docguard-cli 0.29.0__tar.gz → 0.30.1__tar.gz

{docguard_cli-0.29.0 → docguard_cli-0.30.1}/.github/scripts/speckit-submission.py

@@ -61,10 +61,11 @@ def build(version: str, download_url: str):
             "name": "DocGuard — CDD Enforcement",
             "id": "docguard",
             "description": (
-                "Canonical-Driven Development enforcement. Validates, scores, "
-                "and traces project documentation with automated checks, "
-                "AI-driven workflows, and spec-kit hooks. One pinned runtime "
-                "dependency; pure Node.js otherwise."
+                "The only doc-integrity engine with an MCP server, SARIF "
+                "output, and a deterministic zero-LLM core. Validates, "
+                "scores, and traces documentation against code — 24 "
+                "validators, stable finding codes, GitHub Action with PR "
+                "annotations, spec-kit hooks. Pure Node.js, one pinned dep."
             ),
             "author": "raccioly",
             "version": version,

{docguard_cli-0.29.0 → docguard_cli-0.30.1}/.github/workflows/ci.yml

@@ -12,10 +12,15 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node-version: [18, 20, 22]
+        # 24 ships npm 11 — keep it in the matrix so `npm ci` exercises the newer
+        # npm that older Nodes (18/20/22 → npm 10) do NOT. This is what catches
+        # config/install incompatibilities that npm 10 silently accepts but npm 11
+        # treats as fatal (e.g. bug-198: `.npmrc` min-release-age broke the Glama
+        # build on npm 11 while all local/CI installs passed). Do not drop 24.
+        node-version: [18, 20, 22, 24]
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0 # Full git history for freshness validator
 
@@ -97,7 +102,7 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/v')
     needs: test
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v6
         with:
           node-version: 20

docguard_cli-0.30.1/.github/workflows/jules-triage.yml

@@ -0,0 +1,85 @@
+name: Jules PR Triage
+
+# Auto-triage PRs opened by the Google Jules agents (Sentinel/Bolt/Palette).
+# Keeps Jules ON (it stays useful for genuinely-new work) while automatically
+# clearing the duplicate/already-resolved noise it tends to produce, and giving
+# it per-PR feedback (a comment mentioning @jules) so it learns.
+#
+# SECURITY: uses pull_request_target (needs write to comment/close/label on the
+# PR), but reads only PR METADATA (title, author) via the API and NEVER checks
+# out or runs the PR's code — so the elevated token is never exposed to
+# PR-controlled content. (Matches the AGENTS.md CI rule.)
+
+on:
+  pull_request_target:
+    types: [opened, reopened]
+
+permissions:
+  pull-requests: write
+  issues: write
+  contents: read
+
+jobs:
+  triage:
+    # Only act on the Jules bot's PRs; everything else is untouched.
+    if: github.event.pull_request.user.login == 'google-labs-jules[bot]'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Triage the Jules PR
+        uses: actions/github-script@v9
+        with:
+          script: |
+            const pr = context.payload.pull_request;
+            const num = pr.number;
+            const title = pr.title || '';
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+
+            // Known-noise classes for THIS repo (see .jules/*.md RESOLVED markers).
+            const NOISE = [
+              /command injection|exec(File)?Sync/i,                                   // Sentinel — fixed v0.21.1 + #296
+              /performance|optimi[sz]e|precompute|pre-?compile|O\(N|single-pass|\bset\b.*comparison|tolowercase|basenames?/i, // Bolt — applied + refactored
+              /no (web )?ui|no changes? (needed|required)|no ux|no-op/i,               // Palette — no UI in this repo
+            ];
+            const isNoise = NOISE.some((re) => re.test(title));
+
+            // Duplicate detection: another OPEN Jules PR with an equivalent title.
+            const norm = (s) => (s || '')
+              .toLowerCase()
+              .replace(/[^a-z0-9]+/g, ' ')
+              .replace(/\b(sentinel|bolt|palette|critical|high|medium|low|fix|the|a|an|via|in|of|for|to|and)\b/g, ' ')
+              .replace(/\s+/g, ' ')
+              .trim();
+            const mine = norm(title);
+            const { data: open } = await github.rest.pulls.list({ owner, repo, state: 'open', per_page: 100 });
+            const dup = mine && open.find((p) => p.number !== num && norm(p.title) === mine);
+
+            const addLabel = async (name) => {
+              try {
+                await github.rest.issues.addLabels({ owner, repo, issue_number: num, labels: [name] });
+              } catch (e) { core.info(`label "${name}" skipped: ${e.message}`); }
+            };
+
+            if (isNoise || dup) {
+              const reason = dup
+                ? `a duplicate of #${dup.number}`
+                : 'a class already resolved or not applicable in this repo';
+              await github.rest.issues.createComment({
+                owner, repo, issue_number: num,
+                body:
+                  `🤖 **Auto-triaged as stale** — ${reason}.\n\n` +
+                  `@jules please stop opening PRs for this topic: it is covered by the RESOLVED markers in \`.jules/sentinel.md\` / \`.jules/bolt.md\` / \`.jules/palette.md\` and the **Automated agents** rule in \`AGENTS.md\` (search open **and** closed PRs first; never duplicate; only open a new PR for a genuinely-new finding with evidence — an exploit/failing test for security, or a >20% real-workload benchmark for performance). Closing to keep the queue clean.`,
+              });
+              await addLabel('jules-autoclosed');
+              await github.rest.pulls.update({ owner, repo, pull_number: num, state: 'closed' });
+              core.notice(`Closed #${num} (${reason}).`);
+            } else {
+              await addLabel('jules-review');
+              await github.rest.issues.createComment({
+                owner, repo, issue_number: num,
+                body:
+                  `🔎 **Flagged for human review** — this looks like a *new, non-duplicate* change from @jules. ` +
+                  `A maintainer should verify it against \`docguard guard\` + the test suite before merge.`,
+              });
+              core.notice(`#${num} flagged for human review.`);
+            }

{docguard_cli-0.29.0 → docguard_cli-0.30.1}/.github/workflows/release.yml

@@ -19,7 +19,7 @@ jobs:
       version: ${{ steps.check.outputs.version }}
       changed: ${{ steps.check.outputs.changed }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 1 # only need HEAD's package.json; the tag check hits the remote
 
@@ -52,9 +52,11 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node-version: [18, 20, 22]
+        # 24 = npm 11 coverage (18/20/22 ship npm 10). Gates releases on the
+        # newer npm so a version-incompatible .npmrc / install can't ship (bug-198).
+        node-version: [18, 20, 22, 24]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - uses: actions/setup-node@v6
@@ -75,7 +77,7 @@ jobs:
     outputs:
       tag: v${{ needs.detect-version.outputs.version }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0 # Fetch all history + tags for reliable tag detection
 
@@ -132,7 +134,7 @@ jobs:
     needs: [detect-version, create-release]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Build extension ZIP
         run: |
@@ -157,7 +159,7 @@ jobs:
     needs: [detect-version, test, create-release]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v6
         with:
           node-version: 20
@@ -173,7 +175,7 @@ jobs:
     needs: [detect-version, test, create-release]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v6
         with:
           python-version: '3.12'
@@ -215,7 +217,7 @@ jobs:
       issues: write # reminder issue in THIS repo only — never github/spec-kit
     steps:
       - name: Checkout docguard repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Get version and metadata
         id: meta

{docguard_cli-0.29.0 → docguard_cli-0.30.1}/.github/workflows/sync-speckit-catalog.yml

@@ -30,7 +30,7 @@ jobs:
 
     steps:
       - name: Checkout docguard repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Get version and metadata
         id: meta

docguard_cli-0.30.1/.jules/bolt.md

@@ -0,0 +1,24 @@
+# Bolt — performance learnings
+
+> ⛔ **STOP / DO-NOT-DUPLICATE.** Before opening ANY PR, search existing **open
+> AND closed** PRs. Dozens of duplicate "optimize diffTests / Set cross-compare
+> / precompute toLowerCase / pre-compile RegExp" PRs were closed as noise.
+> **Do NOT open another micro-optimization PR** unless you include a **benchmark
+> showing >20% wall-clock improvement on a realistic workload** (a real repo,
+> not a synthetic loop). A theoretical Big-O note is NOT sufficient justification.
+
+## ✅ APPLIED / EVALUATED — the recurring diff & scan optimizations (do NOT re-open)
+
+The learnings below have already been applied where they helped, and the
+affected code (`cli/commands/diff.mjs`, `cli/validators/*`, the scanners) was
+substantially **refactored in v0.29–v0.30** — PRs written against the old shape
+no longer apply and just create merge noise.
+
+- **Early-return in `checkUntrackedTodos`** — already in place.
+- **Precompute `.toLowerCase()` / `.substring()` outside loops** — applied where
+  it mattered; the remaining cases are not hot paths.
+- **Pre-compile `RegExp` outside nested loops** — applied in the scanners.
+
+These are recorded as historical context, **not** as standing mandates to
+re-scan for on every run. The DocGuard test suite (898 tests) and CI already
+guard against regressions here.

docguard_cli-0.30.1/.jules/palette.md

@@ -0,0 +1,11 @@
+# Palette — UX learnings
+
+> ⛔ **STOP.** This repository has **no user-facing UI**: it is a Node.js CLI
+> plus config/docs. There is **no web frontend** (no HTML/CSS/React/Vue) and
+> **no VS Code extension** (it was removed). Palette therefore has nothing to
+> act on here. **Do NOT open UX PRs** — the past "No web UI components" /
+> "No changes required" no-op PRs were closed as noise. Skip this repo.
+
+Historical note: earlier learnings referenced a VS Code extension (status-bar
+tooltips, loading spinners). That extension no longer exists in this repo, so
+those notes are obsolete and must not be acted on.

docguard_cli-0.30.1/.jules/sentinel.md

@@ -0,0 +1,24 @@
+# Sentinel — security learnings
+
+> ⛔ **STOP / DO-NOT-DUPLICATE.** Before opening ANY PR, search existing **open
+> AND closed** PRs and issues. If the topic below is already covered, do NOT
+> open another PR — dozens of duplicate command-injection PRs were closed as
+> noise. Only open a PR for a **new, unaddressed** finding, with a concrete
+> exploit path or failing test as evidence.
+
+## ✅ RESOLVED — Command Injection via execSync (do NOT re-open)
+
+**Status: FIXED and CLOSED. Do not open further PRs about `execSync` / command injection.**
+
+- The real vulnerability (issue #190) was fixed in **v0.21.1** by switching the
+  `specify`-spawning path to `execFileSync` (arguments as an array — no shell
+  interpolation).
+- The last shell-interpolated `execSync` (dead code in `setup.mjs`'s unused
+  `isCliAvailable`) was removed in **PR #296**.
+- Every remaining `execSync` in `cli/` uses a **static string literal**
+  (`git rev-parse …`, `git rev-list --count HEAD`, `git log … | wc -l`) with
+  **no variable interpolation** — not injectable. Leave them as-is; do not "fix" them.
+
+Historical note (kept for context, not for re-application): interpolating
+`projectDir`/`filePath` into a shell string allowed `;`/`&&`/`||` injection;
+`execFileSync` with an args array prevents it. Lesson recorded — already applied.

{docguard_cli-0.29.0 → docguard_cli-0.30.1}/.jules-setup.sh

@@ -19,9 +19,12 @@ export OPENAI_API_KEY="dummy-openai-key"
 # 2. Ecosystem-Specific Dependency Installation
 # ------------------------------------------
 echo "📦 === Installing Dependencies ==="
-# Note: DocGuard has zero production dependencies, but we run npm install
-# in case devDependencies are added in the future.
-npm install
+# DocGuard has one exact-pinned runtime dep (@babel/parser). Use `npm ci`, NOT
+# `npm install`: `npm ci` installs strictly from package-lock.json and never
+# rewrites it, so it leaves the working tree clean. `npm install` can re-resolve
+# and rewrite package-lock.json, which dirties the tree and makes Jules abort
+# with "Working tree is dirty" after setup.
+npm ci
 
 # ------------------------------------------
 # 3. Ecosystem-Specific Tests & Build Checks
@@ -31,11 +34,21 @@ echo "🧪 === Running Initial Test & Validation ==="
 npm test || echo "⚠️ Tests failed, but continuing..."
 
 echo "🏗️ === Verifying Build Integrity ==="
-# Test the primary CLI entrypoint to ensure it is executable
+# Test the primary CLI entrypoint to ensure it is executable.
+# Note: `--version` triggers ensureSkills, which regenerates the tracked
+# `.agent/skills/*.md` files (their `version:` frontmatter tracks the release),
+# so the tree is expected to be dirty right after this — the reset below
+# discards that regeneration.
 node cli/docguard.mjs --version
 
 echo "🧹 === Enforcing Git Tree Integrity ==="
-# Jules requires the working directory to be clean after this script runs
+# Jules requires the working directory to be clean after this script runs, and
+# ignores any changes setup makes. `git clean -fd` alone is INSUFFICIENT — it
+# only removes UNTRACKED files, but our churn is in TRACKED files (regenerated
+# .agent/skills). Hard-reset discards tracked modifications; clean -fd sweeps
+# any stray untracked files. `-fd` respects .gitignore, so node_modules (which
+# we just installed) is preserved.
+git reset --hard HEAD
 git clean -fd || true
 
 echo "✅ Jules VM Local Environment is Ready!"

docguard_cli-0.30.1/.npmrc

@@ -0,0 +1,13 @@
+# Supply-Chain Security Hardening
+# Applied: 2026-05-14T14:19:27Z
+# ignore-scripts: never run a dependency's install/postinstall scripts (the main
+#   supply-chain attack vector). Universally supported across npm versions.
+# audit-level: surface moderate-and-above advisories.
+#
+# NOTE: `min-release-age=7d` was removed 2026-07-06 — newer npm (Node 22+/npm 11+,
+# as used by the Glama MCP build image) rejects the "7d" value ("must be numeric")
+# and HARD-FAILS `npm install` in clean environments (Glama, CI, fresh clones).
+# DocGuard's single runtime dependency is exact-pinned, so the maturity window
+# added little; the exact pin + ignore-scripts + audit-level remain the controls.
+ignore-scripts=true
+audit-level=moderate

docguard_cli-0.30.1/.pre-commit-hooks.yaml

@@ -0,0 +1,49 @@
+# DocGuard hooks for the pre-commit framework (https://pre-commit.com).
+#
+# How this works: `language: node` tells pre-commit to install THIS repo with
+# npm into an isolated nodeenv. package.json's `"bin": { "docguard": ... }`
+# is what makes the `docguard` executable in `entry` resolvable — no global
+# install needed on the consumer's machine.
+#
+# ### pre-commit
+# Consumers add this to their project's .pre-commit-config.yaml:
+#
+#     repos:
+#       - repo: https://github.com/raccioly/docguard
+#         rev: v0.29.0
+#         hooks:
+#           - id: docguard-guard
+#
+# For the full (slower) validator run on push instead of commit:
+#
+#     repos:
+#       - repo: https://github.com/raccioly/docguard
+#         rev: v0.29.0
+#         hooks:
+#           - id: docguard-guard-full
+#
+#     # and install the push-stage hook once per clone:
+#     #   pre-commit install --hook-type pre-push
+#
+# Both hooks validate the project as a whole (docs vs code), so filenames are
+# never passed and the hooks always run (`pass_filenames: false` +
+# `always_run: true`).
+
+- id: docguard-guard
+  name: DocGuard guard (changed-only)
+  description: Fast doc-drift gate — validates only the docs/code touched in the working tree.
+  entry: docguard guard --changed-only --quiet
+  language: node
+  pass_filenames: false
+  always_run: true
+
+- id: docguard-guard-full
+  name: DocGuard guard (full)
+  description: Full DocGuard validator run — every enabled validator, intended for the pre-push stage.
+  entry: docguard guard --quiet
+  language: node
+  pass_filenames: false
+  always_run: true
+  stages: [pre-push]
+  # `pre-push` (vs the legacy `push`) stage name requires pre-commit >= 3.2.
+  minimum_pre_commit_version: '3.2.0'

{docguard_cli-0.29.0 → docguard_cli-0.30.1}/.wolf/anatomy.md

@@ -1,42 +1,51 @@
 # anatomy.md
 
-> Auto-maintained by OpenWolf. Last scanned: 2026-07-03T20:32:09.442Z
-> Files: 649 tracked | Anatomy hits: 0 | Misses: 0
+> Auto-maintained by OpenWolf. Last scanned: 2026-07-06T14:46:58.012Z
+> Files: 670 tracked | Anatomy hits: 0 | Misses: 0
 
 ## ../../../../../../../tmp/
 
 - `append-buglog.mjs` — Declares path (~1335 tok)
 
+## ../../../../../.claude/projects/-Users-ricardoaccioly-Repo-claude-canonical-spec-kit/memory/
+
+- `keep-local-main-synced.md` (~276 tok)
+
 ## ./
 
 - `.docguard.json` (~526 tok)
 - `.docguardignore` — # Python distribution artifacts (~199 tok)
 - `.DS_Store` (~3818 tok)
 - `.gitignore` — Git ignore rules (~167 tok)
-- `.jules-setup.sh` — Google Jules Environment Startup Script (~429 tok)
+- `.jules-setup.sh` — ========================================== (~631 tok)
 - `.npmignore` — Development (~76 tok)
 - `.npmrc` — Supply-Chain Security Hardening (~59 tok)
+- `.pre-commit-hooks.yaml` — DocGuard hooks for the pre-commit framework (https://pre-commit.com). (~490 tok)
 - `action.yml` — Declares fs (~7591 tok)
-- `AGENTS.md` — AI Agent Instructions — DocGuard (~1582 tok)
-- `CHANGELOG.md` — Changelog (~44379 tok)
+- `AGENTS.md` — AI Agent Instructions — DocGuard (~1827 tok)
+- `CHANGELOG.md` — Changelog (~45081 tok)
 - `CLAUDE.md` — OpenWolf (~57 tok)
 - `CODE_OF_CONDUCT.md` — Contributor Covenant Code of Conduct (~532 tok)
 - `COMPARISONS.md` — Comparisons & Honest Limitations (~3053 tok)
 - `CONTRIBUTING.md` — Contributing to DocGuard (~1780 tok)
 - `docguard-cli-0.22.0.tgz` (~80828 tok)
 - `docguard-cli-0.23.0.tgz` (~81238 tok)
-- `DRIFT-LOG.md` — Drift Log (~711 tok)
+- `Dockerfile` — Docker container definition (~204 tok)
+- `DRIFT-LOG.md` — Drift Log (~802 tok)
+- `glama.json` (~29 tok)
 - `LICENSE` — Project license (~286 tok)
 - `package-lock.json` — npm lock file (~617 tok)
-- `package.json` — Node.js package manifest (~446 tok)
+- `package.json` — Node.js package manifest (~459 tok)
 - `PHILOSOPHY.md` — The Philosophy of Canonical-Driven Development (~1757 tok)
 - `pr_description.md` (~260 tok)
 - `pyproject.toml` — The enforcement tool for Canonical-Driven Development (CDD). Audit, generate, and guard your project (~358 tok)
 - `README.es.md` — 🛡️ DocGuard (~1098 tok)
-- `README.md` — Project documentation (~8061 tok)
+- `README.md` — Project documentation (~8436 tok)
 - `README.pt-BR.md` — 🛡️ DocGuard (~1075 tok)
 - `ROADMAP.md` — DocGuard Roadmap (~2432 tok)
 - `SECURITY.md` — Security Policy (~357 tok)
+- `server.json` (~272 tok)
+- `smithery.yaml` — Smithery configuration for the DocGuard MCP server. (~283 tok)
 - `STANDARD.md` — DocGuard Standard v0.1 (~6533 tok)
 - `SUPPLY-CHAIN-AUDIT.md` — Supply-Chain Security Audit (~726 tok)
 - `SUPPORT.md` — Support (~335 tok)
@@ -938,18 +947,26 @@
 ## .github/scripts/
 
 - `speckit-submission-body.sh` — Build the body for a spec-kit "Extension Submission" issue. (~1482 tok)
-- `speckit-submission.py` — Build a spec-kit "Extension Submission" for DocGuard. (~2590 tok)
+- `speckit-submission.py` — Build a spec-kit "Extension Submission" for DocGuard. (~2905 tok)
 
 ## .github/workflows/
 
-- `release.yml` — CI: Auto Release — Tag, GitHub Release, npm, PyPI (~3386 tok)
+- `ci.yml` — CI: DocGuard CI (~1041 tok)
+- `release.yml` — CI: Auto Release — Tag, GitHub Release, npm, PyPI (~3434 tok)
 - `sync-speckit-catalog.yml` — CI: Prepare Spec Kit Catalog Submission (Manual) (~1385 tok)
 
+## .jules/
+
+- `bolt.md` — Bolt — performance learnings (~333 tok)
+- `palette.md` — Palette — UX learnings (~153 tok)
+- `sentinel.md` — Sentinel — security learnings (~329 tok)
+
 ## cli/
 
 - `config.mjs` — DocGuard — configuration loading. (~3265 tok)
-- `docguard.mjs` — DocGuard CLI — The enforcement tool for Canonical-Driven Development (CDD) (~9439 tok)
-- `findings.mjs` — Findings — the structured, LLM-addressable result unit (v0.27). (~9378 tok)
+- `docguard.mjs` — DocGuard CLI — The enforcement tool for Canonical-Driven Development (CDD) (~9606 tok)
+- `findings.mjs` — Findings — the structured, LLM-addressable result unit (v0.27). (~9698 tok)
+- `shared-git.mjs` — Shared Git Utilities — single source of truth for `git log` plumbing (~1851 tok)
 - `shared-ignore.mjs` — Shared Ignore Utility — Unified file filtering for all validators. (~4132 tok)
 - `shared-source.mjs` — Shared Source Resolution — Monorepo-aware source discovery. (~4655 tok)
 - `shared.mjs` — Shared constants for DocGuard CLI — colors, profiles, version. (~3496 tok)
@@ -965,22 +982,25 @@
 - `guard.mjs` — Guard Command — Validate project against its canonical documentation (~11608 tok)
 - `init.mjs` — Init Command — Initialize CDD documentation from templates (~7278 tok)
 - `llms.mjs` — llms Command — Generate llms.txt from canonical documentation (~2137 tok)
-- `mcp.mjs` — MCP Command — DocGuard as a Model Context Protocol server (stdio). (~2902 tok)
+- `mcp.mjs` — MCP Command — DocGuard as a Model Context Protocol server (stdio). (~3098 tok)
 - `memory.mjs` — Memory Command — v0.17-P2. (~2957 tok)
-- `score.mjs` — Score Command — Calculate CDD maturity score (0-100) (~12136 tok)
+- `score.mjs` — Score Command — Calculate CDD maturity score (0-100) (~12221 tok)
+- `setup.mjs` — Setup Command — Interactive onboarding wizard for DocGuard (~5280 tok)
 - `sync-tests.mjs` — `docguard sync --tests` — reconcile the TEST-SPEC Source-to-Test Map from disk. (~3191 tok)
 - `sync.mjs` — Sync Command — keep the documentation memory ALWAYS UP TO DATE. (~2371 tok)
-- `verify.mjs` — Verify Command — `docguard verify --semantic` (LLM field report #5). (~833 tok)
+- `trace.mjs` — Trace Command — Generate a requirements traceability matrix (~7746 tok)
+- `verify.mjs` — Verify Command — `docguard verify` (LLM field reports #5, #11). (~2118 tok)
 
 ## cli/scanners/
 
 - `agent-readability.mjs` — Agent Readability scanner — how well do this repo's docs serve an AI agent? (~2228 tok)
+- `instruction-audit.mjs` — Instruction Audit scanner — drift/conflict audit WITHIN agent instruction (~3668 tok)
 - `inventory.mjs` — Inventory scanners — code-truth the generator PRE-FILLS instead of leaving (~1699 tok)
 - `memory-plan.mjs` — Memory Plan — the orchestration artifact behind AI-powered Generate. (~5744 tok)
 - `project-type.mjs` — Project-Type Detection — the language-agnostic spine. (~4190 tok)
 - `routes.mjs` — Deep Route Scanner (~7712 tok)
 - `semantic-claims.mjs` — Semantic claim extractor (LLM field report #5). (~1998 tok)
-- `speckit.mjs` — Spec Kit Scanner — Detect, validate, and integrate with GitHub Spec Kit (~4785 tok)
+- `speckit.mjs` — Spec Kit Scanner — Detect, validate, and integrate with GitHub Spec Kit (~8882 tok)
 
 ## cli/validators/
 
@@ -1015,7 +1035,7 @@
 
 ## docs-canonical/
 
-- `ARCHITECTURE.md` — Architecture (~2883 tok)
+- `ARCHITECTURE.md` — Architecture (~3029 tok)
 - `DATA-MODEL.md` — Data Model (~1668 tok)
 - `REQUIREMENTS.md` — Requirements (~673 tok)
 - `SURFACE-AUDIT.md` — DocGuard Surface Audit (~5703 tok)
@@ -1031,9 +1051,17 @@
 
 - `extension.yml` (~1026 tok)
 
+## packaging/
+
+- `submissions.md` — DocGuard — Distribution-Channel Submissions (v0.29.0) (~1728 tok)
+
+## packaging/homebrew/
+
+- `docguard.rb` — typed: false (~373 tok)
+
 ## schemas/
 
-- `docguard-config.schema.json` — behavior: docs (~2889 tok)
+- `docguard-config.schema.json` — behavior: docs (~3015 tok)
 
 ## templates/
 
@@ -1042,6 +1070,10 @@
 - `SECURITY.md.template` — Security (~342 tok)
 - `TEST-SPEC.md.template` — /*.ts --> | <!-- e.g. tests/unit/**/*.test.ts --> | Unit | (~771 tok)
 
+## templates/ci/
+
+- `gitlab-component.yml` — DocGuard — GitLab CI/CD component (CI/CD Catalog style, spec:inputs syntax). (~906 tok)
+
 ## templates/commands/
 
 - `docguard.fix.md` — /docguard.fix — Find and Fix CDD Documentation Issues (~771 tok)
@@ -1061,6 +1093,8 @@
 - `field-report-3-deferred.test.mjs` — v0.28 — the detection-gap items deferred from LLM field report #3. (~3122 tok)
 - `field-report-3.test.mjs` — v0.27 — LLM field report #3. (~3315 tok)
 - `freshness.test.mjs` — runGit: commitOldCode (~3536 tok)
+- `hooks.test.mjs` — Declares afterFirst (~2420 tok)
+- `instruction-audit.test.mjs` — Instruction Audit scanner tests (field report #11 — MemoryLint-inspired). (~2387 tok)
 - `inventory.test.mjs` — Declares make (~1048 tok)
 - `llms-full-pack.test.mjs` — CLI: run (~1304 tok)
 - `mcp.test.mjs` — MCP Server Tests — `docguard mcp` over stdio. (~2138 tok)
@@ -1071,3 +1105,5 @@
 - `project-type.test.mjs` — Declares make (~2140 tok)
 - `sarif.test.mjs` — Declares CLI (~1455 tok)
 - `shared-source.test.mjs` — API routes: GET (4 endpoints) (~1714 tok)
+- `speckit-phantom.test.mjs` — Exports users, fetchUserRecords, retry, adapter + 2 more (~2500 tok)
+- `trace-features.test.mjs` — `trace --features` — per-feature spec-kit adherence scoring. (~2423 tok)