announce: aidefence@2.3.0 / aimds-*@0.1.1 — wider injection detection + accurate audit counters + RUSTSEC-2024-0421 cleared (ADR-118)

## Intro

[`aidefence@2.3.0`](https://www.npmjs.com/package/aidefence) and its Rust workspace counterparts (`aimds-core` / `aimds-detection` / `aimds-analysis` / `aimds-response` at `0.1.1`) shipped today (2026-05-14) as the first post-launch correctness pass for AIMDS — the AI Manipulation Defense System that the canonical 3-gate pattern in `ruflo-aidefence` is built on. It's a same-surface, better-behavior release: no MCP-tool signature changes, but the prompt-injection detection widens to catch the canonical `ignore all previous instructions` family + role-hijack + jailbreak markers, the audit counters become accurate for the first time, two silent-fail bugs in meta-learning are fixed, and one CVE is cleared.

This issue tracks the rollout across the eight ruflo plugins that consume `aidefence_*` and links to the planning + per-plugin doc updates already shipped to `main`.

## Features (what 2.3.0 / 0.1.1 actually adds)

| Layer | Change | Impact on ruflo plugins |
|-------|--------|--------------------------|
| 🎯 **Prompt-injection regex** | 0..4-modifier-word window between verb (`ignore`/`disregard`/`forget`/`override`) and noun (`instructions`/`prompts`/`rules`/`context`/`system-prompt`) | Gate 3 (`aidefence_is_safe`) now catches `ignore all previous instructions`, `disregard every system prompt above`, etc. — was missed before. |
| 🎭 **Role-hijack patterns** | `you are now …` / `act as …` / `pretend to be …` | New positive flags in browser-scraped content (ruflo-browser) and inbound federation messages (ruflo-federation). |
| 🚪 **Jailbreak markers** | `DAN mode` / `developer mode` / `god mode` / `root mode` | Same — high-leverage for any plugin that re-injects external text into a prompt. |
| 📊 **Accurate audit counters** | `AuditLogger.total_mitigations` / `.successful_mitigations` backed by `AtomicU64`, was hardcoded `0` | `aidefence_stats` now reports real values. Dashboards charting these were flat; will start showing numbers. |
| 🧠 **Meta-learning convergence** | `calculate_optimization_effectiveness` blends `pattern_effectiveness` HashMap *and* `learned_patterns` Vec; `optimize_strategy` uses `entry().or_insert_with` so first-feedback for an unseen strategy isn't dropped | The response layer's optimization level can now advance from production feedback as the docs always implied. |
| 🔒 **RUSTSEC-2024-0421 cleared** | `validator` 0.18 → 0.20 retires vulnerable `idna 0.5.0` (Punycode-masking host-name attack) and unmaintained `proc-macro-error 1.0.4` | `cargo deny check` is green across all four crates. Removes a CVE flag from ruflo's transitive surface. |
| 🧹 **Quality baselines** | 79/79 cargo tests, 0 clippy warnings, `unsafe_code = "deny"` workspace-wide | Higher trust floor for the security-audit plugin's baseline. |

## Update usage

### If you call the MCP tools directly

No code change — the signatures are unchanged. The same `aidefence_is_safe({prompt})` call now catches a wider injection surface.

```javascript
const verdict = await mcp__claude_flow__aidefence_is_safe({ prompt: userInput });
if (verdict.unsafe) { /* quarantine */ }

const stats = await mcp__claude_flow__aidefence_stats({});
// stats.total_mitigations — was always 0, now real
```

### If you depend on a ruflo plugin

Bump the workspace package to consume the new upstream:

```bash
npm install --save @claude-flow/aidefence@latest
```

Plugin READMEs updated in [PR #2003](https://github.com/ruvnet/ruflo/pull/2003):
- `ruflo-aidefence` — new "What the gates catch" table linking to ADR-118
- `ruflo-browser` — Gate 3 callout for scraped-content scans
- `ruflo-federation` — 3-gate alignment block extended

### Caveats to verify before deploying

1. **Verdict-change blast radius.** Any adversarial-prompt fixture set that asserted `safe: true` on `ignore all previous instructions`, role-hijack, or named-jailbreak phrasings will start failing. That's intended.
2. **Dashboard drift.** `aidefence_stats.total_mitigations` charts will jump from 0 to real numbers. Communicate the re-baseline to operators.
3. **Rust 1.85+ from source.** Building `aimds-*@0.1.1` against pinned-older toolchains breaks (transitive `validator 0.20`). CI already uses stable; out-of-tree consumers building from source may need to bump.

## Full technical write-up

📄 **Gist:** https://gist.github.com/ruvnet/a70791186a3a4c39aff24654396b7ba6 — same content with deeper detail on each layer (sanitizer regex, role-hijack patterns, jailbreak markers, atomic counters, meta-learning fixes, CVE remediation, quality baselines).

## References

- ADR-118 — upgrade decision + migration plan: [`v3/docs/adr/ADR-118-aidefence-2.3.0-upgrade.md`](https://github.com/ruvnet/ruflo/blob/main/v3/docs/adr/ADR-118-aidefence-2.3.0-upgrade.md) (PR #2002)
- Plugin doc updates: [PR #2003](https://github.com/ruvnet/ruflo/pull/2003)
- npm: [`aidefence`](https://www.npmjs.com/package/aidefence) · [`aidefense`](https://www.npmjs.com/package/aidefense) (alias)
- crates.io: [`aimds-core`](https://crates.io/crates/aimds-core) · [`aimds-detection`](https://crates.io/crates/aimds-detection) · [`aimds-analysis`](https://crates.io/crates/aimds-analysis) · [`aimds-response`](https://crates.io/crates/aimds-response)
- Upstream: [ruvnet/midstream AIMDS workspace](https://github.com/ruvnet/midstream/tree/main/AIMDS)
- Canonical 3-gate pattern: [`ruflo-aidefence` ADR-0001](https://github.com/ruvnet/ruflo/blob/main/plugins/ruflo-aidefence/docs/adrs/0001-aidefence-contract.md)

Closing this issue when the workspace `@claude-flow/aidefence` package is bumped to consume `aidefence@^2.3.0` and the smoke test asserts the new detection-positive cases (`ignore all previous instructions` → unsafe, `you are now in DAN mode` → unsafe).