v3.56.1 — config, policy-trust and encrypted-store fixes

ruflo 3.56.1

Patch release: bug fixes only. Published as @claude-flow/cli, claude-flow and ruflo 3.56.1 (latest, alpha, v3alpha). No leaf package changed since 3.56.0.

Fixed

• The policy trust mirror and key now honour HOME and XDG_CONFIG_HOME instead of a fixed home directory, so a throwaway HOME no longer yields policy-anchor-log-missing (#3922, fixes #3919, reported by @HF-teamdev).
• ensureSchemaColumns rewrites the store only when a column was actually added; an up-to-date encrypted memory store is no longer rewritten by a read such as memory stats (#3923, fixes #3918, reported by @HF-teamdev).
• config reset --section <name> resets only that section and removes the matching flat overrides, preserving unrelated configuration (#3901, @rudycelekli).
• MCP config tools (config_get/set/list/export/import/reset) now work on the plain nested JSON document written by the config CLI command instead of assuming a {values, scopes} envelope; existing envelope stores keep their format (#3902, @rudycelekli). This does not change how the daemon reads config.json.

Not in the npm release

The console approvals badge fix (#3924, fixes #3920, reported by @HF-teamdev) ships as ruflo-console 0.40.3 through the plugin marketplace.

Verification

Release PR: #3925 (all CI jobs green; merge commit). Local cli suite: 5483 passed, 2 failed (policy-runtime worker-envelope test and router-cjs-esm-3555); both also fail on v3.56.0 source in a linked-worktree development environment. Witness manifests regenerated for linux, macos and windows (117/117, no drift); helpers manifest re-signed.

Full changelog: https://github.com/ruvnet/ruflo/blob/v3.56.1/CHANGELOG.md