docguard-cli 0.24.0__tar.gz → 0.25.0__tar.gz

{docguard_cli-0.24.0/.claude/worktrees/gallant-bhabha-0b72fc/extensions/spec-kit-docguard → docguard_cli-0.25.0/.agent}/skills/docguard-fix/SKILL.md

@@ -6,10 +6,10 @@ description: AI-driven documentation repair with structured research workflow, t
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.21.1
+  version: 0.25.0
   source: extensions/spec-kit-docguard/skills/docguard-fix
 ---
-<!-- docguard:version: 0.21.1 -->
+<!-- docguard:version: 0.25.0 -->
 
 # DocGuard Fix Skill
 

{docguard_cli-0.24.0/.claude/worktrees/objective-robinson-841179/extensions/spec-kit-docguard → docguard_cli-0.25.0/.agent}/skills/docguard-guard/SKILL.md

@@ -7,10 +7,10 @@ description: Run DocGuard guard validation against Canonical-Driven Development
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.23.0
+  version: 0.25.0
   source: extensions/spec-kit-docguard/skills/docguard-guard
 ---
-<!-- docguard:version: 0.23.0 -->
+<!-- docguard:version: 0.25.0 -->
 
 # DocGuard Guard Skill
 

{docguard_cli-0.24.0/.claude/worktrees/gallant-bhabha-0b72fc → docguard_cli-0.25.0}/.agent/skills/docguard-review/SKILL.md

@@ -6,10 +6,10 @@ description: Cross-document consistency analysis and quality assessment. Perform
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.21.1
+  version: 0.25.0
   source: extensions/spec-kit-docguard/skills/docguard-review
 ---
-<!-- docguard:version: 0.21.1 -->
+<!-- docguard:version: 0.25.0 -->
 
 # DocGuard Review Skill
 

{docguard_cli-0.24.0/.claude/worktrees/gallant-bhabha-0b72fc → docguard_cli-0.25.0}/.agent/skills/docguard-score/SKILL.md

@@ -6,10 +6,10 @@ description: CDD maturity assessment with category-aware improvement roadmap. Ru
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.21.1
+  version: 0.25.0
   source: extensions/spec-kit-docguard/skills/docguard-score
 ---
-<!-- docguard:version: 0.21.1 -->
+<!-- docguard:version: 0.25.0 -->
 
 # DocGuard Score Skill
 

{docguard_cli-0.24.0/.claude/worktrees/gallant-bhabha-0b72fc → docguard_cli-0.25.0}/.agent/skills/docguard-sync/SKILL.md

@@ -4,9 +4,10 @@ description: Keep canonical documentation ALWAYS UP TO DATE. Refreshes code-trut
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.21.1
+  version: 0.25.0
   source: extensions/spec-kit-docguard/skills/docguard-sync
 ---
+<!-- docguard:version: 0.25.0 -->
 
 # DocGuard Sync Skill
 

{docguard_cli-0.24.0/.claude/worktrees/gallant-bhabha-0b72fc → docguard_cli-0.25.0}/.github/workflows/release.yml

@@ -21,23 +21,28 @@ jobs:
     steps:
       - uses: actions/checkout@v6
         with:
-          fetch-depth: 2 # Need previous commit to compare
+          fetch-depth: 1 # only need HEAD's package.json; the tag check hits the remote
 
-      - name: Check if version changed
+      - name: Check if this version needs releasing
         id: check
         run: |
           CURRENT=$(node -p "require('./package.json').version")
-          # Get version from previous commit
-          PREVIOUS=$(git show HEAD~1:package.json 2>/dev/null | node -p "JSON.parse(require('fs').readFileSync('/dev/stdin','utf-8')).version" 2>/dev/null || echo "0.0.0")
+          TAG="v${CURRENT}"
           echo "current=$CURRENT"
-          echo "previous=$PREVIOUS"
-          if [ "$CURRENT" != "$PREVIOUS" ]; then
+          # TAG-DRIVEN gate (not HEAD~1): a version needs releasing iff no tag
+          # v$CURRENT exists yet. The old HEAD~1 comparison skipped the release
+          # whenever a push carried commits AFTER the version-bump commit (the
+          # bump wasn't the tip) — e.g. a batched push of several commits. It saw
+          # HEAD and HEAD~1 both already carrying the new version and wrongly
+          # concluded "unchanged", silently skipping npm/PyPI/GitHub-Release.
+          # Checking the tag is also idempotent: a re-run won't double-publish.
+          if git ls-remote --tags origin "refs/tags/$TAG" | grep -q "refs/tags/$TAG$"; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            echo "⏭️ $TAG already released — nothing to do"
+          else
             echo "version=$CURRENT" >> "$GITHUB_OUTPUT"
             echo "changed=true" >> "$GITHUB_OUTPUT"
-            echo "✅ Version changed: $PREVIOUS → $CURRENT"
-          else
-            echo "changed=false" >> "$GITHUB_OUTPUT"
-            echo "⏭️ Version unchanged ($CURRENT), skipping release"
+            echo "✅ $TAG is not yet released — releasing"
           fi
 
   # ── Step 2: Run full test suite ────────────────────────────────────────
@@ -55,6 +60,8 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node-version }}
+      - name: Install dependencies
+        run: npm ci
       - name: Run Tests
         run: npm test
       - name: Guard (self-check)

docguard_cli-0.25.0/.wolf/buglog.json

@@ -0,0 +1,465 @@
+{
+  "version": 1,
+  "bugs": [
+    {
+      "id": "bug-001",
+      "timestamp": "2026-05-26T16:08:44.583Z",
+      "error_message": "Incorrect value in code",
+      "file": "assets/demo.tape",
+      "root_cause": "Had \"/Users/ricardoaccioly/.gemini/canonical-spec-kit/",
+      "fix": "Changed to \"/Users/ricardoaccioly/.gemini/canonical-spec-kit/",
+      "tags": [
+        "auto-detected",
+        "wrong-value",
+        "tape"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-05-26T16:08:44.583Z"
+    },
+    {
+      "id": "bug-002",
+      "timestamp": "2026-05-26T16:43:46.987Z",
+      "error_message": "Significant refactor of ",
+      "file": ".github/workflows/sync-speckit-catalog.yml",
+      "root_cause": "8 lines replaced/restructured",
+      "fix": "Rewrote 25→28 lines (8 removed)",
+      "tags": [
+        "auto-detected",
+        "refactor",
+        "yml"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-05-26T16:43:46.987Z"
+    },
+    {
+      "id": "bug-003",
+      "timestamp": "2026-05-28T23:39:41.943Z",
+      "error_message": "Incorrect value in code",
+      "file": "../../../package.json",
+      "root_cause": "Had \"0.21.1\"",
+      "fix": "Changed to \"0.22.0\"",
+      "tags": [
+        "auto-detected",
+        "wrong-value",
+        "json"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-05-28T23:39:41.943Z"
+    },
+    {
+      "id": "bug-004",
+      "timestamp": "2026-05-28T23:43:47.639Z",
+      "error_message": "Incorrect value in code",
+      "file": "../../../README.md",
+      "root_cause": "Had \"Validators (23)\"",
+      "fix": "Changed to \"Validators (24)\"",
+      "tags": [
+        "auto-detected",
+        "wrong-value",
+        "md"
+      ],
+      "related_bugs": [],
+      "occurrences": 2,
+      "last_seen": "2026-05-28T23:45:21.168Z"
+    },
+    {
+      "id": "bug-005",
+      "timestamp": "2026-05-29T14:47:36.135Z",
+      "error_message": "Incorrect value in code",
+      "file": "../../../extensions/spec-kit-docguard/commands/guard.md",
+      "root_cause": "Had \"Run 19-validator quality gate with severity triag",
+      "fix": "Changed to \"Run the full quality gate with severity triage an",
+      "tags": [
+        "auto-detected",
+        "wrong-value",
+        "md"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-05-29T14:47:36.135Z"
+    },
+    {
+      "id": "bug-006",
+      "timestamp": "2026-05-29T14:47:39.737Z",
+      "error_message": "Incorrect value in code",
+      "file": "../../../cli/validators/test-spec.mjs",
+      "root_cause": "Had 'TEST-SPEC.md declares no service-to-test mappings",
+      "fix": "Changed to 'TEST-SPEC.md declares no service-to-test mappings",
+      "tags": [
+        "auto-detected",
+        "wrong-value",
+        "mjs"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-05-29T14:47:39.737Z"
+    },
+    {
+      "id": "bug-007",
+      "timestamp": "2026-05-29T14:50:14.653Z",
+      "error_message": "Significant refactor of ",
+      "file": "../../../docs-canonical/REQUIREMENTS.md",
+      "root_cause": "5 lines replaced/restructured",
+      "fix": "Rewrote 5→5 lines (5 removed)",
+      "tags": [
+        "auto-detected",
+        "refactor",
+        "md"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-05-29T14:50:14.653Z"
+    },
+    {
+      "id": "bug-008",
+      "timestamp": "2026-05-29T14:53:55.230Z",
+      "error_message": "Incorrect value in code",
+      "file": "../../../package.json",
+      "root_cause": "Had \"0.22.0\"",
+      "fix": "Changed to \"0.22.1\"",
+      "tags": [
+        "auto-detected",
+        "wrong-value",
+        "json"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-05-29T14:53:55.230Z"
+    },
+    {
+      "id": "bug-009",
+      "timestamp": "2026-05-29T16:02:34.086Z",
+      "error_message": "Wrong reference: execSync should be execFileSync",
+      "file": "../../../vscode-extension/extension.js",
+      "root_cause": "Used \"execSync\" instead of \"execFileSync\"",
+      "fix": "Changed execSync → execFileSync",
+      "tags": [
+        "auto-detected",
+        "wrong-reference",
+        "js"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-05-29T16:02:34.086Z"
+    },
+    {
+      "id": "bug-010",
+      "timestamp": "2026-05-29T16:02:42.285Z",
+      "error_message": "Significant refactor of ",
+      "file": "../../../vscode-extension/extension.js",
+      "root_cause": "4 lines replaced/restructured",
+      "fix": "Rewrote 21→37 lines (4 removed)",
+      "tags": [
+        "auto-detected",
+        "refactor",
+        "js"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-05-29T16:02:42.285Z"
+    },
+    {
+      "id": "bug-011",
+      "timestamp": "2026-05-29T16:02:55.385Z",
+      "error_message": "Incorrect value in code",
+      "file": "../../../vscode-extension/package.json",
+      "root_cause": "Had \"0.4.0\"",
+      "fix": "Changed to \"0.4.1\"",
+      "tags": [
+        "auto-detected",
+        "wrong-value",
+        "json"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-05-29T16:02:55.385Z"
+    },
+    {
+      "id": "bug-012",
+      "timestamp": "2026-05-29T16:23:42.591Z",
+      "error_message": "Incorrect value in code",
+      "file": "../../../vscode-extension/package.json",
+      "root_cause": "Had \"raccioly\"",
+      "fix": "Changed to \"DocGuard\"",
+      "tags": [
+        "auto-detected",
+        "wrong-value",
+        "json"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-05-29T16:23:42.591Z"
+    },
+    {
+      "id": "bug-013",
+      "timestamp": "2026-05-29T17:41:52.724Z",
+      "error_message": "Incorrect value in code",
+      "file": "../../../cli/commands/demo.mjs",
+      "root_cause": "Had '../docguard.mjs'",
+      "fix": "Changed to '../config.mjs'",
+      "tags": [
+        "auto-detected",
+        "wrong-value",
+        "mjs"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-05-29T17:41:52.724Z"
+    },
+    {
+      "id": "bug-014",
+      "timestamp": "2026-05-29T17:46:42.520Z",
+      "error_message": "Missing guard clause",
+      "file": "../../../cli/validators/doc-quality.mjs",
+      "root_cause": "No early return/throw for edge case: !m",
+      "fix": "Added guard clause: if (!m)",
+      "tags": [
+        "auto-detected",
+        "guard-clause",
+        "mjs"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-05-29T17:46:42.520Z"
+    },
+    {
+      "id": "bug-015",
+      "timestamp": "2026-05-29T17:46:53.523Z",
+      "error_message": "Null/undefined access in ",
+      "file": "../../../cli/validators/doc-quality.mjs",
+      "root_cause": "Property access on potentially null/undefined value",
+      "fix": "Added null safety (optional chaining or null check)",
+      "tags": [
+        "auto-detected",
+        "null-safety",
+        "mjs"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-05-29T17:46:53.523Z"
+    },
+    {
+      "id": "bug-016",
+      "timestamp": "2026-05-29T17:47:26.119Z",
+      "error_message": "Missing error handling in unknown",
+      "file": "../../../docs-canonical/SURFACE-AUDIT.md",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
+      "fix": "Added try/catch block",
+      "tags": [
+        "auto-detected",
+        "error-handling",
+        "md"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-05-29T17:47:26.119Z"
+    },
+    {
+      "id": "bug-017",
+      "timestamp": "2026-05-29T19:49:12.053Z",
+      "error_message": "Incorrect value in code",
+      "file": "../../../README.md",
+      "root_cause": "Had `trace`",
+      "fix": "Changed to `cli/shared-trace-patterns.mjs`",
+      "tags": [
+        "auto-detected",
+        "wrong-value",
+        "md"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-05-29T19:49:12.053Z"
+    },
+    {
+      "id": "bug-018",
+      "timestamp": "2026-05-29T19:52:21.944Z",
+      "error_message": "Significant refactor of ",
+      "file": "../../../docs-canonical/ARCHITECTURE.md",
+      "root_cause": "4 lines replaced/restructured",
+      "fix": "Rewrote 5→6 lines (4 removed)",
+      "tags": [
+        "auto-detected",
+        "refactor",
+        "md"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-05-29T19:52:21.944Z"
+    },
+    {
+      "id": "bug-019",
+      "timestamp": "2026-05-29T19:52:38.733Z",
+      "error_message": "Incorrect value in code",
+      "file": "../../../docs-canonical/ARCHITECTURE.md",
+      "root_cause": "Had `DEFAULT_IGNORE_DIRS`",
+      "fix": "Changed to `cli/config.mjs`",
+      "tags": [
+        "auto-detected",
+        "wrong-value",
+        "md"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-05-29T19:52:38.733Z"
+    },
+    {
+      "id": "bug-020",
+      "timestamp": "2026-05-29T19:54:57.149Z",
+      "error_message": "Incorrect value in code",
+      "file": "../../../docs-canonical/SECURITY.md",
+      "root_cause": "Had `git`",
+      "fix": "Changed to `specify init`",
+      "tags": [
+        "auto-detected",
+        "wrong-value",
+        "md"
+      ],
+      "related_bugs": [],
+      "occurrences": 2,
+      "last_seen": "2026-05-29T19:54:58.869Z"
+    },
+    {
+      "id": "bug-021",
+      "timestamp": "2026-05-29T19:55:22.428Z",
+      "error_message": "Incorrect value in code",
+      "file": "../../../ROADMAP.md",
+      "root_cause": "Had `0.4.0`",
+      "fix": "Changed to `0.5.0`",
+      "tags": [
+        "auto-detected",
+        "wrong-value",
+        "md"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-05-29T19:55:22.428Z"
+    },
+    {
+      "id": "bug-022",
+      "timestamp": "2026-05-29T19:59:24.106Z",
+      "error_message": "Incorrect value in code",
+      "file": "../../../package.json",
+      "root_cause": "Had \"0.22.1\"",
+      "fix": "Changed to \"0.23.0\"",
+      "tags": [
+        "auto-detected",
+        "wrong-value",
+        "json"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-05-29T19:59:24.106Z"
+    },
+    {
+      "id": "bug-023",
+      "timestamp": "2026-06-02T15:41:53Z",
+      "error_message": ".docguardignore trailing-slash dir patterns (e.g. 'tests/', 'base-research/') silently match nothing — ignored dirs were still scanned/flagged by every shouldIgnore + buildIgnoreFilter consumer",
+      "file": "cli/shared-ignore.mjs",
+      "root_cause": "globToRegex did not strip a gitignore-style trailing slash, so 'dir/' built an alternation that could only match a literal 'dir//' (double slash) — never a real path. routes.mjs and todo-tracking.mjs WERE correctly wired to shouldIgnore (fcc7264); the glob translator itself was broken. The test suite used 'dir/' forms only in loader/merge assertions and never asserted they MATCH a file, so it stayed green — a false-green coverage gap.",
+      "fix": "Strip a trailing slash in globToRegex (const normalized = pattern.replace trailing-slash || pattern) so 'dir', 'dir/' and 'dir/**' behave identically. Added 4 end-to-end regression tests in tests/docguardignore.test.mjs that assert trailing-slash patterns actually match and do not over-match a sibling sharing the prefix.",
+      "tags": ["ignore", "glob", "false-green", "security-relevant", "field-report", "websec-validator", "B1a"],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-02T15:41:53Z"
+    },
+    {
+      "id": "bug-024",
+      "timestamp": "2026-06-02T15:41:53Z",
+      "error_message": "generate --plan --write crashes with ENOENT creating docs-implementation/KNOWN-GOTCHAS.md",
+      "file": "cli/commands/generate.mjs",
+      "root_cause": "The --plan --write loop mkdir'd only docs-canonical/, then wrote each doc with a raw writeFileSync. buildMemoryPlan unconditionally plans docs-implementation/ docs (KNOWN-GOTCHAS.md, CURRENT-STATE.md), so the first write into that not-yet-created dir threw ENOENT — docs-canonical docs written, first docs-implementation write crashed.",
+      "fix": "Folded mkdirSync(dirname(filePath),{recursive:true}) into the safeWrite helper and routed the --plan --write loop through safeWrite instead of raw writeFileSync (also gains the .bak backup that path previously lacked). Added a regression test in tests/commands.test.mjs running generate --plan --write in a temp project with no docs-implementation/.",
+      "tags": ["generate", "enoent", "mkdir", "field-report", "websec-validator", "B2"],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-02T15:41:53Z"
+    },
+    {
+      "id": "bug-025",
+      "timestamp": "2026-06-02T19:16:48Z",
+      "error_message": "docguard init --fix drops into the interactive doc-picker (\"Which canonical docs does your project need?\") and hangs/fails with no TTY — contradicts its documented \"Auto-create missing files from templates\"",
+      "file": "cli/commands/init.mjs",
+      "root_cause": "--fix was a dead flag: documented (docguard.mjs:111) and set (docguard.mjs:186) but consumed nowhere. init.mjs never read flags.fix, so init ran its normal path; with no skeleton/skipPrompts/wizard/profile set it fell into the interactive askQuestion loop, which blocks/fails without a TTY (CI/agent use).",
+      "fix": "Wired flags.fix into init.mjs: shouldRunGenerate() returns false on --fix (skip the interactive scan-and-propose preview) and the non-interactive branch fires on flags.fix (use profile defaults). The create-loop already skips existing files, so --fix only fills gaps. Added a regression test asserting init --fix creates docs without entering the picker.",
+      "tags": ["init", "cli-flag", "dead-flag", "headless", "field-report", "websec-validator", "B3"],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-02T19:16:48Z"
+    },
+    {
+      "id": "bug-026",
+      "timestamp": "2026-06-02T19:16:48Z",
+      "error_message": "docguard generate --plan (a read-only preview) has side effects — scaffolds .agent/skills, .agent/commands, .specify/ and runs an npm/pip step",
+      "file": "cli/docguard.mjs",
+      "root_cause": "The dispatcher runs ensureSkills() on any command that is not setup/init and not headless. headless = jsonMode||write||checkOnly||changedOnly||quiet, which excluded a bare --plan — so generate --plan triggered ensureSkills' writes. Inconsistent: generate --plan --write was already headless (flags.write) and did NOT scaffold.",
+      "fix": "Added flags.plan to the headless set in docguard.mjs so generate --plan suppresses the banner AND ensureSkills, matching --plan --write. Verified by a before/after probe: a non-headless generate creates .agent (YES), generate --plan does not (no). Added a regression test asserting --plan leaves .agent/ and .specify/ untouched.",
+      "tags": ["generate", "plan", "side-effects", "ensure-skills", "least-surprise", "field-report", "websec-validator", "B4"],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-02T19:16:48Z"
+    },
+    {
+      "id": "bug-027",
+      "timestamp": "2026-06-02T19:30:13Z",
+      "error_message": "project-type detection (generate --plan) misclassifies a Click CLI as 'Express, Flask' — it ingests tests/fixtures/*/package.json + requirements.txt because ignored dirs are not honored",
+      "file": "cli/scanners/project-type.mjs",
+      "root_cause": "findManifests pruned only a hardcoded IGNORE_DIRS set + dot-dirs and never honored config.ignore/.docguardignore. detectEcosystems received config but marked it _config and never passed it to findManifests, so fixture/vendored manifests in user-ignored dirs polluted the detected frameworks/profile. This is the buildMemoryPlan/--plan path (generate's full path uses its own detectStack).",
+      "fix": "Threaded the already-arriving config into findManifests and pruned dirs + skipped manifest files via shouldIgnore(relPosix(root, child), config); detectEcosystems now passes config through (was _config). Depends on bug-023's trailing-slash glob fix so a 'tests/' pattern matches. Regression test in tests/project-type.test.mjs uses a control (fixtures pollute without ignore) + the fix (tests/ ignore drops Express/Flask, keeps the real Click).",
+      "tags": ["project-type", "ignore", "classification", "field-report", "websec-validator", "B1b"],
+      "related_bugs": ["bug-023"],
+      "occurrences": 1,
+      "last_seen": "2026-06-02T19:30:13Z"
+    },
+    {
+      "id": "bug-028",
+      "timestamp": "2026-06-03T01:32:47Z",
+      "error_message": "A hand-corrected source=code section (scanner mislabeled it) is flagged stale forever, and the suggested remedy `sync --write` reverts the correction — no override existed",
+      "file": "cli/validators/generated-staleness.mjs",
+      "root_cause": "Generated-Staleness compared every source=code section against scanner output with no per-section opt-out (quality checks had one; code sections didn't), and sync --write unconditionally replaced source=code sections. So a legitimately hand-maintained section had no escape from the stale-forever / auto-revert trap.",
+      "fix": "Honor a `pinned` attribute on the section marker (<!-- docguard:section id=… source=code pinned=\"reason\" -->), already parsed by parseSections. generated-staleness exempts pinned sections (counted as a pass, mirroring the docguard:quality opt-out) and appends a discoverability hint to the stale warning; sync.mjs skips pinned sections. Tests in generated-staleness.test.mjs (control+fix) and sync.test.mjs (don't-revert).",
+      "tags": ["generated-staleness", "sync", "marker", "false-positive", "field-report", "websec-validator", "B5"],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-03T01:32:47Z"
+    },
+    {
+      "id": "bug-029",
+      "timestamp": "2026-06-03T01:32:47Z",
+      "error_message": "docguard <command> --help printed the global help, not the command's own flags — flag discovery (generate --plan --write, init --skeleton/--wizard/--with) was impossible from --help",
+      "file": "cli/docguard.mjs",
+      "root_cause": "v0.24 made <command> --help non-destructive but routed it to printHelp() (global) because there was no per-command help; the global help lists commands but not each command's full flag set + examples.",
+      "fix": "Added a COMMAND_HELP map (init/generate/guard/score/diff/sync/fix/trace/upgrade/ci/memory) + printCommandHelp(command); the --help dispatch now calls it. Unmapped commands fall back to global help. Flags derived from the vetted global help to avoid documenting non-existent flags. Tests assert generate/init --help show their flags and watch --help falls back without starting the watcher.",
+      "tags": ["cli", "help", "ux", "field-report", "websec-validator", "B6"],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-03T01:32:47Z"
+    },
+    {
+      "id": "bug-030",
+      "timestamp": "2026-06-03T01:32:47Z",
+      "error_message": "generate emits docs-canonical/API-REFERENCE.md, then guard warns it 'exists but is not in your requiredFiles config' — the generator's own output is flagged orphaned",
+      "file": "cli/commands/generate.mjs",
+      "root_cause": "generate's standard doc set is a superset of the profile's requiredFiles.canonical, and generate never updated requiredFiles, so the traceability orphan-check (traceability.mjs:133) flagged docs the generator just created.",
+      "fix": "Added registerGeneratedCanonicalDocs(): after writing, generate merges the canonical docs it emitted into .docguard.json requiredFiles.canonical (additive only, only docs-canonical/*.md that exist on disk, only when a config exists, idempotent). Wired into both the full generate path and the --plan --write path. Test asserts requiredFiles.canonical gains ARCHITECTURE after generate --plan --write.",
+      "tags": ["generate", "traceability", "requiredFiles", "consistency", "field-report", "websec-validator", "B7"],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-03T01:32:47Z"
+    },
+    {
+      "id": "bug-031",
+      "timestamp": "2026-06-03T03:44:15Z",
+      "error_message": "generate --plan mislabels a security/scanner tool's own pattern-strings as real surface (websec-validator flagged as using express/boto3/jwt because its recon code mentions them)",
+      "file": "cli/commands/generate.mjs",
+      "root_cause": "The route/SDK/auth source scanners match pattern-strings; for a cli/library/tool whose source CONTAINS those strings as detection patterns, the auto-extracted surface is the tool's own code, not real usage. No confidence signal existed to warn the user.",
+      "fix": "F1 (chosen scope: flag, don't suppress — suppression would risk a false-green). Added surfaceConfidence(kind): web kinds (webapp/api/service) = 'normal', everything else = 'low'. generate --plan --format json now emits surface.confidence; the text output prints a 'Low-confidence surface — verify, pin with pinned=...' advisory when a non-web kind has web surface. Guard detection unchanged. Test asserts cli→low, api→normal.",
+      "tags": ["generate", "scanner-tool", "false-positive", "confidence", "field-report", "websec-validator", "F1"],
+      "related_bugs": ["bug-023", "bug-028"],
+      "occurrences": 1,
+      "last_seen": "2026-06-03T03:44:15Z"
+    }
+  ]
+}

docguard_cli-0.25.0/.wolf/cerebrum.md

@@ -0,0 +1,26 @@
+# Cerebrum — docguard-cli
+
+> OpenWolf learning memory for **docguard-cli** — the enforcement tool for Canonical-Driven Development (CDD). Audits, generates, and guards project documentation.
+> Last updated: 2026-06-02
+
+## User Preferences
+
+- On field/bug reports, Ricardo prefers **"triage & verify first"** over jumping to fixes — confirm each item against current code (reproduce where possible) and explicitly challenge the report's own stated root-cause before writing any fix. (Chosen on the websec-validator field report, 2026-06-02.)
+
+## Key Learnings
+
+- **Ignore wiring map (as of fcc7264):** all `shared-ignore` consumers — incl. `routes.mjs:90` and `todo-tracking.mjs:307,383` — call `shouldIgnore`. `project-type.mjs` did NOT until the B1b fix (2026-06-02): its `walk()` in `findManifests` now honors config.ignore (prunes dirs + skips manifest files via shouldIgnore). It detects frameworks from **dependency manifests** (`has(deps,'express'/'flask')`), so before the fix it ingested fixture `package.json`/`requirements.txt`. Two different mechanisms: glob filtering on results vs. `DEFAULT_IGNORE_DIRS` (bare dir-name Set) during walks.
+- **`globToRegex` (shared-ignore.mjs:115) silently mishandles trailing-slash dir patterns.** Verified by execution: `buildIgnoreFilter(['tests/'])('tests/fixtures/x.js')` → `false`; `['tests']` and `['tests/**']` → `true`. Gitignore-style `dir/` (the natural form) matches nothing. This makes ignore look wired-but-broken across every consumer. (Fixed 2026-06-02 by stripping the trailing slash.)
+- **The dispatcher (docguard.mjs) installs DocGuard's own agent tooling as a side effect.** `ensureSkills()` runs on every command except `setup`/`init` and except when `headless` (= jsonMode||write||checkOnly||changedOnly||quiet||plan after the B4 fix). It writes `.agent/skills` + `.agent/commands` and can spawn the `specify` CLI (→ `.specify/` + pip/npm). So read-shaped commands must be added to the `headless` set to stay side-effect-free. `headless` is consumed in exactly two places: the banner and this ensureSkills gate.
+
+## Do-Not-Repeat
+
+- **2026-06-02** — Don't trust a bug report's stated root cause. The websec B1 report blamed "scanners/validators skip the ignore file"; the real defect was the trailing-slash glob (above). Fixing per the report ("centralize ignore handling") would have changed nothing AND left a false-green — the exact failure mode this tool exists to prevent.
+- **2026-06-02** — Don't assume a documented CLI flag is wired. `--fix` is documented (`docguard.mjs:111` "Auto-create missing files from templates") and set (`:186`) but read **nowhere** — `init.mjs` never consumes `flags.fix`. `grep` the flag's *consumption*, not just its declaration.
+
+## Decision Log
+
+- **2026-06-02** — Triage-only pass on the websec-validator field report (no code changed, user's choice). Outcome that justified it: B1's reported root-cause was wrong (glob bug, not wiring), B4 is real-on-main via the dispatcher's `ensureSkills` (not the `--plan` code), B6 is partly-fixed/deferred-by-design. Full verified fix-list lives in the cross-session memory `websec-field-feedback-triage.md`.
+- **2026-06-03** — F1 scope: **flag, don't suppress.** For scanner/tool false-positives, generate marks auto-extracted surface 'low' confidence for non-web kinds (cli/library/unknown) but never removes it from guard — suppressing a real surface would be a false-green, the failure mode this tool exists to prevent. User chose this over require-import (which risks false-negatives).
+- **2026-06-03** — F3 scope: added `cli`/`library` **profiles** (non-web required sets) as the contained fix for the web-app-centric doc model. Deliberately did NOT build a bespoke `CLI-REFERENCE` doc *type* (template + documentTypes registry + TRACE_MAP + memory-plan + writer = 5+ files) — that's a separate larger feature. Until then `library` reuses API-REFERENCE as the module-API doc.
+- **2026-06-03** — Pattern for non-trivial validator tests: provoke the deterministic always-emitted section (`tech-stack` in ARCHITECTURE, `memory-plan.mjs:243`) and assert with a **control** (unpinned→stale) + **fix** (pinned→exempt). Same control discipline used for B4 (.agent created by full generate, not by --plan) and F1 (cli→low, api→normal). Keeps tests non-vacuous.

{docguard_cli-0.24.0/.claude/worktrees/zealous-ardinghelli-facf7d → docguard_cli-0.25.0}/.wolf/cron-state.json

@@ -1,5 +1,5 @@
 {
-  "last_heartbeat": "2026-05-31T12:59:18.265Z",
+  "last_heartbeat": "2026-05-31T11:59:18.252Z",
   "engine_status": "running",
   "execution_log": [
     {