docguard-cli 0.34.7__tar.gz → 0.34.9__tar.gz

{docguard_cli-0.34.7/extensions/spec-kit-docguard → docguard_cli-0.34.9/.agent}/skills/docguard-fix/SKILL.md

@@ -6,10 +6,10 @@ description: AI-driven documentation repair with structured research workflow, t
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.7
+  version: 0.34.9
   source: extensions/spec-kit-docguard/skills/docguard-fix
 ---
-<!-- docguard:version: 0.34.7 -->
+<!-- docguard:version: 0.34.9 -->
 
 # DocGuard Fix Skill
 

{docguard_cli-0.34.7 → docguard_cli-0.34.9}/.agent/skills/docguard-guard/SKILL.md

@@ -7,10 +7,10 @@ description: Run DocGuard guard validation against Canonical-Driven Development
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.7
+  version: 0.34.9
   source: extensions/spec-kit-docguard/skills/docguard-guard
 ---
-<!-- docguard:version: 0.34.7 -->
+<!-- docguard:version: 0.34.9 -->
 
 # DocGuard Guard Skill
 

{docguard_cli-0.34.7/extensions/spec-kit-docguard → docguard_cli-0.34.9/.agent}/skills/docguard-review/SKILL.md

@@ -6,10 +6,10 @@ description: Cross-document consistency analysis and quality assessment. Perform
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.7
+  version: 0.34.9
   source: extensions/spec-kit-docguard/skills/docguard-review
 ---
-<!-- docguard:version: 0.34.7 -->
+<!-- docguard:version: 0.34.9 -->
 
 # DocGuard Review Skill
 

{docguard_cli-0.34.7/extensions/spec-kit-docguard → docguard_cli-0.34.9/.agent}/skills/docguard-score/SKILL.md

@@ -6,10 +6,10 @@ description: CDD maturity assessment with category-aware improvement roadmap. Ru
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.7
+  version: 0.34.9
   source: extensions/spec-kit-docguard/skills/docguard-score
 ---
-<!-- docguard:version: 0.34.7 -->
+<!-- docguard:version: 0.34.9 -->
 
 # DocGuard Score Skill
 

{docguard_cli-0.34.7 → docguard_cli-0.34.9}/.agent/skills/docguard-sync/SKILL.md

@@ -4,10 +4,10 @@ description: Keep canonical documentation ALWAYS UP TO DATE. Refreshes code-trut
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.7
+  version: 0.34.9
   source: extensions/spec-kit-docguard/skills/docguard-sync
 ---
-<!-- docguard:version: 0.34.7 -->
+<!-- docguard:version: 0.34.9 -->
 
 # DocGuard Sync Skill
 

{docguard_cli-0.34.7 → docguard_cli-0.34.9}/.github/workflows/release.yml

@@ -298,6 +298,19 @@ jobs:
   publish-pypi:
     needs: [detect-version, test, create-release]
     runs-on: ubuntu-latest
+    # PyPI Trusted Publishing (OIDC) — same rationale as publish-npm: a stored
+    # API token is a credential that expires silently and takes the release
+    # pipeline down with it (see bug-256: NPM_TOKEN expired and cost seven
+    # releases to diagnose). PYPI_API_TOKEN was last rotated 2026-03-15 and was
+    # the next one due to do exactly that. Nothing here can expire.
+    #
+    # `environment` MUST match the Environment name configured in the PyPI
+    # trusted publisher, and `id-token: write` is what mints the OIDC token.
+    # Mirrors the working setup in raccioly/websec-validator's publish.yml.
+    environment: pypi
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-python@v7
@@ -312,16 +325,35 @@ jobs:
           grep 'version' pyproject.toml
 
       - name: Install build tools
-        run: pip install build twine
+        run: pip install build
 
       - name: Build
         run: python -m build
 
-      - name: Publish
-        run: python -m twine upload dist/*
-        env:
-          TWINE_USERNAME: __token__
-          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+      # Assert the OIDC precondition before publishing, rather than finding out
+      # via an auth error that doesn't name the cause (the npm lesson).
+      - name: Assert OIDC token is available
+        run: |
+          if [ -z "$ACTIONS_ID_TOKEN_REQUEST_URL" ]; then
+            echo "::error::ACTIONS_ID_TOKEN_REQUEST_URL is unset — this job lacks id-token: write, so PyPI Trusted Publishing cannot authenticate."
+            exit 1
+          fi
+          echo "OIDC token endpoint available; publishing via Trusted Publishing."
+
+      # No TWINE_USERNAME/TWINE_PASSWORD: the OIDC exchange against the trusted
+      # publisher configured on PyPI (raccioly / docguard / release.yml /
+      # environment: pypi) IS the authentication.
+      # v1.14.2. Pinned by COMMIT sha (dereferenced from the annotated tag, not
+      # the tag object's own sha -- those differ for annotated tags and pinning
+      # the wrong one does not resolve).
+      #
+      # Do NOT pin this back to the older release/v1 sha used by
+      # raccioly/websec-validator: that build's bundled twine rejects
+      # `Metadata-Version: 2.5`, which current setuptools/build now emits --
+      # "InvalidDistribution: '2.5' is not a valid metadata version". v0.34.8
+      # failed exactly there. websec-validator still carries that old pin and
+      # will hit the same wall whenever its setuptools moves forward.
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
 
   # ── Step 7: Prepare Spec Kit community catalog submission ──────────────
   # Per spec-kit maintainer guidance (github/spec-kit#2707) and spec-kit's

{docguard_cli-0.34.7 → docguard_cli-0.34.9}/.wolf/anatomy.md

@@ -1,6 +1,6 @@
 # anatomy.md
 
-> Auto-maintained by OpenWolf. Last scanned: 2026-09-11T16:09:12.886Z
+> Auto-maintained by OpenWolf. Last scanned: 2026-09-11T16:39:55.617Z
 > Files: 707 tracked | Anatomy hits: 0 | Misses: 0
 
 ## ../../../../../../../tmp/
@@ -962,7 +962,7 @@
 - `auto-merge.yml` — CI: Auto-merge (green bot PRs) (~2234 tok)
 - `ci.yml` — CI: DocGuard CI (~1843 tok)
 - `jules-triage.yml` — CI: Jules PR Triage (~1635 tok)
-- `release.yml` — CI: Auto Release — Tag, GitHub Release, npm, PyPI (~5444 tok)
+- `release.yml` — CI: Auto Release — Tag, GitHub Release, npm, PyPI (~6014 tok)
 - `scheduled-release.yml` — CI: Scheduled Release (~2099 tok)
 - `sync-speckit-catalog.yml` — CI: Prepare Spec Kit Catalog Submission (Manual) (~1385 tok)
 

{docguard_cli-0.34.7 → docguard_cli-0.34.9}/.wolf/buglog.json

@@ -4768,6 +4768,47 @@
       "related_bugs": [],
       "occurrences": 1,
       "last_seen": "2026-09-11T16:08:59.962Z"
+    },
+    {
+      "id": "bug-259",
+      "timestamp": "2026-09-11T16:20:00Z",
+      "error_message": "RESOLVED: npm publish failed for SEVEN consecutive releases (v0.34.1 - v0.34.7). Final error before the fix: 'npm verbose oidc Failed token exchange request with body message: OIDC token exchange error - package not found' on POST /-/npm/v1/oidc/token/exchange/package/docguard-cli.",
+      "file": ".github/workflows/release.yml + npmjs.com trusted publisher config",
+      "root_cause": "THREE independent faults stacked, each masking the next, which is why six fixes each 'changed the error' without fixing it. (1) NPM_TOKEN expired ~2026-08 (bug-256). (2) After migrating to Trusted Publishing, the publish job ran Node 20 -- npm Trusted Publishing requires npm >= 11.5.1 AND Node >= 22.14.0, and below that floor npm never ATTEMPTS the OIDC exchange, silently falling back to token auth. (3) The npm-side trusted publisher was created with the Repository field containing a TRAILING SLASH ('docguard/'), so the stored config was 'raccioly/docguard/' and never matched the OIDC claim 'raccioly/docguard'. Fault 3 was invisible until faults 1 and 2 were cleared, because only then did npm get far enough to actually attempt the exchange and report a specific error.",
+      "fix": "(1) Trusted Publishing replaces the expiring token (bug-257). (2) publish-npm now runs Node 24, with an explicit precondition assert on Node >= 22.14.0, npm >= 11.5.1 and ACTIONS_ID_TOKEN_REQUEST_URL. (3) Added a SECOND trusted publisher on npmjs.com with Repository exactly 'docguard' (no trailing slash) -- deliberately additive rather than deleting the malformed one, so a failed recreate could not leave the package with no publisher at all. Publish succeeded immediately on rerun: docguard-cli@0.34.7 is live and tagged latest; npm, PyPI and the git tag are all in sync at 0.34.7 for the first time since 0.34.0.",
+      "tags": [
+        "npm-publish",
+        "trusted-publishing",
+        "oidc",
+        "node-version-floor",
+        "trailing-slash",
+        "stacked-faults",
+        "resolved"
+      ],
+      "related_bugs": [
+        "bug-256",
+        "bug-257",
+        "bug-258"
+      ],
+      "occurrences": 7,
+      "last_seen": "2026-09-11T16:12:49Z",
+      "notes": "Process lesson, not just a technical one: six releases were burned guessing from a generic 404 when `npm publish --loglevel verbose` named the exact failing endpoint and reason on the FIRST run that had it. When an error is generic and a fix 'changes the error' without fixing it, that is the signal to stop iterating and start instrumenting. Also: display text is not data -- the malformed trailing slash was visible in the UI the whole time but rendered as 'raccioly/docguard/' which looked like a path separator; it was only provable once a correct second entry rendered differently ('raccioly/docguard') right next to it."
+    },
+    {
+      "id": "bug-290",
+      "timestamp": "2026-09-11T16:33:44.539Z",
+      "error_message": "Significant refactor of ",
+      "file": ".github/workflows/release.yml",
+      "root_cause": "6 lines replaced/restructured",
+      "fix": "Rewrote 27→49 lines (6 removed)",
+      "tags": [
+        "auto-detected",
+        "refactor",
+        "yml"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T16:33:44.539Z"
     }
   ]
 }

{docguard_cli-0.34.7 → docguard_cli-0.34.9}/.wolf/cerebrum.md

@@ -12,6 +12,10 @@
 
 ## Key Learnings
 
+- **2026-09-11 — When a fix "changes the error" but doesn't fix it, STOP GUESSING AND INSTRUMENT.** The npm publish failure took seven releases because three faults were stacked (expired token → Node below the OIDC floor → malformed trusted-publisher config), each hiding the next, so every partial fix produced a *new* plausible-looking error and made a wrong theory feel confirmed. `npm publish --loglevel verbose` named the exact failing endpoint and reason (`POST /-/npm/v1/oidc/token/exchange/... → "OIDC token exchange error - package not found"`) on the very first run that had it. That single flag was worth more than five diagnostic cycles. Rule: after the SECOND failed fix of the same symptom, stop proposing causes and add logging/asserts that make the failure self-describing. See bug-259.
+- **2026-09-11 — Rendered UI text is not data.** The npm trusted publisher had been stored with a trailing slash in the Repository field (`docguard/`), so it never matched the OIDC claim `raccioly/docguard`. It displayed as `raccioly/docguard/` the whole time, which reads exactly like a path separator — I looked at it twice and dismissed it. It only became provable when a correctly-created second entry rendered *differently* (`raccioly/docguard`) directly beside it. When a value's correctness matters and the UI won't show you the raw field, create a known-good control and compare renderings rather than reasoning about the formatting.
+- **2026-09-11 — Prefer additive over destructive when repairing third-party config.** npm fixes trusted-publisher fields at creation ("to change them, delete and recreate"). Rather than deleting the suspect entry, I added a second one with verified values — so a failed recreate (the form had already been blocked once by a browser extension) couldn't leave the package with no publisher at all. It worked, which also *proved* the old entry was the broken one. Delete the stale entry only after the replacement is confirmed working.
+- **2026-09-11 — Never locate a YAML block by first-match on a structural pattern that repeats across jobs.** A scripted edit meant for `publish-npm` matched `build-mcpb` first (both start `checkout → setup-node → node-version: 20`), clobbering that job's body and deleting `publish-npm` entirely — the workflow then failed at parse time with zero jobs. Use targeted anchored edits, and after any workflow edit assert the full job list and each job's step names before pushing.
 - **2026-09-11 — `npm install -g npm@latest` in a CI step is never safe to assume works — npm's own majors bump their engines floor too.** v0.34.3's Trusted Publishing fix used `npm@latest`, which resolved to npm 12.0.2 (`engines: node ^22.22.2 || ^24.15.0 || >=26.0.0`) — incompatible with the Node 20 the publish-npm job runs on. Exact same class of mistake as bug-255 (@babel/parser major bump), one layer up the toolchain, caught by the pipeline itself on the very next real run. Fix: pin to a checked-compatible range (`npm@11`, whose engines field is `^20.17.0 || >=22.9.0`) and verify by actually installing it in an isolated prefix, not by reasoning about what "should" be compatible. See bug-258.
 - **2026-09-11 — Fixed bug-256 permanently: migrated publish-npm to Trusted Publishing (OIDC), retiring NODE_AUTH_TOKEN entirely.** See bug-257. Two non-obvious things worth remembering: (1) npm Trusted Publishing needs npm CLI >=11.5.0 — Node 20's bundled npm is older, so the workflow now self-updates (`npm install -g npm@latest`) before publishing; forgetting this would trade one failure mode for another. (2) A GitHub Actions "rerun failed jobs" reruns using the workflow file AS IT EXISTED AT THAT RUN'S COMMIT, not the current default-branch version — editing release.yml and then rerunning an old failed run would NOT pick up the fix. Had to cut an actual new release (v0.34.3, no code changes) to get a fresh run that exercises the updated workflow. Confirm any workflow-file fix via a genuinely new run, never a rerun of a run that predates the fix.
 - **2026-09-11 — Claude in Chrome can get blocked by an unrelated browser extension's overlay.** Mid-way through filling an npm settings form (Trusted Publisher setup), clicks and even a plain screenshot started failing with "Cannot access a chrome-extension:// URL of different extension" — almost certainly another extension (password manager autofill is the likely suspect) injected a frame that captured input on the tab. Claude in Chrome can't reach into another extension's frame to dismiss it; the fix was asking the user to click/Escape on their end to clear it, then resuming automation. Also: user's real Chrome profile carries their own extensions, unlike the in-app Browser pane — expect this class of interference there and not in the sandboxed pane.

{docguard_cli-0.34.7 → docguard_cli-0.34.9}/.wolf/hooks/_session.json

@@ -18,8 +18,8 @@
       "first_read": "2026-09-11T14:49:34.552Z"
     },
     "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/workflows/release.yml": {
-      "count": 7,
-      "tokens": 4763,
+      "count": 9,
+      "tokens": 5444,
       "first_read": "2026-09-11T15:15:37.248Z"
     },
     "/private/tmp/claude-501/-Users-ricardoaccioly-Repo-claude-canonical-spec-kit/25ac0636-5765-49fe-a808-dd97dc825b30/tasks/bcylzwtls.output": {
@@ -41,6 +41,16 @@
       "count": 1,
       "tokens": 0,
       "first_read": "2026-09-11T16:01:53.189Z"
+    },
+    "/private/tmp/claude-501/-Users-ricardoaccioly-Repo-claude-canonical-spec-kit/25ac0636-5765-49fe-a808-dd97dc825b30/tasks/bl3wuxq6y.output": {
+      "count": 1,
+      "tokens": 0,
+      "first_read": "2026-09-11T16:13:05.923Z"
+    },
+    "/private/tmp/claude-501/-Users-ricardoaccioly-Repo-claude-canonical-spec-kit/25ac0636-5765-49fe-a808-dd97dc825b30/tasks/bxfoxiweq.output": {
+      "count": 1,
+      "tokens": 0,
+      "first_read": "2026-09-11T16:39:11.726Z"
     }
   },
   "files_written": [
@@ -223,13 +233,25 @@
       "action": "edit",
       "tokens": 526,
       "at": "2026-09-11T16:09:12.899Z"
+    },
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/workflows/release.yml",
+      "action": "edit",
+      "tokens": 616,
+      "at": "2026-09-11T16:33:44.536Z"
+    },
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/workflows/release.yml",
+      "action": "edit",
+      "tokens": 212,
+      "at": "2026-09-11T16:39:55.629Z"
     }
   ],
   "edit_counts": {
     ".github/dependabot.yml": 1,
     "CHANGELOG.md": 9,
     "package.json": 3,
-    ".github/workflows/release.yml": 9,
+    ".github/workflows/release.yml": 11,
     ".github/workflows/ci.yml": 1,
     ".github/workflows/auto-merge.yml": 3,
     ".github/workflows/scheduled-release.yml": 2,
@@ -237,8 +259,8 @@
     "tests/commands.test.mjs": 1
   },
   "anatomy_hits": 2,
-  "anatomy_misses": 6,
-  "repeated_reads_warned": 8,
+  "anatomy_misses": 8,
+  "repeated_reads_warned": 10,
   "cerebrum_warnings": 0,
-  "stop_count": 19
+  "stop_count": 26
 }

{docguard_cli-0.34.7 → docguard_cli-0.34.9}/.wolf/memory.md

@@ -1316,3 +1316,12 @@
 | 12:02 | Session end: 28 writes across 9 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 8 reads | ~69392 tok |
 | 12:08 | Edited .github/workflows/release.yml | expanded (+12 lines) | ~375 |
 | 12:09 | Edited .github/workflows/release.yml | expanded (+25 lines) | ~526 |
+| 12:11 | Session end: 30 writes across 9 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 8 reads | ~70092 tok |
+| 12:16 | Session end: 30 writes across 9 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 9 reads | ~70092 tok |
+| 12:19 | Session end: 30 writes across 9 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 9 reads | ~70092 tok |
+| 12:31 | Session end: 30 writes across 9 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 9 reads | ~70092 tok |
+| 12:32 | Session end: 30 writes across 9 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 9 reads | ~70092 tok |
+| 12:33 | Edited .github/workflows/release.yml | expanded (+22 lines) | ~616 |
+| 12:34 | Session end: 31 writes across 9 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 9 reads | ~71389 tok |
+| 12:37 | Session end: 31 writes across 9 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 9 reads | ~71389 tok |
+| 12:39 | Edited .github/workflows/release.yml | expanded (+10 lines) | ~212 |