release(alpha.43+44): pin neural→sona@0.1.5, republish modules w/ sta…

…ndalone READMEs, add npm download badges everywhere (#2022)

This commit closes the chain started in ca0a6fa (standalone use recipes
landed in repo but never reached npm because no version bumps shipped).

## Changes

### Module version bumps (alpha.43)
- @claude-flow/memory     → 3.0.0-alpha.17  (republish standalone use README)
- @claude-flow/embeddings → 3.0.0-alpha.18  (republish standalone use README)
- @claude-flow/security   → 3.0.0-alpha.8   (republish standalone use README)
- @claude-flow/neural     → 3.0.0-alpha.9   (pin @ruvector/sona to 0.1.5,
                                             republish standalone use README)
- @claude-flow/cli        → 3.7.0-alpha.43  (repin to new modules above)
- claude-flow             → 3.7.0-alpha.43  (umbrella)
- ruflo                   → 3.7.0-alpha.43  (umbrella)

### Umbrella bump (alpha.44) — npm download badges
- @claude-flow/cli        → 3.7.0-alpha.44
- claude-flow             → 3.7.0-alpha.44
- ruflo                   → 3.7.0-alpha.44

### Neural sona pin (root fix for #2022)
@claude-flow/neural alpha.8 had `"@ruvector/sona": "latest"`, and
@ruvector/sona@0.1.6 (current latest on npm) shipped as an empty publish
— README + package.json only, no index.js or native bins. So every
fresh `npm install @claude-flow/neural@alpha.8` broke at import time
with `Cannot find package '.../node_modules/@ruvector/sona/index.js'`.

Alpha.9 pins to the exact known-good 0.1.5 (which has index.js + 7
platform-specific .node bins). Will revert to a range once
@ruvector/sona@0.1.7+ ships with content (tracked in #2022).

### npm download badges across every published package README
Added `shields.io/npm/dm/<pkg>` (monthly downloads) badges to:
  - claims, cli-core, plugins (had no npm badges at all)
  - plugin-agent-federation, plugin-iot-cognitum (no npm badges)
  - browser, codex, mcp (had version badge, missing downloads)
  - umbrella root README (now badges both `ruflo` + `claude-flow`)
The ruflo/README.md and v3/@claude-flow/cli/README.md auto-copy from
root via prepublishOnly, so they inherit the new badges on publish.

Packages that already carried downloads badges (aidefence, deployment,
embeddings, guidance, hooks, integration, memory, neural, performance,
providers, security, shared, swarm, testing) are unchanged.

## Live functional check on the published artifacts

  - Fresh `npm install @claude-flow/neural@3.0.0-alpha.9`:
    sona resolves to 0.1.5; `import('@claude-flow/neural')` returns
    A2CAlgorithm, BalancedMode, BaseModeImplementation, BatchMode,
    CuriosityModule, ... (was broken before alpha.9).
  - Standalone use sections from ca0a6fa now visible on npmjs.com for
    memory@alpha.17, embeddings@alpha.18, security@alpha.8, neural@alpha.9.
  - npm dm/ badges resolve and render the current weekly download count.

Co-Authored-By: RuFlo <ruv@ruv.net>

fix(browser): #2015 round 2 — strip bogus --kind flag, ship alpha.42

Round 1 (alpha.41) added the required --dimension flag to
`ruvector rvf create` but left the equally bogus `--kind browser-session`
in place. ruvector@0.2.25's `rvf create` accepts only:

  -d, --dimension <n>    (required)
  -m, --metric <metric>  (optional, default cosine)

Commander's required-option check fires before its unknown-option
check, so the original bug report (#2015) only surfaced the dimension
error. The fresh live regression check after publishing alpha.41
exposed the second-layer bug: `error: unknown option '--kind'`.

This round:
- Strip `--kind browser-session` from all 5 call sites (TS source,
  compiled dist via rebuild, replay-spike.sh, browser-agent.md,
  browser-record/SKILL.md). Also fixed the ADR prose example.
- Tighten the smoke (scripts/smoke-browser-rvf-create-flags.mjs):
  - Switch from rg-based content scan to an explicit PATHS_IN_SCOPE
    list (the original `--kind browser-session` anchor is gone, so
    we can no longer identify call sites by content).
  - Police BOTH invariants per line:
      * --dimension / -d is present
      * --kind is ABSENT (since ruvector@0.2.25 rejects it)
  - Skip quoted-string false positives ('rvf create failed' log lines).

Versions:
  @claude-flow/cli    3.7.0-alpha.42
  claude-flow         3.7.0-alpha.42
  ruflo               3.7.0-alpha.42
  @claude-flow/memory 3.0.0-alpha.16  (unchanged, #2019 fix already live)

Post-publish live functional check (everything green):
- ruvector rvf create --dimension 384 (no --kind): exit 0, .rvf file
  written. Reproduces what the MCP tool now invokes.
- Published CLI dist:113 carries '--dimension','384', no --kind.
- #2019 vectorBackend / graphAdapter functional test from
  alpha.41 still passes against published memory@3.0.0-alpha.16.
- verify.mjs precondition contract still holds.

Co-Authored-By: RuFlo <ruv@ruv.net>

fix(verify+memory+browser): #1880, #2019, #2015 — three precondition/…

…contract fixes + CI guards

Three small but recurring bugs ship together because they share the
same anti-pattern: a try/catch (or a missing flag) silently turned a
clear precondition failure into a vague "verification failed" /
"controller disabled" / "rvf create failed" outcome that downstream
consumers couldn't act on.

#1880 — witness verify exits 1 on source-only checkouts
  - The 12h scheduled verification has been filing a duplicate
    "HIGH — verification broken" issue every cron run since 2026-05-10
    because the runner does a source-only checkout (no @noble/ed25519
    install, no `npm run build`) and verify.mjs lumped that into the
    same exit-1 bucket as a real signature regression.
  - verify.mjs now reserves exit 2 strictly for precondition misses:
      * @noble/ed25519 not installed                → exit 2
      * every manifest entry missing AND manifest   → exit 2
        references /dist/ paths (= "dist not built")
    Real failures (signature invalid, specific marker regressed)
    keep exit 1. The scheduled runner can now distinguish
    "needs install/build" from "we broke something".
  - New CI guard: scripts/smoke-witness-verify-precondition.mjs
    drives all three shapes (missing dep, all-files-missing,
    built tree) and asserts the exit code contract.
  - Wired into v3-ci.yml as witness-verify-precondition-smoke and
    into witness-verify's `needs:` so a contract break blocks publish.

#2019 — vectorBackend controller permanently disabled
  - @claude-flow/memory's controller-registry.ts calls
    agentdb.getController('vectorBackend'). agentdb@3.0.0-alpha.14's
    getController switch only handles memory/reflexion/skills/causal
    and throws `Unknown controller: vectorBackend` for everything else
    — silently swallowed, leaving the controller `enabled: false`
    even though `agentdb.vectorBackend` is a real field on the
    instance (assigned in AgentDB.initialize()).
  - Registry now probes `agentdb[name]` directly first, falls back to
    getController only when the field is absent. Applied to all three
    accessor paths (initializeController, get, isEnabled).
  - RuntimeConfig gains an optional `agentdb` injection field so
    tests and consumers with a pre-built AgentDB can govern it via
    the registry.
  - Two new tests in controller-registry.test.ts cover both branches
    (direct property wins; falls back to getController when absent).
  - Full controller-registry suite stays green (67 tests).

#2015 — ruflo-browser session_record fails every call
  - ruvector@0.2.25 makes `-d, --dimension <n>` required on
    `rvf create`. The browser_session_record MCP tool wrapper invoked
    `rvf create … --kind browser-session` WITHOUT the flag, so every
    call returned `{ success: false, error: "rvf create failed" }`.
  - All five call sites updated to pass `--dimension 384` (matches
    MiniLM-L6 / AgentDB index default):
      v3/@claude-flow/cli/src/mcp-tools/browser-session-tools.ts
      plugins/ruflo-browser/scripts/replay-spike.sh
      plugins/ruflo-browser/agents/browser-agent.md
      plugins/ruflo-browser/skills/browser-record/SKILL.md
      plugins/ruflo-browser/docs/adrs/0001-browser-skills-architecture.md
  - New CI guard: scripts/smoke-browser-rvf-create-flags.mjs
    statically scans every `rvf create … --kind browser-session`
    invocation across the repo (TS, dist, shell, markdown) and
    fails if any is missing --dimension / -d.
  - Wired into v3-ci.yml as browser-rvf-create-flags-smoke and into
    witness-verify's `needs:` so a regression blocks publish.

Cases covered by guards: source-only checkout (no deps), source-only
checkout with build, built tree, missing dimension flag on TS/dist/
shell/markdown call sites. The smokes are independent jobs so the CI
summary names the specific contract that broke.

Co-Authored-By: RuFlo <ruv@ruv.net>

v3.7.0-alpha.33 — 14 critical fixes since alpha.27

chore(release): 3.7.0-alpha.23 — ships #1863 task-status crash fix + #…

…1899 hooks rename

All 3 packages on alpha+latest+v3alpha atomically:
  @claude-flow/cli@3.7.0-alpha.23
  claude-flow@3.7.0-alpha.23
  ruflo@3.7.0-alpha.23

Includes:
  - #1863 — guard undefined arrays in `task status` (no more TypeError)
  - #1863 — new cli-no-crash CI smoke (task create→status + list formatters)
  - #1899 — ruflo-core hooks call `npx ruflo@alpha` not `npx claude-flow@alpha`
    (in-tree; marketplace republish of ruflo-core@0.2.2 still pending)

Co-Authored-By: RuFlo <ruv@ruv.net>

chore(release): 3.7.0-alpha.22 — ADR-112 tool discoverability + #1889 …

…paired-tool round-trip + #1892 statusline

Published with all 3 packages on alpha+latest+v3alpha atomically:
  @claude-flow/cli@3.7.0-alpha.22
  claude-flow@3.7.0-alpha.22
  ruflo@3.7.0-alpha.22

Ships #1897 — see release notes for the user-facing overview.

Co-Authored-By: RuFlo <ruv@ruv.net>

docs(userguide): update for v3.7 — substrate upgrades + agentdb delet…

…e tools

- Header: v3.5 -> v3.7 reference; surface npx ruflo@latest version
- New "What is new in 3.7" section covering: cli-core split (alpha.5+),
  Thompson sampling router (alpha.5), neural@3.0.0-alpha.8 substrate
  upgrades (persistence / seedable RNG / self-consistency / Flash Attention
  + MoE migration / retrieval-path observability / SEO keywords), and the
  3 new agentdb_*-delete MCP tools (alpha.8)
- AgentDB integration: bumped reference 3.0.0-alpha.10 -> 3.0.0-alpha.13
  and called out the new Cypher-routed delete API

End-user CLI surface unchanged. The "What did not change" callout makes
that explicit so 3.6 users can upgrade without relearning anything.

Co-Authored-By: RuFlo <ruv@ruv.net>

fix(daemon): break IPC pipe so background daemon survives parent exit…

… on Windows (#1766)

The Liberation reporter (Zarkk1zz) diagnosed this cleanly. On Windows
+ Node 25, \`npx claude-flow daemon start\` reported success then the
spawned daemon died ~1s later. PR #1719 (v3.6.13) fixed the previous
\`spawn(..., {shell:true})\` bug, but the new \`fork(..., { stdio:
[..., 'ipc'] })\` path left the IPC channel open. \`child.unref()\`
releases the libuv handle but does NOT close the IPC pipe — and on
Windows, that pipe is what tied the daemon's lifetime to the parent
npx wrapper. When npx exited, the pipe tore down and the daemon went
with it.

Fix in v3/@claude-flow/cli/src/commands/daemon.ts:

  - detached: !isWin   →   detached: true   (every platform)
  - After child.unref(), call child.disconnect() (wrapped in try)
    to explicitly break the IPC pipe.

POSIX-tested locally: macOS daemon start/stop roundtrip works, daemon
survives parent exit (PID stays RUNNING after the parent shell exits).
Windows path is what changes meaningfully — detached:true gives the
child its own session/pgid, disconnect() severs the IPC pipe, daemon
genuinely stands on its own.

Bumps all three packages to 3.7.0-alpha.3:
  @claude-flow/cli   3.7.0-alpha.1 → 3.7.0-alpha.3
  claude-flow        3.7.0-alpha.1 → 3.7.0-alpha.3
  ruflo              3.7.0-alpha.2 → 3.7.0-alpha.3

(Skipped alpha.2 on cli/claude-flow because ruflo already used that
slot for the dep-range fix — keeping all three aligned at .3.)

Closes #1766

Co-Authored-By: RuFlo <ruv@ruv.net>

chore(release): 3.7.0-alpha.1 — cli-core split alpha

Bumps three packages to 3.7.0-alpha.1 to ship the cli-core split:

  - @claude-flow/cli      3.6.30 → 3.7.0-alpha.1
  - claude-flow           3.6.30 → 3.7.0-alpha.1
  - ruflo                 3.6.30 → 3.7.0-alpha.1

Also published @claude-flow/cli-core@3.7.0-alpha.5 (was already on `alpha`
tag; this release promotes it to `latest` since the cli now depends on it).

What changed (architectural):
  - New @claude-flow/cli-core package (~156 KB unpacked, JSON-backed memory,
    no SQLite/HNSW/ONNX) for plugin authors who want fast cold-cache spawn
  - @claude-flow/cli now depends on cli-core, with 4 foundation modules
    (types, output, mcp-tools/types, mcp-tools/validate-input — 1,229 LOC)
    re-exported from cli-core instead of duplicated
  - 8 plugin scripts (6 cost-tracker + 2 ruflo-adr) opt into the lite path
    via CLI_CORE=1 — when set, they spawn cli-core@alpha (~1.5s cold) instead
    of cli@latest (~35s cold). 22.9× cold-cache speedup measured

What didn't change (intentional):
  - cli's full feature surface — same 26 commands, 140+ subcommands, same
    SQLite/HNSW/ONNX semantic search, same MCP tool registry. The lite path
    is OPT-IN for plugin authors; default behavior is unchanged.

Refs ADR-100, #1748 Issue 3, #1760, #1764

Co-Authored-By: RuFlo <ruv@ruv.net>

Ruflo 3.6.30 — #1748 Issue 4 first batch (sharpen high-overlap tool d…

…escriptions)