docguard-cli 0.34.3__tar.gz → 0.34.5__tar.gz

{docguard_cli-0.34.3/extensions/spec-kit-docguard → docguard_cli-0.34.5/.agent}/skills/docguard-fix/SKILL.md

@@ -6,10 +6,10 @@ description: AI-driven documentation repair with structured research workflow, t
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.3
+  version: 0.34.5
   source: extensions/spec-kit-docguard/skills/docguard-fix
 ---
-<!-- docguard:version: 0.34.3 -->
+<!-- docguard:version: 0.34.5 -->
 
 # DocGuard Fix Skill
 

{docguard_cli-0.34.3 → docguard_cli-0.34.5}/.agent/skills/docguard-guard/SKILL.md

@@ -7,10 +7,10 @@ description: Run DocGuard guard validation against Canonical-Driven Development
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.2
+  version: 0.34.5
   source: extensions/spec-kit-docguard/skills/docguard-guard
 ---
-<!-- docguard:version: 0.34.2 -->
+<!-- docguard:version: 0.34.5 -->
 
 # DocGuard Guard Skill
 

{docguard_cli-0.34.3/extensions/spec-kit-docguard → docguard_cli-0.34.5/.agent}/skills/docguard-review/SKILL.md

@@ -6,10 +6,10 @@ description: Cross-document consistency analysis and quality assessment. Perform
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.3
+  version: 0.34.5
   source: extensions/spec-kit-docguard/skills/docguard-review
 ---
-<!-- docguard:version: 0.34.3 -->
+<!-- docguard:version: 0.34.5 -->
 
 # DocGuard Review Skill
 

{docguard_cli-0.34.3/extensions/spec-kit-docguard → docguard_cli-0.34.5/.agent}/skills/docguard-score/SKILL.md

@@ -6,10 +6,10 @@ description: CDD maturity assessment with category-aware improvement roadmap. Ru
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.3
+  version: 0.34.5
   source: extensions/spec-kit-docguard/skills/docguard-score
 ---
-<!-- docguard:version: 0.34.3 -->
+<!-- docguard:version: 0.34.5 -->
 
 # DocGuard Score Skill
 

{docguard_cli-0.34.3 → docguard_cli-0.34.5}/.agent/skills/docguard-sync/SKILL.md

@@ -4,10 +4,10 @@ description: Keep canonical documentation ALWAYS UP TO DATE. Refreshes code-trut
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.2
+  version: 0.34.5
   source: extensions/spec-kit-docguard/skills/docguard-sync
 ---
-<!-- docguard:version: 0.34.2 -->
+<!-- docguard:version: 0.34.5 -->
 
 # DocGuard Sync Skill
 

docguard_cli-0.34.5/.github/workflows/auto-merge.yml

@@ -0,0 +1,152 @@
+name: Auto-merge (green bot PRs)
+
+# Hands-off merging for bot PRs that have ALREADY passed the full CI matrix.
+#
+# WHY workflow_run AND NOT `gh pr merge --auto`: GitHub's native auto-merge
+# requires the repo-level `allow_auto_merge` setting plus REQUIRED status
+# checks in branch protection. Without required checks configured, `--auto`
+# merges IMMEDIATELY without waiting for CI — worse than merging by hand.
+# This workflow instead fires only after "DocGuard CI" reports success for
+# the head SHA, re-verifies every matrix leg via the API, and merges itself.
+# No repo settings required, and it is fail-closed: anything unexpected → skip.
+#
+# SECURITY: workflow_run runs in the BASE repo context with write scope, so it
+# NEVER checks out or executes PR code. It reads PR metadata + check results
+# via the API only. (Same rule as jules-triage.yml / AGENTS.md CI rule.)
+#
+# WHAT AUTO-MERGES:
+#   - dependabot: patch + minor only. Majors NEVER (v0.34.1 shipped a Node-18
+#     break from an auto-accepted @babel/parser major; bug-255).
+#   - jules: test-only and docs-only changes. Anything touching cli/ logic,
+#     .github/, or package.json is labeled and left for a human.
+
+on:
+  workflow_run:
+    workflows: ["DocGuard CI"]
+    types: [completed]
+
+permissions:
+  contents: write
+  pull-requests: write
+  checks: read
+  actions: read
+
+jobs:
+  auto-merge:
+    if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Evaluate and merge if safe
+        uses: actions/github-script@v9
+        with:
+          script: |
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const run = context.payload.workflow_run;
+            const headSha = run.head_sha;
+
+            // ── Locate the PR for this CI run ────────────────────────────
+            const { data: prs } = await github.rest.repos.listPullRequestsAssociatedWithCommit({
+              owner, repo, commit_sha: headSha,
+            });
+            const pr = prs.find((p) => p.state === 'open');
+            if (!pr) { core.info('No open PR for this SHA — nothing to do.'); return; }
+            const num = pr.number;
+            const author = pr.user.login;
+
+            const BOT_DEPENDABOT = 'dependabot[bot]';
+            const BOT_JULES = 'google-labs-jules[bot]';
+            const BOT_ACTIONS = 'github-actions[bot]';
+            if (![BOT_DEPENDABOT, BOT_JULES, BOT_ACTIONS].includes(author)) {
+              core.info(`#${num} authored by ${author} (not a handled bot) — leaving alone.`);
+              return;
+            }
+
+            const hold = async (label, why) => {
+              try {
+                await github.rest.issues.addLabels({ owner, repo, issue_number: num, labels: [label] });
+              } catch (e) { core.info(`label skipped: ${e.message}`); }
+              await github.rest.issues.createComment({
+                owner, repo, issue_number: num,
+                body: `⏸️ **Held for human review** — ${why}\n\nCI is green, but this falls outside the auto-merge policy in \`.github/workflows/auto-merge.yml\`.`,
+              });
+              core.notice(`#${num} held: ${why}`);
+            };
+
+            // ── Re-verify EVERY matrix leg independently ─────────────────
+            // workflow_run.conclusion=success covers this run, but be explicit:
+            // all four Node legs must be present AND successful. Fail closed.
+            const { data: checks } = await github.rest.checks.listForRef({
+              owner, repo, ref: headSha, per_page: 100,
+            });
+            const REQUIRED = ['test (18)', 'test (20)', 'test (22)', 'test (24)'];
+            const bad = [];
+            for (const name of REQUIRED) {
+              const c = checks.check_runs.find((r) => r.name === name);
+              if (!c) bad.push(`${name}: missing`);
+              else if (c.conclusion !== 'success') bad.push(`${name}: ${c.conclusion}`);
+            }
+            if (bad.length) {
+              core.info(`#${num} not merging — checks not all green: ${bad.join(', ')}`);
+              return;
+            }
+
+            // ── Scope gate: what files does this PR touch? ───────────────
+            const { data: files } = await github.rest.pulls.listFiles({
+              owner, repo, pull_number: num, per_page: 300,
+            });
+            const paths = files.map((f) => f.filename);
+
+            if (author === BOT_ACTIONS) {
+              // Release PRs cut by scheduled-release.yml. Tightly constrained:
+              // must come from a release/ branch and touch ONLY the version +
+              // changelog + generated extension metadata. Anything else under
+              // this bot's name is not something we cut, so hold it.
+              if (!pr.head.ref.startsWith('release/')) {
+                await hold('needs-review', `an automated PR from a non-\`release/\` branch (\`${pr.head.ref}\`).`);
+                return;
+              }
+              const ALLOWED = /^(package(-lock)?\.json|CHANGELOG\.md|extensions\/|\.agent\/)/;
+              const unexpected = paths.filter((p) => !ALLOWED.test(p));
+              if (unexpected.length) {
+                await hold('needs-review', `a release PR touching unexpected files:\n${unexpected.map((p) => `- \`${p}\``).join('\n')}`);
+                return;
+              }
+              core.info(`#${num} automated release PR (${pr.head.ref}) — eligible.`);
+            } else if (author === BOT_DEPENDABOT) {
+              // Version delta from the title: "bump X from 1.2.3 to 1.2.4"
+              const m = /from (\d+)\.(\d+)\.(\d+)\S* to (\d+)\.(\d+)\.(\d+)/.exec(pr.title || '');
+              if (!m) { await hold('needs-review', 'could not parse the version delta from the PR title.'); return; }
+              const [fromMaj, fromMin] = [Number(m[1]), Number(m[2])];
+              const [toMaj, toMin] = [Number(m[4]), Number(m[5])];
+              if (toMaj !== fromMaj) {
+                await hold('needs-review', `this is a **major** bump (${m[1]}.${m[2]}.${m[3]} → ${m[4]}.${m[5]}.${m[6]}). Majors are never auto-merged — a @babel/parser major silently dropped Node 18 support and broke a release (bug-255).`);
+                return;
+              }
+              core.info(`#${num} dependabot ${toMin !== fromMin ? 'minor' : 'patch'} bump — eligible.`);
+            } else {
+              // Jules: only test-only / docs-only changes auto-merge.
+              const risky = paths.filter((p) =>
+                !(p.startsWith('tests/') || p.startsWith('docs/') || p.endsWith('.md'))
+              );
+              if (risky.length) {
+                await hold('jules-review', `it changes non-test/non-doc files:\n${risky.map((p) => `- \`${p}\``).join('\n')}\n\nProduction-logic changes from an agent get a human read before they ship to npm.`);
+                return;
+              }
+              core.info(`#${num} jules test/docs-only (${paths.length} files) — eligible.`);
+            }
+
+            // ── Merge ────────────────────────────────────────────────────
+            try {
+              await github.rest.pulls.merge({
+                owner, repo, pull_number: num, merge_method: 'squash',
+              });
+              await github.rest.issues.createComment({
+                owner, repo, issue_number: num,
+                body: `🤖 **Auto-merged** — all four Node legs (18/20/22/24) green, within the test-runtime budget, and inside the auto-merge policy in \`.github/workflows/auto-merge.yml\`.`,
+              });
+              core.notice(`Merged #${num}.`);
+            } catch (e) {
+              core.warning(`Merge of #${num} failed: ${e.message}`);
+              await hold('needs-review', `auto-merge failed: \`${e.message}\``);
+            }

{docguard_cli-0.34.3 → docguard_cli-0.34.5}/.github/workflows/ci.yml

@@ -45,8 +45,30 @@ jobs:
         run: python3 -c "import docguard_cli.wrapper; print('docguard_cli.wrapper OK')"
 
       # ── Automated Test Suite ──
-      - name: Run Tests
-        run: npm test
+      # Also enforces a RUNTIME BUDGET. A test that walks an unintended tree
+      # (e.g. passing '/' as a project dir) still PASSES — it just takes
+      # forever. PR #328 did exactly that: tests/schemas.test.mjs went from
+      # 118ms to >10s and the whole suite from ~25s to 190s, green the entire
+      # time. Only a duration check catches that class, so auto-merge depends
+      # on this gate existing. Normal: ~33s (node 24) to ~51s (node 18) on CI.
+      # Budget is deliberately loose — it catches catastrophes, not jitter.
+      - name: Run Tests (with runtime budget)
+        env:
+          TEST_BUDGET_MS: 120000
+        run: |
+          set -o pipefail
+          npm test 2>&1 | tee /tmp/test-output.txt
+          DURATION=$(grep -oE 'duration_ms [0-9]+' /tmp/test-output.txt | tail -1 | grep -oE '[0-9]+' | cut -d. -f1)
+          if [ -z "$DURATION" ]; then
+            echo "::warning::Could not parse test duration — skipping budget check"
+            exit 0
+          fi
+          echo "Test suite duration: ${DURATION}ms (budget: ${TEST_BUDGET_MS}ms)"
+          if [ "$DURATION" -gt "$TEST_BUDGET_MS" ]; then
+            echo "::error::Test suite took ${DURATION}ms, over the ${TEST_BUDGET_MS}ms budget."
+            echo "::error::Something is scanning far more than it should (see PR #328 / bug-254)."
+            exit 1
+          fi
 
       # ── Self-validation (dogfooding) ──
       - name: CLI Version

{docguard_cli-0.34.3 → docguard_cli-0.34.5}/.github/workflows/jules-triage.yml

@@ -52,7 +52,32 @@ jobs:
               .trim();
             const mine = norm(title);
             const { data: open } = await github.rest.pulls.list({ owner, repo, state: 'open', per_page: 100 });
-            const dup = mine && open.find((p) => p.number !== num && norm(p.title) === mine);
+            let dup = mine && open.find((p) => p.number !== num && norm(p.title) === mine);
+
+            // Title-equality alone is too strict: #324 "add tests for untested
+            // shared-ignore utilities", #325 "add missing tests for
+            // shared-ignore functions" and #329 "Add unit tests for
+            // shared-ignore detection utilities" were the SAME work, all three
+            // sat open, and two of them would have collided on the same import
+            // block if merged together. So also treat a PR as a duplicate when
+            // it touches an identical file set to another open Jules PR.
+            // Still metadata-only (listFiles) — never checks out PR code.
+            if (!dup) {
+              const fileSet = async (n) => {
+                const { data } = await github.rest.pulls.listFiles({ owner, repo, pull_number: n, per_page: 300 });
+                return data.map((f) => f.filename).sort().join('|');
+              };
+              try {
+                const mineFiles = await fileSet(num);
+                if (mineFiles) {
+                  for (const p of open) {
+                    if (p.number === num) continue;
+                    if (p.user.login !== 'google-labs-jules[bot]') continue;
+                    if (await fileSet(p.number) === mineFiles) { dup = p; break; }
+                  }
+                }
+              } catch (e) { core.info(`file-overlap dup check skipped: ${e.message}`); }
+            }
 
             const addLabel = async (name) => {
               try {

{docguard_cli-0.34.3 → docguard_cli-0.34.5}/.github/workflows/release.yml

@@ -204,17 +204,60 @@ jobs:
       - uses: actions/setup-node@v7
         with:
           node-version: 20
-          registry-url: 'https://registry.npmjs.org'
+          # DELIBERATELY NO `registry-url`. setup-node's registry-url writes an
+          # .npmrc containing:
+          #     //registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}
+          # With NODE_AUTH_TOKEN removed (Trusted Publishing), that expands to
+          # an EMPTY token. npm then takes the token-auth path holding no token
+          # and 404s, never attempting the OIDC exchange at all. v0.34.4 failed
+          # exactly this way: npm@11 installed fine, provenance signed fine, no
+          # OIDC notice in the log, then "404 ... could not be found or you do
+          # not have permission". npm defaults to registry.npmjs.org anyway, so
+          # dropping this loses nothing.
 
       # Trusted Publishing (OIDC) needs npm CLI >= 11.5.0; Node 20's bundled
-      # npm predates that, so self-update first. No NODE_AUTH_TOKEN needed —
-      # npm exchanges the id-token (permissions, above) directly with the
-      # registry via the trusted-publisher connection configured on
-      # npmjs.com (raccioly/docguard, release.yml). This replaces the
-      # NPM_TOKEN-based auth that silently broke for 2 releases (v0.34.1,
-      # v0.34.2 never reached npm) when the token expired — nothing here
-      # can expire the same way; a short-lived token is minted per run.
-      - run: npm install -g npm@latest
+      # npm predates that, so self-update first. Pinned to the 11.x line
+      # (NOT `npm@latest`) because npm 12 requires Node ^22.22.2 || ^24.15.0
+      # || >=26.0.0 -- newer than the Node 20 this job runs on. Learned this
+      # the hard way: the first cut of this fix used `npm@latest` and broke
+      # the same way the @babel/parser major bump did earlier (bug-255) --
+      # an unpinned "latest" floated past what this job's Node version
+      # supports. npm 11.x itself supports Node ^20.17.0 || >=22.9.0, so it
+      # installs cleanly here. No NODE_AUTH_TOKEN needed — npm exchanges the
+      # id-token (permissions, above) directly with the registry via the
+      # trusted-publisher connection configured on npmjs.com
+      # (raccioly/docguard, release.yml). This replaces the NPM_TOKEN-based
+      # auth that silently broke for 2 releases (v0.34.1, v0.34.2 never
+      # reached npm) when the token expired — nothing here can expire the
+      # same way; a short-lived token is minted per run.
+      - run: npm install -g npm@11
+
+      # Fail LOUDLY if anything put an auth token back in the npm config.
+      # A stray (even empty) _authToken silently routes npm away from OIDC and
+      # the only symptom is a generic 404 that reads like a missing package --
+      # it cost four releases (v0.34.1 through v0.34.4) to identify. Better to
+      # break here with a clear message than to publish-fail cryptically again.
+      - name: Assert no npm auth token is configured (OIDC must be the path)
+        run: |
+          npm --version
+          # NOTE: `npm config get <key>` refuses on auth keys ("protected") and
+          # `npm config list --json` omits them entirely, so neither can be used
+          # to detect this. Grep the actual .npmrc files instead.
+          USERCONFIG=$(npm config list | sed -n 's/^userconfig = "\(.*\)"$/\1/p')
+          HITS=""
+          for f in "$USERCONFIG" ".npmrc" "$HOME/.npmrc"; do
+            if [ -n "$f" ] && [ -f "$f" ] && grep -qE '_authToken|_auth[[:space:]]*=' "$f"; then
+              HITS="$HITS $f"
+            fi
+          done
+          if [ -n "$HITS" ]; then
+            echo "::error::npm auth token found in:$HITS"
+            echo "::error::Even an EMPTY _authToken routes npm to token auth and skips OIDC/Trusted Publishing —"
+            echo "::error::the only symptom is a generic 404 that reads like a missing package."
+            echo "::error::Remove registry-url from setup-node and any NODE_AUTH_TOKEN from this job."
+            exit 1
+          fi
+          echo "No auth token configured — npm will use OIDC (Trusted Publishing)."
 
       - name: Publish (with provenance)
         run: npm publish --provenance

docguard_cli-0.34.5/.github/workflows/scheduled-release.yml

@@ -0,0 +1,171 @@
+name: Scheduled Release
+
+# Self-sustaining releases: batches whatever has landed on main since the last
+# tag into a weekly patch release, instead of cutting a version per merge.
+#
+# WHY BATCHED AND NOT PER-MERGE: every release publishes to npm AND PyPI
+# publicly. Per-merge releases would burn a version number per dependabot
+# patch and publish constantly. Weekly batching keeps releases hands-off
+# without turning the registry into a changelog.
+#
+# HOW IT TRIGGERS THE ACTUAL RELEASE: this workflow only bumps package.json
+# and pushes. release.yml is triggered by pushes that touch package.json, so
+# it picks up from there and does tag → GitHub Release → npm → PyPI → catalog
+# reminder. Keeping the publish logic in one place (release.yml) on purpose.
+#
+# NO-OP WHEN NOTHING CHANGED: if there are no commits since the last release
+# tag, this exits without bumping — no empty releases.
+
+on:
+  schedule:
+    - cron: '0 9 * * 1' # Mondays 09:00 UTC
+  workflow_dispatch:
+    inputs:
+      bump:
+        description: 'Version bump type'
+        required: false
+        default: 'patch'
+        type: choice
+        options: [patch, minor]
+
+permissions:
+  contents: write
+
+jobs:
+  cut-release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 20
+
+      - name: Check for unreleased changes
+        id: check
+        run: |
+          CURRENT=$(node -p "require('./package.json').version")
+          LAST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
+          echo "current=$CURRENT" >> "$GITHUB_OUTPUT"
+
+          if [ -z "$LAST_TAG" ]; then
+            echo "No tags yet — nothing to compare against, skipping."
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # Commits since the last tag, excluding the release commits themselves
+          # and the OpenWolf bookkeeping noise (.wolf/ is auto-written by hooks
+          # every session and must never on its own justify a release).
+          COMMITS=$(git log "${LAST_TAG}..HEAD" --oneline -- . ':!.wolf' | grep -viE '^[0-9a-f]+ (release|chore\(release\)):' || true)
+          COUNT=$(echo "$COMMITS" | grep -c . || true)
+
+          echo "Last tag: $LAST_TAG"
+          echo "Releasable commits since: $COUNT"
+          echo "$COMMITS"
+
+          if [ "$COUNT" -eq 0 ]; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+            echo "last_tag=$LAST_TAG" >> "$GITHUB_OUTPUT"
+            # Stash the log for the changelog entry
+            echo "$COMMITS" > /tmp/commits.txt
+          fi
+
+      - name: Bump version and write changelog
+        if: steps.check.outputs.changed == 'true'
+        run: |
+          BUMP="${{ inputs.bump || 'patch' }}"
+          OLD="${{ steps.check.outputs.current }}"
+          NEW=$(node -e "
+            const [maj,min,pat] = '$OLD'.split('.').map(Number);
+            console.log('$BUMP' === 'minor' ? \`\${maj}.\${min+1}.0\` : \`\${maj}.\${min}.\${pat+1}\`);
+          ")
+          echo "Bumping $OLD → $NEW"
+
+          node -e "
+            const fs = require('fs');
+            const p = JSON.parse(fs.readFileSync('package.json','utf8'));
+            p.version = '$NEW';
+            fs.writeFileSync('package.json', JSON.stringify(p,null,2) + '\n');
+          "
+          npm install --package-lock-only --ignore-scripts
+
+          # Changelog entry from the commit subjects, so release.yml's notes
+          # extractor (which reads the '## [VERSION]' section) has real content.
+          {
+            echo "## [$NEW] - $(date -u +%Y-%m-%d)"
+            echo
+            echo "Automated weekly release — batches everything merged since \`${{ steps.check.outputs.last_tag }}\`."
+            echo
+            echo "### Changed"
+            echo
+            sed -E 's/^[0-9a-f]+ /- /' /tmp/commits.txt
+            echo
+          } > /tmp/entry.md
+
+          # Splice in directly under '## [Unreleased]'
+          awk '/^## \[Unreleased\]/ { print; print ""; while ((getline line < "/tmp/entry.md") > 0) print line; next } { print }' \
+            CHANGELOG.md > /tmp/CHANGELOG.new && mv /tmp/CHANGELOG.new CHANGELOG.md
+
+          # Keep the spec-kit extension metadata in lockstep (same thing
+          # `docguard fix --write` does locally before a manual release).
+          node cli/docguard.mjs fix --write || true
+
+          echo "NEW_VERSION=$NEW" >> "$GITHUB_ENV"
+
+      - name: Verify the tree is still green before releasing
+        if: steps.check.outputs.changed == 'true'
+        run: |
+          npm ci
+          npm test
+          node cli/docguard.mjs guard || [ $? -eq 2 ]
+
+      # Two stacked constraints make a direct `git push origin HEAD:main`
+      # impossible here, so this opens a PR instead:
+      #
+      #   1. main requires a pull request. github-actions[bot] is not an admin
+      #      and has no bypass, so a direct push is rejected outright.
+      #   2. A PR opened with GITHUB_TOKEN does NOT trigger further workflow
+      #      runs (GitHub's loop guard). So ci.yml would never fire on it, the
+      #      required test (18/20/22/24) checks would never report, and the PR
+      #      would sit forever on "Expected — waiting for status to be
+      #      reported" — unmergeable.
+      #
+      # So: push a branch (unprotected), open the PR, then explicitly dispatch
+      # ci.yml against that branch so the checks DO report on its head SHA.
+      # auto-merge.yml then merges it once all four legs are green, and the
+      # resulting package.json change on main triggers release.yml to publish.
+      - name: Open release PR and kick off its CI
+        if: steps.check.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          BRANCH="release/v${NEW_VERSION}"
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git checkout -b "$BRANCH"
+          git add package.json package-lock.json CHANGELOG.md extensions/ .agent/ 2>/dev/null || true
+          git commit -m "release: v${NEW_VERSION} — automated weekly batch
+
+          Cut by .github/workflows/scheduled-release.yml. Publishing itself is
+          handled by release.yml, which triggers once this lands on main."
+          git push origin "$BRANCH"
+
+          gh pr create \
+            --base main \
+            --head "$BRANCH" \
+            --title "release: v${NEW_VERSION} — automated weekly batch" \
+            --body "Automated weekly release cut by \`scheduled-release.yml\`.
+
+          Batches everything merged since \`${{ steps.check.outputs.last_tag }}\`. Tests and \`guard\` already passed on this tree before the PR was opened; CI is dispatched separately below so the required checks report (a GITHUB_TOKEN-opened PR does not trigger workflows on its own).
+
+          Once green, \`auto-merge.yml\` merges this, and the \`package.json\` change triggers \`release.yml\` to tag and publish."
+
+          # Required checks must actually report on this SHA or the PR can
+          # never merge -- see constraint 2 above.
+          gh workflow run ci.yml --ref "$BRANCH"
+          echo "Opened $BRANCH and dispatched CI."

{docguard_cli-0.34.3 → docguard_cli-0.34.5}/.wolf/anatomy.md

@@ -1,7 +1,7 @@
 # anatomy.md
 
-> Auto-maintained by OpenWolf. Last scanned: 2026-09-11T15:17:16.962Z
-> Files: 704 tracked | Anatomy hits: 0 | Misses: 0
+> Auto-maintained by OpenWolf. Last scanned: 2026-09-11T15:50:08.916Z
+> Files: 707 tracked | Anatomy hits: 0 | Misses: 0
 
 ## ../../../../../../../tmp/
 
@@ -29,7 +29,7 @@
 - `.pre-commit-hooks.yaml` — DocGuard hooks for the pre-commit framework (https://pre-commit.com). (~490 tok)
 - `action.yml` — Declares fs (~7591 tok)
 - `AGENTS.md` — AI Agent Instructions — DocGuard (~1827 tok)
-- `CHANGELOG.md` — Changelog (~51752 tok)
+- `CHANGELOG.md` — Changelog (~53296 tok)
 - `CLAUDE.md` — OpenWolf (~57 tok)
 - `CODE_OF_CONDUCT.md` — Contributor Covenant Code of Conduct (~532 tok)
 - `COMPARISONS.md` — Comparisons & Honest Limitations (~3382 tok)
@@ -959,8 +959,11 @@
 
 ## .github/workflows/
 
-- `ci.yml` — CI: DocGuard CI (~1468 tok)
-- `release.yml` — CI: Auto Release — Tag, GitHub Release, npm, PyPI (~4114 tok)
+- `auto-merge.yml` — CI: Auto-merge (green bot PRs) (~2234 tok)
+- `ci.yml` — CI: DocGuard CI (~1843 tok)
+- `jules-triage.yml` — CI: Jules PR Triage (~1635 tok)
+- `release.yml` — CI: Auto Release — Tag, GitHub Release, npm, PyPI (~4892 tok)
+- `scheduled-release.yml` — CI: Scheduled Release (~2099 tok)
 - `sync-speckit-catalog.yml` — CI: Prepare Spec Kit Catalog Submission (Manual) (~1385 tok)
 
 ## .jules/
@@ -1113,7 +1116,7 @@
 - `canonical-docs-nested-phase2.test.mjs` — Phase 2 of the nested-canonical-docs fix: the remaining 14 sites found (~1482 tok)
 - `canonical-docs-nested.test.mjs` — Regression: canonical docs in SUBFOLDERS must be seen by every consumer. (~2028 tok)
 - `changelog.test.mjs` — Exports x, x (~1315 tok)
-- `commands.test.mjs` — DocGuard CLI Tests — Tests all commands and flags (~10442 tok)
+- `commands.test.mjs` — DocGuard CLI Tests — Tests all commands and flags (~10729 tok)
 - `cross-reference.test.mjs` — Cross-Reference Validator — K-7 / S-8 (~4060 tok)
 - `ensure-skills-idempotent.test.mjs` — v0.24 — Skill install is idempotent (field report, Issue D). (~1133 tok)
 - `field-report-3-deferred.test.mjs` — v0.28 — the detection-gap items deferred from LLM field report #3. (~3325 tok)