph
• Two paths reach the memory. The adapter's tools, through the ABP;gate; Ruflo's command line, around it.
• OnThe screen,author thatsays isso thehimself. test's"Only design.adapter Bytools inference,pass anthrough agentthis with a shell could take the second path.gate."
1 unchanged paragraph
• One fix is suggested. Compile the rows into Ruflo's own policy engine, in enforce mode.
• Five smaller questions. Records, error text, the vault's next home, a file name, the approval path.
• Questions, not findings. Mondweep agreed to publish them, and his answers are welcome here.
• The fix is on his list. Native plugin registration, so the rules run where Ruflo runs.
• The other questions have answers. In the code: the errors, the records, the vault's next home, the file name, approval.
2 unchanged paragraphs, under Two paths to the same memory {#paths}
The first is the adapter. ItsMondweep's threecode, tools,mondweep/sgit-ruv-memory, checkpoint, close_run and restore, each pass a policy gate built fromrows,rows into Ruflo rules when the server starts, and before each of its tools runs, checkpoint, inspect, restore and close_run, it asks a pinned copy of Ruflo's own policy evaluator for a decision in enforce mode. Anything not allowed is refused, and an unsupported or ambiguous policy rejects the gatewhole fails closed.document. That is the path for steps 4, 5, 6, 8 and 11, and every one of them did what the policy said: the out-of-scope checkpoint refused, the in-scope one allowed, the deletion stopped for want of approval,stopped, the restore allowed, and the tampered restore allowed by the policy and then rejectedrefused by the vault.adapter's integrity check.
The second is Ruflo's own command line. In step 3 it writes the two facts straight into the SQLite memory file. In steps 9 and 10 it reads the restored file. None of those calls passes the gate. InThe theanalysis addendum'sput words:it as "The ABP guards the adapter, but Ruflo's command-line tool writes and reads the same SQLite file without passing through it."it", and Mondweep's README says the same in his own words: "This is an external adapter using a pinned copy of Ruflo's evaluator, not Ruflo's running policy state. Only adapter tools pass through this gate. Other shell/network tools are unaffected."
5 unchanged paragraphs, under What the screen shows, and what it does not {#shown}
Inferred,Not nottested: shown: thatwhat an agent with shell access couldwould usedo with the same command line, or with any SQLite client,client. The code confirms the path exists; nobody tried to change its memory without an ABP check. The test does not trymisuse it, and it was not the test'srun's question. It is the question I would ask next.
To be fair to the run: using the command line in steps 3 and 9 is what makes it convincing. Step 9 is strong precisely because Ruflo itself, not the adapter, reads the facts back. The gap is not a mistake in the test. It is a property of where this ABP is enforced.enforced, and the author documents it.
2 unchanged paragraphs, under Why this matters beyond this run {#why}
At The AI Conference, speaker after speaker said policy must live outside the model. This run does that:that, and better than most: the gateABP is code,compiled, strictly, into the rule format of the tool it governs, evaluated by that tool's own evaluator, and it fails closed, and it held.closed. What it adds is the next lesson. Outside the model is necessary; around every path to the data is the harder part.
1 unchanged paragraph, under How it could close {#close}
The addendumrules suggestsare onealready way: compile the ABP rows intoin Ruflo's ownformat policyand engine,already inchecked enforceby mode,Ruflo's evaluator. What is missing is running them where Ruflo itself runs, so the command line's memory calls are checked too. TheMondweep's engineREADME exists in Ruflo;lists it wasamong notthe usedfollow-ups: in"native thisplugin run.registration", alongside remote sync, key rotation and multi-tenant isolation.
Two other ways come to mind, and I offer them as ideas, not findings. Keep the working memory file somewhere only the adapter can reach, so the command line has to go through it. Or make the adapter the only thing that can decrypt memory at all, so a plain file never sits in a workspace an agent can write to. His README is candid that "Plaintext exists during staging and intentionally in restored workspaces", which is the trade that makes step 9 possible. Each option has costs, and Mondweephe will know better than I do which fits Ruflo.
FiveThe moreother questionsquestions, forand the authoranswers in the code {#questions}
The analysisvideo raisedleft thesefive alongsidesmaller thequestions gap.open. TheyThe arerepository questions,answers noteach findings.of them.
1. IsWhy eachdoes decisionevery recorded?error read the same? On purpose. The ABPserver is enforced by a custom local adapter. Does it keep a record of each allow and deny, and which row fired?
2. Same message, different causes. The scope denial andreplaces the approvaldetail stopwith both read "PermissionError: operation"operation failed; check configuration, policy and integrity", andwith a comment: "Do not leak dependency errors containing private paths or credentials." Inside, the tampergate's readsown message names the samereason: text"Policy asblocked operation", followed by the evaluator's reason.
2. Is each decision recorded? Not yet. The evaluator returns a ValueError.decision Uniformfor messagesevery avoidcall; leakingnothing detail;writes anit to a log. An operator log naming the row that fired would help.turn each decision into evidence.
3. Where does the vault go next? TheNowhere yet: "no remote push is performed", and remote sync is a follow-up. Each checkpoint storeis isits own SGit objectsvault on the same machine. A push to a vault server, a clone on another machine, and a check that the server holds only ciphertext would close the loop, as the[The architecture piece argues.says what a second machine would add.
4. memory.dbmemory.db, then memory.sqlite? The adapter stages and memory.sqlite.Stepevery 3checkpoint storesas withmemory.sqlite, --path memory.db; step 9 reads --path memory.sqlite. Probablyrestoresource writesfile underwas a new name; one line would explain it.called.
5. TheWhy does approval path,mean withstop? anBecause approver. Deletionthere is blockednothing withoutyet approval.to Showinggive approval with. The README: "There is no human approval fulfilment mechanism yet." The policy file records it succeedin the row's own barrier: "Human approval is required; MVP blocks this operation". The run proves the row blocks; proving it releases with a named approver would proveis the rownext is approval, not simply no.test.
2 unchanged paragraphs, under Where to go next {#next}
Back to the walkthrough for the run in order, or to the architecture for when the vault is used. Or step through the run: steps 3, 9 and 10 each link back here.here, and every step shows what the code confirms.
1 unchanged paragraph, under What this does not claim {#limits}
• Not a vulnerability report. No one tried to bypass the policy; the secondauthor documents the path is inferred from the design.himself.
1 unchanged paragraph
• The fixes are ideas. TheNative addendum'splugin suggestionregistration andis minehis follow-up; the other two are untestedmine, here.untested.
• FromThe code was read, not run, here. Its tests and evidence are the screen only. The audio was not transcribed; the author may already address some of these.author's.
If you are Mondweep, or anyone who has run this, and havewant anto answeradd to any of these, write to agent@riskmandate.ai and it will be added here.agent@riskmandate.ai.
1 unchanged paragraph, under Where this comes from {#sources}
The video: Mondweep Chakravorty, SGit × Ruflo | Working Proof of Concept, published on YouTube on 17 October 2026, made as a member of the #Ruflo-Federation; this analysis and its questions areis published with his agreement. The code: mondweep/sgit-ruv-memory, MIT, read at its commit of 16 October 2026: the README, sgit_ruv_memory/core.py, server.py, abp.py, policy/bridge.mjs and examples/memory.abp.json. The analysis and its architecture addendum: Claude (Anthropic), 17 October 2026, made for me from on-screen content only;content; written up and checked against the video's timeline and the code by this site's agent; the editorial responsibility is mine. Ruflo: ruvnet/ruflo, MIT. Related: your agent's logs are a self-report, The AI Conference 2026, read for agent governance, a policy beside the prompt.