fix: npm publish-hygiene + core bugs (#354 #323 #376 #417 #415 #372 #422 #437 #367 #438) + regression-guard CI

[ruvnet]

Summary

Closes a cluster of "the published artifact / running code is structurally broken" issues, plus two concrete core bugs, and adds a Regression Guard workflow so they can't silently come back.

npm packaging

• ONNX WASM files not bundled on clean insteall #354 / ONNX embedder fails on Node 22 LTS with 'Unknown file extension .wasm' #323 — ruvector: ONNX wasm runtime assets are now copied into dist/ (new scripts/copy-onnx.js) and src/core/onnx/ added to files; the ONNX loader reads the .wasm via fs + WebAssembly.instantiate instead of an ESM wasm-module import (no --experimental-wasm-modules on Node 18–24). → ruvector@0.2.26.
• npm package fails to import in 0.2.23 because published tarball is missing dist/index.js #376 — scripts/verify-dist.js rewritten: hard-fails on missing dist/index.js + the 6 ONNX assets, asserts dist/ is in files; still runs from prepublishOnly after build.
• CLI commands that take a <database> path are broken on freshly-created DBs (and embed text fails on missing ONNX bundle) #417 — ruvector CLI: db-path subcommands (insert/search/stats/export/import) read a <db>.meta.json sidecar instead of JSON.parse-ing the redb binary; all those handlers are now async + await the wrapper; correct option names (dimensions, k, …); embed text gives an actionable error when the ONNX bundle is missing.
• @ruvector/rvf-wasm@0.1.6 is unloadable: pkg/rvf_wasm.js mixes ESM syntax (import.meta, export default) into CJS-classified file #415 — @ruvector/rvf-wasm repackaged ESM-only (type: module, exports → .mjs, removed the mixed module.exports / export default) → 0.1.7; @ruvector/rvf switched to a downlevel-safe dynamic import() → 0.2.1. Tarball load-tests pass on Node 22.
• MCP brain_* tools fail with ERR_PACKAGE_PATH_NOT_EXPORTED — bin/mcp-server.js require()s ESM-only @ruvector/pi-brain #372 — the ruvector MCP server loads @ruvector/pi-brain via await import (it is ESM-only) instead of require (11 sites); the MODULE_NOT_FOUND checks also accept ERR_MODULE_NOT_FOUND / ERR_PACKAGE_PATH_NOT_EXPORTED.
• MCP tool hooks_route_enhanced returns 'spawnSync /bin/sh ETIMEDOUT' while CLI 'ruvector hooks route-enhanced' runs in <200ms #422 — hooks_route_enhanced calls the local cli.js directly (execFileSync(node, [cli.js, …])) instead of npx ruvector … — npx cold-start was burning the 30 s budget.

core

• deadlock: VectorDb::delete double-acquires stats RwLock #437 — VectorDB::delete no longer acquires self.stats.write() twice in one expression (parking_lot self-deadlock). Regression test added (timeout-guarded thread).
• EphemeralAgent::get_patterns() returns an empty list because of a stub-shaped internal call #367 — sona EphemeralAgent::get_patterns / FederatedCoordinator no longer call find_patterns(&[], 0) (always empty) → get_all_patterns().
• ruvector-core: avx512f intrinsics force nightly toolchain on all dependents #438 — ruvector-core avx512f intrinsics gated behind an opt-in simd-avx512 Cargo feature (OFF by default); dispatch falls through to AVX2/scalar when not compiled. Stable cargo check -p ruvector-core is clean.

CI / CD

• .github/workflows/regression-guard.yml + scripts/ci/check-npm-package-integrity.mjs — npm pack tarball file-presence + node --check + load-without-packaging-error for ruvector & @ruvector/rvf-wasm; a stable-toolchain build guard (ruvector-core: avx512f intrinsics force nightly toolchain on all dependents #438); bans npx in the hooks_route_enhanced MCP handler (MCP tool hooks_route_enhanced returns 'spawnSync /bin/sh ETIMEDOUT' while CLI 'ruvector hooks route-enhanced' runs in <200ms #422) and require('@ruvector/pi-brain') in the MCP server (MCP brain_* tools fail with ERR_PACKAGE_PATH_NOT_EXPORTED — bin/mcp-server.js require()s ESM-only @ruvector/pi-brain #372); checks the pgrx version pin is documented (cargo build --release fails out of the box due to pgrx version mismatch #331).
• .github/workflows/publish-fixed-packages.yml — tag/dispatch publish for ruvector + @ruvector/rvf-wasm + @ruvector/rvf (the packages the per-feature build-*.yml workflows don't cover): dry-run by default, gated on the regression guard, skips already-published versions, npm provenance. No publishes are performed by this PR.
• cargo build --release fails out of the box due to pgrx version mismatch #331 — verified crates/ruvector-postgres/README.md already pins cargo install cargo-pgrx --version "0.12.9" --locked; the CI guard now keeps it documented.

Validation

• cargo check --workspace --exclude ruvector-postgres → clean (warnings only).
• Touched-crate tests pass: ruvector-router-core::delete_does_not_deadlock, sona ... federated (6), ruvector-core ... simd_intrinsics (18).
• npm run build + npm run verify-dist + npm pack --dry-run for ruvector → ONNX assets + dist/index.js present; node scripts/ci/check-npm-package-integrity.mjs → all green.
• @ruvector/rvf-wasm packed tarball: dynamic import() of .mjs and await init() succeed on Node 22.
• No tests were deleted; no test became newly-failing. (The 13 pre-existing ruvector npm-test failures — brain agi / midstream / brain search --verbose help text — are unrelated and untouched.)

Not in this PR (deferred — see issue notes)

• ruvector-router-core HNSW: search returns 0 results from inserted vectors at scale (recall@1 << 1.0) #430 HNSW recall@1 collapse at scale — LARGE (heap-orientation rework + lock-ordering + scale tests); deserves its own PR. An upstream patch exists.
• Missing embedder binary: obsidian-brain references ruvultra-embedder which does not exist #455 missing ruvultra-embedder HTTP binary — touches a separate repo (obsidian-brain) and needs a naming decision (ruvllm-embedder vs ruvultra-embedder).
• SQL migration references wrong symbol names for type I/O functions #325 SQL migration symbol names — the real fix is cargo pgrx schema generation / a pgrx 0.17 migration across the whole pg extension (couples with cargo build --release fails out of the box due to pgrx version mismatch #331); only the doc-note part is cheap and is already present.
• Per-environment crate publishing for the changed crates (ruvector-core, ruvector-router-core, sona) — these are internal workspace members, not currently on crates.io; the existing publish-all.yml only publishes ruvector-math / ruvector-attention.

🤖 Generated with claude-flow