v10.5.0 — Recognisable
V10.4.1 proved ownership of the package. This release makes the one page a user actually sees look like the thing they are trusting.
It is also the first release that published itself end to end — tag, gates, npm, registry, verification — with nothing left for anyone to remember.
The consent screen
If you connect BrainLLM to Claude, the authorization screen is very likely the only BrainLLM interface you will ever look at. Until now it was a generic light/dark card with a purple button, bearing no visual relationship to the product it was granting access to.
That is not a cosmetic problem. A consent screen is the single page where someone must be certain what they are looking at, and "this doesn't look like the thing I installed" is exactly the doubt it must not create.
It now carries the landing site's design: the #0a0a0f ground with its amber radial glow, Space Grotesk headings, the raised card on a hairline border, a monospace chip for the requesting host, and the site's own 3×3 node mark — six lit, three dark.
The error page shares the same shell. It was previously inline styles on a bare <body>, which meant the two pages reachable in this flow looked like they came from different products — and the unbranded one was the page users hit when something had already gone wrong.
It makes no external requests, deliberately
The landing site pulls Space Grotesk and Inter from Google Fonts. The consent screen does not, and that is a decision rather than an omission to tidy up later.
A third-party request on this page would tell that host someone is authorizing access to their memory, add a dependency the authorization flow cannot function without, and place a blocking request on exactly the networks most likely to restrict it.
The font stacks name the same faces first, so a machine that already has them renders identically. The brand mark is CSS dots rather than an image for the same reason — no request, and no rasterised copy that can drift from the vector.
A test asserts the rendered page contains no external src or href at all, so the reasoning does not have to be rediscovered by whoever next edits the file.
The security property is now tested, not just commented
The screen names the host of the client_id URL — the one part of a client's identity that DNS and TLS vouch for. It never displays client_name, which is self-asserted text in a document the requester controls and could just as easily read "Anthropic".
That was previously guaranteed by a comment. It now has tests: the host is displayed and HTML-escaped, carried query parameters are escaped, and the error state keeps the form intact.
The release verifier was wrong on every successful release
v10.4.1 published correctly to both registries and the workflow reported failure. The verify step called npm view immediately after npm publish, npm's CDN had not propagated, and it announced "the publish did not take effect" about a publish that plainly had.
A check added to prevent false confidence produced a false alarm instead, which is the worse of the two failures — a red that is routinely wrong is a red nobody reads.
It now retries for three minutes against both registries, prints what it actually saw on each attempt, and on genuine exhaustion says to check the registry directly rather than assume failure, because the publish step reporting success is stronger evidence than a verifier's timeout. It also genuinely checks the MCP Registry now, rather than echoing the response and passing regardless.
First fully automatic release
Everything downstream of git push origin v10.5.0 happened on its own: gates, build, 181 tests, tag-versus-manifest agreement, release-metadata validation, npm publish with SLSA provenance, MCP Registry publish, and outside verification of both — authenticated end to end by OIDC, with no secrets stored anywhere.
The failure this removes had happened twice: six commits shipped between v10.1.0 and v10.2.0 with npm still serving 10.1.0, and v10.3.0 shipped complete with docs, site and a live deploy while every registry stayed put. Both times every local signal was green.
181 tests, tsc --noEmit clean, build clean. 42 core tools, 75 with full mode.