ruvnet-brain 4.5.0 → 4.5.1

package/README.md

@@ -7,7 +7,7 @@ Created: 2026-06-29 22:36:38 EDT
 
 # 🧠 RuvNet Brain
 
-### 🧠 RuvNet Brain — [![RuvNet Brain version 4.5.0 — updated 2026-07-30 03:24 EDT](https://img.shields.io/badge/version_4.5.0-updated_2026--07--30_03:24_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](https://github.com/stuinfla/ruvnet-brain/blob/main/plugin/.claude-plugin/plugin.json)
+### 🧠 RuvNet Brain — [![RuvNet Brain version 4.5.1 — updated 2026-07-30 03:24 EDT](https://img.shields.io/badge/version_4.5.1-updated_2026--07--30_03:24_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](https://github.com/stuinfla/ruvnet-brain/blob/main/plugin/.claude-plugin/plugin.json)
 
 **A portable, source-grounded brain over Reuven Cohen's (rUv's) RuvNet stack — delivered as a Claude Code plugin that makes Claude _use_ the stack instead of fighting it.**
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.5.0",
+  "version": "4.5.1",
   "description": "One-command installer for RuvNet Brain \u2014 a portable, source-grounded brain over rUv's RuvNet building blocks, delivered as a Claude Code plugin so Claude uses the stack instead of fighting it.",
   "type": "module",
   "bin": {

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ruvnet-brain",
   "description": "RuvNet brain transplant for Claude Code — grounds every RuvNet decision in real source across 77 rUv repositories, prefers Ruflo / RuVector-RVF / AgentDB over training-prior defaults (pgvector, Pinecone, hand-rolled cosine), and can pull in any RuvNet repo on demand. Ships a UserPromptSubmit retrieve-and-inject grounding hook and a PreToolUse write gate that refuses ungrounded rUv-product code until search_ruvnet has been consulted (ADR-0012 / ADR-067).",
-  "version": "4.5.0",
+  "version": "4.5.1",
   "author": {
     "name": "Stuart Kerr"
   },

package/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.5.0",
+  "version": "4.5.1",
   "description": "Source-grounded RuvNet knowledge, lifecycle enforcement, and learning for Codex.",
   "author": {
     "name": "Stuart Kerr"

package/plugin/scripts/brain-confirmation.mjs

@@ -121,15 +121,20 @@ export function confirm({ footprint, env = process.env, home = os.homedir(), now
   }
   const source = readJson(path.join(roots.kbDir, 'SOURCE.json'));
   const builtMs = Date.parse(source?.builtUtc || '');
-  const signature = readJson(path.join(roots.brainHome, SIGNATURE_RECORD));
+  const signatureFile = path.join(roots.brainHome, SIGNATURE_RECORD);
+  const recorded = fs.existsSync(signatureFile);
+  const signature = recorded ? readJson(signatureFile) : null;
   const coverage = sha256File(path.join(roots.kbDir, 'COVERAGE.json'));
   const signed = Boolean(signature?.coverageSha256 && coverage && signature.coverageSha256 === coverage);
   const tag = source?.corpusReleaseTag || source?.releaseTag || null;
-  // Structural problems (a second copy, unverified bytes) gate; age is currency and only advises.
+  // Structural problems (a second copy, a record the live bytes contradict) gate; age is currency and only advises.
+  // NO record is provenance unknown, not provably broken (an install from a local sealed artifact and the automatic
+  // updater never write one): it advises. A record that is present but unreadable or does not match gates.
   const knowledgeProblems = [];
   const knowledgeAdvice = [];
   if (footprint.kbCopies !== 1) knowledgeProblems.push([`${footprint.kbCopies} copies on disk (must be exactly 1)`, footprint.kbCopyFix || (footprint.kbCopies ? CLEAN : 'npx ruvnet-brain@latest')]);
-  if (!signed) knowledgeProblems.push([signature ? 'signature record does not match the live COVERAGE.json' : 'no signature verification recorded for these bytes', UPDATE]);
+  if (!recorded) knowledgeAdvice.push([`installed or updated without a recorded signature verification — run ${UPDATE} to verify`, UPDATE]);
+  else if (!signed) knowledgeProblems.push([signature ? 'signature record does not match the live COVERAGE.json' : 'signature record is unreadable', UPDATE]);
   if (!Number.isFinite(builtMs) || (now - builtMs) / 3_600_000 >= KNOWLEDGE_MAX_AGE_HOURS) knowledgeAdvice.push([`built ${Number.isFinite(builtMs) ? ago(builtMs, now) : 'at an unknown time'} (limit ${KNOWLEDGE_MAX_AGE_HOURS}h)`, UPDATE]);
   const where = roots.location?.state === 'linked'
     ? `at ${roots.kbDir} (moved to ${volumeOf(roots.location.real)}, mounted)` : `at ${roots.kbDir}`;