docguard-cli 0.34.7__tar.gz → 0.35.0__tar.gz

{docguard_cli-0.34.7/extensions/spec-kit-docguard → docguard_cli-0.35.0/.agent}/skills/docguard-fix/SKILL.md

@@ -6,10 +6,10 @@ description: AI-driven documentation repair with structured research workflow, t
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.7
+  version: 0.35.0
   source: extensions/spec-kit-docguard/skills/docguard-fix
 ---
-<!-- docguard:version: 0.34.7 -->
+<!-- docguard:version: 0.35.0 -->
 
 # DocGuard Fix Skill
 

{docguard_cli-0.34.7 → docguard_cli-0.35.0}/.agent/skills/docguard-guard/SKILL.md

@@ -7,10 +7,10 @@ description: Run DocGuard guard validation against Canonical-Driven Development
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.7
+  version: 0.35.0
   source: extensions/spec-kit-docguard/skills/docguard-guard
 ---
-<!-- docguard:version: 0.34.7 -->
+<!-- docguard:version: 0.35.0 -->
 
 # DocGuard Guard Skill
 

{docguard_cli-0.34.7/extensions/spec-kit-docguard → docguard_cli-0.35.0/.agent}/skills/docguard-review/SKILL.md

@@ -6,10 +6,10 @@ description: Cross-document consistency analysis and quality assessment. Perform
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.7
+  version: 0.35.0
   source: extensions/spec-kit-docguard/skills/docguard-review
 ---
-<!-- docguard:version: 0.34.7 -->
+<!-- docguard:version: 0.35.0 -->
 
 # DocGuard Review Skill
 

{docguard_cli-0.34.7/extensions/spec-kit-docguard → docguard_cli-0.35.0/.agent}/skills/docguard-score/SKILL.md

@@ -6,10 +6,10 @@ description: CDD maturity assessment with category-aware improvement roadmap. Ru
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.7
+  version: 0.35.0
   source: extensions/spec-kit-docguard/skills/docguard-score
 ---
-<!-- docguard:version: 0.34.7 -->
+<!-- docguard:version: 0.35.0 -->
 
 # DocGuard Score Skill
 

{docguard_cli-0.34.7 → docguard_cli-0.35.0}/.agent/skills/docguard-sync/SKILL.md

@@ -4,10 +4,10 @@ description: Keep canonical documentation ALWAYS UP TO DATE. Refreshes code-trut
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.7
+  version: 0.35.0
   source: extensions/spec-kit-docguard/skills/docguard-sync
 ---
-<!-- docguard:version: 0.34.7 -->
+<!-- docguard:version: 0.35.0 -->
 
 # DocGuard Sync Skill
 

{docguard_cli-0.34.7 → docguard_cli-0.35.0}/.github/workflows/release.yml

@@ -154,6 +154,59 @@ jobs:
             "spec-kit-docguard-v${VERSION}.zip" \
             --clobber
 
+  # ── Step 4c: Publish the MCP server image to GHCR ──────────────────────
+  # The Dockerfile already existed but was only ever built FROM SOURCE by MCP
+  # directory inspectors (Glama et al.) on every check, and was undocumented.
+  # Publishing it means they (and CI users) can pull a prebuilt image instead.
+  #
+  # GHCR, not GitHub's npm registry: public GHCR images pull with NO auth,
+  # whereas npm.pkg.github.com requires a PAT even for public packages — which
+  # would make it strictly worse than npmjs.com and purely cosmetic.
+  #
+  # NOTHING depends on this job, so a failure here cannot block npm, PyPI, the
+  # GitHub Release, or the catalog reminder — they all run in parallel. It is
+  # deliberately NOT `continue-on-error`, because that reports a failed job as
+  # successful and would hide a broken image behind a green run.
+  #
+  # Uses the docker CLI (preinstalled on the runner) rather than third-party
+  # actions: two separate action-pin problems bit this pipeline today
+  # (@babel/parser major, and a pypa action too old for metadata 2.5), and this
+  # needs no action versions at all. Auth is GITHUB_TOKEN — nothing to expire.
+  publish-ghcr:
+    needs: [detect-version, test, create-release]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Log in to GHCR
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
+
+      - name: Build and push image
+        run: |
+          VERSION="${{ needs.detect-version.outputs.version }}"
+          # GHCR requires a lowercase path; github.repository is already
+          # lowercase here but normalise anyway so a future rename can't break it.
+          IMAGE="ghcr.io/$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')"
+          echo "Building $IMAGE:$VERSION"
+          docker build -t "$IMAGE:$VERSION" -t "$IMAGE:latest" .
+
+          # Prove the image actually starts before publishing it. The entrypoint
+          # is an stdio MCP server, so it blocks waiting on stdin — feed it a
+          # JSON-RPC initialize and require a response rather than just checking
+          # the container didn't exit.
+          echo "Smoke-testing the image..."
+          REQ='{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"ci","version":"0"}}}'
+          OUT="$(echo "$REQ" | timeout 60 docker run -i --rm "$IMAGE:$VERSION" 2>/dev/null | head -1 || true)"
+          echo "response: ${OUT:0:200}"
+          echo "$OUT" | grep -q '"jsonrpc"' || { echo "::error::Image did not answer an MCP initialize over stdio — not publishing."; exit 1; }
+
+          docker push "$IMAGE:$VERSION"
+          docker push "$IMAGE:latest"
+          echo "Published $IMAGE:$VERSION and :latest"
+
   # ── Step 4b: Build and attach Claude Desktop extension (.mcpb) ─────────
   # One-click local install for Claude Desktop (Settings → Extensions).
   # Stages the exact npm-pack payload + the one production dep, stamps the
@@ -298,6 +351,19 @@ jobs:
   publish-pypi:
     needs: [detect-version, test, create-release]
     runs-on: ubuntu-latest
+    # PyPI Trusted Publishing (OIDC) — same rationale as publish-npm: a stored
+    # API token is a credential that expires silently and takes the release
+    # pipeline down with it (see bug-256: NPM_TOKEN expired and cost seven
+    # releases to diagnose). PYPI_API_TOKEN was last rotated 2026-03-15 and was
+    # the next one due to do exactly that. Nothing here can expire.
+    #
+    # `environment` MUST match the Environment name configured in the PyPI
+    # trusted publisher, and `id-token: write` is what mints the OIDC token.
+    # Mirrors the working setup in raccioly/websec-validator's publish.yml.
+    environment: pypi
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-python@v7
@@ -312,16 +378,35 @@ jobs:
           grep 'version' pyproject.toml
 
       - name: Install build tools
-        run: pip install build twine
+        run: pip install build
 
       - name: Build
         run: python -m build
 
-      - name: Publish
-        run: python -m twine upload dist/*
-        env:
-          TWINE_USERNAME: __token__
-          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+      # Assert the OIDC precondition before publishing, rather than finding out
+      # via an auth error that doesn't name the cause (the npm lesson).
+      - name: Assert OIDC token is available
+        run: |
+          if [ -z "$ACTIONS_ID_TOKEN_REQUEST_URL" ]; then
+            echo "::error::ACTIONS_ID_TOKEN_REQUEST_URL is unset — this job lacks id-token: write, so PyPI Trusted Publishing cannot authenticate."
+            exit 1
+          fi
+          echo "OIDC token endpoint available; publishing via Trusted Publishing."
+
+      # No TWINE_USERNAME/TWINE_PASSWORD: the OIDC exchange against the trusted
+      # publisher configured on PyPI (raccioly / docguard / release.yml /
+      # environment: pypi) IS the authentication.
+      # v1.14.2. Pinned by COMMIT sha (dereferenced from the annotated tag, not
+      # the tag object's own sha -- those differ for annotated tags and pinning
+      # the wrong one does not resolve).
+      #
+      # Do NOT pin this back to the older release/v1 sha used by
+      # raccioly/websec-validator: that build's bundled twine rejects
+      # `Metadata-Version: 2.5`, which current setuptools/build now emits --
+      # "InvalidDistribution: '2.5' is not a valid metadata version". v0.34.8
+      # failed exactly there. websec-validator still carries that old pin and
+      # will hit the same wall whenever its setuptools moves forward.
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
 
   # ── Step 7: Prepare Spec Kit community catalog submission ──────────────
   # Per spec-kit maintainer guidance (github/spec-kit#2707) and spec-kit's

{docguard_cli-0.34.7 → docguard_cli-0.35.0}/.wolf/anatomy.md

@@ -1,6 +1,6 @@
 # anatomy.md
 
-> Auto-maintained by OpenWolf. Last scanned: 2026-09-11T16:09:12.886Z
+> Auto-maintained by OpenWolf. Last scanned: 2026-09-11T18:56:56.165Z
 > Files: 707 tracked | Anatomy hits: 0 | Misses: 0
 
 ## ../../../../../../../tmp/
@@ -46,7 +46,7 @@
 - `pr_description.md` (~260 tok)
 - `pyproject.toml` — The enforcement tool for Canonical-Driven Development (CDD). Audit, generate, and guard your project (~358 tok)
 - `README.es.md` — 🛡️ DocGuard (~1098 tok)
-- `README.md` — Project documentation (~9554 tok)
+- `README.md` — Project documentation (~10093 tok)
 - `README.pt-BR.md` — 🛡️ DocGuard (~1075 tok)
 - `ROADMAP.md` — DocGuard Roadmap (~2529 tok)
 - `SECURITY.md` — Security Policy (~357 tok)
@@ -962,7 +962,7 @@
 - `auto-merge.yml` — CI: Auto-merge (green bot PRs) (~2234 tok)
 - `ci.yml` — CI: DocGuard CI (~1843 tok)
 - `jules-triage.yml` — CI: Jules PR Triage (~1635 tok)
-- `release.yml` — CI: Auto Release — Tag, GitHub Release, npm, PyPI (~5444 tok)
+- `release.yml` — CI: Auto Release — Tag, GitHub Release, npm, PyPI (~6837 tok)
 - `scheduled-release.yml` — CI: Scheduled Release (~2099 tok)
 - `sync-speckit-catalog.yml` — CI: Prepare Spec Kit Catalog Submission (Manual) (~1385 tok)
 

{docguard_cli-0.34.7 → docguard_cli-0.35.0}/.wolf/buglog.json

@@ -4768,6 +4768,47 @@
       "related_bugs": [],
       "occurrences": 1,
       "last_seen": "2026-09-11T16:08:59.962Z"
+    },
+    {
+      "id": "bug-259",
+      "timestamp": "2026-09-11T16:20:00Z",
+      "error_message": "RESOLVED: npm publish failed for SEVEN consecutive releases (v0.34.1 - v0.34.7). Final error before the fix: 'npm verbose oidc Failed token exchange request with body message: OIDC token exchange error - package not found' on POST /-/npm/v1/oidc/token/exchange/package/docguard-cli.",
+      "file": ".github/workflows/release.yml + npmjs.com trusted publisher config",
+      "root_cause": "THREE independent faults stacked, each masking the next, which is why six fixes each 'changed the error' without fixing it. (1) NPM_TOKEN expired ~2026-08 (bug-256). (2) After migrating to Trusted Publishing, the publish job ran Node 20 -- npm Trusted Publishing requires npm >= 11.5.1 AND Node >= 22.14.0, and below that floor npm never ATTEMPTS the OIDC exchange, silently falling back to token auth. (3) The npm-side trusted publisher was created with the Repository field containing a TRAILING SLASH ('docguard/'), so the stored config was 'raccioly/docguard/' and never matched the OIDC claim 'raccioly/docguard'. Fault 3 was invisible until faults 1 and 2 were cleared, because only then did npm get far enough to actually attempt the exchange and report a specific error.",
+      "fix": "(1) Trusted Publishing replaces the expiring token (bug-257). (2) publish-npm now runs Node 24, with an explicit precondition assert on Node >= 22.14.0, npm >= 11.5.1 and ACTIONS_ID_TOKEN_REQUEST_URL. (3) Added a SECOND trusted publisher on npmjs.com with Repository exactly 'docguard' (no trailing slash) -- deliberately additive rather than deleting the malformed one, so a failed recreate could not leave the package with no publisher at all. Publish succeeded immediately on rerun: docguard-cli@0.34.7 is live and tagged latest; npm, PyPI and the git tag are all in sync at 0.34.7 for the first time since 0.34.0.",
+      "tags": [
+        "npm-publish",
+        "trusted-publishing",
+        "oidc",
+        "node-version-floor",
+        "trailing-slash",
+        "stacked-faults",
+        "resolved"
+      ],
+      "related_bugs": [
+        "bug-256",
+        "bug-257",
+        "bug-258"
+      ],
+      "occurrences": 7,
+      "last_seen": "2026-09-11T16:12:49Z",
+      "notes": "Process lesson, not just a technical one: six releases were burned guessing from a generic 404 when `npm publish --loglevel verbose` named the exact failing endpoint and reason on the FIRST run that had it. When an error is generic and a fix 'changes the error' without fixing it, that is the signal to stop iterating and start instrumenting. Also: display text is not data -- the malformed trailing slash was visible in the UI the whole time but rendered as 'raccioly/docguard/' which looked like a path separator; it was only provable once a correct second entry rendered differently ('raccioly/docguard') right next to it."
+    },
+    {
+      "id": "bug-290",
+      "timestamp": "2026-09-11T16:33:44.539Z",
+      "error_message": "Significant refactor of ",
+      "file": ".github/workflows/release.yml",
+      "root_cause": "6 lines replaced/restructured",
+      "fix": "Rewrote 27→49 lines (6 removed)",
+      "tags": [
+        "auto-detected",
+        "refactor",
+        "yml"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T16:33:44.539Z"
     }
   ]
 }

{docguard_cli-0.34.7 → docguard_cli-0.35.0}/.wolf/cerebrum.md

@@ -12,6 +12,13 @@
 
 ## Key Learnings
 
+- **2026-09-11 — docguard now publishes to BOTH registries with zero stored credentials.** npm and PyPI are both on OIDC Trusted Publishing; `NPM_TOKEN` and `PYPI_API_TOKEN` are deleted and no workflow references any publish credential. Config on record: npm trusted publisher `raccioly` / `docguard` / `release.yml` (no environment); PyPI trusted publisher `raccioly` / `docguard` / `release.yml` / environment `pypi`, with a matching `pypi` GitHub environment (the repo had NO environments before — a workflow `environment:` reference with nothing to bind to is a silent trap). Proven on v0.34.9: npm, PyPI and the git tag all serve 0.34.9.
+- **2026-09-11 — Gate a destructive cleanup on POSITIVE PROOF, not on "the run finished".** Before deleting `PYPI_API_TOKEN` I required BOTH `publish-pypi == success` AND PyPI actually serving the new version. That mattered: an earlier check in the same minute read PyPI as still `0.34.7` (JSON API/CDN lag) while the job had already succeeded. Had I deleted on job status alone I'd have been acting on a reading that was, at that instant, ambiguous. Re-check the end state at deletion time rather than trusting an earlier sample.
+- **2026-09-11 — Pin GitHub Actions by the DEREFERENCED COMMIT sha, not the annotated tag object's sha.** `gh api .../git/ref/tags/vX` returns the *tag object* sha for annotated tags; pinning that does not resolve. Dereference via `.../git/tags/<sha>` to get `.object.sha`. Also: an old `pypa/gh-action-pypi-publish` pin bundles a twine too old for `Metadata-Version: 2.5` (emitted by current setuptools/build) and fails with `InvalidDistribution: '2.5' is not a valid metadata version` — a BUILD-metadata failure that occurs before auth, so it proves nothing about an OIDC migration either way. Don't read "the error moved" as progress. websec-validator still carries that old pin and will hit the same wall when its setuptools advances.
+- **2026-09-11 — When a fix "changes the error" but doesn't fix it, STOP GUESSING AND INSTRUMENT.** The npm publish failure took seven releases because three faults were stacked (expired token → Node below the OIDC floor → malformed trusted-publisher config), each hiding the next, so every partial fix produced a *new* plausible-looking error and made a wrong theory feel confirmed. `npm publish --loglevel verbose` named the exact failing endpoint and reason (`POST /-/npm/v1/oidc/token/exchange/... → "OIDC token exchange error - package not found"`) on the very first run that had it. That single flag was worth more than five diagnostic cycles. Rule: after the SECOND failed fix of the same symptom, stop proposing causes and add logging/asserts that make the failure self-describing. See bug-259.
+- **2026-09-11 — Rendered UI text is not data.** The npm trusted publisher had been stored with a trailing slash in the Repository field (`docguard/`), so it never matched the OIDC claim `raccioly/docguard`. It displayed as `raccioly/docguard/` the whole time, which reads exactly like a path separator — I looked at it twice and dismissed it. It only became provable when a correctly-created second entry rendered *differently* (`raccioly/docguard`) directly beside it. When a value's correctness matters and the UI won't show you the raw field, create a known-good control and compare renderings rather than reasoning about the formatting.
+- **2026-09-11 — Prefer additive over destructive when repairing third-party config.** npm fixes trusted-publisher fields at creation ("to change them, delete and recreate"). Rather than deleting the suspect entry, I added a second one with verified values — so a failed recreate (the form had already been blocked once by a browser extension) couldn't leave the package with no publisher at all. It worked, which also *proved* the old entry was the broken one. Delete the stale entry only after the replacement is confirmed working.
+- **2026-09-11 — Never locate a YAML block by first-match on a structural pattern that repeats across jobs.** A scripted edit meant for `publish-npm` matched `build-mcpb` first (both start `checkout → setup-node → node-version: 20`), clobbering that job's body and deleting `publish-npm` entirely — the workflow then failed at parse time with zero jobs. Use targeted anchored edits, and after any workflow edit assert the full job list and each job's step names before pushing.
 - **2026-09-11 — `npm install -g npm@latest` in a CI step is never safe to assume works — npm's own majors bump their engines floor too.** v0.34.3's Trusted Publishing fix used `npm@latest`, which resolved to npm 12.0.2 (`engines: node ^22.22.2 || ^24.15.0 || >=26.0.0`) — incompatible with the Node 20 the publish-npm job runs on. Exact same class of mistake as bug-255 (@babel/parser major bump), one layer up the toolchain, caught by the pipeline itself on the very next real run. Fix: pin to a checked-compatible range (`npm@11`, whose engines field is `^20.17.0 || >=22.9.0`) and verify by actually installing it in an isolated prefix, not by reasoning about what "should" be compatible. See bug-258.
 - **2026-09-11 — Fixed bug-256 permanently: migrated publish-npm to Trusted Publishing (OIDC), retiring NODE_AUTH_TOKEN entirely.** See bug-257. Two non-obvious things worth remembering: (1) npm Trusted Publishing needs npm CLI >=11.5.0 — Node 20's bundled npm is older, so the workflow now self-updates (`npm install -g npm@latest`) before publishing; forgetting this would trade one failure mode for another. (2) A GitHub Actions "rerun failed jobs" reruns using the workflow file AS IT EXISTED AT THAT RUN'S COMMIT, not the current default-branch version — editing release.yml and then rerunning an old failed run would NOT pick up the fix. Had to cut an actual new release (v0.34.3, no code changes) to get a fresh run that exercises the updated workflow. Confirm any workflow-file fix via a genuinely new run, never a rerun of a run that predates the fix.
 - **2026-09-11 — Claude in Chrome can get blocked by an unrelated browser extension's overlay.** Mid-way through filling an npm settings form (Trusted Publisher setup), clicks and even a plain screenshot started failing with "Cannot access a chrome-extension:// URL of different extension" — almost certainly another extension (password manager autofill is the likely suspect) injected a frame that captured input on the tab. Claude in Chrome can't reach into another extension's frame to dismiss it; the fix was asking the user to click/Escape on their end to clear it, then resuming automation. Also: user's real Chrome profile carries their own extensions, unlike the in-app Browser pane — expect this class of interference there and not in the sandboxed pane.

{docguard_cli-0.34.7 → docguard_cli-0.35.0}/.wolf/hooks/_session.json

@@ -18,8 +18,8 @@
       "first_read": "2026-09-11T14:49:34.552Z"
     },
     "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/workflows/release.yml": {
-      "count": 7,
-      "tokens": 4763,
+      "count": 10,
+      "tokens": 6014,
       "first_read": "2026-09-11T15:15:37.248Z"
     },
     "/private/tmp/claude-501/-Users-ricardoaccioly-Repo-claude-canonical-spec-kit/25ac0636-5765-49fe-a808-dd97dc825b30/tasks/bcylzwtls.output": {
@@ -41,6 +41,31 @@
       "count": 1,
       "tokens": 0,
       "first_read": "2026-09-11T16:01:53.189Z"
+    },
+    "/private/tmp/claude-501/-Users-ricardoaccioly-Repo-claude-canonical-spec-kit/25ac0636-5765-49fe-a808-dd97dc825b30/tasks/bl3wuxq6y.output": {
+      "count": 1,
+      "tokens": 0,
+      "first_read": "2026-09-11T16:13:05.923Z"
+    },
+    "/private/tmp/claude-501/-Users-ricardoaccioly-Repo-claude-canonical-spec-kit/25ac0636-5765-49fe-a808-dd97dc825b30/tasks/bxfoxiweq.output": {
+      "count": 1,
+      "tokens": 0,
+      "first_read": "2026-09-11T16:39:11.726Z"
+    },
+    "/private/tmp/claude-501/-Users-ricardoaccioly-Repo-claude-canonical-spec-kit/25ac0636-5765-49fe-a808-dd97dc825b30/tasks/bflc3gu0x.output": {
+      "count": 2,
+      "tokens": 0,
+      "first_read": "2026-09-11T16:42:40.087Z"
+    },
+    "/private/tmp/claude-501/-Users-ricardoaccioly-Repo-claude-canonical-spec-kit/25ac0636-5765-49fe-a808-dd97dc825b30/tasks/b2dhgtypc.output": {
+      "count": 1,
+      "tokens": 0,
+      "first_read": "2026-09-11T16:44:06.922Z"
+    },
+    "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/README.md": {
+      "count": 1,
+      "tokens": 9554,
+      "first_read": "2026-09-11T18:56:48.652Z"
     }
   },
   "files_written": [
@@ -223,22 +248,47 @@
       "action": "edit",
       "tokens": 526,
       "at": "2026-09-11T16:09:12.899Z"
+    },
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/workflows/release.yml",
+      "action": "edit",
+      "tokens": 616,
+      "at": "2026-09-11T16:33:44.536Z"
+    },
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/workflows/release.yml",
+      "action": "edit",
+      "tokens": 212,
+      "at": "2026-09-11T16:39:55.629Z"
+    },
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/workflows/release.yml",
+      "action": "edit",
+      "tokens": 845,
+      "at": "2026-09-11T18:56:06.356Z"
+    },
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/README.md",
+      "action": "edit",
+      "tokens": 263,
+      "at": "2026-09-11T18:56:56.174Z"
     }
   ],
   "edit_counts": {
     ".github/dependabot.yml": 1,
     "CHANGELOG.md": 9,
     "package.json": 3,
-    ".github/workflows/release.yml": 9,
+    ".github/workflows/release.yml": 12,
     ".github/workflows/ci.yml": 1,
     ".github/workflows/auto-merge.yml": 3,
     ".github/workflows/scheduled-release.yml": 2,
     ".github/workflows/jules-triage.yml": 1,
-    "tests/commands.test.mjs": 1
+    "tests/commands.test.mjs": 1,
+    "README.md": 1
   },
-  "anatomy_hits": 2,
-  "anatomy_misses": 6,
-  "repeated_reads_warned": 8,
+  "anatomy_hits": 3,
+  "anatomy_misses": 10,
+  "repeated_reads_warned": 12,
   "cerebrum_warnings": 0,
-  "stop_count": 19
+  "stop_count": 32
 }

{docguard_cli-0.34.7 → docguard_cli-0.35.0}/.wolf/memory.md

@@ -1316,3 +1316,20 @@
 | 12:02 | Session end: 28 writes across 9 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 8 reads | ~69392 tok |
 | 12:08 | Edited .github/workflows/release.yml | expanded (+12 lines) | ~375 |
 | 12:09 | Edited .github/workflows/release.yml | expanded (+25 lines) | ~526 |
+| 12:11 | Session end: 30 writes across 9 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 8 reads | ~70092 tok |
+| 12:16 | Session end: 30 writes across 9 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 9 reads | ~70092 tok |
+| 12:19 | Session end: 30 writes across 9 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 9 reads | ~70092 tok |
+| 12:31 | Session end: 30 writes across 9 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 9 reads | ~70092 tok |
+| 12:32 | Session end: 30 writes across 9 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 9 reads | ~70092 tok |
+| 12:33 | Edited .github/workflows/release.yml | expanded (+22 lines) | ~616 |
+| 12:34 | Session end: 31 writes across 9 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 9 reads | ~71389 tok |
+| 12:37 | Session end: 31 writes across 9 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 9 reads | ~71389 tok |
+| 12:39 | Edited .github/workflows/release.yml | expanded (+10 lines) | ~212 |
+| 12:42 | Session end: 32 writes across 9 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 10 reads | ~71601 tok |
+| 12:42 | Session end: 32 writes across 9 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 11 reads | ~71601 tok |
+| 12:45 | Session end: 32 writes across 9 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 12 reads | ~71601 tok |
+| 12:46 | Session end: 32 writes across 9 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 12 reads | ~71601 tok |
+| 12:50 | Session end: 32 writes across 9 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 12 reads | ~71601 tok |
+| 14:36 | Session end: 32 writes across 9 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 12 reads | ~71601 tok |
+| 14:56 | Edited .github/workflows/release.yml | expanded (+53 lines) | ~845 |
+| 14:56 | Edited README.md | expanded (+19 lines) | ~245 |