docguard-cli 0.26.0__tar.gz → 0.27.0__tar.gz

{docguard_cli-0.26.0/extensions/spec-kit-docguard → docguard_cli-0.27.0/.agent}/skills/docguard-fix/SKILL.md

@@ -6,10 +6,10 @@ description: AI-driven documentation repair with structured research workflow, t
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.25.0
+  version: 0.27.0
   source: extensions/spec-kit-docguard/skills/docguard-fix
 ---
-<!-- docguard:version: 0.25.0 -->
+<!-- docguard:version: 0.27.0 -->
 
 # DocGuard Fix Skill
 

{docguard_cli-0.26.0 → docguard_cli-0.27.0}/.agent/skills/docguard-guard/SKILL.md

@@ -7,10 +7,10 @@ description: Run DocGuard guard validation against Canonical-Driven Development
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.25.0
+  version: 0.27.0
   source: extensions/spec-kit-docguard/skills/docguard-guard
 ---
-<!-- docguard:version: 0.25.0 -->
+<!-- docguard:version: 0.27.0 -->
 
 # DocGuard Guard Skill
 

{docguard_cli-0.26.0/extensions/spec-kit-docguard → docguard_cli-0.27.0/.agent}/skills/docguard-review/SKILL.md

@@ -6,10 +6,10 @@ description: Cross-document consistency analysis and quality assessment. Perform
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.25.0
+  version: 0.27.0
   source: extensions/spec-kit-docguard/skills/docguard-review
 ---
-<!-- docguard:version: 0.25.0 -->
+<!-- docguard:version: 0.27.0 -->
 
 # DocGuard Review Skill
 

{docguard_cli-0.26.0/extensions/spec-kit-docguard → docguard_cli-0.27.0/.agent}/skills/docguard-score/SKILL.md

@@ -6,10 +6,10 @@ description: CDD maturity assessment with category-aware improvement roadmap. Ru
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.25.0
+  version: 0.27.0
   source: extensions/spec-kit-docguard/skills/docguard-score
 ---
-<!-- docguard:version: 0.25.0 -->
+<!-- docguard:version: 0.27.0 -->
 
 # DocGuard Score Skill
 

{docguard_cli-0.26.0/extensions/spec-kit-docguard → docguard_cli-0.27.0/.agent}/skills/docguard-sync/SKILL.md

@@ -4,10 +4,10 @@ description: Keep canonical documentation ALWAYS UP TO DATE. Refreshes code-trut
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.25.0
+  version: 0.27.0
   source: extensions/spec-kit-docguard/skills/docguard-sync
 ---
-<!-- docguard:version: 0.25.0 -->
+<!-- docguard:version: 0.27.0 -->
 
 # DocGuard Sync Skill
 

docguard_cli-0.27.0/.github/ISSUE_TEMPLATE/docguard-feedback.md

@@ -0,0 +1,26 @@
+---
+name: DocGuard feedback (false positive / detection gap)
+about: Report a finding DocGuard got wrong, or a check it should make. Usually opened pre-filled by `docguard feedback`.
+title: "[feedback] <CODE> (<validator>): <short message>"
+labels: docguard-feedback
+---
+
+<!--
+Most of this is filled in automatically when you run `docguard feedback`.
+No source code or secret values are included — only a finding code, a basename,
+a line number, and DocGuard's own redacted context.
+-->
+
+- **DocGuard version:**
+- **Finding code:** <!-- e.g. SEC001 -->
+- **Validator:**
+- **Location (basename:line):**
+- **Confidence:** <!-- high | low -->
+
+**What DocGuard flagged**
+
+<!-- The redacted context from `docguard feedback`. -->
+
+**Why it's wrong (or what it missed)**
+
+<!-- One or two lines: this is UI copy, a runner var, a dynamic-import cycle break, etc. -->

{docguard_cli-0.26.0 → docguard_cli-0.27.0}/.github/scripts/speckit-submission.py

@@ -183,14 +183,34 @@ def render_body(fields, checkbox_items) -> str:
     return "\n\n".join(blocks) + "\n"
 
 
+# Large free-text fields overflow GitHub's URL length limit (~8 KB) — the form
+# then returns "Whoa there! Your request URL is too long." and prefills NOTHING.
+# Keep these OUT of the prefilled URL; they live in the --body paste-fallback,
+# which the issue surfaces in a copy/paste <details> block. The URL prefills the
+# short, high-value identity fields; the human pastes the rest.
+URL_OMIT = {"features", "testing-details", "example-usage",
+            "catalog-entry", "additional-context"}
+
+# Conservative cap (well under GitHub's limit) so the one-click link always loads.
+URL_MAX = 6000
+
+
 def render_url(fields, version) -> str:
     params = {"template": TEMPLATE,
               "title": f"[Extension]: Update DocGuard — CDD Enforcement (v{version})"}
     for fid, _label, value in fields:
-        if value is None:
-            continue  # checkbox groups can't be prefilled via URL
+        if value is None or fid in URL_OMIT:
+            continue  # checkbox groups + oversized fields are paste-only
         params[fid] = value
-    return FORM_URL + "?" + urlencode(params, quote_via=quote)
+    url = FORM_URL + "?" + urlencode(params, quote_via=quote)
+    # Safety net: if still too long, shed the longest optional fields until it
+    # fits. (Identity fields — id/name/version/urls — are always kept.)
+    for fid in ("required-tools", "tags", "description", "documentation", "changelog"):
+        if len(url) <= URL_MAX:
+            break
+        params.pop(fid, None)
+        url = FORM_URL + "?" + urlencode(params, quote_via=quote)
+    return url
 
 
 def main():

{docguard_cli-0.26.0 → docguard_cli-0.27.0}/.wolf/anatomy.md

@@ -1,7 +1,7 @@
 # anatomy.md
 
-> Auto-maintained by OpenWolf. Last scanned: 2026-06-10T21:09:50.636Z
-> Files: 579 tracked | Anatomy hits: 0 | Misses: 0
+> Auto-maintained by OpenWolf. Last scanned: 2026-06-19T19:17:33.183Z
+> Files: 589 tracked | Anatomy hits: 0 | Misses: 0
 
 ## ../../../../../../../tmp/
 
@@ -18,7 +18,7 @@
 - `.npmrc` — Supply-Chain Security Hardening (~59 tok)
 - `action.yml` — CI: 'DocGuard — CDD Compliance' (~4322 tok)
 - `AGENTS.md` — AI Agent Instructions — DocGuard (~1275 tok)
-- `CHANGELOG.md` — Changelog (~39309 tok)
+- `CHANGELOG.md` — Changelog (~40407 tok)
 - `CLAUDE.md` — OpenWolf (~57 tok)
 - `CODE_OF_CONDUCT.md` — Contributor Covenant Code of Conduct (~532 tok)
 - `COMPARISONS.md` — Comparisons & Honest Limitations (~3053 tok)
@@ -32,8 +32,8 @@
 - `PHILOSOPHY.md` — The Philosophy of Canonical-Driven Development (~1757 tok)
 - `pr_description.md` (~260 tok)
 - `pyproject.toml` — The enforcement tool for Canonical-Driven Development (CDD). Audit, generate, and guard your project (~351 tok)
-- `README.md` — Project documentation (~7359 tok)
-- `ROADMAP.md` — DocGuard Roadmap (~1494 tok)
+- `README.md` — Project documentation (~7411 tok)
+- `ROADMAP.md` — DocGuard Roadmap (~2193 tok)
 - `SECURITY.md` — Security Policy (~357 tok)
 - `STANDARD.md` — DocGuard Standard v0.1 (~6435 tok)
 - `SUPPLY-CHAIN-AUDIT.md` — Supply-Chain Security Audit (~726 tok)
@@ -925,6 +925,10 @@
 - `mechanical.mjs` — Mechanical Fix Registry — applies deterministic, no-LLM fixes in place. (~3008 tok)
 - `sections.mjs` — Section-addressable docs — the foundation for surgical, non-destructive doc (~1676 tok)
 
+## .github/ISSUE_TEMPLATE/
+
+- `docguard-feedback.md` (~215 tok)
+
 ## .github/scripts/
 
 - `speckit-submission-body.sh` — Build the body for a spec-kit "Extension Submission" issue. (~1482 tok)
@@ -938,14 +942,19 @@
 ## cli/
 
 - `config.mjs` — DocGuard — configuration loading. (~3265 tok)
-- `docguard.mjs` — DocGuard CLI — The enforcement tool for Canonical-Driven Development (CDD) (~8124 tok)
+- `docguard.mjs` — DocGuard CLI — The enforcement tool for Canonical-Driven Development (CDD) (~8443 tok)
+- `findings.mjs` — Findings — the structured, LLM-addressable result unit (v0.27). (~2174 tok)
 - `shared-ignore.mjs` — Shared Ignore Utility — Unified file filtering for all validators. (~2780 tok)
-- `shared-source.mjs` — Shared Source Resolution — Monorepo-aware source discovery. (~4357 tok)
+- `shared-source.mjs` — Shared Source Resolution — Monorepo-aware source discovery. (~4655 tok)
 
 ## cli/commands/
 
 - `agent.mjs` — `docguard agent` — the one-shot agent task graph. (~1644 tok)
+- `explain.mjs` — Explain Command — v0.16-P6. (~9022 tok)
+- `feedback.mjs` — Feedback Command — close the loop with the tool's maintainers (v0.27). (~1920 tok)
 - `generate.mjs` — Generate Command — Reverse-engineer canonical docs from an existing codebase (~15364 tok)
+- `guard.mjs` — Guard Command — Validate project against its canonical documentation (~9556 tok)
+- `score.mjs` — Score Command — Calculate CDD maturity score (0-100) (~11214 tok)
 
 ## cli/scanners/
 
@@ -956,8 +965,11 @@
 
 ## cli/validators/
 
+- `doc-quality.mjs` — Doc Quality Validator — Measures documentation writing quality (~6349 tok)
 - `freshness.mjs` — Freshness Validator — Check if documentation is stale relative to code changes. (~3462 tok)
 - `metrics-consistency.mjs` — Metrics Consistency Validator — Detects stale hardcoded numbers in docs. (~2714 tok)
+- `security.mjs` — Security Validator — Basic checks for secrets in code (~2882 tok)
+- `todo-tracking.mjs` — TODO/FIXME Tracking Validator — Ensures code annotations are documented (~3644 tok)
 
 ## cli/writers/
 
@@ -972,6 +984,7 @@
 - `agent.test.mjs` — Exports x (~1138 tok)
 - `commands.test.mjs` — DocGuard CLI Tests — Tests all commands and flags (~10304 tok)
 - `ensure-skills-idempotent.test.mjs` — v0.24 — Skill install is idempotent (field report, Issue D). (~1133 tok)
+- `field-report-3.test.mjs` — v0.27 — LLM field report #3. (~3315 tok)
 - `freshness.test.mjs` — runGit: commitOldCode (~3536 tok)
 - `inventory.test.mjs` — Declares make (~1048 tok)
 - `mechanical.test.mjs` — Declares write (~1161 tok)

{docguard_cli-0.26.0 → docguard_cli-0.27.0}/.wolf/buglog.json

@@ -1197,6 +1197,254 @@
       "related_bugs": [],
       "occurrences": 1,
       "last_seen": "2026-06-10"
+    },
+    {
+      "id": "bug-072",
+      "timestamp": "2026-06-19T18:58:53.419Z",
+      "error_message": "Missing guard clause",
+      "file": "cli/validators/security.mjs",
+      "root_cause": "No early return/throw for edge case: /EXAMPLE/i.test(matchStr",
+      "fix": "Added guard clause: if (/EXAMPLE/i.test(matchStr)",
+      "tags": [
+        "auto-detected",
+        "guard-clause",
+        "mjs"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-19T18:58:53.419Z"
+    },
+    {
+      "id": "bug-073",
+      "timestamp": "2026-06-19T18:59:27.854Z",
+      "error_message": "Significant refactor of ",
+      "file": "cli/validators/security.mjs",
+      "root_cause": "24 lines replaced/restructured",
+      "fix": "Rewrote 92→133 lines (24 removed)",
+      "tags": [
+        "auto-detected",
+        "refactor",
+        "mjs"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-19T18:59:27.854Z"
+    },
+    {
+      "id": "bug-074",
+      "timestamp": "2026-06-19T19:00:26.895Z",
+      "error_message": "Null/undefined access in ",
+      "file": "cli/validators/doc-quality.mjs",
+      "root_cause": "Property access on potentially null/undefined value",
+      "fix": "Added null safety (optional chaining or null check)",
+      "tags": [
+        "auto-detected",
+        "null-safety",
+        "mjs"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-19T19:00:26.895Z"
+    },
+    {
+      "id": "bug-075",
+      "timestamp": "2026-06-19T19:01:14.391Z",
+      "error_message": "Missing guard clause",
+      "file": "cli/commands/guard.mjs",
+      "root_cause": "No early return/throw for edge case: item.severity === 'error' && !showErr",
+      "fix": "Added guard clause: if (item.severity === 'error' && !showErr)",
+      "tags": [
+        "auto-detected",
+        "guard-clause",
+        "mjs"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-19T19:01:14.391Z"
+    },
+    {
+      "id": "bug-076",
+      "timestamp": "2026-06-19T19:01:51.613Z",
+      "error_message": "Significant refactor of ",
+      "file": "cli/commands/guard.mjs",
+      "root_cause": "4 lines replaced/restructured",
+      "fix": "Rewrote 9→26 lines (4 removed)",
+      "tags": [
+        "auto-detected",
+        "refactor",
+        "mjs"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-19T19:01:51.613Z"
+    },
+    {
+      "id": "bug-077",
+      "timestamp": "2026-06-19T19:02:04.155Z",
+      "error_message": "Wrong condition in logic",
+      "file": "cli/commands/explain.mjs",
+      "root_cause": "Condition was: if (!match)",
+      "fix": "Changed to: if (CODES[codeKey])",
+      "tags": [
+        "auto-detected",
+        "logic-fix",
+        "mjs"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-19T19:02:04.155Z"
+    },
+    {
+      "id": "bug-078",
+      "timestamp": "2026-06-19T19:05:57.706Z",
+      "error_message": "Wrong operator: || should be &&",
+      "file": "cli/validators/security.mjs",
+      "root_cause": "Used \"||\" instead of \"&&\"",
+      "fix": "Changed operator || → &&",
+      "tags": [
+        "auto-detected",
+        "operator-fix",
+        "mjs"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-19T19:05:57.706Z"
+    },
+    {
+      "id": "bug-079",
+      "timestamp": "2026-06-19T19:12:59.245Z",
+      "error_message": "Significant refactor of ",
+      "file": "cli/commands/score.mjs",
+      "root_cause": "59 lines replaced/restructured",
+      "fix": "Rewrote 65→3 lines (59 removed)",
+      "tags": [
+        "auto-detected",
+        "refactor",
+        "mjs"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-19T19:12:59.245Z"
+    },
+    {
+      "id": "bug-080",
+      "timestamp": "2026-06-19T19:13:23.491Z",
+      "error_message": "Missing error handling in detectTestRunner",
+      "file": "cli/commands/score.mjs",
+      "root_cause": "Code path had no error handling — exceptions would propagate uncaught",
+      "fix": "Added try/catch block",
+      "tags": [
+        "auto-detected",
+        "error-handling",
+        "mjs"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-19T19:13:23.491Z"
+    },
+    {
+      "id": "bug-081",
+      "timestamp": "2026-06-19T19:13:28.639Z",
+      "error_message": "Wrong reference: runScoreInternal should be detectTestRunner",
+      "file": "tests/field-report-3.test.mjs",
+      "root_cause": "Used \"runScoreInternal\" instead of \"detectTestRunner\"",
+      "fix": "Changed runScoreInternal → detectTestRunner",
+      "tags": [
+        "auto-detected",
+        "wrong-reference",
+        "mjs"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-19T19:13:28.639Z"
+    },
+    {
+      "id": "bug-082",
+      "timestamp": "2026-06-19T19:16:17.809Z",
+      "error_message": "Incorrect value in code",
+      "file": "README.md",
+      "root_cause": "Had `explain <warning>`",
+      "fix": "Changed to `explain <warning\\|CODE>`",
+      "tags": [
+        "auto-detected",
+        "wrong-value",
+        "md"
+      ],
+      "related_bugs": [],
+      "occurrences": 2,
+      "last_seen": "2026-06-19T19:16:22.195Z"
+    },
+    {
+      "id": "bug-083",
+      "timestamp": "2026-06-19T19:16:35.517Z",
+      "error_message": "Incorrect value in code",
+      "file": "package.json",
+      "root_cause": "Had \"0.26.0\"",
+      "fix": "Changed to \"0.27.0\"",
+      "tags": [
+        "auto-detected",
+        "wrong-value",
+        "json"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-19T19:16:35.517Z"
+    },
+    {
+      "id": "bug-084",
+      "timestamp": "2026-06-19T19:16:39.073Z",
+      "error_message": "Incorrect value in code",
+      "file": "pyproject.toml",
+      "root_cause": "Had \"0.25.1\"",
+      "fix": "Changed to \"0.27.0\"",
+      "tags": [
+        "auto-detected",
+        "wrong-value",
+        "toml"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-19T19:16:39.073Z"
+    },
+    {
+      "id": "bug-085",
+      "timestamp": "2026-06-19T19:16:52.578Z",
+      "error_message": "Incorrect value in code",
+      "file": "extensions/spec-kit-docguard/extension.yml",
+      "root_cause": "Had \"0.25.1\"",
+      "fix": "Changed to \"0.27.0\"",
+      "tags": [
+        "auto-detected",
+        "wrong-value",
+        "yml"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-06-19T19:16:52.578Z"
+    },
+    {
+      "id": "bug-086",
+      "timestamp": "2026-06-19T20:05:00.000Z",
+      "error_message": "Security validator flags a validation-message string (e.g. password: \"New password must differ from recent passwords\") as a hardcoded password — a blocking false positive (LLM field report #3, item #1).",
+      "file": "cli/validators/security.mjs",
+      "root_cause": "The SEC password regex matches any quoted value 8+ chars after a password/passwd/pwd key, regardless of whether the value is natural-language copy vs an actual credential.",
+      "fix": "Added looksLikeProse(value): a multi-word natural-language value downgrades the finding to a LOW-confidence, suppressible, reportable warning (not a blocking error). Still surfaced — no false-green. Implemented on the new findings architecture (cli/findings.mjs) with stable code SEC001.",
+      "tags": ["security", "false-positive", "findings", "field-report-3"],
+      "related_bugs": ["bug-087"],
+      "occurrences": 1,
+      "last_seen": "2026-06-19T20:05:00.000Z"
+    },
+    {
+      "id": "bug-087",
+      "timestamp": "2026-06-19T20:06:00.000Z",
+      "error_message": "tests/security.test.mjs: 'should flag common hardcoded passwords and API keys' expected 2 errors, got 1 — a real single-token password \"SuperSecretPassword!\" was wrongly downgraded to a low-confidence warning.",
+      "file": "cli/validators/security.mjs",
+      "root_cause": "First cut of looksLikeProse treated ANY value ending in .!? as prose. Strong passwords commonly end in '!' — so a one-word secret was misclassified as natural language.",
+      "fix": "Terminal punctuation alone no longer reclassifies a value: prose now requires >=3 words, OR a 2-word fragment ending in .!?. A single token like 'SuperSecretPassword!' stays a blocking error. The existing security test caught it.",
+      "tags": ["security", "heuristic", "regression", "self-caught"],
+      "related_bugs": ["bug-086"],
+      "occurrences": 1,
+      "last_seen": "2026-06-19T20:06:00.000Z"
     }
   ]
-}
+}

{docguard_cli-0.26.0 → docguard_cli-0.27.0}/.wolf/cerebrum.md

@@ -19,8 +19,17 @@
 - **`flags.format` defaults to `'text'` globally (docguard.mjs:~302).** So plan/agent commands can't distinguish "unset" from "explicit text". Convention: text summary is the default, `--format json` is the machine artifact (matches every other command). `generate --plan` and the new `agent` command are headless (own header, no global banner, no ensureSkills).
 - **Pre-filled code-truth + `docguard agent`.** `cli/scanners/inventory.mjs` (`scanComponents` = top-level source modules with single-package-wrapper descent; `scanTestInventory` = per-file test-case counts, multi-language) feed pre-filled ARCHITECTURE Component Map + a TEST-SPEC inventory section (generate previously never emitted TEST-SPEC). `cli/commands/agent.mjs` (`buildAgentTaskGraph`, pure) emits an ordered task graph (config→canonical-docs→verify) with kind code-truth|human-judgment, prefilled content, grounding, per-task `acceptance.verify`, and confidence. `--profile` overrides config to preview without `init`.
 
+- **Findings architecture (v0.27, `cli/findings.mjs`).** A validator can emit structured `Finding[]` — `{code, validator, severity, confidence, message, location, suggestion, reportable, redactedContext}` — and return `resultFromFindings(findings, {passed,total})`, which DERIVES the legacy `{errors,warnings,passed,total}` from the same array AND attaches `findings`. Backward-compatible: guard renders `findings` richly (inline `→ suggestion`, `[CODE]` tag, low-confidence marker) when present, else falls back to the error/warning strings (`renderableItems()` in guard.mjs). Counts/exit-codes still come from errors/warnings — never duplicated. Only `security` is fully migrated so far; the rest inherit the fallback. Stable codes live in the `CODES` registry (append-only — a published code is public surface). `explain <CODE>` and inline `// docguard:ignore <CODE>` both key off it.
+- **Inline suppression** (`suppressesCode`/`lineSuppresses` in findings.mjs): `// docguard:ignore SEC001`, `docguard:ignore SEC*`, `docguard:ignore-secret` (any SEC*), bare `docguard:ignore` (any), comma lists — checked on the flagged line AND the line above. The security validator calls `lineSuppresses(code, matchLine, prevLine)` before emitting.
+- **guard's stable contract (v0.27).** `runGuardInternal` now additionally returns `findings` (flattened), `reportable` (low-confidence subset), and `nextStep`. These are additive — existing JSON consumers unaffected. The "always suggest next" footer in `runGuard` derives from these: diagnose pointer on non-PASS, workflow `score` pointer on PASS, `docguard feedback` nudge when reportable findings exist, and a read-only `docguard init` skills nudge (never writes).
+- **`docguard feedback` (v0.27).** Local-first: writes `.docguard/feedback/<code>-<id>.json` (deterministic id via djb2 hash — no Date/random) + prints a prefilled GitHub issue URL CAPPED at 1800 chars and REDACTED (basename:line only, no literal values — security builds `redactedContext` that omits the matched value). Reuses the commit-3b600fd lesson (oversized URL overflows GitHub's ~8 KB limit). It's in `READ_ONLY_COMMANDS` (so it never scaffolds skills) even though it writes its own feedback dir.
+- **`score.mjs` can't be unit-tested with `{}`** — `runScoreInternal({})` throws (`calcStructureScore` reads `config.requiredFiles.canonical`). Extract testable seams instead: the test-runner detection is now `export function detectTestRunner(dir, config)` (recognizes vitest-in-vite.config via `vitest/config` import or a `test:` block, `scripts.test` runner names, and workspace-subdir configs). Pattern for future score tests: pull the unit out, don't feed the whole pipeline a half-config.
+
 ## Do-Not-Repeat
 
+- **2026-06-19** — A "prose vs secret" heuristic must NOT treat terminal punctuation alone as a prose signal. First cut of `looksLikeProse` flagged any value ending in `.!?` as natural language; strong passwords routinely end in `!` (`"SuperSecretPassword!"`), so a real one-token secret got downgraded to a low-confidence warning — the existing `security.test.mjs` caught it (2 errors → 1). Rule that works: prose = ≥3 words, OR a 2-word fragment ending in `.!?`. When adding a downgrade heuristic to a SECURITY check, bias toward keeping the error (a false-negative hides a secret) and write the test against a single-token-secret control.
+- **2026-06-19** — When adding a new `docguard` command, the repo guards ITSELF: Surface-Sync flags it missing from the README commands table and Canonical-Sync flags the "ships N commands" count + the architecture mermaid `Commands (N)`. Update all three (README prose count, README table, mermaid) in the same change or DocGuard's own guard fails. `feedback` made it 14 → 16 (there was a pre-existing 1-off; real count was already 15).
+
 - **2026-06-09** — spec-kit extension manifest: an `alias` MUST differ from its command `name`. spec-kit registers name + every alias in one namespace, so `aliases: ["speckit.docguard.guard"]` on a command named `speckit.docguard.guard` is a self-collision → "Duplicate command or alias" → install/update aborts + rolls back. (Issue #229; broke v0.23.0–v0.25.0.) If an alias adds nothing, omit it.
 - **2026-06-09** — Do NOT publish to the spec-kit community catalog via a direct PR against `github/spec-kit` (editing `catalog.community.json`). Maintainers reject that path (github/spec-kit#2707; the publishing guide is explicit). Catalog add/update MUST go through the **Extension Submission issue template** (`.github/ISSUE_TEMPLATE/extension_submission.yml`), and it must be submitted **through the form UI** — the template's `labels:`/auto-assign only fire on a real form submission, NOT on an API `gh issue create` (which also can't apply labels without triage rights we lack on github/spec-kit). So our triggers do NOT call github/spec-kit at all: `.github/scripts/speckit-submission.py` emits a **prefilled `issues/new?template=…` URL** (`--url`) + a paste-fallback body (`--body`), and the workflows open a one-click reminder issue **in our own repo** (release.yml `sync-catalog` job + manual sync-speckit-catalog.yml). Ricardo clicks → submits the form. When the upstream form fields change, update `speckit-submission.py` to match. `SPECKIT_PR_TOKEN` is no longer needed by these workflows.
 

docguard_cli-0.27.0/.wolf/hooks/_session.json

@@ -0,0 +1,18 @@
+{
+  "session_id": "session-2026-06-22-1153",
+  "started": "2026-06-22T15:53:57.872Z",
+  "files_read": {
+    "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.claude/worktrees/crazy-hofstadter-94c5a8/.github/workflows/release.yml": {
+      "count": 1,
+      "tokens": 3386,
+      "first_read": "2026-06-22T15:56:26.574Z"
+    }
+  },
+  "files_written": [],
+  "edit_counts": {},
+  "anatomy_hits": 1,
+  "anatomy_misses": 0,
+  "repeated_reads_warned": 0,
+  "cerebrum_warnings": 0,
+  "stop_count": 0
+}

{docguard_cli-0.26.0 → docguard_cli-0.27.0}/.wolf/memory.md

@@ -301,3 +301,54 @@
 | 17:08 | Edited CHANGELOG.md | expanded (+53 lines) | ~920 |
 | 17:09 | Edited README.md | 2→3 lines | ~75 |
 | 17:09 | Created ../../../../../../../tmp/append-buglog.mjs | — | ~1335 |
+
+## Session: 2026-06-19 13:28
+
+| Time | Action | File(s) | Outcome | ~Tokens |
+|------|--------|---------|---------|--------|
+| 14:58 | Created cli/findings.mjs | — | ~2174 |
+| 14:58 | Edited cli/validators/security.mjs | expanded (+12 lines) | ~184 |
+| 14:58 | Edited cli/validators/security.mjs | added 4 condition(s) | ~372 |
+| 14:59 | Edited cli/validators/security.mjs | added 1 condition(s) | ~1575 |
+| 14:59 | Edited cli/shared-source.mjs | added 2 condition(s) | ~302 |
+| 14:59 | Edited cli/shared-source.mjs | added 1 condition(s) | ~92 |
+| 15:00 | Edited cli/shared-source.mjs | 9→9 lines | ~140 |
+| 15:00 | Edited cli/validators/todo-tracking.mjs | modified 27() | ~129 |
+| 15:00 | Edited cli/validators/doc-quality.mjs | modified 27() | ~117 |
+| 15:00 | Edited cli/validators/doc-quality.mjs | added optional chaining | ~209 |
+| 15:00 | Edited cli/commands/explain.mjs | inline fix | ~114 |
+| 15:00 | Edited cli/commands/score.mjs | added 6 condition(s) | ~630 |
+| 15:01 | Edited cli/commands/guard.mjs | expanded (+12 lines) | ~244 |
+| 15:01 | Edited cli/commands/guard.mjs | added 3 condition(s) | ~403 |
+| 15:01 | Edited cli/commands/guard.mjs | added 1 condition(s) | ~206 |
+| 15:01 | Edited cli/commands/guard.mjs | added 1 condition(s) | ~436 |
+| 15:01 | Edited cli/commands/explain.mjs | added 1 import(s) | ~20 |
+| 15:02 | Edited cli/commands/explain.mjs | added 3 condition(s) | ~284 |
+| 15:03 | Created cli/commands/feedback.mjs | — | ~1920 |
+| 15:03 | Edited cli/docguard.mjs | 2→3 lines | ~96 |
+| 15:03 | Edited cli/docguard.mjs | added 1 import(s) | ~29 |
+| 15:03 | Edited cli/docguard.mjs | 4→7 lines | ~89 |
+| 15:03 | Edited cli/docguard.mjs | modified 27() | ~106 |
+| 15:03 | Edited cli/docguard.mjs | expanded (+6 lines) | ~193 |
+| 15:04 | Created .github/ISSUE_TEMPLATE/docguard-feedback.md | — | ~229 |
+| 15:05 | Edited cli/validators/security.mjs | match() → language() | ~148 |
+| 15:11 | Created tests/field-report-3.test.mjs | — | ~3315 |
+| 15:12 | Edited cli/commands/score.mjs | removed 65 lines | ~56 |
+| 15:13 | Edited cli/commands/score.mjs | added error handling | ~880 |
+| 15:13 | Edited tests/field-report-3.test.mjs | 2→2 lines | ~33 |
+| 15:13 | Edited tests/field-report-3.test.mjs | 27→28 lines | ~333 |
+| 15:15 | Edited cli/validators/security.mjs | modified 27() | ~72 |
+| 15:16 | Edited README.md | inline fix | ~90 |
+| 15:16 | Edited README.md | 2→3 lines | ~100 |
+| 15:16 | Edited README.md | 14 → 16 | ~18 |
+| 15:16 | Edited package.json | 0.26 → 0.27 | ~7 |
+| 15:16 | Edited pyproject.toml | "0.25.1" → "0.27.0" | ~5 |
+| 15:16 | Edited extensions/spec-kit-docguard/extension.yml | "0.25.1" → "0.27.0" | ~6 |
+| 15:17 | Edited CHANGELOG.md | expanded (+71 lines) | ~1175 |
+| 15:17 | Edited ROADMAP.md | 3→4 lines | ~266 |
+| 15:22 | Session end: 40 writes across 18 files (findings.mjs, security.mjs, shared-source.mjs, todo-tracking.mjs, doc-quality.mjs) | 20 reads | ~95007 tok |
+
+## Session: 2026-06-22 11:53
+
+| Time | Action | File(s) | Outcome | ~Tokens |
+|------|--------|---------|---------|--------|