docs(modules): publish standalone-use recipes for memory, embeddings, security + flag @ruvector/sona empty-publish blocking neural

Adds a 'Standalone use (without the Ruflo CLI)' section to each
module's README right after Installation, with copy-pasteable
recipes verified against the published artifacts (fresh `npm install`
clean room, no patched dist, exit 0 for every example).

Recipes:

@claude-flow/memory (@3.0.0-alpha.16)
  1. HNSWIndex — add 3 vectors, search top-2, no other deps
  2. ControllerRegistry + injected AgentDB — proves the v3
     governance layer works on a caller-owned AgentDB instance
     (the agentdb injection field added in #2019)

@claude-flow/embeddings
  1. MockEmbeddingService + cosineSimilarity — embed + compare
     without network calls
  2. Provider swap snippet showing OpenAI / Transformers / etc.
     keep the same API surface

@claude-flow/security (@3.0.0-alpha.7)
  1. InputValidator.validate(EmailSchema) +
     new PasswordHasher({ rounds: 12 }) +
     createCredentialGenerator().generateApiKey() — three of the
     OWASP top 10 in ~15 lines
  2. createDevelopmentExecutor — git through the allowlist gate;
     createProjectPathValidator — refuses `../` traversal with
     errors[] surfaced

Bugs uncovered by running the recipes against live npm:

  - `embed()` returns { embedding, tokens, ... }, not a raw Float32Array
    (recipe destructures `.embedding`).
  - createPasswordHasher(rounds: number) accepts a NUMBER, not a
    config object (passing `{ rounds: 12 }` made config.rounds nest
    into `{ rounds: 12 }` and bcryptjs threw 'Illegal arguments:
    string, object'). Switched recipe to `new PasswordHasher(...)`.
  - generateCredentials() does NOT generate API keys — that lives
    on `CredentialGenerator.generateApiKey(prefix)`. Recipe now
    uses createCredentialGenerator().generateApiKey().
  - PathValidator result is { isValid, errors[], ... }, not
    { valid, error }. Recipe matches the real shape.

Not included — @claude-flow/neural standalone recipe:

  @claude-flow/neural@3.0.0-alpha.8 currently fails on fresh
  install because @ruvector/sona@0.1.6 is an empty publish (only
  README + package.json — no index.js, no native bins).
  @ruvector/sona@0.1.5 had full content (index.js + 7 platform
  bins), so this is a regression in the latest sona release that
  blocks the entire neural package from loading.

  Rather than ship a broken recipe, the neural README gains a
  'Known issue' callout pointing at @ruvector/sona@0.1.6. Fix
  path: republish @ruvector/sona with content or pin
  @claude-flow/neural to @ruvector/sona@^0.1.5 in its next bump.

Co-Authored-By: RuFlo <ruv@ruv.net>

v3/@claude-flow/embeddings/README.md

@@ -32,6 +32,65 @@
 npm install @claude-flow/embeddings
 ```
 
+## Standalone use (without the Ruflo CLI)
+
+This package runs on its own — no `@claude-flow/cli`, no MCP server,
+no API key required for the recipes below (the `MockEmbeddingService`
+gives deterministic 384-dim vectors so examples are reproducible).
+Swap to `OpenAIEmbeddingService` / `TransformersEmbeddingService` /
+`AgenticFlowEmbeddingService` when you're ready for real embeddings.
+
+### Recipe — Embed + compare without a network call
+
+```typescript
+// recipe.mjs
+import {
+  MockEmbeddingService,
+  cosineSimilarity,
+} from '@claude-flow/embeddings';
+
+const service = new MockEmbeddingService({ dimension: 384 });
+
+// `embed()` returns { embedding: Float32Array, tokens, ... } —
+// destructure for the raw vector.
+const [{ embedding: cat }, { embedding: dog }, { embedding: car }] =
+  await Promise.all([
+    service.embed('a friendly cat'),
+    service.embed('a friendly dog'),
+    service.embed('a red sports car'),
+  ]);
+
+console.log('cat ↔ dog:', cosineSimilarity(cat, dog).toFixed(4));
+console.log('cat ↔ car:', cosineSimilarity(cat, car).toFixed(4));
+// With real embeddings the pet pair will score higher than the cat/car pair.
+```
+
+### Provider swap — same surface, real vectors
+
+```typescript
+import { createEmbeddingService, cosineSimilarity } from '@claude-flow/embeddings';
+
+// OpenAI
+const openai = createEmbeddingService({
+  provider: 'openai',
+  model: 'text-embedding-3-small',
+  apiKey: process.env.OPENAI_API_KEY!,
+});
+
+// Or local ONNX via @huggingface/transformers (no API key needed)
+const local = createEmbeddingService({
+  provider: 'transformers',
+  model: 'Xenova/all-MiniLM-L6-v2', // 384-dim, ~25MB
+});
+
+await openai.initialize();
+const v = await openai.embed('hello world');
+```
+
+`cosineSimilarity`, `euclideanDistance`, `dotProduct`, and
+`computeSimilarity` are exported as plain functions — useful when you
+already have vectors from another source and just need the math.
+
 ## Quick Start
 
 ```typescript

v3/@claude-flow/memory/README.md

@@ -28,6 +28,66 @@
 npm install @claude-flow/memory
 ```
 
+## Standalone use (without the Ruflo CLI)
+
+This package works on its own — you don't need `@claude-flow/cli` or the
+full Ruflo install. Use it any time you want HNSW vector search, an
+AgentDB façade, or the v3 controller registry from your own app.
+
+Two recipes that exercise the most-installed surface:
+
+### Recipe 1 — HNSW index with built-in quantization (no other deps)
+
+```typescript
+// recipe.mjs
+import { HNSWIndex } from '@claude-flow/memory';
+
+const index = new HNSWIndex({
+  dimensions: 8,
+  M: 16,
+  efConstruction: 200,
+  metric: 'cosine',
+});
+
+// Add a few vectors
+await index.addPoint('doc-a', new Float32Array([1, 0, 0, 0, 0, 0, 0, 0]));
+await index.addPoint('doc-b', new Float32Array([0.9, 0.1, 0, 0, 0, 0, 0, 0]));
+await index.addPoint('doc-c', new Float32Array([0, 1, 0, 0, 0, 0, 0, 0]));
+
+// Search — top 2 nearest to "doc-a"-shaped query
+const hits = await index.search(new Float32Array([1, 0, 0, 0, 0, 0, 0, 0]), 2);
+console.log(hits); // [{ id: 'doc-a', distance: 0 }, { id: 'doc-b', distance: ~0.005 }]
+```
+
+### Recipe 2 — Drive the controller registry against your own AgentDB
+
+The registry coordinates 15+ memory controllers (learning bridge, memory
+graph, tiered cache, vector backend, etc.) on top of an AgentDB instance
+you own. Useful when you already have an AgentDB lifecycle and just
+want the v3 governance layer (issue #2019 added the `agentdb` injection
+field that makes this clean).
+
+```typescript
+import { ControllerRegistry } from '@claude-flow/memory';
+import { AgentDB } from 'agentdb';
+
+const agentdb = new AgentDB({ dbPath: ':memory:' });
+await agentdb.initialize();
+
+const registry = new ControllerRegistry();
+await registry.initialize({ agentdb });
+
+// Now everything backed by AgentDB is reachable through the registry
+const reflexion = registry.get('reflexion');     // ReflexionMemory
+const vectorBackend = registry.get('vectorBackend'); // live vector backend
+const enabled = registry.isEnabled('skills');    // true
+
+const health = await registry.healthCheck();
+console.log(`${health.activeControllers}/${health.controllers.length} controllers active`);
+
+await registry.shutdown();
+```
+
 ## Quick Start
 
 ```typescript

v3/@claude-flow/neural/README.md

@@ -17,6 +17,15 @@ A self-contained learning module that records agent execution trajectories, dist
 npm install @claude-flow/neural
 ```
 
+> **Known issue (2026-05-16):** `@claude-flow/neural@3.0.0-alpha.8`
+> transitively depends on `@ruvector/sona`, and the latest published
+> `@ruvector/sona@0.1.6` is an empty release (README + `package.json`
+> only — no `index.js`, no native bins). Until a content-bearing
+> sona is republished or this package pins `@ruvector/sona@^0.1.5`,
+> fresh `npm install`s of `@claude-flow/neural` will fail at import
+> time with `Cannot find package '…/node_modules/@ruvector/sona/index.js'`.
+> See ruvnet/ruflo for a tracking issue.
+
 ## Quick start (recommended)
 
 `NeuralLearningSystem` is the high-level entry point — it wires `SONAManager`, `ReasoningBank`, and `PatternLearner` together so callers don't have to:

v3/@claude-flow/security/README.md

@@ -24,6 +24,64 @@
 npm install @claude-flow/security
 ```
 
+## Standalone use (without the Ruflo CLI)
+
+This is a plain library — every primitive (`PasswordHasher`,
+`PathValidator`, `SafeExecutor`, `InputValidator`, `CredentialGenerator`)
+is independently importable. No CLI, no MCP server, no daemon. The
+primitives close CVE-2 (weak hashing), CVE-3 (default credentials),
+HIGH-1 (command injection), and HIGH-2 (path traversal) — drop them
+into any Node app that needs to validate at a system boundary.
+
+### Recipe — Validate input, hash a password, generate an API key
+
+```typescript
+// recipe.mjs
+import {
+  InputValidator,
+  EmailSchema,
+  PasswordHasher,
+  createCredentialGenerator,
+} from '@claude-flow/security';
+
+// 1. Validate user input at the boundary (Zod schemas, no surprises)
+const email = InputValidator.validate(EmailSchema, 'user@example.com');
+//             ↳ throws if invalid; returns the typed value otherwise
+
+// 2. Hash a password with bcrypt at the recommended cost (CVE-2)
+//    Default policy: ≥8 chars, ≥1 upper, ≥1 lower, ≥1 digit.
+//    Tune with new PasswordHasher({ rounds, requireUppercase, ... }).
+const hasher = new PasswordHasher({ rounds: 12 });
+const hash   = await hasher.hash('CorrectHorseBatteryStaple9');
+const ok     = await hasher.verify('CorrectHorseBatteryStaple9', hash); // true
+
+// 3. Generate a high-entropy API key (CVE-3) — uses crypto.randomBytes
+//    under the hood and refuses to emit keys below 32 bytes of entropy.
+const creds = createCredentialGenerator();
+const apiKey = creds.generateApiKey('ck_live_');
+console.log(apiKey.keyId, apiKey.key.slice(0, 16) + '…');
+// → 7e2b1a9c-…  ck_live_xX9aQ…
+```
+
+### Recipe — Refuse command injection + path traversal
+
+```typescript
+import {
+  createDevelopmentExecutor,
+  createProjectPathValidator,
+} from '@claude-flow/security';
+
+// SafeExecutor — only the allow-listed commands ever run (HIGH-1)
+const exec = createDevelopmentExecutor({ projectRoot: process.cwd() });
+const { stdout } = await exec.execute('git', ['status', '--porcelain']);
+
+// PathValidator — refuses traversal and symlinks out of the project (HIGH-2)
+const paths = createProjectPathValidator(process.cwd());
+const result = await paths.validate('../../etc/passwd');
+if (!result.isValid) console.log('blocked:', result.errors.join('; '));
+// → blocked: Path traversal pattern detected
+```
+
 ## Quick Start
 
 ```typescript