ruvector 0.2.32 — Harness Router + Default-Deny MCP

Published to npm: ruvector@0.2.32 (npm i ruvector / npx ruvector@0.2.32).

Implements ADR-256: borrow the "agent harness" concepts using primitives ruvector already ships — no new runtime dependency.

✨ New

• ruvector harness status [--json] — one unified view of the routing/agent surface: Tiny Dancer cost router, semantic router, hooks routing, MCP server, witness chain, and SONA memory, with graceful degradation when optional deps are absent.
• Default-deny MCP tool policy — least-privilege control over which MCP tools are exposed/callable:
  • RUVECTOR_MCP_ALLOW="hooks_route,hooks_recall" — allowlist
  • RUVECTOR_MCP_DENY="hooks_force_learn" — denylist (wins over allow)
  • RUVECTOR_MCP_PROFILE=readonly — curated safe subset
  • Precedence: DENY > ALLOW/PROFILE > allow-all (no policy = backward-compatible)
• Stable memory namespace — RUVECTOR_MEMORY_NAMESPACE (default ruvector), surfaced as memory.namespace.

🔒 / 🛠 Fixes

• Startup-budget CI guard — fails CI if a borrowed feature regresses cold start (the new harness command adds ~0–3ms).
• Cross-platform build script — ONNX asset copy now uses fs.cpSync, so npm publish works off-Linux (was silently Windows-broken).

✅ Verification

npm test green — CLI 73/0, MCP-policy 8/0, startup-budget 2/0. Published artifact smoke-tested: npx ruvector@0.2.32 harness status --json.

🤖 Generated with claude-flow