build-router.yml / ruvector-publish.yml: npm publish failures are swallowed (`|| echo`) so the publish job reports success with nothing on npm

[ruvnet]

What happened (2026-09-21)

Dispatched build-router.yml with publish=true on branch fix/router-knn-embedder-pkg-native-types (run 35610002495). All five build jobs and the Publish Router Platform Packages job reported success, but nothing reached npm. The job log shows every platform publish failing:

npm error code E404
npm error 404 Not Found - PUT https://registry.npmjs.org/@ruvector%2frouter-darwin-arm64 - Not found
Failed to publish @ruvector/router-darwin-arm64

npm returns 404 (not 403) for an unauthenticated/unauthorized publish to a scoped package, so this is the repo's NPM_TOKEN secret being expired/rotated or lacking publish rights on @ruvector/*. (The last router publish that worked was 0.1.30 on 2026-04-06.)

Why it looked green

.github/workflows/build-router.yml:

npm publish --access public || echo "Failed to publish @ruvector/router-${platform}"
...
run: npm publish --access public || echo "Package may already exist"

A publish step that cannot fail is worse than no CI: the optional-deps-resolvable-on-npm guard on the PR then fails with no obvious cause.

Proposed fix

1. Rotate NPM_TOKEN (granular token, publish scope, packages @ruvector/*).
2. Replace both || echo … with a real failure. If "already published" must stay tolerated, check first:

   if npm view "@ruvector/router-${platform}@${VERSION}" version >/dev/null 2>&1; then echo "already published"; else npm publish --access public; fi

3. Add a post-publish verification step (npm view <pkg>@<version> version for all six packages) so the job's conclusion means "it is on the registry".
4. Consider npm publish --provenance now that publishes run from GitHub Actions.

The 0.1.31 packages were published from the maintainer's local session using the exact CI-built artifacts from run 35610002495 to unblock #1005.

🤖 Generated with claude-flow

[ruvnet]

Token rotated. The repository's NPM_TOKEN secret was last set on 2026-06-03 and no longer authenticated — npm answers an unauthorized scoped publish with 404 Not Found on the PUT, which is what both workflows were hitting. It has been replaced (2026-09-21) with a valid publish token whose identity is ruvnet and which reports read-write on @ruvector/*.

Two things in this issue are still open and are not fixed by rotating the token:

1. build-router.yml ends its publish step with || echo "Failed...", so a failed publish leaves the job green with nothing on the registry. That is what made the dead token invisible for months. ruvector-publish.yml did the right thing and failed loudly.
2. Neither workflow verifies afterwards that the version is actually resolvable on the registry.

Both are being fixed in the PR that adds the platform-build workflows for the two new packages, along with a bounded retry, since a fresh publish can take a minute or two to propagate and npm view returns 404 in that window.

For the record, @ruvector/router@0.1.31 (plus its five platform packages) and ruvector@0.3.2 were published from a local login as a workaround while the CI token was dead; both are live and verified on the registry.

🤖 Generated with claude-flow

https://claude.ai/code/session_01LNEfix9xQvKBUcVVSBCWXa

[ruvnet]

Complete.

• The token was rotated on 2026-09-21. build-router.yml no longer has || echo and checks every package on the registry after publishing.
• fix: #995 #984 #968 #988 + publish hardening; ruvector 0.3.3, graph-node 2.1.1 #1014 found and removed the same swallowed-failure pattern in build-graph-node.yml: publish-platforms.js skipped missing binaries and caught publish errors, and the main publish ended in || echo. Both now fail the job. It also added a post-publish registry check to ruvector-publish.yml.
• That check proved itself on the first run: npm now says "your package is being processed", and ruvector@0.3.3 took about 5½ minutes to resolve, longer than the ~3-minute window. ci(publish): longer npm propagation window; fix(filter): E0275 in Workspace CI #1015 raises every registry poll to about 12 minutes.