docguard-cli 0.34.9__tar.gz → 0.36.0__tar.gz

{docguard_cli-0.34.9/extensions/spec-kit-docguard → docguard_cli-0.36.0/.agent}/skills/docguard-fix/SKILL.md

@@ -6,10 +6,10 @@ description: AI-driven documentation repair with structured research workflow, t
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.9
+  version: 0.35.0
   source: extensions/spec-kit-docguard/skills/docguard-fix
 ---
-<!-- docguard:version: 0.34.9 -->
+<!-- docguard:version: 0.35.0 -->
 
 # DocGuard Fix Skill
 

{docguard_cli-0.34.9 → docguard_cli-0.36.0}/.agent/skills/docguard-guard/SKILL.md

@@ -7,10 +7,10 @@ description: Run DocGuard guard validation against Canonical-Driven Development
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.9
+  version: 0.35.0
   source: extensions/spec-kit-docguard/skills/docguard-guard
 ---
-<!-- docguard:version: 0.34.9 -->
+<!-- docguard:version: 0.35.0 -->
 
 # DocGuard Guard Skill
 

{docguard_cli-0.34.9/extensions/spec-kit-docguard → docguard_cli-0.36.0/.agent}/skills/docguard-review/SKILL.md

@@ -6,10 +6,10 @@ description: Cross-document consistency analysis and quality assessment. Perform
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.9
+  version: 0.35.0
   source: extensions/spec-kit-docguard/skills/docguard-review
 ---
-<!-- docguard:version: 0.34.9 -->
+<!-- docguard:version: 0.35.0 -->
 
 # DocGuard Review Skill
 

{docguard_cli-0.34.9/extensions/spec-kit-docguard → docguard_cli-0.36.0/.agent}/skills/docguard-score/SKILL.md

@@ -6,10 +6,10 @@ description: CDD maturity assessment with category-aware improvement roadmap. Ru
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.9
+  version: 0.35.0
   source: extensions/spec-kit-docguard/skills/docguard-score
 ---
-<!-- docguard:version: 0.34.9 -->
+<!-- docguard:version: 0.35.0 -->
 
 # DocGuard Score Skill
 

{docguard_cli-0.34.9 → docguard_cli-0.36.0}/.agent/skills/docguard-sync/SKILL.md

@@ -4,10 +4,10 @@ description: Keep canonical documentation ALWAYS UP TO DATE. Refreshes code-trut
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.34.9
+  version: 0.35.0
   source: extensions/spec-kit-docguard/skills/docguard-sync
 ---
-<!-- docguard:version: 0.34.9 -->
+<!-- docguard:version: 0.35.0 -->
 
 # DocGuard Sync Skill
 

{docguard_cli-0.34.9 → docguard_cli-0.36.0}/.docguardignore

@@ -38,3 +38,9 @@ templates/demo-fixture/**
 packaging/
 packaging/**
 
+
+# Generated audit reports and probe templates are historical tool output, not product source.
+websec-out/
+websec-out/**
+graphify-out/
+graphify-out/**

docguard_cli-0.36.0/.github/ISSUE_TEMPLATE/docguard-feedback.md

@@ -0,0 +1,28 @@
+---
+name: DocGuard feedback (false positive / detection gap)
+about: Contribute a synthetic reproduction of a disputed finding or missed defect.
+title: "[feedback] <CODE>: <short description>"
+labels: docguard-feedback
+---
+
+- **DocGuard version:**
+- **Runtime / operating system:**
+- **Finding code / detector:**
+- **Type:** false positive / missed defect / unsupported syntax / policy question
+- **Existing open and closed issues/PRs checked:**
+
+**Expected behavior**
+
+**Actual behavior and exact command**
+
+**Minimal synthetic reproduction**
+
+Provide invented source and minimal configuration. Review all content before sharing. Full local feedback records can contain private paths and diagnostic text; do not attach them by default.
+
+**Neighboring valid or invalid case**
+
+What closely related example should still pass or fail after a fix?
+
+**Contribution**
+
+A report or a test-only contribution is welcome. See CONTRIBUTING.md, "Turn a finding into a regression test". No credentials or private source are required.

{docguard_cli-0.34.9 → docguard_cli-0.36.0}/.github/scripts/speckit-submission.py

@@ -61,7 +61,7 @@ def build(version: str, download_url: str):
             "name": "DocGuard — CDD Enforcement",
             "id": "docguard",
             "description": (
-                "The only doc-integrity engine with an MCP server, "
+                "A documentation-integrity engine with an MCP server, "
                 "SARIF/JUnit output, and a deterministic zero-LLM core. "
                 "Validates, scores, and traces documentation against code — "
                 "27 validators, stable finding codes, adoption baseline for "
@@ -125,7 +125,7 @@ def build(version: str, download_url: str):
         ("tags", "Tags",
          "documentation, validation, quality, cdd, traceability, ai-agents, enforcement, spec-kit"),
         ("features", "Key Features",
-         "- 19-validator quality gate with severity triage and a remediation plan\n"
+         "- Configurable quality gate with severity triage and a remediation plan\n"
          "- AI-driven documentation repair with codebase research and validation loops\n"
          "- Cross-document semantic consistency analysis (read-only review)\n"
          "- CDD maturity score with an ROI-based improvement roadmap\n"
@@ -134,10 +134,10 @@ def build(version: str, download_url: str):
         ("testing", "Testing Checklist", None),
         ("requirements", "Submission Requirements", None),
         ("testing-details", "Testing Details",
-         "**Tested on:** Linux + macOS with the spec-kit CLI.\n\n"
+         "**Release verification:** Record the platforms and results actually tested before submission.\n\n"
          "**Install:**\n```bash\n"
          f"specify extension add docguard --from {download_url}\n```\n\n"
-         "**Scenarios verified:**\n"
+         "**Scenarios to verify for this release:**\n"
          "1. Extension installs from the release ZIP without manifest validation errors.\n"
          "2. All six `speckit.docguard.*` commands resolve and run.\n"
          "3. The three workflow hooks register against spec-kit's lifecycle."),
@@ -179,7 +179,7 @@ def render_body(fields, checkbox_items) -> str:
     blocks = []
     for fid, label, value in fields:
         if value is None:  # checkbox group
-            ticked = "\n".join(f"- [x] {item}" for item in checkbox_items[fid])
+            ticked = "\n".join(f"- [ ] {item}" for item in checkbox_items[fid])
             blocks.append(f"### {label}\n\n{ticked}")
         else:
             blocks.append(f"### {label}\n\n{value}")

{docguard_cli-0.34.9 → docguard_cli-0.36.0}/.github/workflows/ci.yml

@@ -7,6 +7,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -20,11 +23,16 @@ jobs:
         node-version: [18, 20, 22, 24]
 
     steps:
-      - uses: actions/checkout@v7
+      - name: Initialize report paths
+        shell: bash
+        run: |
+          echo "DOCGUARD_REPORT=$RUNNER_TEMP/docguard-report.json" >> "$GITHUB_ENV"
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0 # Full git history for freshness validator
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node-version }}
 
@@ -53,15 +61,16 @@ jobs:
       # on this gate existing. Normal: ~33s (node 24) to ~51s (node 18) on CI.
       # Budget is deliberately loose — it catches catastrophes, not jitter.
       - name: Run Tests (with runtime budget)
+        shell: bash
         env:
           TEST_BUDGET_MS: 120000
         run: |
           set -o pipefail
-          npm test 2>&1 | tee /tmp/test-output.txt
-          DURATION=$(grep -oE 'duration_ms [0-9]+' /tmp/test-output.txt | tail -1 | grep -oE '[0-9]+' | cut -d. -f1)
+          node --test --test-reporter=tap tests/*.test.mjs 2>&1 | tee /tmp/test-output.txt
+          DURATION=$(awk '/^# duration_ms [0-9]+/ { duration = int($3) } END { print duration }' /tmp/test-output.txt)
           if [ -z "$DURATION" ]; then
-            echo "::warning::Could not parse test duration — skipping budget check"
-            exit 0
+            echo "::error::Missing TAP suite duration — runtime budget could not be verified"
+            exit 1
           fi
           echo "Test suite duration: ${DURATION}ms (budget: ${TEST_BUDGET_MS}ms)"
           if [ "$DURATION" -gt "$TEST_BUDGET_MS" ]; then
@@ -75,9 +84,21 @@ jobs:
         run: node cli/docguard.mjs --version
 
       - name: Guard (self-check)
+        shell: bash
         run: |
           # Exit 0 = pass, Exit 1 = errors (fail CI), Exit 2 = warnings only (allow)
-          node cli/docguard.mjs guard || [ $? -eq 2 ]
+          status=0
+          node cli/docguard.mjs guard --format json > "$DOCGUARD_REPORT" || status=$?
+          cat "$DOCGUARD_REPORT"
+          [ "$status" -eq 0 ] || [ "$status" -eq 2 ]
+
+      - name: Upload guard findings
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: docguard-report-node-${{ matrix.node-version }}
+          path: ${{ env.DOCGUARD_REPORT }}
+          if-no-files-found: warn
 
       - name: Score
         run: node cli/docguard.mjs score
@@ -113,13 +134,20 @@ jobs:
           python3 -c "import xml.etree.ElementTree as ET; r=ET.parse('/tmp/guard-junit.xml').getroot(); print('junit OK:', r.attrib)"
 
       - name: Baseline roundtrip (freeze → pass → restore)
+        shell: bash
         run: |
           mkdir -p /tmp/docguard-baseline && cd /tmp/docguard-baseline
           printf '{"projectName":"bl-ci","profile":"standard"}' > .docguard.json
           mkdir -p docs-canonical && echo "# Architecture" > docs-canonical/ARCHITECTURE.md
-          node $GITHUB_WORKSPACE/cli/docguard.mjs guard --update-baseline
-          node $GITHUB_WORKSPACE/cli/docguard.mjs guard   # must exit 0 now
-          node $GITHUB_WORKSPACE/cli/docguard.mjs guard --no-baseline || [ $? -ne 0 ]
+          node "$GITHUB_WORKSPACE/cli/docguard.mjs" guard --update-baseline
+          node "$GITHUB_WORKSPACE/cli/docguard.mjs" guard   # must exit 0 now
+          status=0
+          node "$GITHUB_WORKSPACE/cli/docguard.mjs" guard --no-baseline || status=$?
+          # This incomplete standard-profile fixture has errors, not just warnings.
+          if [ "$status" -ne 1 ]; then
+            echo "::error::Expected guard --no-baseline to exit 1, got $status"
+            exit 1
+          fi
 
       # ── Cross-project tests ──
       - name: Init in temp dir
@@ -151,8 +179,8 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/v')
     needs: test
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 20
           registry-url: 'https://registry.npmjs.org'

{docguard_cli-0.34.9 → docguard_cli-0.36.0}/.github/workflows/release.yml

@@ -154,6 +154,59 @@ jobs:
             "spec-kit-docguard-v${VERSION}.zip" \
             --clobber
 
+  # ── Step 4c: Publish the MCP server image to GHCR ──────────────────────
+  # The Dockerfile already existed but was only ever built FROM SOURCE by MCP
+  # directory inspectors (Glama et al.) on every check, and was undocumented.
+  # Publishing it means they (and CI users) can pull a prebuilt image instead.
+  #
+  # GHCR, not GitHub's npm registry: public GHCR images pull with NO auth,
+  # whereas npm.pkg.github.com requires a PAT even for public packages — which
+  # would make it strictly worse than npmjs.com and purely cosmetic.
+  #
+  # NOTHING depends on this job, so a failure here cannot block npm, PyPI, the
+  # GitHub Release, or the catalog reminder — they all run in parallel. It is
+  # deliberately NOT `continue-on-error`, because that reports a failed job as
+  # successful and would hide a broken image behind a green run.
+  #
+  # Uses the docker CLI (preinstalled on the runner) rather than third-party
+  # actions: two separate action-pin problems bit this pipeline today
+  # (@babel/parser major, and a pypa action too old for metadata 2.5), and this
+  # needs no action versions at all. Auth is GITHUB_TOKEN — nothing to expire.
+  publish-ghcr:
+    needs: [detect-version, test, create-release]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Log in to GHCR
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
+
+      - name: Build and push image
+        run: |
+          VERSION="${{ needs.detect-version.outputs.version }}"
+          # GHCR requires a lowercase path; github.repository is already
+          # lowercase here but normalise anyway so a future rename can't break it.
+          IMAGE="ghcr.io/$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')"
+          echo "Building $IMAGE:$VERSION"
+          docker build -t "$IMAGE:$VERSION" -t "$IMAGE:latest" .
+
+          # Prove the image actually starts before publishing it. The entrypoint
+          # is an stdio MCP server, so it blocks waiting on stdin — feed it a
+          # JSON-RPC initialize and require a response rather than just checking
+          # the container didn't exit.
+          echo "Smoke-testing the image..."
+          REQ='{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"ci","version":"0"}}}'
+          OUT="$(echo "$REQ" | timeout 60 docker run -i --rm "$IMAGE:$VERSION" 2>/dev/null | head -1 || true)"
+          echo "response: ${OUT:0:200}"
+          echo "$OUT" | grep -q '"jsonrpc"' || { echo "::error::Image did not answer an MCP initialize over stdio — not publishing."; exit 1; }
+
+          docker push "$IMAGE:$VERSION"
+          docker push "$IMAGE:latest"
+          echo "Published $IMAGE:$VERSION and :latest"
+
   # ── Step 4b: Build and attach Claude Desktop extension (.mcpb) ─────────
   # One-click local install for Claude Desktop (Settings → Extensions).
   # Stages the exact npm-pack payload + the one production dep, stamps the

{docguard_cli-0.34.9 → docguard_cli-0.36.0}/.wolf/anatomy.md

@@ -1,6 +1,6 @@
 # anatomy.md
 
-> Auto-maintained by OpenWolf. Last scanned: 2026-09-11T16:39:55.617Z
+> Auto-maintained by OpenWolf. Last scanned: 2026-09-11T18:56:56.165Z
 > Files: 707 tracked | Anatomy hits: 0 | Misses: 0
 
 ## ../../../../../../../tmp/
@@ -46,7 +46,7 @@
 - `pr_description.md` (~260 tok)
 - `pyproject.toml` — The enforcement tool for Canonical-Driven Development (CDD). Audit, generate, and guard your project (~358 tok)
 - `README.es.md` — 🛡️ DocGuard (~1098 tok)
-- `README.md` — Project documentation (~9554 tok)
+- `README.md` — Project documentation (~10093 tok)
 - `README.pt-BR.md` — 🛡️ DocGuard (~1075 tok)
 - `ROADMAP.md` — DocGuard Roadmap (~2529 tok)
 - `SECURITY.md` — Security Policy (~357 tok)
@@ -962,7 +962,7 @@
 - `auto-merge.yml` — CI: Auto-merge (green bot PRs) (~2234 tok)
 - `ci.yml` — CI: DocGuard CI (~1843 tok)
 - `jules-triage.yml` — CI: Jules PR Triage (~1635 tok)
-- `release.yml` — CI: Auto Release — Tag, GitHub Release, npm, PyPI (~6014 tok)
+- `release.yml` — CI: Auto Release — Tag, GitHub Release, npm, PyPI (~6837 tok)
 - `scheduled-release.yml` — CI: Scheduled Release (~2099 tok)
 - `sync-speckit-catalog.yml` — CI: Prepare Spec Kit Catalog Submission (Manual) (~1385 tok)
 

{docguard_cli-0.34.9 → docguard_cli-0.36.0}/.wolf/buglog.json

@@ -4809,6 +4809,307 @@
       "related_bugs": [],
       "occurrences": 1,
       "last_seen": "2026-09-11T16:33:44.539Z"
+    },
+    {
+      "id": "bug-291",
+      "timestamp": "2026-09-11T19:39:03.585Z",
+      "error_message": "Source changes returned stale cached documentation plans",
+      "file": "cli/scanners/memory-plan.mjs",
+      "root_cause": "Cache identity relied on manifests and HEAD, missing source content",
+      "fix": "Hash bounded relevant input content and scanner/config identity; fail closed on incomplete reads and publish atomically",
+      "tags": [
+        "cache",
+        "stale-source"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T19:39:03.585Z"
+    },
+    {
+      "id": "bug-292",
+      "timestamp": "2026-09-11T19:39:03.585Z",
+      "error_message": "Generated pre-push hook allowed an unparsed formatted score",
+      "file": "cli/commands/hooks.mjs",
+      "root_cause": "Compact JSON regex did not match real formatted command output",
+      "fix": "Parse JSON with Node and block malformed output or unavailable runtime",
+      "tags": [
+        "hooks",
+        "enforcement"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T19:39:03.585Z"
+    },
+    {
+      "id": "bug-293",
+      "timestamp": "2026-09-11T19:39:03.585Z",
+      "error_message": "Requirement IDs inside test fixtures generated false orphan findings",
+      "file": "cli/validators/traceability.mjs",
+      "root_cause": "Generic source matching treated fixture strings as declarations",
+      "fix": "Extract real comments and test labels with AST or scoped lexical fallback",
+      "tags": [
+        "traceability",
+        "false-positive"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T19:39:03.585Z"
+    },
+    {
+      "id": "bug-294",
+      "timestamp": "2026-09-11T19:39:03.585Z",
+      "error_message": "Freshness omitted configured nested documents and watcher errors escaped cleanup",
+      "file": "cli/validators/freshness.mjs",
+      "root_cause": "Narrow source/doc discovery and incomplete asynchronous lifecycle handling",
+      "fix": "Expand scoped freshness inputs; batch history; reject future dates; coalesce watch work and clean up on errors",
+      "tags": [
+        "freshness",
+        "watch"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T19:39:03.585Z"
+    },
+    {
+      "id": "bug-295",
+      "timestamp": "2026-09-11T19:39:03.585Z",
+      "error_message": "Structural score and empty claim sets implied factual accuracy",
+      "file": "cli/commands/score.mjs",
+      "root_cause": "Structural proxies and absence of extracted claims were treated as verification",
+      "fix": "Expose structural maturity separately and preserve null/unverified assurance across consumers",
+      "tags": [
+        "score",
+        "assurance"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T19:39:03.585Z"
+    },
+    {
+      "id": "bug-296",
+      "timestamp": "2026-09-11T19:39:03.585Z",
+      "error_message": "init --with ci executed a check instead of creating a workflow",
+      "file": "cli/commands/init.mjs",
+      "root_cause": "Scaffolder dispatcher called the standalone CI runner",
+      "fix": "Copy the maintained template with preserve/force behavior and destination checks",
+      "tags": [
+        "init",
+        "ci"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T19:39:03.585Z"
+    },
+    {
+      "id": "bug-297",
+      "timestamp": "2026-09-11T19:41:37.939Z",
+      "error_message": "Disk cache promotion exceeded the entry bound and accepted malformed nested plans",
+      "file": "cli/scanners/memory-plan.mjs",
+      "root_cause": "Disk-hit insertion bypassed eviction and envelope validation omitted nested consumer shapes",
+      "fix": "Use shared bounded insertion and validate cached plan shapes and depth before reuse",
+      "tags": [
+        "cache",
+        "review"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T19:41:37.939Z"
+    },
+    {
+      "id": "bug-298",
+      "timestamp": "2026-09-11T19:41:37.939Z",
+      "error_message": "Empty findings implied implementation correctness; unknown ALCOA rendered as failed",
+      "file": "cli/commands/report.mjs",
+      "root_cause": "Markdown presentation ignored assurance and unknown status",
+      "fix": "Scope empty output to configured checks and preserve unverified ALCOA status",
+      "tags": [
+        "report",
+        "assurance"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T19:41:37.939Z"
+    },
+    {
+      "id": "bug-299",
+      "timestamp": "2026-09-11T19:41:37.939Z",
+      "error_message": "Feedback reported saved file paths after persistence failed",
+      "file": "cli/commands/feedback.mjs",
+      "root_cause": "JSON emitted before writes and errors were swallowed",
+      "fix": "Persist first; expose saved/error per record; null unsaved file and exit 1 on failure",
+      "tags": [
+        "feedback",
+        "io"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T19:41:37.939Z"
+    },
+    {
+      "id": "bug-300",
+      "timestamp": "2026-09-11T19:42:37.776Z",
+      "error_message": "Workflow expression scope was invalid and baseline restoration assertion accepted every status",
+      "file": ".github/workflows/ci.yml",
+      "root_cause": "runner.temp used at job env scope; shell OR expression treated any failure as expected",
+      "fix": "Move report paths into supported step contexts and assert the expected baseline-restored exit status with executable regression coverage",
+      "tags": [
+        "ci",
+        "review",
+        "templates"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T19:42:37.776Z"
+    },
+    {
+      "id": "bug-301",
+      "timestamp": "2026-09-11T20:42:23.164Z",
+      "error_message": "OpenAPI omissions attributed to missing implementation",
+      "file": "cli/validators/api-surface.mjs",
+      "root_cause": "Contract evidence was treated as code evidence",
+      "fix": "Cross-check extracted code routes, identify authority, and refuse removal when the route exists or code evidence is unavailable",
+      "tags": [
+        "precision",
+        "regression"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T20:42:23.164Z"
+    },
+    {
+      "id": "bug-302",
+      "timestamp": "2026-09-11T20:42:23.164Z",
+      "error_message": "Formatting-only edits produced deletion review noise",
+      "file": "cli/validators/diff-suspicion.mjs",
+      "root_cause": "Removed tokens were not compared with reintroduced tokens or syntax-equivalent code",
+      "fix": "Compare additions and AST equivalence while preserving genuinely removed declarations",
+      "tags": [
+        "precision",
+        "regression"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T20:42:23.164Z"
+    },
+    {
+      "id": "bug-303",
+      "timestamp": "2026-09-11T20:42:23.164Z",
+      "error_message": "Negated or historical technology prose appeared as current use",
+      "file": "cli/validators/docs-diff.mjs",
+      "root_cause": "Technology names matched without assertion context",
+      "fix": "Recognize negation including coordinated lists; retain independent affirmative claims",
+      "tags": [
+        "precision",
+        "regression"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T20:42:23.164Z"
+    },
+    {
+      "id": "bug-304",
+      "timestamp": "2026-09-11T20:42:23.164Z",
+      "error_message": "Synthetic expectations flagged while sibling placeholders could hide real credentials",
+      "file": "cli/validators/security.mjs",
+      "root_cause": "Text-wide placeholder handling lacked expression ownership",
+      "fix": "Restrict exemptions to explicit synthetic mock expectations and preserve real-secret controls",
+      "tags": [
+        "precision",
+        "regression"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T20:42:23.164Z"
+    },
+    {
+      "id": "bug-305",
+      "timestamp": "2026-09-11T20:42:23.164Z",
+      "error_message": "Explained conditional skips warned and nested suite skips were missed",
+      "file": "cli/validators/todo-tracking.mjs",
+      "root_cause": "Skip patterns did not distinguish titles, reasons, and nested suites",
+      "fix": "Recognize static reasons and suite calls with neighboring unexplained-skip controls",
+      "tags": [
+        "precision",
+        "regression"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T20:42:23.164Z"
+    },
+    {
+      "id": "bug-306",
+      "timestamp": "2026-09-11T20:42:23.164Z",
+      "error_message": "Worker bindings missing or confused by lexical shadowing",
+      "file": "cli/shared-source.mjs",
+      "root_cause": "Worker handler scope and lexical declarations were not modeled",
+      "fix": "Resolve bindings using optional existing Babel parser and conservative tested fallback",
+      "tags": [
+        "precision",
+        "regression"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T20:42:23.164Z"
+    },
+    {
+      "id": "bug-307",
+      "timestamp": "2026-09-11T20:42:23.164Z",
+      "error_message": "Custom document layout bypassed writer and path boundaries",
+      "file": "cli/shared-doc-roles.mjs",
+      "root_cause": "Hardcoded writers and direct readers did not share role validation",
+      "fix": "Validate role paths including symlinks and private aliases; fence CLI and direct automatic writers",
+      "tags": [
+        "precision",
+        "regression"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T20:42:23.164Z"
+    },
+    {
+      "id": "bug-308",
+      "timestamp": "2026-09-11T20:42:23.164Z",
+      "error_message": "Zero matches could imply comprehensive successful checks",
+      "file": "cli/commands/guard.mjs",
+      "root_cause": "Applicability and document inventory were conflated with evidence coverage",
+      "fix": "Expose check states and reasons independently of legacy gate status",
+      "tags": [
+        "precision",
+        "regression"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T20:42:23.164Z"
+    },
+    {
+      "id": "bug-309",
+      "timestamp": "2026-09-11T20:42:23.164Z",
+      "error_message": "Missing test annotation mislabeled behavioral coverage; spec checks coupled to canonical folder",
+      "file": "cli/validators/traceability.mjs",
+      "root_cause": "Annotation absence treated as proof and missing canonical folder stopped unrelated spec checks",
+      "fix": "Describe annotation uncertainty, scan spec artifacts independently, avoid duplicate default-file warnings and non-test hints",
+      "tags": [
+        "precision",
+        "regression"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T20:42:23.164Z"
+    },
+    {
+      "id": "bug-310",
+      "timestamp": "2026-09-11T20:42:23.164Z",
+      "error_message": "Concurrent demo tests raced and kept fixtures leaked",
+      "file": "tests/demo-command.test.mjs",
+      "root_cause": "Global temporary directory counts plus swallowed ESM require error",
+      "fix": "Use isolated temporary roots and imported rmSync with finally cleanup",
+      "tags": [
+        "precision",
+        "regression"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-11T20:42:23.164Z"
     }
   ]
-}
+}