docguard-cli 0.34.0__tar.gz → 0.34.2__tar.gz

{docguard_cli-0.34.0/extensions/spec-kit-docguard → docguard_cli-0.34.2/.agent}/skills/docguard-fix/SKILL.md

@@ -6,10 +6,10 @@ description: AI-driven documentation repair with structured research workflow, t
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.0
+  version: 0.34.2
   source: extensions/spec-kit-docguard/skills/docguard-fix
 ---
-<!-- docguard:version: 0.34.0 -->
+<!-- docguard:version: 0.34.2 -->
 
 # DocGuard Fix Skill
 

{docguard_cli-0.34.0 → docguard_cli-0.34.2}/.agent/skills/docguard-guard/SKILL.md

@@ -7,10 +7,10 @@ description: Run DocGuard guard validation against Canonical-Driven Development
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.0
+  version: 0.34.2
   source: extensions/spec-kit-docguard/skills/docguard-guard
 ---
-<!-- docguard:version: 0.34.0 -->
+<!-- docguard:version: 0.34.2 -->
 
 # DocGuard Guard Skill
 

{docguard_cli-0.34.0/extensions/spec-kit-docguard → docguard_cli-0.34.2/.agent}/skills/docguard-review/SKILL.md

@@ -6,10 +6,10 @@ description: Cross-document consistency analysis and quality assessment. Perform
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.0
+  version: 0.34.2
   source: extensions/spec-kit-docguard/skills/docguard-review
 ---
-<!-- docguard:version: 0.34.0 -->
+<!-- docguard:version: 0.34.2 -->
 
 # DocGuard Review Skill
 

{docguard_cli-0.34.0/extensions/spec-kit-docguard → docguard_cli-0.34.2/.agent}/skills/docguard-score/SKILL.md

@@ -6,10 +6,10 @@ description: CDD maturity assessment with category-aware improvement roadmap. Ru
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.0
+  version: 0.34.2
   source: extensions/spec-kit-docguard/skills/docguard-score
 ---
-<!-- docguard:version: 0.34.0 -->
+<!-- docguard:version: 0.34.2 -->
 
 # DocGuard Score Skill
 

{docguard_cli-0.34.0 → docguard_cli-0.34.2}/.agent/skills/docguard-sync/SKILL.md

@@ -4,10 +4,10 @@ description: Keep canonical documentation ALWAYS UP TO DATE. Refreshes code-trut
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.0
+  version: 0.34.2
   source: extensions/spec-kit-docguard/skills/docguard-sync
 ---
-<!-- docguard:version: 0.34.0 -->
+<!-- docguard:version: 0.34.2 -->
 
 # DocGuard Sync Skill
 

docguard_cli-0.34.2/.github/dependabot.yml

@@ -0,0 +1,32 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      all-npm:
+        patterns: ["*"]
+    ignore:
+      # @babel/parser 8.x requires Node ^22.18.0 || >=24.11.0, silently dropping
+      # Node 18 — which this project declares support for and CI gates on.
+      # Confirmed twice (PRs #331, #335): the major bump passes tests on a
+      # single local Node version but breaks the Node 18 CI job with wrong
+      # AST-parse results (not an install failure, so it slips past casual
+      # review). Stay on 7.x; take patches (see #333) via version-update:semver-patch/minor.
+      - dependency-name: "@babel/parser"
+        update-types: ["version-update:semver-major"]
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      all-pip:
+        patterns: ["*"]
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      all-actions:
+        patterns: ["*"]

{docguard_cli-0.34.0 → docguard_cli-0.34.2}/.github/workflows/ci.yml

@@ -24,7 +24,7 @@ jobs:
         with:
           fetch-depth: 0 # Full git history for freshness validator
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node-version }}
 
@@ -130,7 +130,7 @@ jobs:
     needs: test
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 20
           registry-url: 'https://registry.npmjs.org'

{docguard_cli-0.34.0 → docguard_cli-0.34.2}/.github/workflows/release.yml

@@ -59,7 +59,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node-version }}
       - name: Install dependencies
@@ -164,7 +164,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 20
 
@@ -201,7 +201,7 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 20
           registry-url: 'https://registry.npmjs.org'
@@ -217,7 +217,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.12'
 

{docguard_cli-0.34.0 → docguard_cli-0.34.2}/.github/workflows/supply-chain.yml

@@ -17,8 +17,8 @@ permissions:
 jobs:
   osv-scan-pr:
     if: github.event_name == 'pull_request'
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.3.8"
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.5.1"
 
   osv-scan-scheduled:
     if: github.event_name != 'pull_request'
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.3.8"
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.5.1"

{docguard_cli-0.34.0 → docguard_cli-0.34.2}/.wolf/anatomy.md

@@ -1,7 +1,7 @@
 # anatomy.md
 
-> Auto-maintained by OpenWolf. Last scanned: 2026-08-13T18:59:25.435Z
-> Files: 700 tracked | Anatomy hits: 0 | Misses: 0
+> Auto-maintained by OpenWolf. Last scanned: 2026-09-11T14:49:52.100Z
+> Files: 704 tracked | Anatomy hits: 0 | Misses: 0
 
 ## ../../../../../../../tmp/
 
@@ -29,7 +29,7 @@
 - `.pre-commit-hooks.yaml` — DocGuard hooks for the pre-commit framework (https://pre-commit.com). (~490 tok)
 - `action.yml` — Declares fs (~7591 tok)
 - `AGENTS.md` — AI Agent Instructions — DocGuard (~1827 tok)
-- `CHANGELOG.md` — Changelog (~50468 tok)
+- `CHANGELOG.md` — Changelog (~51473 tok)
 - `CLAUDE.md` — OpenWolf (~57 tok)
 - `CODE_OF_CONDUCT.md` — Contributor Covenant Code of Conduct (~532 tok)
 - `COMPARISONS.md` — Comparisons & Honest Limitations (~3382 tok)
@@ -945,6 +945,7 @@
 
 ## .github/
 
+- `dependabot.yml` (~296 tok)
 - `PULL_REQUEST_TEMPLATE.md` — Pull Request (~223 tok)
 
 ## .github/ISSUE_TEMPLATE/
@@ -1011,6 +1012,7 @@
 - `memory-plan.mjs` — Memory Plan — the orchestration artifact behind AI-powered Generate. (~5744 tok)
 - `project-type.mjs` — Project-Type Detection — the language-agnostic spine. (~4190 tok)
 - `routes.mjs` — Deep Route Scanner (~7712 tok)
+- `schemas.mjs` — Deep Schema Scanner (~7517 tok)
 - `semantic-claims.mjs` — Semantic claim extractor (LLM field report #5). (~2120 tok)
 - `speckit.mjs` — Spec Kit Scanner — Detect, validate, and integrate with GitHub Spec Kit (~8882 tok)
 
@@ -1040,7 +1042,7 @@
 - `structure.mjs` — Structure Validator — Checks that all required CDD files exist (~1647 tok)
 - `surface-sync.mjs` — Surface-Sync Validator — item-level drift detection for enumerable surfaces. (~4219 tok)
 - `test-spec.mjs` — Test Spec Validator — Checks that tests exist per TEST-SPEC.md coverage rules (~4463 tok)
-- `todo-tracking.mjs` — TODO/FIXME Tracking Validator — Ensures code annotations are documented (~3916 tok)
+- `todo-tracking.mjs` — TODO/FIXME Tracking Validator — Ensures code annotations are documented (~3931 tok)
 - `traceability.mjs` — Traceability Validator — Checks that canonical docs are linked to source code (~5732 tok)
 
 ## cli/writers/
@@ -1135,8 +1137,10 @@
 - `reference-existence.test.mjs` — Exports validateToken, getUserById, verifyToken, getUserById + 4 more (~1853 tok)
 - `report.test.mjs` — `docguard report` — compliance-evidence bundle (v0.33). (~1636 tok)
 - `sarif.test.mjs` — Declares CLI (~1455 tok)
+- `schemas.test.mjs` — '] }); (~1716 tok)
 - `shared-source.test.mjs` — API routes: GET (4 endpoints) (~1714 tok)
 - `speckit-phantom.test.mjs` — Exports users, fetchUserRecords, retry, adapter + 2 more (~2500 tok)
+- `todo-tracking.test.mjs` — result: myFunc, myFunc, check, legacy (~1491 tok)
 - `trace-features.test.mjs` — `trace --features` — per-feature spec-kit adherence scoring. (~2423 tok)
 - `traceability.test.mjs` — Exports foo, GET, x (~3729 tok)
 - `v020-consolidation.test.mjs` — v0.20 — Surface consolidation tests. (~2540 tok)

{docguard_cli-0.34.0 → docguard_cli-0.34.2}/.wolf/buglog.json

@@ -4318,9 +4318,138 @@
         "readdirSync",
         "basename-preservation"
       ],
-      "related_bugs": ["bug-252"],
+      "related_bugs": [
+        "bug-252"
+      ],
       "occurrences": 1,
       "last_seen": "2026-08-13T19:00:00Z"
+    },
+    {
+      "id": "bug-263",
+      "timestamp": "2026-08-28T16:38:52.952Z",
+      "error_message": "Missing guard clause",
+      "file": "cli/scanners/schemas.mjs",
+      "root_cause": "No early return/throw for edge case: !field.type",
+      "fix": "Added guard clause: if (!field.type)",
+      "tags": [
+        "auto-detected",
+        "guard-clause",
+        "mjs"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-08-28T16:38:52.952Z"
+    },
+    {
+      "id": "bug-264",
+      "timestamp": "2026-08-28T16:41:43.490Z",
+      "error_message": "Incorrect value in code",
+      "file": "package.json",
+      "root_cause": "Had \"0.34.0\"",
+      "fix": "Changed to \"0.34.1\"",
+      "tags": [
+        "auto-detected",
+        "wrong-value",
+        "json"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-08-28T16:41:43.490Z"
+    },
+    {
+      "id": "bug-254",
+      "timestamp": "2026-08-28T16:45:00Z",
+      "error_message": "extractOpenAPIRelationships crashed on a field with no `type` (a bare $ref is valid OpenAPI); TODO-Tracking's test-file exclusion regex only matched the dotted JS convention (foo.test.py), never the idiomatic Python/Go/Ruby naming (test_foo.py, foo_test.go, foo_spec.rb), so TODOs inside real test files' test functions were flagged as untracked source TODOs",
+      "file": "cli/scanners/schemas.mjs, cli/validators/todo-tracking.mjs",
+      "root_cause": "schemas.mjs: field.type undefined passed the !== checks (undefined !== 'string' etc. all true) then .toLowerCase() threw. todo-tracking.mjs: TEST_NAME_RE only had the JS-style dotted pattern applied across all languages, which nobody actually writes in Python/Go/Ruby.",
+      "fix": "Cherry-picked from PR #328 (external/bot-authored, closed unmerged): added `if (!field.type) continue;` guard; replaced TEST_NAME_RE with a pattern covering the JS dotted convention plus idiomatic test_*.py/*_test.py/*_test.go/*_spec.rb/*_test.rb. The PR's OWN test was broken and had to be rewritten: it called scanSchemasDeep('/', {}, docTools, {}) where docTools.openapi was missing `found: true` — since scanSchemasDeep's OpenAPI early-return requires `openapi.found` truthy, the malformed fixture fell through into a REAL directory scan of '/', turning a 118ms test into 190+ seconds (confirmed via isolated timing: clean main runs schemas.test.mjs in 118ms, PR328-merged runs it in 10s+ timeout). Fixed by adding `found: true` to the fixture and using a proper mkdtempSync tmpdir instead of '/'.",
+      "tags": [
+        "openapi",
+        "schemas",
+        "todo-tracking",
+        "crash",
+        "false-positive",
+        "test-hygiene",
+        "external-pr-review",
+        "performance-regression"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-08-28T16:45:00Z",
+      "notes": "Lesson for reviewing ANY externally/bot-authored PR before merging: run its tests MERGED ONTO current main (not the raw branch) and TIME the run, not just check pass/fail — a test that passes but is 1000x slower than it should be is often a sign the test isn't exercising what it claims to."
+    },
+    {
+      "id": "bug-266",
+      "timestamp": "2026-08-28T16:49:33.891Z",
+      "error_message": "Incorrect value in code",
+      "file": "package.json",
+      "root_cause": "Had \"8.0.4\"",
+      "fix": "Changed to \"7.29.7\"",
+      "tags": [
+        "auto-detected",
+        "wrong-value",
+        "json"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-08-28T16:49:33.891Z"
+    },
+    {
+      "id": "bug-255",
+      "timestamp": "2026-08-28T16:55:00Z",
+      "error_message": "v0.34.1 release pipeline failed on test (18) — 20 tests failing, all in js-ast/routes/schemas AST-parsing tests — while test (20)/(22)/(24) passed. create-release, publish-npm, publish-pypi correctly skipped (dependency gate worked as designed, nothing published).",
+      "file": "package.json, package-lock.json",
+      "root_cause": "Merged dependabot PR #331 bumping @babel/parser 7.29.7 to 8.0.4 (major) after testing 1036/1036 green — but only on the local machine's Node 24. @babel/parser@8.0.4's own package.json declares engines: {node: '^22.18.0 || >=24.11.0'} — it silently dropped Node 18 (and isn't really supported on 20 either, though it happened to still work there). docguard-cli declares engines: {node: '>=18.0.0'} and CI's test matrix gates all of 18/20/22/24 — the mismatch only manifests as behavioral breakage (bad AST parse results), not an install failure, so npm install/npm ci never complained.",
+      "fix": "Reverted @babel/parser to 7.29.7 in package.json + package-lock.json (npm install to resync lock). Installed Node 18 and 20 locally via fnm (previously only had 22/24) and re-ran the FULL suite on all four versions (18, 20, 22, 24) before pushing again — closing the exact gap that let this ship in the first place. Commented on the merged PR #331 documenting the revert for the historical record.",
+      "tags": [
+        "dependency-bump",
+        "babel-parser",
+        "node-version-compat",
+        "engines-field",
+        "release-pipeline-caught-it",
+        "ci-test-matrix",
+        "major-version-bump"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-08-28T16:55:00Z",
+      "notes": "The release pipeline did exactly its job: test(18) failed, everything downstream (tag/npm/pypi) correctly skipped via job dependencies, nothing bad shipped. The gap was in MY pre-push verification, not the CI design."
+    },
+    {
+      "id": "bug-268",
+      "timestamp": "2026-09-11T14:49:52.110Z",
+      "error_message": "Incorrect value in code",
+      "file": "package.json",
+      "root_cause": "Had \"0.34.1\"",
+      "fix": "Changed to \"0.34.2\"",
+      "tags": [
+        "auto-detected",
+        "wrong-value",
+        "json"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T14:49:52.110Z"
+    },
+    {
+      "id": "bug-256",
+      "timestamp": "2026-09-11T15:00:00Z",
+      "error_message": "publish-npm for v0.34.1 failed identically 3 times across 2 weeks (2026-08-28 x2, 2026-09-11): provenance signs successfully (distinct Sigstore transparency-log entry each time) then npm error E404 'docguard-cli@0.34.1 is not in this registry' on the PUT, ~0.1-0.4s later.",
+      "file": ".github/workflows/release.yml (NPM_TOKEN secret, not a code file)",
+      "root_cause": "NPM_TOKEN (a GitHub Actions repo secret) most likely expired. gh secret list shows it was last rotated 2026-05-22; the v0.34.0 publish succeeded on 2026-08-13 (day 83) using this same token, and every attempt since 2026-08-28 (day 98) has failed identically — consistent with npm's ~90-day default expiration on Automation tokens. npm returns 404 rather than 401/403 for some auth-scope failures during publish (a known npm registry quirk — doesn't confirm a package exists to an unauthorized/wrongly-scoped identity), which is why the error text looks like a missing-package error instead of an auth error. Confirmed NOT a registry incident: npm status page all-green throughout, incident history shows no active issue, and docguard-cli's existing versions were untouched on the registry each time.",
+      "fix": "Cannot fix from the CLI/repo — requires the user to generate a new npm Automation token (npmjs.com account settings) with publish rights to docguard-cli, and update the NPM_TOKEN secret in GitHub repo settings. Documented in CHANGELOG v0.34.2 'Known issue' section so it's visible to anyone checking why npm is behind. v0.34.1 and v0.34.2 are both correctly tagged/GitHub-released/PyPI-published (those don't depend on NPM_TOKEN) — only npm is stuck.",
+      "tags": [
+        "npm-publish",
+        "token-expiration",
+        "ci-secret",
+        "release-pipeline",
+        "not-fixable-by-agent",
+        "e404-masks-auth-failure"
+      ],
+      "related_bugs": [],
+      "occurrences": 3,
+      "last_seen": "2026-09-11T14:34:00Z",
+      "notes": "Do NOT keep blindly retrying publish-npm if this recurs after a token rotation looks successful — verify the token's actual publish scope/expiration on npmjs.com first. Also: don't assume '404 on a publish that should be an update' is a transient registry blip just because npm's status page is green and the error text sounds like a missing-package error — check secret rotation dates before concluding 'try again later'."
     }
   ]
 }

{docguard_cli-0.34.0 → docguard_cli-0.34.2}/.wolf/cerebrum.md

@@ -12,6 +12,12 @@
 
 ## Key Learnings
 
+- **2026-09-11 — `npm error 404` on a PUBLISH (not install) can mean an expired token, not a missing package or a registry incident.** `publish-npm` for v0.34.1 failed identically 3x over 2 weeks: provenance signs fine (real, distinct Sigstore transparency-log entries each time — proves GitHub's OIDC → Sigstore leg works), then the actual registry PUT 404s with "'docguard-cli@0.34.1' is not in this registry" ~0.1-0.4s later. Ruled out registry incident (npm status green, incident history clean, package untouched on registry each time) before concluding it's the token — `gh secret list` showing `NPM_TOKEN` last rotated 2026-05-22, and the last successful publish being 2026-08-13 (day 83) with every attempt since day 98 failing, lines up with npm's ~90-day Automation-token default expiration. npm apparently returns 404 (not 401/403) for some auth/scope failures on publish, presumably to avoid confirming a package's existence to an unauthorized caller — worth remembering next time a publish 404s on a package that obviously exists. This is NOT fixable by the agent — needs the user to rotate the token on npmjs.com and update the GitHub secret. See bug-256.
+- **2026-09-11 — The full-Node-matrix-testing discipline (from bug-255) paid off immediately.** Same dependabot proposed the same @babel/parser 7→8 major bump again (#335) two weeks after the first revert — closed it on sight, no need to re-investigate. A companion Jules-bot PR (#333) independently arrived at the correct fix (bump to the latest 7.x patch, explicitly Node-18-aware in its own PR description) — merged after verifying 1042/1042 across Node 18/20/22/24 AGAIN, plus a combined-branch test with 5 other PRs merged together (1050/1050 across all four versions) before pushing. Also added a `dependabot.yml` ignore rule for `@babel/parser` majors specifically (`update-types: version-update:semver-major`) so this stops recurring every cycle — patches/minors still flow through.
+- **2026-09-11 — A `run_in_background` Bash task can get silently orphaned if the app quits and restarts mid-session.** After an app restart, a previously-backgrounded `npm test` loop showed 3+ minutes of dead air (not even the first version's header output completing) with zero matching process in `ps aux` — not a hang, the process was gone and the harness's tracking was gone with it. Don't wait indefinitely on a background task's notification after a session restart; check `ps aux` for the actual process, and if nothing is running, just re-issue the command directly instead of continuing to wait.
+- **2026-08-28 — "Tests pass" on a major dependency bump means nothing if you only tested one Node version.** Merged dependabot's @babel/parser 7→8 bump after 1036/1036 passed locally — but locally means Node 24 only, and `@babel/parser@8.0.4` declares `engines: {node: '^22.18.0 || >=24.11.0'}`, silently dropping Node 18 (which this project's `engines` field and CI matrix both explicitly support). The mismatch doesn't fail `npm install` — it just produces wrong AST-parse results on the unsupported version, caught only when the release pipeline ran the real Node 18 test job and failed 20 tests. The pipeline's job-dependency gating worked exactly as designed (create-release/publish-npm/publish-pypi all correctly skipped), so nothing bad shipped — but the gap was avoidable. Fixed properly this time: `fnm install 18 20` locally, then verify a major bump across the FULL matrix a project's `engines` field + CI declare, not just the default local version, before pushing. Same rule applies to any future dependency bump on a project with a multi-version support matrix.
+- **2026-08-28 — When reviewing an externally/bot-authored PR before merging, MERGE it onto current main in an isolated worktree and TIME the test run — don't trust the PR's own "tests pass" status.** PR #328's own new test passed, but merging it onto main and timing the full suite showed a 12x slowdown (118ms → 190s) on the exact file it modified. Root cause: the test called `scanSchemasDeep('/', {}, docTools, {})` with a malformed fixture (`docTools.openapi` missing `found: true`) — since the intended code path's early-return requires `openapi.found` truthy, the fixture fell through into a REAL recursive scan of `/`. A test that passes but never exercises the code it claims to is worse than an honest failure. Recipe: `git fetch origin pull/<n>/head:branch && git worktree add /tmp/x branch && cd /tmp/x && git merge origin/main --no-edit && ln -s <main>/node_modules . && npm test` (time it, don't just check exit code).
+- **2026-08-28 — Jules (Google's coding agent) PRs "started by @raccioly" are the repo owner's OWN automated task runs, not third-party contributions.** Three of them (#324, #325, #329) were near-duplicate attempts at the same "add missing shared-ignore test coverage" task, submitted a week apart — evidence of a retry loop where the prior PR was never merged/closed. Diff their content directly before assuming independence: #325 was a strict subset of #324's coverage (same 3 functions, #324 additionally covered `walkFiles`), making #329/#325 fully redundant once #324 merges. Two more (#316, #327) were 0-file "checked, no update needed" PRs from a scheduled dependency-check task — safe to close outright once the real update (via dependabot) has merged.
 - **2026-08-13 — When a fix changes what a bare filename gets replaced with (e.g. `f` → `doc.rel`), check whether that string feeds MESSAGE TEXT or a MATCHING KEY before applying it everywhere.** During the bug-253 second pass, blindly swapping bare basenames for full paths in `listCanonicalDocs`-based fixes broke two different things: (a) guard-validator finding `message`/`location` text is serialized verbatim into `guard --format json` — this repo's own self-scan is the regression oracle precisely because its `docs-canonical/` is flat, so ANY string-format change shows up as a diff even though nothing is "wrong"; the fix is `basename(doc.rel)` at each such site, matching the pre-existing flat-tree string exactly. (b) Some sites match by basename elsewhere in the SAME file (`impact.mjs`: `docsIndex.has(basename(f))`; `traceability.mjs`: `TRACE_MAP[docFile]`) — keying the Map/lookup by full path there silently breaks that unrelated lookup while ostensibly fixing visibility. Rule: the correct replacement value depends on what the ORIGINAL code produced for the FLAT case — reproduce that exact string (via `basename(d.rel)` if original was bare, or `d.rel` directly if original was already a `docs-canonical/${f}`-style template) — never assume "more specific path = strictly better."
 - **2026-08-13 — `npm ci` does not care that `package-lock.json`'s top-level `"version"` field is stale relative to `package.json`.** Verified empirically (`npm ci` succeeds despite a 6-version gap: lock at 0.28.0, package.json bumped to 0.34.0) — it only validates the dependency tree, not root metadata. Not a release blocker; pre-existing drift, out of scope to fix opportunistically mid-release.
 - **2026-08-13 — A machine's global npm config can break EVERY `npm install`, and it looks like it's the package's fault.** `min-release-age=<seconds>` in npm 11's global npmrc (this machine: `~/.local/share/fnm/node-versions/v24.18.0/installation/etc/npmrc`) triggered `ENOVERSIONS` on install of ANY package (verified with an unrelated package, `is-odd`) — not just docguard-cli. A prior agent session diagnosed this as "docguard-cli's own registry corruption" and was wrong; independent verification (`npm view <pkg> time --json` on the actual registry, `--min-release-age=0` override test) showed the registry data was clean and the failure was 100% local. This repo's own `.npmrc` already carries a comment about removing an identical `min-release-age=7d` project-level setting for the same class of npm-11 hard-fail — the fix (delete the line) is well-precedented. Lesson: don't trust another agent's root-cause attribution for an install failure without an independent repro — "it's the package" and "it's your npm config" produce identical symptoms.

docguard_cli-0.34.2/.wolf/hooks/_session.json

@@ -0,0 +1,51 @@
+{
+  "session_id": "session-2026-09-11-1037",
+  "started": "2026-09-11T14:37:40.706Z",
+  "files_read": {
+    "/private/tmp/claude-501/-Users-ricardoaccioly-Repo-claude-canonical-spec-kit/25ac0636-5765-49fe-a808-dd97dc825b30/tasks/brseuna27.output": {
+      "count": 1,
+      "tokens": 0,
+      "first_read": "2026-09-11T14:43:51.353Z"
+    },
+    "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/dependabot.yml": {
+      "count": 1,
+      "tokens": 0,
+      "first_read": "2026-09-11T14:48:10.487Z"
+    },
+    "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/CHANGELOG.md": {
+      "count": 1,
+      "tokens": 50928,
+      "first_read": "2026-09-11T14:49:34.552Z"
+    }
+  },
+  "files_written": [
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/dependabot.yml",
+      "action": "edit",
+      "tokens": 206,
+      "at": "2026-09-11T14:48:16.734Z"
+    },
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/CHANGELOG.md",
+      "action": "edit",
+      "tokens": 635,
+      "at": "2026-09-11T14:49:48.266Z"
+    },
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/package.json",
+      "action": "edit",
+      "tokens": 7,
+      "at": "2026-09-11T14:49:52.109Z"
+    }
+  ],
+  "edit_counts": {
+    ".github/dependabot.yml": 1,
+    "CHANGELOG.md": 1,
+    "package.json": 1
+  },
+  "anatomy_hits": 1,
+  "anatomy_misses": 2,
+  "repeated_reads_warned": 0,
+  "cerebrum_warnings": 0,
+  "stop_count": 0
+}

{docguard_cli-0.34.0 → docguard_cli-0.34.2}/.wolf/memory.md

@@ -1207,3 +1207,66 @@
 | 14:59 | Edited package.json | inline fix | ~7 |
 | 14:59 | Edited CHANGELOG.md | 3→5 lines | ~14 |
 | 15:00 | phase 2: fixed remaining 14 flat-readdirSync sites (19 total across both passes) + 6 tests + v0.34.0 bump | cli/{commands,validators}/*.mjs (14 files), CHANGELOG.md, package.json, tests/canonical-docs-nested-phase2.test.mjs | 1036/1036 pass; self-scan byte-identical; 4/6 new tests fail on v0.33.1 | ~85k |
+| 15:03 | Session end: 52 writes across 18 files (impact.mjs, init.mjs, llms.mjs, memory.mjs, trace.mjs) | 16 reads | ~124750 tok |
+| 15:06 | Session end: 52 writes across 18 files (impact.mjs, init.mjs, llms.mjs, memory.mjs, trace.mjs) | 16 reads | ~124750 tok |
+
+## Session: 2026-08-17 11:09
+
+| Time | Action | File(s) | Outcome | ~Tokens |
+|------|--------|---------|---------|--------|
+
+## Session: 2026-08-17 11:09
+
+| Time | Action | File(s) | Outcome | ~Tokens |
+|------|--------|---------|---------|--------|
+
+## Session: 2026-08-28 21:48
+
+| Time | Action | File(s) | Outcome | ~Tokens |
+|------|--------|---------|---------|--------|
+
+## Session: 2026-08-28 21:48
+
+| Time | Action | File(s) | Outcome | ~Tokens |
+|------|--------|---------|---------|--------|
+| 12:38 | Edited cli/scanners/schemas.mjs | added 1 condition(s) | ~68 |
+| 12:39 | Edited cli/validators/todo-tracking.mjs | inline fix | ~36 |
+| 12:40 | Edited tests/schemas.test.mjs | expanded (+28 lines) | ~262 |
+| 12:40 | Edited tests/todo-tracking.test.mjs | modified test_foo() | ~263 |
+| 12:41 | Edited CHANGELOG.md | expanded (+16 lines) | ~308 |
+| 12:41 | Edited package.json | inline fix | ~7 |
+| 12:43 | triaged 8 open PRs + 3 issues: merged babel bump (#331), GH Actions bump (#330), walkFiles tests (#324); cherry-picked OpenAPI crash + TODO-tracking fixes from #328 with a corrected test (original hung on a bad `/` fixture path); closed 4 redundant/stale PRs + 1 stale issue; scoped #326 (configurable docs location) separately; v0.34.1 | cli/scanners/schemas.mjs, cli/validators/todo-tracking.mjs, tests/{schemas,todo-tracking}.test.mjs, CHANGELOG.md, package.json | 1042/1042 pass; guard exit=0 | ~70k |
+| 12:44 | Session end: 6 writes across 6 files (schemas.mjs, todo-tracking.mjs, schemas.test.mjs, todo-tracking.test.mjs, CHANGELOG.md) | 1 reads | ~1009 tok |
+| 12:49 | Edited package.json | inline fix | ~9 |
+| 12:51 | Edited CHANGELOG.md | 4→7 lines | ~271 |
+| 12:53 | Session end: 8 writes across 6 files (schemas.mjs, todo-tracking.mjs, schemas.test.mjs, todo-tracking.test.mjs, CHANGELOG.md) | 2 reads | ~52054 tok |
+| 12:58 | Session end: 8 writes across 6 files (schemas.mjs, todo-tracking.mjs, schemas.test.mjs, todo-tracking.test.mjs, CHANGELOG.md) | 2 reads | ~52054 tok |
+| 13:00 | Session end: 8 writes across 6 files (schemas.mjs, todo-tracking.mjs, schemas.test.mjs, todo-tracking.test.mjs, CHANGELOG.md) | 2 reads | ~52054 tok |
+
+## Session: 2026-08-28 14:59
+
+| Time | Action | File(s) | Outcome | ~Tokens |
+|------|--------|---------|---------|--------|
+
+## Session: 2026-08-28 14:59
+
+| Time | Action | File(s) | Outcome | ~Tokens |
+|------|--------|---------|---------|--------|
+
+## Session: 2026-09-11 10:30
+
+| Time | Action | File(s) | Outcome | ~Tokens |
+|------|--------|---------|---------|--------|
+
+## Session: 2026-09-11 10:30
+
+| Time | Action | File(s) | Outcome | ~Tokens |
+|------|--------|---------|---------|--------|
+
+## Session: 2026-09-11 10:37
+
+| Time | Action | File(s) | Outcome | ~Tokens |
+|------|--------|---------|---------|--------|
+| 10:48 | Edited .github/dependabot.yml | modified twice() | ~206 |
+| 10:49 | Edited CHANGELOG.md | expanded (+21 lines) | ~592 |
+| 10:49 | Edited package.json | inline fix | ~7 |