It says OK. Your agent's memory just stopped reaching disk.

Four separate things can go quietly wrong under one healthy-looking AI agent stack — and every one of them fails silently.

Say your coding agent is supposed to remember what it learned last week: where the bugs live, which fixes worked. One day an ordinary background package upgrade runs. Nothing crashes. The tool still prints "saved." But underneath, the small embedded database file it writes to (SQLite — a local data file, not a server) can quietly lose its fast native connection and fall back to a slower substitute that never actually finishes the write. The agent keeps working. It just forgets, silently, forever.

Reinstalling doesn't reliably fix it either. A newer version of npm (the tool that installs JavaScript packages) started blocking, by default, the exact install step that builds that fast database connection — a reasonable security precaution against packages running arbitrary code on install. It just means a plain reinstall can leave you back on the broken, forgetful path, with no error telling you so.

A related package the agent depends on for catching hostile instructions hidden in text (prompt-injection defense) can simply stop being included in a later release. The guard you assume is running isn't there — and nothing says so.

Add background helper processes that can keep running and spending API credits after you've moved on, and a pattern-memory file that can corrupt if a process is killed mid-write, and you get a stack that looks healthy in every log line while quietly accumulating exactly the kind of failure nobody notices until the agent gives a wrong, forgetful answer at the worst moment.

The problem

not hypotheticalThe dropped prompt-injection guard was traced and filed upstream as ruvnet/ruflo issue #2670 — one of six issues this kit's verification work has surfaced.

You never install ruflo or agentic-qe yourself. ak setup installs them, ak status shows what's true, ak sync converges everything to good, and ak uninstall leaves cleanly — each ending in something checkable, not just an assurance.

The big idea

The clever move isn't the healing logic itself; it's refusing to declare victory on a message. During setup, agentic-kit writes a real probe key into the memory store, then reads that exact row back from disk before it will say VERIFIED.

If the fast native path is still broken, THIS is the first thing that fails — loudly, at setup, with a named fix — instead of the thing you discover three weeks later when the agent has forgotten everything.

The aha

oh — it doesn't ask ruflo whether memory works. It writes a key, waits for the disk, and reads that exact row back. No confirmed row, no VERIFIED.

A thin CLI hands off to a command router (setup / status / sync / uninstall), which calls a shared healer library — the same functions ported from a battle-tested shell predecessor — that inspects and repairs your machine's global ruflo and agentic-qe installations.

ak sync is the one convergence verb: it upgrades ruflo + agentic-qe first (when a newer release exists), re-heals everything an upgrade may have wiped — native bindings, the security guard, daemon supply, CLAUDE.md guidance blocks — then re-runs the same write-and-read-back probe from setup, and only then self-updates the kit itself, as the last step, so new code never applies mid-sync.

Architecture

Data flow

Both commands below are read-only or dry-run — real output, captured straight from this repo's own CLI, nothing staged.

ak status
  ✓ versions   ruflo 3.30.2 (latest)
  ✓            agentic-qe 3.12.2
  ✓ self       kit 4.0.0-alpha.4
  ⚠ natives    no agentdb found
               → sync installs ruflo
  ⚠ security   security pkg missing
  ⚠ mcp        ruflo MCP unregistered
  ⚠ daemons    14 running, 1 stale
               → sync reaps stale ones
  ⚠ blocks     4 CLAUDE.md drifted

sync plan (5 action(s)):
• [natives] install ruflo
  because: no agentdb found
• [mcp] register claude-flow
  because: MCP unregistered
• [mcp] migrate legacy key
  because: old registration found
• [daemons] reap stale ones
  because: 1 stale daemon
• [blocks] reconcile CLAUDE.md
  because: 4 block(s) drifted

Requirements: Node ≥22, npm, and the claude CLI. That's the whole list — ruflo and agentic-qe are not prerequisites.

npm install -g @pacphi/agentic-kit@next

1. 1. Install the kit npm install -g @pacphi/agentic-kit@next — the only package you ever install by hand.
2. 2. Run setup once per machine ak setup — installs ruflo + agentic-qe globally, working around npm's allow-scripts gate so native bindings actually build. Run it inside a git repo and it also sets up that project: pinned memory path, a verified store→disk write, a local-only ($0) daemon.
3. 3. See what's true ak status — a per-subsystem ✓/⚠/✗ dashboard, read-only, in under a second. You will see one line per subsystem, like ✓ versions ruflo 3.30.2 (latest), with any ⚠ row naming the exact fix.
4. 4. Preview, then converge ak sync --dry-run shows the exact plan and why; run ak sync (no flag) to upgrade, heal, and re-verify in one pass — it self-updates the kit last, so new code never applies mid-run. A clean run ends with every row ✓ and, inside a project, the setup receipt memory write VERIFIED (store → on-disk row confirmed).
5. 5. Leave cleanly, any time ak uninstall (or --purge for the global packages) — your project data is never touched.

Everything above came from a real vector knowledge base built from this exact repo — not a summary. Download the same base as a drop-in pack so your own AI agent can answer questions about agentic-kit from real passages, not a guess.