mirror of
https://github.com/ruvnet/RuVector.git
synced 2026-08-07 07:43:52 +00:00
86062a2e13
* feat(forge-core): author module for writing signed RVF containers rvf-forge-core could verify containers but not produce them, so every test and fixture had to hand-assemble bytes through testkit. The author module makes writing a first-class operation: ContainerBuilder assembles segments, computes per-segment digests, and emits a signed root manifest that this crate's own verifier accepts. Segment kind decides signing policy rather than the caller: a .wasm payload becomes an executable WASM segment and is signed individually, anything else becomes an opaque VEC segment. That keeps rule 3 of the loading contract — unsigned executable segments are rejected by default — a property of the writer, not something each caller has to remember to ask for. The parity fixture generator now builds its input through this module instead of a bespoke byte layout, so the TypeScript and Rust sides are compared against a shared definition of what a valid container is. 138 tests, clippy clean. Co-Authored-By: claude-flow <ruv@ruv.net> Claude-Session: https://claude.ai/code/session_01ParP55bZs2iTGEGvpnUecx * feat(rvforge): add the create command that writes a signed agent.rvf Closes the gap that made the published 0.1.0 unusable end to end: init printed "Next: rvforge pack <agent.rvf>" while creating no such file, so a first-time user's next command failed with FORGE_E_IO and there was no supported way to produce the input every other command needs. The only valid .rvf in the repo lived in tests/fixtures, which is not in the published tarball. create reads project metadata and declared capabilities from rvforge.json and signs with the key init --keygen recorded, so the common case takes no arguments. With no --from it writes a minimal but complete skeleton — a META segment declaring the requested capability classes and a signed root MANIFEST — which is enough for validate, test, pack, publish and build to run. Walking the whole pipeline before you have a model to put in it is the point. --from <dir> adds files as segments in sorted order, so the same input directory produces the same bytes. init's next-step line now points at create rather than at a file it does not write. Verified from an empty directory against the built CLI: init, create, validate --deep and test all exit 0 on a self-authored artifact. 253 tests. Co-Authored-By: claude-flow <ruv@ruv.net> Claude-Session: https://claude.ai/code/session_01ParP55bZs2iTGEGvpnUecx * feat(reader): install, library and update flows over verified artifacts Takes rvforge-reader from a verification surface to one that manages installed agents: install, a library of what is installed, and update with rollback. Each flow re-verifies rather than trusting the step before it — an artifact that verified at download is verified again at install and again at load, because the file on disk between those points is not the same object the check covered. The dock bridge keeps the trust boundary the Dock exists to enforce. Chrome the system owns — trust badge, network indicator, pause — is populated from SystemOwnedStatus only, and agent-supplied text stays in AgentProvidedStatus and is sanitized before display. A hostile agent cannot forge an approved badge or claim it has stopped while running, because the types do not give it a channel to those fields. Update binds to lineage: an update whose base identity does not match the installed artifact is refused rather than applied, and rollback restores the previous version with its state capsule intact. 189 tests, clippy clean. Co-Authored-By: claude-flow <ruv@ruv.net> Claude-Session: https://claude.ai/code/session_01ParP55bZs2iTGEGvpnUecx * fix(deps): bump rkyv 0.8.16 to 0.8.18 for RUSTSEC-2026-0233/0234/0235 Three advisories published against rkyv 0.8.16: a use-after-free during deserialization of crafted archives (RUSTSEC-2026-0233), and out-of-bounds reads from insufficient archive validation for Rc/Arc (0235) and hash tables (0234). rkyv is a workspace-wide dependency of ruvector-core, ruvector-graph, ruvector-router-core and ruvector-sparse-inference. All three advisories are deserialization-side, which is where untrusted bytes arrive, so an ignore entry would be the wrong call even though the existing audit.toml has that mechanism — .cargo/audit.toml states the policy directly: anything fixable is fixed via a dependency bump rather than ignored. Lockfile only, no manifest change. cargo audit exits 0 and the four dependent crates check clean. Co-Authored-By: claude-flow <ruv@ruv.net> Claude-Session: https://claude.ai/code/session_01ParP55bZs2iTGEGvpnUecx |
||
|---|---|---|
| .. | ||
| benchmark | ||
| build | ||
| ci | ||
| deploy | ||
| lib | ||
| patches/hnsw_rs | ||
| publish | ||
| research-gate | ||
| sona-drift | ||
| test | ||
| training | ||
| validate | ||
| analyze-evolution.js | ||
| analyze-ham10000.js | ||
| build-solver.sh | ||
| build-sonic-ct-wasm.sh | ||
| check_brain_status.sh | ||
| claude-code-decompile.sh | ||
| claude-code-rvf-corpus.sh | ||
| create-brainpedia.py | ||
| deploy-crawl-phase1.sh | ||
| deploy-dragnes.sh | ||
| deploy-gemini-agents.sh | ||
| deploy-wet-job.sh | ||
| deploy_brain_services.sh | ||
| deploy_trainer.sh | ||
| discover_and_train.sh | ||
| extract-ruqu-rvdna-submodules.sh | ||
| gemini-agents.js | ||
| generate-rvf-manifest.py | ||
| historical-crawl-import.sh | ||
| publish-rvf.sh | ||
| README.md | ||
| rebuild-all-versions.mjs | ||
| run_mincut_bench.sh | ||
| rvagent-flywheel-evaluator.mjs | ||
| rvforge-parity-check.sh | ||
| rvforge-parity-fixture.cjs | ||
| seed-brain-all.py | ||
| seed-brain.rs | ||
| seed-specialized.py | ||
| setup-gcs-examples.sh | ||
| sift1m_hnswlib_bench.mjs | ||
| sql-audit-v3.sql | ||
| swarm_train_15.sh | ||
| sync-lockfile.sh | ||
| train-lora.py | ||
| train_brain.sh | ||
| training_orchestrator.sh | ||
| upvote_memories.py | ||
| vote-boost.py | ||
| wet-filter-inject.js | ||
| wet-full-import.sh | ||
| wet-job.yaml | ||
| wet-orchestrate.sh | ||
| wet-processor.sh | ||
RuVector Automation Scripts
This directory contains automation scripts organized by purpose.
📁 Directory Structure
scripts/
├── README.md # This file
├── benchmark/ # Performance benchmarking
├── build/ # Build utilities
├── ci/ # CI/CD automation
├── deploy/ # Deployment scripts
├── patches/ # Patch files
├── publish/ # Package publishing
├── test/ # Testing scripts
└── validate/ # Validation & verification
🚀 Deployment
Scripts for deploying to production.
| Script | Description |
|---|---|
deploy/deploy.sh |
Comprehensive deployment (crates.io + npm) |
deploy/test-deploy.sh |
Test deployment without publishing |
deploy/DEPLOYMENT.md |
Full deployment documentation |
deploy/DEPLOYMENT-QUICKSTART.md |
Quick deployment guide |
Usage:
# Full deployment
./scripts/deploy/deploy.sh
# Dry run
./scripts/deploy/deploy.sh --dry-run
# Test deployment
./scripts/deploy/test-deploy.sh
📦 Publishing
Scripts for publishing packages to registries.
| Script | Description |
|---|---|
publish/publish-all.sh |
Publish all packages |
publish/publish-crates.sh |
Publish Rust crates to crates.io |
publish/publish-cli.sh |
Publish CLI package |
publish/publish-router-wasm.sh |
Publish router WASM package |
publish/check-and-publish-router-wasm.sh |
Check and publish router WASM |
Usage:
# Set credentials first
export CRATES_API_KEY="your-crates-io-token"
export NPM_TOKEN="your-npm-token"
# Publish all
./scripts/publish/publish-all.sh
# Publish crates only
./scripts/publish/publish-crates.sh
📊 Benchmarking
Performance benchmarking scripts.
| Script | Description |
|---|---|
benchmark/run_benchmarks.sh |
Run core benchmarks |
benchmark/run_llm_benchmarks.sh |
Run LLM inference benchmarks |
Usage:
# Run core benchmarks
./scripts/benchmark/run_benchmarks.sh
# Run LLM benchmarks
./scripts/benchmark/run_llm_benchmarks.sh
🧪 Testing
Testing and validation scripts.
| Script | Description |
|---|---|
test/test-wasm.mjs |
Test WASM bindings |
test/test-graph-cli.sh |
Test graph CLI commands |
test/test-all-graph-commands.sh |
Test all graph commands |
test/test-docker-package.sh |
Test Docker packaging |
Usage:
# Test WASM
node ./scripts/test/test-wasm.mjs
# Test graph CLI
./scripts/test/test-graph-cli.sh
✅ Validation
Package and build verification scripts.
| Script | Description |
|---|---|
validate/validate-packages.sh |
Validate package configs |
validate/validate-packages-simple.sh |
Simple package validation |
validate/verify-paper-impl.sh |
Verify paper implementation |
validate/verify_hnsw_build.sh |
Verify HNSW build |
Usage:
# Validate packages
./scripts/validate/validate-packages.sh
# Verify HNSW
./scripts/validate/verify_hnsw_build.sh
🔄 CI/CD
Continuous integration scripts.
| Script | Description |
|---|---|
ci/ci-sync-lockfile.sh |
Auto-fix lock files in CI |
ci/sync-lockfile.sh |
Sync package-lock.json |
ci/install-hooks.sh |
Install git hooks |
Usage:
# Install git hooks (recommended)
./scripts/ci/install-hooks.sh
# Sync lockfile
./scripts/ci/sync-lockfile.sh
🛠️ Build
Build utility scripts located in build/.
🩹 Patches
Patch files for dependencies located in patches/.
🚀 Quick Start
For Development
-
Install git hooks (recommended):
./scripts/ci/install-hooks.sh -
Run tests:
./scripts/test/test-wasm.mjs
For Deployment
-
Set credentials:
export CRATES_API_KEY="your-crates-io-token" export NPM_TOKEN="your-npm-token" -
Dry run first:
./scripts/deploy/deploy.sh --dry-run -
Deploy:
./scripts/deploy/deploy.sh
🔐 Security
Never commit credentials! Always use environment variables or .env file.
See deploy/DEPLOYMENT.md for security best practices.