fix: ruvector-postgres v0.3.1 — audit bug fixes, 46 SQL functions, Docker publish

.gcloudignore

@@ -0,0 +1,24 @@
+# Cloud Build ignores — keep context under 50 MiB
+target/
+node_modules/
+.git/
+examples/
+benchmarks/
+docs/
+scripts/
+bindings/
+npm/
+test_models/
+*.wasm
+*.so
+*.o
+*.a
+*.d
+*.rlib
+*.rmeta
+*.dwo
+*.dwp
+*.node
+*.db
+.claude/
+package-lock.json

.github/workflows/sync-rvf-examples.yml

@@ -0,0 +1,82 @@
+name: Sync RVF Examples to GCS
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'examples/rvf/output/**'
+      - 'examples/rvf/generate_examples.rs'
+      - 'scripts/generate-rvf-manifest.py'
+  workflow_dispatch:
+    inputs:
+      force_sync:
+        description: 'Force sync even without changes'
+        type: boolean
+        default: false
+
+env:
+  GCS_BUCKET: ruvector-examples
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set version
+        run: |
+          VERSION=$(jq -r .version npm/packages/ruvector/package.json)
+          echo "VERSION=$VERSION" >> $GITHUB_ENV
+          echo "Syncing version: $VERSION"
+
+      - name: Generate manifest
+        run: |
+          python3 scripts/generate-rvf-manifest.py \
+            --input examples/rvf/output/ \
+            --version ${{ env.VERSION }} \
+            --output examples/rvf/manifest.json
+
+      - name: Generate checksums
+        run: |
+          cd examples/rvf/output
+          sha256sum *.rvf > checksums.sha256
+
+      - name: Authenticate to Google Cloud
+        if: github.ref == 'refs/heads/main'
+        uses: google-github-actions/auth@v2
+        with:
+          workload_identity_provider: ${{ secrets.GCP_WIF_PROVIDER }}
+          service_account: ${{ secrets.GCS_SERVICE_ACCOUNT }}
+
+      - name: Upload examples to GCS
+        if: github.ref == 'refs/heads/main'
+        uses: google-github-actions/upload-cloud-storage@v2
+        with:
+          path: examples/rvf/output/
+          destination: ${{ env.GCS_BUCKET }}/v${{ env.VERSION }}/
+          glob: '*.rvf'
+
+      - name: Upload manifest and checksums
+        if: github.ref == 'refs/heads/main'
+        run: |
+          gsutil cp examples/rvf/manifest.json gs://${{ env.GCS_BUCKET }}/v${{ env.VERSION }}/manifest.json
+          gsutil cp examples/rvf/output/checksums.sha256 gs://${{ env.GCS_BUCKET }}/v${{ env.VERSION }}/checksums.sha256
+          # Update root manifest (latest)
+          gsutil cp examples/rvf/manifest.json gs://${{ env.GCS_BUCKET }}/manifest.json
+
+      - name: Verify upload
+        if: github.ref == 'refs/heads/main'
+        run: |
+          echo "Verifying GCS upload..."
+          REMOTE_COUNT=$(gsutil ls gs://${{ env.GCS_BUCKET }}/v${{ env.VERSION }}/*.rvf | wc -l)
+          LOCAL_COUNT=$(ls examples/rvf/output/*.rvf | wc -l)
+          echo "Remote: $REMOTE_COUNT files, Local: $LOCAL_COUNT files"
+          if [ "$REMOTE_COUNT" -ne "$LOCAL_COUNT" ]; then
+            echo "ERROR: File count mismatch!"
+            exit 1
+          fi
+          echo "Upload verified successfully"

.gitignore

@@ -98,3 +98,10 @@ data/
 # Large model files
 *.gguf
 test_models/*.gguf
+
+# Compiled server binaries (built for Cloud Run deploy)
+/mcp-brain-server
+crates/mcp-brain-server/mcp-brain-server
+
+# Backup files
+*.bak

CLAUDE.md

@@ -13,13 +13,53 @@
 
 ## Publishing (crates.io & npm)
 
-- Credentials are stored in `.env` at the project root — source it before publishing
-- Cargo token is in `~/.cargo/credentials.toml` (auto-loaded by cargo)
+- Credentials are in `.env` (project root) and `~/.cargo/credentials.toml` — NEVER commit or log these
 - npm is authenticated as `ruvnet` — verify with `npm whoami`
+- **NEVER** echo, cat, or print credential files. Source `.env` only via `source .env`
 - **Publish order for solver crates**: `ruvector-solver` first (no deps), then `ruvector-solver-wasm` and `ruvector-solver-node` (depend on solver)
 - Always run `cargo publish --dry-run --allow-dirty` before real publish
 - `ruvector-profiler` has `publish = false` — intentionally not publishable
 
+### npx ruvector (npm)
+
+- **Package**: `ruvector` on npm, published as `ruvnet`
+- **Location**: `npm/packages/ruvector/`
+- **Current version**: check `npm/packages/ruvector/package.json`
+- **Pre-publish checklist**:
+  1. `cd npm/packages/ruvector`
+  2. Update version in `package.json` AND `bin/mcp-server.js` (2 occurrences of version string)
+  3. `node -c bin/cli.js && node -c bin/mcp-server.js` (syntax check)
+  4. `npm test` (55 CLI + integration tests must pass)
+  5. `npm publish --access public`
+- **Key files**:
+  - `bin/cli.js` (~8500 lines) — 48 commands, 12 groups (brain, edge, identity, mcp, rvf, hooks, llm, sona, route, gnn, attention, embed)
+  - `bin/mcp-server.js` (~3500 lines) — 91 MCP tools, stdio + SSE transports
+  - `test/integration.js` — module loading, type defs, package structure
+  - `test/cli-commands.js` — 55 CLI command tests
+- **chalk ESM fix**: chalk v5 is ESM-only, we use CJS. Always use: `const _chalk = require('chalk'); const chalk = _chalk.default || _chalk;`
+- **Lazy loading**: GNN, attention, ora are lazy-loaded for ~55ms startup. Do NOT convert to eager imports.
+- **Peer deps** (optional): `@ruvector/pi-brain`, `@ruvector/ruvllm`, `@ruvector/router`
+
+### π.ruv.io (Cloud Run)
+
+- **Service**: `ruvbrain` in `us-central1` on project `ruv-dev`
+- **Source**: `crates/mcp-brain-server/` — axum Rust server
+- **Landing page**: `crates/mcp-brain-server/static/index.html` (embedded via `include_str!`)
+- **Origin slideshow**: `crates/mcp-brain-server/static/origin.html`
+- **Deploy**:
+  1. Edit HTML in `crates/mcp-brain-server/static/`
+  2. `gcloud builds submit --config=crates/mcp-brain-server/cloudbuild.yaml --project=ruv-dev .`
+  3. `gcloud run deploy ruvbrain --image gcr.io/ruv-dev/ruvbrain:latest --region us-central1 --project ruv-dev`
+- **Dockerfile**: `crates/mcp-brain-server/Dockerfile` — strips `examples/` from workspace before build
+- **Domain**: `π.ruv.io` (also `pi.ruv.io`) → Cloud Run custom domain mapping
+
+### Rust Crates (crates.io)
+
+- **Publish order**: Check inter-crate `path =` dependencies. Publish leaf crates first.
+- **Version deps**: Before publishing, convert `path = "../foo"` to `version = "x.y"` in Cargo.toml
+- **Dry run**: `cargo publish --dry-run --allow-dirty -p <crate-name>`
+- **EXO-AI crates**: Published as v0.1.1 (ruvector-exo-core, ruvector-exo-vision, etc.)
+
 ## File Organization
 
 - NEVER save to root folder — use the directories below