docguard-cli 0.34.2__tar.gz → 0.34.3__tar.gz

{docguard_cli-0.34.2 → docguard_cli-0.34.3}/.github/workflows/release.yml

@@ -206,10 +206,18 @@ jobs:
           node-version: 20
           registry-url: 'https://registry.npmjs.org'
 
+      # Trusted Publishing (OIDC) needs npm CLI >= 11.5.0; Node 20's bundled
+      # npm predates that, so self-update first. No NODE_AUTH_TOKEN needed —
+      # npm exchanges the id-token (permissions, above) directly with the
+      # registry via the trusted-publisher connection configured on
+      # npmjs.com (raccioly/docguard, release.yml). This replaces the
+      # NPM_TOKEN-based auth that silently broke for 2 releases (v0.34.1,
+      # v0.34.2 never reached npm) when the token expired — nothing here
+      # can expire the same way; a short-lived token is minted per run.
+      - run: npm install -g npm@latest
+
       - name: Publish (with provenance)
         run: npm publish --provenance
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
   # ── Step 6: Publish to PyPI ────────────────────────────────────────────
   publish-pypi:

{docguard_cli-0.34.2 → docguard_cli-0.34.3}/.wolf/anatomy.md

@@ -1,6 +1,6 @@
 # anatomy.md
 
-> Auto-maintained by OpenWolf. Last scanned: 2026-09-11T14:49:52.100Z
+> Auto-maintained by OpenWolf. Last scanned: 2026-09-11T15:17:16.962Z
 > Files: 704 tracked | Anatomy hits: 0 | Misses: 0
 
 ## ../../../../../../../tmp/
@@ -29,7 +29,7 @@
 - `.pre-commit-hooks.yaml` — DocGuard hooks for the pre-commit framework (https://pre-commit.com). (~490 tok)
 - `action.yml` — Declares fs (~7591 tok)
 - `AGENTS.md` — AI Agent Instructions — DocGuard (~1827 tok)
-- `CHANGELOG.md` — Changelog (~51473 tok)
+- `CHANGELOG.md` — Changelog (~51752 tok)
 - `CLAUDE.md` — OpenWolf (~57 tok)
 - `CODE_OF_CONDUCT.md` — Contributor Covenant Code of Conduct (~532 tok)
 - `COMPARISONS.md` — Comparisons & Honest Limitations (~3382 tok)
@@ -960,7 +960,7 @@
 ## .github/workflows/
 
 - `ci.yml` — CI: DocGuard CI (~1468 tok)
-- `release.yml` — CI: Auto Release — Tag, GitHub Release, npm, PyPI (~3434 tok)
+- `release.yml` — CI: Auto Release — Tag, GitHub Release, npm, PyPI (~4114 tok)
 - `sync-speckit-catalog.yml` — CI: Prepare Spec Kit Catalog Submission (Manual) (~1385 tok)
 
 ## .jules/

{docguard_cli-0.34.2 → docguard_cli-0.34.3}/.wolf/buglog.json

@@ -4450,6 +4450,58 @@
       "occurrences": 3,
       "last_seen": "2026-09-11T14:34:00Z",
       "notes": "Do NOT keep blindly retrying publish-npm if this recurs after a token rotation looks successful — verify the token's actual publish scope/expiration on npmjs.com first. Also: don't assume '404 on a publish that should be an update' is a transient registry blip just because npm's status page is green and the error text sounds like a missing-package error — check secret rotation dates before concluding 'try again later'."
+    },
+    {
+      "id": "bug-270",
+      "timestamp": "2026-09-11T15:15:53.416Z",
+      "error_message": "Significant refactor of ",
+      "file": ".github/workflows/release.yml",
+      "root_cause": "2 lines replaced/restructured",
+      "fix": "Rewrote 10→18 lines (2 removed)",
+      "tags": [
+        "auto-detected",
+        "refactor",
+        "yml"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T15:15:53.416Z"
+    },
+    {
+      "id": "bug-271",
+      "timestamp": "2026-09-11T15:17:16.971Z",
+      "error_message": "Incorrect value in code",
+      "file": "package.json",
+      "root_cause": "Had \"0.34.2\"",
+      "fix": "Changed to \"0.34.3\"",
+      "tags": [
+        "auto-detected",
+        "wrong-value",
+        "json"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T15:17:16.971Z"
+    },
+    {
+      "id": "bug-257",
+      "timestamp": "2026-09-11T15:20:00Z",
+      "error_message": "Resolution of bug-256 (expired NPM_TOKEN blocking publish-npm for 2 releases).",
+      "file": ".github/workflows/release.yml",
+      "root_cause": "See bug-256: a stored GitHub secret (NPM_TOKEN) with an ~90-day expiration window, no rotation reminder, silent failure mode (npm returns 404 not 401/403 on the auth-scope failure). Structural problem: ANY stored long-lived publish credential recurs this exact class of outage eventually.",
+      "fix": "Migrated publish-npm from NODE_AUTH_TOKEN (classic token auth) to npm Trusted Publishing (OIDC) — configured a trusted publisher on npmjs.com for docguard-cli (GitHub Actions, raccioly/docguard, release.yml, 'Allow npm publish' enabled since the workflow does a direct publish not stage+publish), then removed NODE_AUTH_TOKEN from the workflow entirely and added `npm install -g npm@latest` before publish (Trusted Publishing needs npm CLI >=11.5.0; Node 20's bundled npm predates that). The existing `id-token: write` permission (already present for provenance signing) is reused for the OIDC exchange itself — no new permissions needed. Nothing in this setup can expire the way a stored token did; npm mints a short-lived token per run. Verified end-to-end with a real v0.34.3 release (no code changes, purely to exercise the new pipeline — a rerun of the OLD failed job would have used the stale pre-fix workflow file, since GitHub Actions reruns pin to the original run's commit).",
+      "tags": [
+        "npm-publish",
+        "trusted-publishing",
+        "oidc",
+        "release-pipeline",
+        "permanent-fix",
+        "browser-automation"
+      ],
+      "related_bugs": ["bug-256"],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T15:20:00Z",
+      "notes": "The npm-side setup (trusted publisher config) was done via Claude in Chrome browser automation on the user's authenticated session — the user generated nothing themselves manually beyond confirming form field values live, since a different browser extension's autofill overlay blocked automation from reaching two fields directly. Token/credential VALUES never passed through the agent's context at any point — only the trusted-publisher CONFIGURATION (org/repo/workflow name, which are not secrets) did."
     }
   ]
 }

{docguard_cli-0.34.2 → docguard_cli-0.34.3}/.wolf/cerebrum.md

@@ -12,6 +12,8 @@
 
 ## Key Learnings
 
+- **2026-09-11 — Fixed bug-256 permanently: migrated publish-npm to Trusted Publishing (OIDC), retiring NODE_AUTH_TOKEN entirely.** See bug-257. Two non-obvious things worth remembering: (1) npm Trusted Publishing needs npm CLI >=11.5.0 — Node 20's bundled npm is older, so the workflow now self-updates (`npm install -g npm@latest`) before publishing; forgetting this would trade one failure mode for another. (2) A GitHub Actions "rerun failed jobs" reruns using the workflow file AS IT EXISTED AT THAT RUN'S COMMIT, not the current default-branch version — editing release.yml and then rerunning an old failed run would NOT pick up the fix. Had to cut an actual new release (v0.34.3, no code changes) to get a fresh run that exercises the updated workflow. Confirm any workflow-file fix via a genuinely new run, never a rerun of a run that predates the fix.
+- **2026-09-11 — Claude in Chrome can get blocked by an unrelated browser extension's overlay.** Mid-way through filling an npm settings form (Trusted Publisher setup), clicks and even a plain screenshot started failing with "Cannot access a chrome-extension:// URL of different extension" — almost certainly another extension (password manager autofill is the likely suspect) injected a frame that captured input on the tab. Claude in Chrome can't reach into another extension's frame to dismiss it; the fix was asking the user to click/Escape on their end to clear it, then resuming automation. Also: user's real Chrome profile carries their own extensions, unlike the in-app Browser pane — expect this class of interference there and not in the sandboxed pane.
 - **2026-09-11 — `npm error 404` on a PUBLISH (not install) can mean an expired token, not a missing package or a registry incident.** `publish-npm` for v0.34.1 failed identically 3x over 2 weeks: provenance signs fine (real, distinct Sigstore transparency-log entries each time — proves GitHub's OIDC → Sigstore leg works), then the actual registry PUT 404s with "'docguard-cli@0.34.1' is not in this registry" ~0.1-0.4s later. Ruled out registry incident (npm status green, incident history clean, package untouched on registry each time) before concluding it's the token — `gh secret list` showing `NPM_TOKEN` last rotated 2026-05-22, and the last successful publish being 2026-08-13 (day 83) with every attempt since day 98 failing, lines up with npm's ~90-day Automation-token default expiration. npm apparently returns 404 (not 401/403) for some auth/scope failures on publish, presumably to avoid confirming a package's existence to an unauthorized caller — worth remembering next time a publish 404s on a package that obviously exists. This is NOT fixable by the agent — needs the user to rotate the token on npmjs.com and update the GitHub secret. See bug-256.
 - **2026-09-11 — The full-Node-matrix-testing discipline (from bug-255) paid off immediately.** Same dependabot proposed the same @babel/parser 7→8 major bump again (#335) two weeks after the first revert — closed it on sight, no need to re-investigate. A companion Jules-bot PR (#333) independently arrived at the correct fix (bump to the latest 7.x patch, explicitly Node-18-aware in its own PR description) — merged after verifying 1042/1042 across Node 18/20/22/24 AGAIN, plus a combined-branch test with 5 other PRs merged together (1050/1050 across all four versions) before pushing. Also added a `dependabot.yml` ignore rule for `@babel/parser` majors specifically (`update-types: version-update:semver-major`) so this stops recurring every cycle — patches/minors still flow through.
 - **2026-09-11 — A `run_in_background` Bash task can get silently orphaned if the app quits and restarts mid-session.** After an app restart, a previously-backgrounded `npm test` loop showed 3+ minutes of dead air (not even the first version's header output completing) with zero matching process in `ps aux` — not a hang, the process was gone and the harness's tracking was gone with it. Don't wait indefinitely on a background task's notification after a session restart; check `ps aux` for the actual process, and if nothing is running, just re-issue the command directly instead of continuing to wait.

{docguard_cli-0.34.2 → docguard_cli-0.34.3}/.wolf/hooks/_session.json

@@ -13,9 +13,14 @@
       "first_read": "2026-09-11T14:48:10.487Z"
     },
     "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/CHANGELOG.md": {
-      "count": 1,
-      "tokens": 50928,
+      "count": 2,
+      "tokens": 51473,
       "first_read": "2026-09-11T14:49:34.552Z"
+    },
+    "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/workflows/release.yml": {
+      "count": 2,
+      "tokens": 3434,
+      "first_read": "2026-09-11T15:15:37.248Z"
     }
   },
   "files_written": [
@@ -36,16 +41,41 @@
       "action": "edit",
       "tokens": 7,
       "at": "2026-09-11T14:49:52.109Z"
+    },
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/workflows/release.yml",
+      "action": "edit",
+      "tokens": 248,
+      "at": "2026-09-11T15:15:53.414Z"
+    },
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/CHANGELOG.md",
+      "action": "edit",
+      "tokens": 332,
+      "at": "2026-09-11T15:16:58.870Z"
+    },
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/CHANGELOG.md",
+      "action": "edit",
+      "tokens": 7,
+      "at": "2026-09-11T15:17:12.589Z"
+    },
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/package.json",
+      "action": "edit",
+      "tokens": 7,
+      "at": "2026-09-11T15:17:16.970Z"
     }
   ],
   "edit_counts": {
     ".github/dependabot.yml": 1,
-    "CHANGELOG.md": 1,
-    "package.json": 1
+    "CHANGELOG.md": 3,
+    "package.json": 2,
+    ".github/workflows/release.yml": 1
   },
-  "anatomy_hits": 1,
+  "anatomy_hits": 2,
   "anatomy_misses": 2,
-  "repeated_reads_warned": 0,
+  "repeated_reads_warned": 2,
   "cerebrum_warnings": 0,
-  "stop_count": 0
+  "stop_count": 5
 }

{docguard_cli-0.34.2 → docguard_cli-0.34.3}/.wolf/memory.md

@@ -1270,3 +1270,12 @@
 | 10:48 | Edited .github/dependabot.yml | modified twice() | ~206 |
 | 10:49 | Edited CHANGELOG.md | expanded (+21 lines) | ~592 |
 | 10:49 | Edited package.json | inline fix | ~7 |
+| 10:54 | Session end: 3 writes across 3 files (dependabot.yml, CHANGELOG.md, package.json) | 3 reads | ~51776 tok |
+| 11:00 | Session end: 3 writes across 3 files (dependabot.yml, CHANGELOG.md, package.json) | 3 reads | ~51776 tok |
+| 11:09 | Session end: 3 writes across 3 files (dependabot.yml, CHANGELOG.md, package.json) | 3 reads | ~51776 tok |
+| 11:12 | Session end: 3 writes across 3 files (dependabot.yml, CHANGELOG.md, package.json) | 3 reads | ~51776 tok |
+| 11:13 | Session end: 3 writes across 3 files (dependabot.yml, CHANGELOG.md, package.json) | 3 reads | ~51776 tok |
+| 11:15 | Edited .github/workflows/release.yml | expanded (+8 lines) | ~248 |
+| 11:16 | Edited CHANGELOG.md | expanded (+9 lines) | ~310 |
+| 11:17 | Edited CHANGELOG.md | inline fix | ~7 |
+| 11:17 | Edited package.json | inline fix | ~7 |

{docguard_cli-0.34.2 → docguard_cli-0.34.3}/.wolf/token-ledger.json

@@ -2,14 +2,14 @@
   "version": 1,
   "created_at": "2026-05-26T15:31:59.491Z",
   "lifetime": {
-    "total_tokens_estimated": 6774099,
-    "total_reads": 1610,
-    "total_writes": 2939,
+    "total_tokens_estimated": 7032979,
+    "total_reads": 1625,
+    "total_writes": 2954,
     "total_sessions": 52,
-    "anatomy_hits": 991,
-    "anatomy_misses": 615,
+    "anatomy_hits": 996,
+    "anatomy_misses": 625,
     "repeated_reads_blocked": 940,
-    "estimated_savings_vs_bare_cli": 5294489
+    "estimated_savings_vs_bare_cli": 5295489
   },
   "sessions": [
     {
@@ -26055,6 +26055,256 @@
         "repeated_reads_blocked": 0,
         "anatomy_lookups": 1
       }
+    },
+    {
+      "id": "session-2026-09-11-1037",
+      "started": "2026-09-11T14:37:40.706Z",
+      "ended": "2026-09-11T14:54:20.555Z",
+      "reads": [
+        {
+          "file": "/private/tmp/claude-501/-Users-ricardoaccioly-Repo-claude-canonical-spec-kit/25ac0636-5765-49fe-a808-dd97dc825b30/tasks/brseuna27.output",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/dependabot.yml",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/CHANGELOG.md",
+          "tokens_estimated": 50928,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/dependabot.yml",
+          "tokens_estimated": 206,
+          "action": "edit"
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/CHANGELOG.md",
+          "tokens_estimated": 635,
+          "action": "edit"
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/package.json",
+          "tokens_estimated": 7,
+          "action": "edit"
+        }
+      ],
+      "totals": {
+        "input_tokens_estimated": 50928,
+        "output_tokens_estimated": 848,
+        "reads_count": 3,
+        "writes_count": 3,
+        "repeated_reads_blocked": 0,
+        "anatomy_lookups": 1
+      }
+    },
+    {
+      "id": "session-2026-09-11-1037",
+      "started": "2026-09-11T14:37:40.706Z",
+      "ended": "2026-09-11T15:00:06.361Z",
+      "reads": [
+        {
+          "file": "/private/tmp/claude-501/-Users-ricardoaccioly-Repo-claude-canonical-spec-kit/25ac0636-5765-49fe-a808-dd97dc825b30/tasks/brseuna27.output",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/dependabot.yml",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/CHANGELOG.md",
+          "tokens_estimated": 50928,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/dependabot.yml",
+          "tokens_estimated": 206,
+          "action": "edit"
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/CHANGELOG.md",
+          "tokens_estimated": 635,
+          "action": "edit"
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/package.json",
+          "tokens_estimated": 7,
+          "action": "edit"
+        }
+      ],
+      "totals": {
+        "input_tokens_estimated": 50928,
+        "output_tokens_estimated": 848,
+        "reads_count": 3,
+        "writes_count": 3,
+        "repeated_reads_blocked": 0,
+        "anatomy_lookups": 1
+      }
+    },
+    {
+      "id": "session-2026-09-11-1037",
+      "started": "2026-09-11T14:37:40.706Z",
+      "ended": "2026-09-11T15:09:29.209Z",
+      "reads": [
+        {
+          "file": "/private/tmp/claude-501/-Users-ricardoaccioly-Repo-claude-canonical-spec-kit/25ac0636-5765-49fe-a808-dd97dc825b30/tasks/brseuna27.output",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/dependabot.yml",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/CHANGELOG.md",
+          "tokens_estimated": 50928,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/dependabot.yml",
+          "tokens_estimated": 206,
+          "action": "edit"
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/CHANGELOG.md",
+          "tokens_estimated": 635,
+          "action": "edit"
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/package.json",
+          "tokens_estimated": 7,
+          "action": "edit"
+        }
+      ],
+      "totals": {
+        "input_tokens_estimated": 50928,
+        "output_tokens_estimated": 848,
+        "reads_count": 3,
+        "writes_count": 3,
+        "repeated_reads_blocked": 0,
+        "anatomy_lookups": 1
+      }
+    },
+    {
+      "id": "session-2026-09-11-1037",
+      "started": "2026-09-11T14:37:40.706Z",
+      "ended": "2026-09-11T15:12:24.393Z",
+      "reads": [
+        {
+          "file": "/private/tmp/claude-501/-Users-ricardoaccioly-Repo-claude-canonical-spec-kit/25ac0636-5765-49fe-a808-dd97dc825b30/tasks/brseuna27.output",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/dependabot.yml",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/CHANGELOG.md",
+          "tokens_estimated": 50928,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/dependabot.yml",
+          "tokens_estimated": 206,
+          "action": "edit"
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/CHANGELOG.md",
+          "tokens_estimated": 635,
+          "action": "edit"
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/package.json",
+          "tokens_estimated": 7,
+          "action": "edit"
+        }
+      ],
+      "totals": {
+        "input_tokens_estimated": 50928,
+        "output_tokens_estimated": 848,
+        "reads_count": 3,
+        "writes_count": 3,
+        "repeated_reads_blocked": 0,
+        "anatomy_lookups": 1
+      }
+    },
+    {
+      "id": "session-2026-09-11-1037",
+      "started": "2026-09-11T14:37:40.706Z",
+      "ended": "2026-09-11T15:13:38.156Z",
+      "reads": [
+        {
+          "file": "/private/tmp/claude-501/-Users-ricardoaccioly-Repo-claude-canonical-spec-kit/25ac0636-5765-49fe-a808-dd97dc825b30/tasks/brseuna27.output",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/dependabot.yml",
+          "tokens_estimated": 0,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/CHANGELOG.md",
+          "tokens_estimated": 50928,
+          "was_repeated": false,
+          "anatomy_had_description": false
+        }
+      ],
+      "writes": [
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/dependabot.yml",
+          "tokens_estimated": 206,
+          "action": "edit"
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/CHANGELOG.md",
+          "tokens_estimated": 635,
+          "action": "edit"
+        },
+        {
+          "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/package.json",
+          "tokens_estimated": 7,
+          "action": "edit"
+        }
+      ],
+      "totals": {
+        "input_tokens_estimated": 50928,
+        "output_tokens_estimated": 848,
+        "reads_count": 3,
+        "writes_count": 3,
+        "repeated_reads_blocked": 0,
+        "anatomy_lookups": 1
+      }
     }
   ],
   "daemon_usage": [],

{docguard_cli-0.34.2 → docguard_cli-0.34.3}/CHANGELOG.md

@@ -7,6 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.34.3] - 2026-09-11
+
+No code changes from v0.34.2 — this release exists to exercise the fixed publish pipeline end to end (a re-run of a past workflow job uses the workflow file as it existed at that run's commit, so getting the fix below actually tested required a fresh run).
+
+### Fixed
+
+- **npm publish switched from a stored `NODE_AUTH_TOKEN` to Trusted Publishing (OIDC).** The token that broke v0.34.1/v0.34.2's npm publish (see their entries below) is retired — `publish-npm` now authenticates via the `id-token: write` OIDC token exchanged directly with npm's registry, matched against a trusted-publisher connection configured on npmjs.com (raccioly/docguard, `release.yml`). Nothing here can expire the way a stored token did; a short-lived token is minted per run. Also self-updates npm before publishing (`npm install -g npm@latest`), since Trusted Publishing needs npm CLI >= 11.5.0 and Node 20's bundled npm predates that.
+- v0.34.1 and v0.34.2 remain permanently missing from npm (tag/GitHub release/PyPI all landed for both) — not worth backfilling now that publishing works again going forward.
+
 ## [0.34.2] - 2026-09-11
 
 ### Fixed

{docguard_cli-0.34.2 → docguard_cli-0.34.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: docguard-cli
-Version: 0.34.2
+Version: 0.34.3
 Summary: The enforcement tool for Canonical-Driven Development (CDD). Audit, generate, and guard your project documentation. No Python dependencies (requires Node.js 18+).
 Project-URL: Homepage, https://github.com/raccioly/docguard
 Project-URL: Documentation, https://github.com/raccioly/docguard#readme

{docguard_cli-0.34.2 → docguard_cli-0.34.3}/extensions/spec-kit-docguard/extension.yml

@@ -3,7 +3,7 @@ schema_version: "1.0"
 extension:
   id: "docguard"
   name: "DocGuard — CDD Enforcement"
-  version: "0.34.2"
+  version: "0.34.3"
   description: "Canonical-Driven Development enforcement as a true spec-kit extension. LLM-first design with automated validators, 4 AI behavior skills, spec-kit skill chaining, and workflow hooks. One pinned runtime dependency (@babel/parser); pure Node.js otherwise."
   author: "Ricardo Accioly"
   repository: "https://github.com/raccioly/docguard"

{docguard_cli-0.34.2 → docguard_cli-0.34.3}/extensions/spec-kit-docguard/skills/docguard-fix/SKILL.md

@@ -6,10 +6,10 @@ description: AI-driven documentation repair with structured research workflow, t
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.2
+  version: 0.34.3
   source: extensions/spec-kit-docguard/skills/docguard-fix
 ---
-<!-- docguard:version: 0.34.2 -->
+<!-- docguard:version: 0.34.3 -->
 
 # DocGuard Fix Skill
 

{docguard_cli-0.34.2 → docguard_cli-0.34.3}/extensions/spec-kit-docguard/skills/docguard-guard/SKILL.md

@@ -7,10 +7,10 @@ description: Run DocGuard guard validation against Canonical-Driven Development
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.2
+  version: 0.34.3
   source: extensions/spec-kit-docguard/skills/docguard-guard
 ---
-<!-- docguard:version: 0.34.2 -->
+<!-- docguard:version: 0.34.3 -->
 
 # DocGuard Guard Skill
 

{docguard_cli-0.34.2 → docguard_cli-0.34.3}/extensions/spec-kit-docguard/skills/docguard-review/SKILL.md

@@ -6,10 +6,10 @@ description: Cross-document consistency analysis and quality assessment. Perform
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.2
+  version: 0.34.3
   source: extensions/spec-kit-docguard/skills/docguard-review
 ---
-<!-- docguard:version: 0.34.2 -->
+<!-- docguard:version: 0.34.3 -->
 
 # DocGuard Review Skill
 

{docguard_cli-0.34.2 → docguard_cli-0.34.3}/extensions/spec-kit-docguard/skills/docguard-score/SKILL.md

@@ -6,10 +6,10 @@ description: CDD maturity assessment with category-aware improvement roadmap. Ru
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.2
+  version: 0.34.3
   source: extensions/spec-kit-docguard/skills/docguard-score
 ---
-<!-- docguard:version: 0.34.2 -->
+<!-- docguard:version: 0.34.3 -->
 
 # DocGuard Score Skill
 

{docguard_cli-0.34.2 → docguard_cli-0.34.3}/extensions/spec-kit-docguard/skills/docguard-sync/SKILL.md

@@ -4,10 +4,10 @@ description: Keep canonical documentation ALWAYS UP TO DATE. Refreshes code-trut
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.2
+  version: 0.34.3
   source: extensions/spec-kit-docguard/skills/docguard-sync
 ---
-<!-- docguard:version: 0.34.2 -->
+<!-- docguard:version: 0.34.3 -->
 
 # DocGuard Sync Skill
 

{docguard_cli-0.34.2 → docguard_cli-0.34.3}/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "docguard-cli",
-  "version": "0.34.2",
+  "version": "0.34.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "docguard-cli",
-      "version": "0.34.2",
+      "version": "0.34.3",
       "license": "MIT",
       "dependencies": {
         "@babel/parser": "7.29.8"

{docguard_cli-0.34.2 → docguard_cli-0.34.3}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "docguard-cli",
-  "version": "0.34.2",
+  "version": "0.34.3",
   "description": "The enforcement tool for Canonical-Driven Development (CDD). Audit, generate, and guard your project documentation.",
   "type": "module",
   "bin": {

{docguard_cli-0.34.2 → docguard_cli-0.34.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "docguard-cli"
-version = "0.34.2"
+version = "0.34.3"
 description = "The enforcement tool for Canonical-Driven Development (CDD). Audit, generate, and guard your project documentation. No Python dependencies (requires Node.js 18+)."
 readme = "README.md"
 license = { text = "MIT" }