docs: correct the pre-existence claim in #306's CHANGELOG entry and script header (#319)

CHANGELOG.md

@@ -12,14 +12,14 @@ Format: [Semantic Versioning](https://semver.org). Schema versions and record se
 - New standing check, `scripts/check_mutation_thm_trail.py`: soft-warns
   on records where `mutation_count` is 1 or higher but `aivss.notes`
   has no discoverable mention of the ThM decision made when that
-  mutation was recorded (raised or left unchanged, either way). The
-  record-sourcing process already requires stating that decision
-  explicitly in the commit message, but a commit message isn't visible
-  to anyone reading the record JSON directly or reviewing a PR without
-  digging through git history; this makes the same explanation
-  checkable by requiring it live in the record's own `aivss.notes`
-  field, the same place this kind of reasoning trail already lives
-  (see `AVE-2026-00074`'s `notes` explaining an empty `mitre_atlas`).
+  mutation was recorded (raised or left unchanged, either way). This
+  introduces the expectation that an edit raising `mutation_count`
+  states the ThM decision (raised or left unchanged) in the record's
+  own `aivss.notes`, where a reader of the record JSON or a reviewer
+  of a PR can see it without digging through git history. No earlier
+  written requirement existed; the same field already carries this
+  kind of reasoning elsewhere (see `AVE-2026-00074`'s `notes`
+  explaining an empty `mitre_atlas`).
   A keyword match, not a correctness check -- no script can judge
   whether a cited source is genuinely a working PoC versus theoretical,
   only that a real, in-record explanation exists for a human reviewer

CLAUDE.md

@@ -10,11 +10,11 @@ Single source of truth for how work happens in this repo.
 aveproject/ave — the behavioral classification standard for agentic AI components.
 An independent standard that bawbel-scanner implements. NOT a feature of the scanner.
 
-- Records: 56 published (schema_version 1.1.0)
+- Records: see dist/ave-records-latest.json (the count changes; do not hardcode it here)
 - Schema: schema/ave-record-1.1.0.schema.json
 - Scoring: OWASP AIVSS v0.8
 - Registry: aveproject.org
-- Public API: api.piranha.bawbel.io
+- Public API: api.aveproject.org
 - Scanner: github.com/bawbel/scanner (reference implementation)
 
 This repo contains DEFINITIONS, not detections.
@@ -129,7 +129,7 @@ def validate_record(record: dict) -> tuple[bool, list[str]]:
 
 ```bash
 npm install ajv ajv-formats           # schema validation deps
-npm run build:local                   # build records.js for ave-site
+node scripts/build-records.js         # build dist/ave-records-latest.json
 
 # Python validation
 pip install -e ".[dev]"

SECURITY.md

@@ -50,8 +50,8 @@ No redacted or partial disclosures.
 | [aveproject/ave](https://github.com/aveproject/ave) | AVE standard — records and schema |
 | [aveproject/ave-site](https://github.com/aveproject/ave-site) | aveproject.org website |
 | [bawbel/scanner](https://github.com/bawbel/scanner) | CLI scanner (reference implementation) |
-| [api.piranha.bawbel.io](https://api.piranha.bawbel.io) | PiranhaDB threat intel API |
-| [bawbel.io](https://bawbel.io) | Bawbel website |
+| [aveproject/ave-api](https://github.com/aveproject/ave-api) | Reference API source |
+| [api.aveproject.org](https://api.aveproject.org) | Reference API, live lookup by AVE ID |
 
 ---
 

dist/ave-records-latest.manifest.json

@@ -1,6 +1,6 @@
 {
   "schema_version": "1.1.0",
   "record_count": 87,
-  "generated_at": "2026-10-01T15:37:17.126Z",
+  "generated_at": "2026-10-14T23:42:07.522Z",
   "source": "https://github.com/aveproject/ave"
 }

scripts/check_mutation_thm_trail.py

@@ -4,12 +4,12 @@
 #       correctness, a script can't judge whether a cited source is
 #       genuinely a PoC versus theoretical, only that a real,
 #       in-record explanation exists for a human reviewer to check.
-# Why:  the sourcing process for new record variants requires stating
-#       the ThM decision explicitly, raised or unchanged, either way,
-#       in the commit message. That's invisible to anyone reading the
-#       record JSON directly. This check makes the requirement durable
-#       by looking for the same explanation inside the record itself,
-#       where a reviewer or a future contributor can actually see it.
+# Why:  when a record's mutation_count rises, the ThM decision (raised
+#       or unchanged) belongs where a reader of the record JSON can see
+#       it, not only in a commit message. This check introduces that
+#       expectation; no earlier written requirement existed. It looks
+#       for the explanation inside the record itself, where a reviewer
+#       or a future contributor can actually see it.
 import argparse
 import json
 import sys