docguard-cli 0.34.9__tar.gz → 0.35.0__tar.gz

{docguard_cli-0.34.9/extensions/spec-kit-docguard → docguard_cli-0.35.0/.agent}/skills/docguard-fix/SKILL.md

@@ -6,10 +6,10 @@ description: AI-driven documentation repair with structured research workflow, t
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.9
+  version: 0.35.0
   source: extensions/spec-kit-docguard/skills/docguard-fix
 ---
-<!-- docguard:version: 0.34.9 -->
+<!-- docguard:version: 0.35.0 -->
 
 # DocGuard Fix Skill
 

{docguard_cli-0.34.9 → docguard_cli-0.35.0}/.agent/skills/docguard-guard/SKILL.md

@@ -7,10 +7,10 @@ description: Run DocGuard guard validation against Canonical-Driven Development
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.9
+  version: 0.35.0
   source: extensions/spec-kit-docguard/skills/docguard-guard
 ---
-<!-- docguard:version: 0.34.9 -->
+<!-- docguard:version: 0.35.0 -->
 
 # DocGuard Guard Skill
 

{docguard_cli-0.34.9/extensions/spec-kit-docguard → docguard_cli-0.35.0/.agent}/skills/docguard-review/SKILL.md

@@ -6,10 +6,10 @@ description: Cross-document consistency analysis and quality assessment. Perform
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.9
+  version: 0.35.0
   source: extensions/spec-kit-docguard/skills/docguard-review
 ---
-<!-- docguard:version: 0.34.9 -->
+<!-- docguard:version: 0.35.0 -->
 
 # DocGuard Review Skill
 

{docguard_cli-0.34.9/extensions/spec-kit-docguard → docguard_cli-0.35.0/.agent}/skills/docguard-score/SKILL.md

@@ -6,10 +6,10 @@ description: CDD maturity assessment with category-aware improvement roadmap. Ru
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.9
+  version: 0.35.0
   source: extensions/spec-kit-docguard/skills/docguard-score
 ---
-<!-- docguard:version: 0.34.9 -->
+<!-- docguard:version: 0.35.0 -->
 
 # DocGuard Score Skill
 

{docguard_cli-0.34.9 → docguard_cli-0.35.0}/.agent/skills/docguard-sync/SKILL.md

@@ -4,10 +4,10 @@ description: Keep canonical documentation ALWAYS UP TO DATE. Refreshes code-trut
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.9
+  version: 0.35.0
   source: extensions/spec-kit-docguard/skills/docguard-sync
 ---
-<!-- docguard:version: 0.34.9 -->
+<!-- docguard:version: 0.35.0 -->
 
 # DocGuard Sync Skill
 

{docguard_cli-0.34.9 → docguard_cli-0.35.0}/.github/workflows/release.yml

@@ -154,6 +154,59 @@ jobs:
             "spec-kit-docguard-v${VERSION}.zip" \
             --clobber
 
+  # ── Step 4c: Publish the MCP server image to GHCR ──────────────────────
+  # The Dockerfile already existed but was only ever built FROM SOURCE by MCP
+  # directory inspectors (Glama et al.) on every check, and was undocumented.
+  # Publishing it means they (and CI users) can pull a prebuilt image instead.
+  #
+  # GHCR, not GitHub's npm registry: public GHCR images pull with NO auth,
+  # whereas npm.pkg.github.com requires a PAT even for public packages — which
+  # would make it strictly worse than npmjs.com and purely cosmetic.
+  #
+  # NOTHING depends on this job, so a failure here cannot block npm, PyPI, the
+  # GitHub Release, or the catalog reminder — they all run in parallel. It is
+  # deliberately NOT `continue-on-error`, because that reports a failed job as
+  # successful and would hide a broken image behind a green run.
+  #
+  # Uses the docker CLI (preinstalled on the runner) rather than third-party
+  # actions: two separate action-pin problems bit this pipeline today
+  # (@babel/parser major, and a pypa action too old for metadata 2.5), and this
+  # needs no action versions at all. Auth is GITHUB_TOKEN — nothing to expire.
+  publish-ghcr:
+    needs: [detect-version, test, create-release]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Log in to GHCR
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
+
+      - name: Build and push image
+        run: |
+          VERSION="${{ needs.detect-version.outputs.version }}"
+          # GHCR requires a lowercase path; github.repository is already
+          # lowercase here but normalise anyway so a future rename can't break it.
+          IMAGE="ghcr.io/$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')"
+          echo "Building $IMAGE:$VERSION"
+          docker build -t "$IMAGE:$VERSION" -t "$IMAGE:latest" .
+
+          # Prove the image actually starts before publishing it. The entrypoint
+          # is an stdio MCP server, so it blocks waiting on stdin — feed it a
+          # JSON-RPC initialize and require a response rather than just checking
+          # the container didn't exit.
+          echo "Smoke-testing the image..."
+          REQ='{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"ci","version":"0"}}}'
+          OUT="$(echo "$REQ" | timeout 60 docker run -i --rm "$IMAGE:$VERSION" 2>/dev/null | head -1 || true)"
+          echo "response: ${OUT:0:200}"
+          echo "$OUT" | grep -q '"jsonrpc"' || { echo "::error::Image did not answer an MCP initialize over stdio — not publishing."; exit 1; }
+
+          docker push "$IMAGE:$VERSION"
+          docker push "$IMAGE:latest"
+          echo "Published $IMAGE:$VERSION and :latest"
+
   # ── Step 4b: Build and attach Claude Desktop extension (.mcpb) ─────────
   # One-click local install for Claude Desktop (Settings → Extensions).
   # Stages the exact npm-pack payload + the one production dep, stamps the

{docguard_cli-0.34.9 → docguard_cli-0.35.0}/.wolf/anatomy.md

@@ -1,6 +1,6 @@
 # anatomy.md
 
-> Auto-maintained by OpenWolf. Last scanned: 2026-09-11T16:39:55.617Z
+> Auto-maintained by OpenWolf. Last scanned: 2026-09-11T18:56:56.165Z
 > Files: 707 tracked | Anatomy hits: 0 | Misses: 0
 
 ## ../../../../../../../tmp/
@@ -46,7 +46,7 @@
 - `pr_description.md` (~260 tok)
 - `pyproject.toml` — The enforcement tool for Canonical-Driven Development (CDD). Audit, generate, and guard your project (~358 tok)
 - `README.es.md` — 🛡️ DocGuard (~1098 tok)
-- `README.md` — Project documentation (~9554 tok)
+- `README.md` — Project documentation (~10093 tok)
 - `README.pt-BR.md` — 🛡️ DocGuard (~1075 tok)
 - `ROADMAP.md` — DocGuard Roadmap (~2529 tok)
 - `SECURITY.md` — Security Policy (~357 tok)
@@ -962,7 +962,7 @@
 - `auto-merge.yml` — CI: Auto-merge (green bot PRs) (~2234 tok)
 - `ci.yml` — CI: DocGuard CI (~1843 tok)
 - `jules-triage.yml` — CI: Jules PR Triage (~1635 tok)
-- `release.yml` — CI: Auto Release — Tag, GitHub Release, npm, PyPI (~6014 tok)
+- `release.yml` — CI: Auto Release — Tag, GitHub Release, npm, PyPI (~6837 tok)
 - `scheduled-release.yml` — CI: Scheduled Release (~2099 tok)
 - `sync-speckit-catalog.yml` — CI: Prepare Spec Kit Catalog Submission (Manual) (~1385 tok)
 

{docguard_cli-0.34.9 → docguard_cli-0.35.0}/.wolf/cerebrum.md

@@ -12,6 +12,9 @@
 
 ## Key Learnings
 
+- **2026-09-11 — docguard now publishes to BOTH registries with zero stored credentials.** npm and PyPI are both on OIDC Trusted Publishing; `NPM_TOKEN` and `PYPI_API_TOKEN` are deleted and no workflow references any publish credential. Config on record: npm trusted publisher `raccioly` / `docguard` / `release.yml` (no environment); PyPI trusted publisher `raccioly` / `docguard` / `release.yml` / environment `pypi`, with a matching `pypi` GitHub environment (the repo had NO environments before — a workflow `environment:` reference with nothing to bind to is a silent trap). Proven on v0.34.9: npm, PyPI and the git tag all serve 0.34.9.
+- **2026-09-11 — Gate a destructive cleanup on POSITIVE PROOF, not on "the run finished".** Before deleting `PYPI_API_TOKEN` I required BOTH `publish-pypi == success` AND PyPI actually serving the new version. That mattered: an earlier check in the same minute read PyPI as still `0.34.7` (JSON API/CDN lag) while the job had already succeeded. Had I deleted on job status alone I'd have been acting on a reading that was, at that instant, ambiguous. Re-check the end state at deletion time rather than trusting an earlier sample.
+- **2026-09-11 — Pin GitHub Actions by the DEREFERENCED COMMIT sha, not the annotated tag object's sha.** `gh api .../git/ref/tags/vX` returns the *tag object* sha for annotated tags; pinning that does not resolve. Dereference via `.../git/tags/<sha>` to get `.object.sha`. Also: an old `pypa/gh-action-pypi-publish` pin bundles a twine too old for `Metadata-Version: 2.5` (emitted by current setuptools/build) and fails with `InvalidDistribution: '2.5' is not a valid metadata version` — a BUILD-metadata failure that occurs before auth, so it proves nothing about an OIDC migration either way. Don't read "the error moved" as progress. websec-validator still carries that old pin and will hit the same wall when its setuptools advances.
 - **2026-09-11 — When a fix "changes the error" but doesn't fix it, STOP GUESSING AND INSTRUMENT.** The npm publish failure took seven releases because three faults were stacked (expired token → Node below the OIDC floor → malformed trusted-publisher config), each hiding the next, so every partial fix produced a *new* plausible-looking error and made a wrong theory feel confirmed. `npm publish --loglevel verbose` named the exact failing endpoint and reason (`POST /-/npm/v1/oidc/token/exchange/... → "OIDC token exchange error - package not found"`) on the very first run that had it. That single flag was worth more than five diagnostic cycles. Rule: after the SECOND failed fix of the same symptom, stop proposing causes and add logging/asserts that make the failure self-describing. See bug-259.
 - **2026-09-11 — Rendered UI text is not data.** The npm trusted publisher had been stored with a trailing slash in the Repository field (`docguard/`), so it never matched the OIDC claim `raccioly/docguard`. It displayed as `raccioly/docguard/` the whole time, which reads exactly like a path separator — I looked at it twice and dismissed it. It only became provable when a correctly-created second entry rendered *differently* (`raccioly/docguard`) directly beside it. When a value's correctness matters and the UI won't show you the raw field, create a known-good control and compare renderings rather than reasoning about the formatting.
 - **2026-09-11 — Prefer additive over destructive when repairing third-party config.** npm fixes trusted-publisher fields at creation ("to change them, delete and recreate"). Rather than deleting the suspect entry, I added a second one with verified values — so a failed recreate (the form had already been blocked once by a browser extension) couldn't leave the package with no publisher at all. It worked, which also *proved* the old entry was the broken one. Delete the stale entry only after the replacement is confirmed working.

{docguard_cli-0.34.9 → docguard_cli-0.35.0}/.wolf/hooks/_session.json

@@ -18,8 +18,8 @@
       "first_read": "2026-09-11T14:49:34.552Z"
     },
     "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/workflows/release.yml": {
-      "count": 9,
-      "tokens": 5444,
+      "count": 10,
+      "tokens": 6014,
       "first_read": "2026-09-11T15:15:37.248Z"
     },
     "/private/tmp/claude-501/-Users-ricardoaccioly-Repo-claude-canonical-spec-kit/25ac0636-5765-49fe-a808-dd97dc825b30/tasks/bcylzwtls.output": {
@@ -51,6 +51,21 @@
       "count": 1,
       "tokens": 0,
       "first_read": "2026-09-11T16:39:11.726Z"
+    },
+    "/private/tmp/claude-501/-Users-ricardoaccioly-Repo-claude-canonical-spec-kit/25ac0636-5765-49fe-a808-dd97dc825b30/tasks/bflc3gu0x.output": {
+      "count": 2,
+      "tokens": 0,
+      "first_read": "2026-09-11T16:42:40.087Z"
+    },
+    "/private/tmp/claude-501/-Users-ricardoaccioly-Repo-claude-canonical-spec-kit/25ac0636-5765-49fe-a808-dd97dc825b30/tasks/b2dhgtypc.output": {
+      "count": 1,
+      "tokens": 0,
+      "first_read": "2026-09-11T16:44:06.922Z"
+    },
+    "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/README.md": {
+      "count": 1,
+      "tokens": 9554,
+      "first_read": "2026-09-11T18:56:48.652Z"
     }
   },
   "files_written": [
@@ -245,22 +260,35 @@
       "action": "edit",
       "tokens": 212,
       "at": "2026-09-11T16:39:55.629Z"
+    },
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/.github/workflows/release.yml",
+      "action": "edit",
+      "tokens": 845,
+      "at": "2026-09-11T18:56:06.356Z"
+    },
+    {
+      "file": "/Users/ricardoaccioly/Repo_claude/canonical-spec-kit/README.md",
+      "action": "edit",
+      "tokens": 263,
+      "at": "2026-09-11T18:56:56.174Z"
     }
   ],
   "edit_counts": {
     ".github/dependabot.yml": 1,
     "CHANGELOG.md": 9,
     "package.json": 3,
-    ".github/workflows/release.yml": 11,
+    ".github/workflows/release.yml": 12,
     ".github/workflows/ci.yml": 1,
     ".github/workflows/auto-merge.yml": 3,
     ".github/workflows/scheduled-release.yml": 2,
     ".github/workflows/jules-triage.yml": 1,
-    "tests/commands.test.mjs": 1
+    "tests/commands.test.mjs": 1,
+    "README.md": 1
   },
-  "anatomy_hits": 2,
-  "anatomy_misses": 8,
-  "repeated_reads_warned": 10,
+  "anatomy_hits": 3,
+  "anatomy_misses": 10,
+  "repeated_reads_warned": 12,
   "cerebrum_warnings": 0,
-  "stop_count": 26
+  "stop_count": 32
 }

{docguard_cli-0.34.9 → docguard_cli-0.35.0}/.wolf/memory.md

@@ -1325,3 +1325,11 @@
 | 12:34 | Session end: 31 writes across 9 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 9 reads | ~71389 tok |
 | 12:37 | Session end: 31 writes across 9 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 9 reads | ~71389 tok |
 | 12:39 | Edited .github/workflows/release.yml | expanded (+10 lines) | ~212 |
+| 12:42 | Session end: 32 writes across 9 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 10 reads | ~71601 tok |
+| 12:42 | Session end: 32 writes across 9 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 11 reads | ~71601 tok |
+| 12:45 | Session end: 32 writes across 9 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 12 reads | ~71601 tok |
+| 12:46 | Session end: 32 writes across 9 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 12 reads | ~71601 tok |
+| 12:50 | Session end: 32 writes across 9 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 12 reads | ~71601 tok |
+| 14:36 | Session end: 32 writes across 9 files (dependabot.yml, CHANGELOG.md, package.json, release.yml, ci.yml) | 12 reads | ~71601 tok |
+| 14:56 | Edited .github/workflows/release.yml | expanded (+53 lines) | ~845 |
+| 14:56 | Edited README.md | expanded (+19 lines) | ~245 |