docguard-cli 0.34.5__tar.gz → 0.34.7__tar.gz

{docguard_cli-0.34.5/extensions/spec-kit-docguard → docguard_cli-0.34.7/.agent}/skills/docguard-fix/SKILL.md

@@ -6,10 +6,10 @@ description: AI-driven documentation repair with structured research workflow, t
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.5
+  version: 0.34.7
   source: extensions/spec-kit-docguard/skills/docguard-fix
 ---
-<!-- docguard:version: 0.34.5 -->
+<!-- docguard:version: 0.34.7 -->
 
 # DocGuard Fix Skill
 

{docguard_cli-0.34.5 → docguard_cli-0.34.7}/.agent/skills/docguard-guard/SKILL.md

@@ -7,10 +7,10 @@ description: Run DocGuard guard validation against Canonical-Driven Development
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.5
+  version: 0.34.7
   source: extensions/spec-kit-docguard/skills/docguard-guard
 ---
-<!-- docguard:version: 0.34.5 -->
+<!-- docguard:version: 0.34.7 -->
 
 # DocGuard Guard Skill
 

{docguard_cli-0.34.5/extensions/spec-kit-docguard → docguard_cli-0.34.7/.agent}/skills/docguard-review/SKILL.md

@@ -6,10 +6,10 @@ description: Cross-document consistency analysis and quality assessment. Perform
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.5
+  version: 0.34.7
   source: extensions/spec-kit-docguard/skills/docguard-review
 ---
-<!-- docguard:version: 0.34.5 -->
+<!-- docguard:version: 0.34.7 -->
 
 # DocGuard Review Skill
 

{docguard_cli-0.34.5/extensions/spec-kit-docguard → docguard_cli-0.34.7/.agent}/skills/docguard-score/SKILL.md

@@ -6,10 +6,10 @@ description: CDD maturity assessment with category-aware improvement roadmap. Ru
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.5
+  version: 0.34.7
   source: extensions/spec-kit-docguard/skills/docguard-score
 ---
-<!-- docguard:version: 0.34.5 -->
+<!-- docguard:version: 0.34.7 -->
 
 # DocGuard Score Skill
 

{docguard_cli-0.34.5 → docguard_cli-0.34.7}/.agent/skills/docguard-sync/SKILL.md

@@ -4,10 +4,10 @@ description: Keep canonical documentation ALWAYS UP TO DATE. Refreshes code-trut
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.5
+  version: 0.34.7
   source: extensions/spec-kit-docguard/skills/docguard-sync
 ---
-<!-- docguard:version: 0.34.5 -->
+<!-- docguard:version: 0.34.7 -->
 
 # DocGuard Sync Skill
 

{docguard_cli-0.34.5 → docguard_cli-0.34.7}/.github/workflows/release.yml

@@ -203,64 +203,96 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-node@v7
         with:
-          node-version: 20
-          # DELIBERATELY NO `registry-url`. setup-node's registry-url writes an
-          # .npmrc containing:
-          #     //registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}
-          # With NODE_AUTH_TOKEN removed (Trusted Publishing), that expands to
-          # an EMPTY token. npm then takes the token-auth path holding no token
-          # and 404s, never attempting the OIDC exchange at all. v0.34.4 failed
-          # exactly this way: npm@11 installed fine, provenance signed fine, no
-          # OIDC notice in the log, then "404 ... could not be found or you do
-          # not have permission". npm defaults to registry.npmjs.org anyway, so
-          # dropping this loses nothing.
-
-      # Trusted Publishing (OIDC) needs npm CLI >= 11.5.0; Node 20's bundled
-      # npm predates that, so self-update first. Pinned to the 11.x line
-      # (NOT `npm@latest`) because npm 12 requires Node ^22.22.2 || ^24.15.0
-      # || >=26.0.0 -- newer than the Node 20 this job runs on. Learned this
-      # the hard way: the first cut of this fix used `npm@latest` and broke
-      # the same way the @babel/parser major bump did earlier (bug-255) --
-      # an unpinned "latest" floated past what this job's Node version
-      # supports. npm 11.x itself supports Node ^20.17.0 || >=22.9.0, so it
-      # installs cleanly here. No NODE_AUTH_TOKEN needed — npm exchanges the
-      # id-token (permissions, above) directly with the registry via the
-      # trusted-publisher connection configured on npmjs.com
-      # (raccioly/docguard, release.yml). This replaces the NPM_TOKEN-based
-      # auth that silently broke for 2 releases (v0.34.1, v0.34.2 never
-      # reached npm) when the token expired — nothing here can expire the
-      # same way; a short-lived token is minted per run.
+          # MUST be >= 22.14.0. npm Trusted Publishing (OIDC) requires
+          # npm CLI >= 11.5.1 AND Node >= 22.14.0, per npm's own docs.
+          # This job ran Node 20 for five straight failed releases
+          # (v0.34.1 - v0.34.5): below that floor npm never even ATTEMPTS the
+          # OIDC exchange, it just falls through to token auth. That produced
+          # two red herrings in sequence -- E404 "not found or you do not have
+          # permission" while an empty _authToken was present, then ENEEDAUTH
+          # once it wasn't -- neither of which names the actual cause.
+          node-version: 24
+          # NO registry-url, deliberately, and this combination has never
+          # actually been tried before. Tracing every failed run:
+          #   v0.34.4  Node 20 + registry-url  -> E404      (Node too old for
+          #                                                  OIDC; empty token
+          #                                                  used instead)
+          #   v0.34.5  Node 20 + no registry   -> ENEEDAUTH (no token at all,
+          #                                                  Node still too old)
+          #   v0.34.6  Node 24 + registry-url  -> E404      (Node fine, but the
+          #                                                  empty _authToken
+          #                                                  setup-node writes
+          #                                                  took the token path)
+          # Each run had exactly ONE of the two blockers. Node >= 22.14 clears
+          # the OIDC floor; omitting registry-url stops setup-node writing
+          # `//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}`, which with
+          # NODE_AUTH_TOKEN unset expands to an EMPTY token that npm still
+          # treats as configured auth. npm defaults to registry.npmjs.org
+          # anyway, so nothing is lost by omitting it.
+
+      # Belt and braces: Node 24 already bundles npm >= 11.5.1, but pin
+      # explicitly so a runner-image change can't silently drop below the
+      # floor. npm@11 (not @latest) -- npm 12 raised its own Node floor, and
+      # an unpinned "latest" is exactly how bug-258 happened.
       - run: npm install -g npm@11
 
-      # Fail LOUDLY if anything put an auth token back in the npm config.
-      # A stray (even empty) _authToken silently routes npm away from OIDC and
-      # the only symptom is a generic 404 that reads like a missing package --
-      # it cost four releases (v0.34.1 through v0.34.4) to identify. Better to
-      # break here with a clear message than to publish-fail cryptically again.
-      - name: Assert no npm auth token is configured (OIDC must be the path)
+      # Assert the OIDC preconditions up front, rather than discovering a
+      # violation three minutes later as an unrelated-looking auth error.
+      - name: Assert Trusted Publishing preconditions
         run: |
-          npm --version
-          # NOTE: `npm config get <key>` refuses on auth keys ("protected") and
-          # `npm config list --json` omits them entirely, so neither can be used
-          # to detect this. Grep the actual .npmrc files instead.
+          NPM_V=$(npm --version)
+          echo "node=$(node -p 'process.versions.node') npm=$NPM_V"
+          node -e '
+            const [maj, min] = process.versions.node.split(".").map(Number);
+            if (!(maj > 22 || (maj === 22 && min >= 14))) {
+              console.error(`::error::Node ${process.versions.node} is below the 22.14.0 floor npm Trusted Publishing requires. OIDC is silently not attempted below it and publish fails as an auth error.`);
+              process.exit(1);
+            }
+          '
+          node -e '
+            const v = process.argv[1].split(".").map(Number);
+            if (!(v[0] > 11 || (v[0] === 11 && (v[1] > 5 || (v[1] === 5 && v[2] >= 1))))) {
+              console.error(`::error::npm ${process.argv[1]} is below the 11.5.1 floor npm Trusted Publishing requires.`);
+              process.exit(1);
+            }
+          ' "$NPM_V"
+          if [ -z "$ACTIONS_ID_TOKEN_REQUEST_URL" ]; then
+            echo "::error::ACTIONS_ID_TOKEN_REQUEST_URL is unset — this job lacks id-token: write, so no OIDC token can be minted."
+            exit 1
+          fi
+          echo "OIDC preconditions satisfied."
+
+      # Diagnostics. Six releases have failed here on a generic 404 that never
+      # names the real cause, so capture the auth state BEFORE publishing
+      # rather than inferring it from the failure afterwards.
+      - name: Diagnose npm auth state
+        run: |
+          echo "--- versions ---"
+          echo "node=$(node -p 'process.versions.node')  npm=$(npm --version)"
+          echo "--- OIDC env present? (values intentionally not printed) ---"
+          [ -n "$ACTIONS_ID_TOKEN_REQUEST_URL" ] && echo "ACTIONS_ID_TOKEN_REQUEST_URL: set" || echo "ACTIONS_ID_TOKEN_REQUEST_URL: MISSING"
+          [ -n "$ACTIONS_ID_TOKEN_REQUEST_TOKEN" ] && echo "ACTIONS_ID_TOKEN_REQUEST_TOKEN: set" || echo "ACTIONS_ID_TOKEN_REQUEST_TOKEN: MISSING"
+          echo "--- resolved registry ---"
+          npm config get registry
+          echo "--- .npmrc files (token VALUES redacted, presence shown) ---"
           USERCONFIG=$(npm config list | sed -n 's/^userconfig = "\(.*\)"$/\1/p')
-          HITS=""
           for f in "$USERCONFIG" ".npmrc" "$HOME/.npmrc"; do
-            if [ -n "$f" ] && [ -f "$f" ] && grep -qE '_authToken|_auth[[:space:]]*=' "$f"; then
-              HITS="$HITS $f"
+            if [ -n "$f" ] && [ -f "$f" ]; then
+              echo "  [$f]"
+              sed -E 's/(_authToken=).*/\1<REDACTED-OR-EMPTY>/' "$f" | sed 's/^/    /'
+            else
+              echo "  [$f] (absent)"
             fi
           done
-          if [ -n "$HITS" ]; then
-            echo "::error::npm auth token found in:$HITS"
-            echo "::error::Even an EMPTY _authToken routes npm to token auth and skips OIDC/Trusted Publishing —"
-            echo "::error::the only symptom is a generic 404 that reads like a missing package."
-            echo "::error::Remove registry-url from setup-node and any NODE_AUTH_TOKEN from this job."
-            exit 1
-          fi
-          echo "No auth token configured — npm will use OIDC (Trusted Publishing)."
 
-      - name: Publish (with provenance)
-        run: npm publish --provenance
+      # No --provenance flag and no NODE_AUTH_TOKEN: under Trusted Publishing
+      # npm generates provenance attestations automatically, and the OIDC
+      # exchange against the trusted-publisher connection on npmjs.com
+      # (raccioly/docguard -> release.yml) IS the authentication.
+      # --loglevel verbose so that if this fails again, the log shows which
+      # auth path npm chose instead of leaving it to inference.
+      - name: Publish (provenance is automatic under Trusted Publishing)
+        run: npm publish --loglevel verbose
 
   # ── Step 6: Publish to PyPI ────────────────────────────────────────────
   publish-pypi:

{docguard_cli-0.34.5 → docguard_cli-0.34.7}/.wolf/anatomy.md

@@ -1,6 +1,6 @@
 # anatomy.md
 
-> Auto-maintained by OpenWolf. Last scanned: 2026-09-11T15:50:08.916Z
+> Auto-maintained by OpenWolf. Last scanned: 2026-09-11T16:09:12.886Z
 > Files: 707 tracked | Anatomy hits: 0 | Misses: 0
 
 ## ../../../../../../../tmp/
@@ -29,7 +29,7 @@
 - `.pre-commit-hooks.yaml` — DocGuard hooks for the pre-commit framework (https://pre-commit.com). (~490 tok)
 - `action.yml` — Declares fs (~7591 tok)
 - `AGENTS.md` — AI Agent Instructions — DocGuard (~1827 tok)
-- `CHANGELOG.md` — Changelog (~53296 tok)
+- `CHANGELOG.md` — Changelog (~53685 tok)
 - `CLAUDE.md` — OpenWolf (~57 tok)
 - `CODE_OF_CONDUCT.md` — Contributor Covenant Code of Conduct (~532 tok)
 - `COMPARISONS.md` — Comparisons & Honest Limitations (~3382 tok)
@@ -962,7 +962,7 @@
 - `auto-merge.yml` — CI: Auto-merge (green bot PRs) (~2234 tok)
 - `ci.yml` — CI: DocGuard CI (~1843 tok)
 - `jules-triage.yml` — CI: Jules PR Triage (~1635 tok)
-- `release.yml` — CI: Auto Release — Tag, GitHub Release, npm, PyPI (~4892 tok)
+- `release.yml` — CI: Auto Release — Tag, GitHub Release, npm, PyPI (~5444 tok)
 - `scheduled-release.yml` — CI: Scheduled Release (~2099 tok)
 - `sync-speckit-catalog.yml` — CI: Prepare Spec Kit Catalog Submission (Manual) (~1385 tok)
 

{docguard_cli-0.34.5 → docguard_cli-0.34.7}/.wolf/buglog.json

@@ -4704,6 +4704,70 @@
       "related_bugs": [],
       "occurrences": 1,
       "last_seen": "2026-09-11T15:50:08.928Z"
+    },
+    {
+      "id": "bug-285",
+      "timestamp": "2026-09-11T15:55:09.291Z",
+      "error_message": "Significant refactor of ",
+      "file": "CHANGELOG.md",
+      "root_cause": "2 lines replaced/restructured",
+      "fix": "Rewrote 9→21 lines (2 removed)",
+      "tags": [
+        "auto-detected",
+        "refactor",
+        "md"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T15:55:09.291Z"
+    },
+    {
+      "id": "bug-286",
+      "timestamp": "2026-09-11T15:55:22.456Z",
+      "error_message": "Incorrect value in code",
+      "file": "CHANGELOG.md",
+      "root_cause": "Had `.npmrc`",
+      "fix": "Changed to `npm config get`",
+      "tags": [
+        "auto-detected",
+        "wrong-value",
+        "md"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T15:55:22.456Z"
+    },
+    {
+      "id": "bug-287",
+      "timestamp": "2026-09-11T15:57:59.781Z",
+      "error_message": "Significant refactor of ",
+      "file": ".github/workflows/release.yml",
+      "root_cause": "11 lines replaced/restructured",
+      "fix": "Rewrote 14→17 lines (11 removed)",
+      "tags": [
+        "auto-detected",
+        "refactor",
+        "yml"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T15:57:59.781Z"
+    },
+    {
+      "id": "bug-288",
+      "timestamp": "2026-09-11T16:08:59.962Z",
+      "error_message": "Significant refactor of ",
+      "file": ".github/workflows/release.yml",
+      "root_cause": "5 lines replaced/restructured",
+      "fix": "Rewrote 6→18 lines (5 removed)",
+      "tags": [
+        "auto-detected",
+        "refactor",
+        "yml"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T16:08:59.962Z"
     }
   ]
 }

{docguard_cli-0.34.5 → docguard_cli-0.34.7}/.wolf/hooks/_session.json

@@ -18,14 +18,29 @@
       "first_read": "2026-09-11T14:49:34.552Z"
     },
     "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/workflows/release.yml": {
-      "count": 3,
-      "tokens": 4114,
+      "count": 7,
+      "tokens": 4763,
       "first_read": "2026-09-11T15:15:37.248Z"
     },
     "/private/tmp/claude-501/-Users-ricardoaccioly-Repo-claude-canonical-spec-kit/25ac0636-5765-49fe-a808-dd97dc825b30/tasks/bcylzwtls.output": {
       "count": 1,
       "tokens": 0,
       "first_read": "2026-09-11T15:48:05.168Z"
+    },
+    "/private/tmp/claude-501/-Users-ricardoaccioly-Repo-claude-canonical-spec-kit/25ac0636-5765-49fe-a808-dd97dc825b30/tasks/bno5towq5.output": {
+      "count": 1,
+      "tokens": 0,
+      "first_read": "2026-09-11T15:52:48.971Z"
+    },
+    "/private/tmp/claude-501/-Users-ricardoaccioly-Repo-claude-canonical-spec-kit/25ac0636-5765-49fe-a808-dd97dc825b30/tasks/bafoc2qz9.output": {
+      "count": 1,
+      "tokens": 0,
+      "first_read": "2026-09-11T15:56:42.484Z"
+    },
+    "/private/tmp/claude-501/-Users-ricardoaccioly-Repo-claude-canonical-spec-kit/25ac0636-5765-49fe-a808-dd97dc825b30/tasks/b4o2fwehl.output": {
+      "count": 1,
+      "tokens": 0,
+      "first_read": "2026-09-11T16:01:53.189Z"
     }
   },
   "files_written": [
@@ -172,13 +187,49 @@
       "action": "edit",
       "tokens": 254,
       "at": "2026-09-11T15:50:08.926Z"
+    },
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/CHANGELOG.md",
+      "action": "edit",
+      "tokens": 794,
+      "at": "2026-09-11T15:55:09.289Z"
+    },
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/CHANGELOG.md",
+      "action": "edit",
+      "tokens": 138,
+      "at": "2026-09-11T15:55:22.453Z"
+    },
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/workflows/release.yml",
+      "action": "edit",
+      "tokens": 303,
+      "at": "2026-09-11T15:57:59.778Z"
+    },
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/workflows/release.yml",
+      "action": "edit",
+      "tokens": 594,
+      "at": "2026-09-11T15:58:21.011Z"
+    },
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/workflows/release.yml",
+      "action": "edit",
+      "tokens": 375,
+      "at": "2026-09-11T16:08:59.960Z"
+    },
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/workflows/release.yml",
+      "action": "edit",
+      "tokens": 526,
+      "at": "2026-09-11T16:09:12.899Z"
     }
   ],
   "edit_counts": {
     ".github/dependabot.yml": 1,
-    "CHANGELOG.md": 7,
+    "CHANGELOG.md": 9,
     "package.json": 3,
-    ".github/workflows/release.yml": 5,
+    ".github/workflows/release.yml": 9,
     ".github/workflows/ci.yml": 1,
     ".github/workflows/auto-merge.yml": 3,
     ".github/workflows/scheduled-release.yml": 2,
@@ -186,8 +237,8 @@
     "tests/commands.test.mjs": 1
   },
   "anatomy_hits": 2,
-  "anatomy_misses": 3,
-  "repeated_reads_warned": 4,
+  "anatomy_misses": 6,
+  "repeated_reads_warned": 8,
   "cerebrum_warnings": 0,
-  "stop_count": 15
+  "stop_count": 19
 }

{docguard_cli-0.34.5 → docguard_cli-0.34.7}/.wolf/memory.md

@@ -1306,3 +1306,13 @@
 | 11:47 | Session end: 22 writes across 8 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 4 reads | ~66040 tok |
 | 11:49 | Edited tests/commands.test.mjs | expanded (+17 lines) | ~391 |
 | 11:50 | Edited CHANGELOG.md | 1→2 lines | ~237 |
+| 11:51 | Session end: 24 writes across 9 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 5 reads | ~66713 tok |
+| 11:55 | Edited CHANGELOG.md | expanded (+12 lines) | ~741 |
+| 11:55 | Edited CHANGELOG.md | 3→2 lines | ~129 |
+| 11:56 | Session end: 26 writes across 9 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 6 reads | ~68423 tok |
+| 11:57 | Edited .github/workflows/release.yml | 14→17 lines | ~303 |
+| 11:58 | Edited .github/workflows/release.yml | added 2 condition(s) | ~594 |
+| 11:59 | Session end: 28 writes across 9 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 7 reads | ~69392 tok |
+| 12:02 | Session end: 28 writes across 9 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 8 reads | ~69392 tok |
+| 12:08 | Edited .github/workflows/release.yml | expanded (+12 lines) | ~375 |
+| 12:09 | Edited .github/workflows/release.yml | expanded (+25 lines) | ~526 |