docguard-cli 0.37.0__tar.gz → 0.37.1__tar.gz

{docguard_cli-0.37.0 → docguard_cli-0.37.1}/.agent/skills/docguard-fix/SKILL.md

@@ -6,10 +6,10 @@ description: AI-driven documentation repair with structured research workflow, t
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.36.2
+  version: 0.37.1
   source: extensions/spec-kit-docguard/skills/docguard-fix
 ---
-<!-- docguard:version: 0.36.2 -->
+<!-- docguard:version: 0.37.1 -->
 
 # DocGuard Fix Skill
 

{docguard_cli-0.37.0/extensions/spec-kit-docguard → docguard_cli-0.37.1/.agent}/skills/docguard-guard/SKILL.md

@@ -7,10 +7,10 @@ description: Run DocGuard guard validation against Canonical-Driven Development
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.37.0
+  version: 0.37.1
   source: extensions/spec-kit-docguard/skills/docguard-guard
 ---
-<!-- docguard:version: 0.37.0 -->
+<!-- docguard:version: 0.37.1 -->
 
 # DocGuard Guard Skill
 

{docguard_cli-0.37.0/extensions/spec-kit-docguard → docguard_cli-0.37.1/.agent}/skills/docguard-review/SKILL.md

@@ -6,10 +6,10 @@ description: Cross-document consistency analysis and quality assessment. Perform
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.37.0
+  version: 0.37.1
   source: extensions/spec-kit-docguard/skills/docguard-review
 ---
-<!-- docguard:version: 0.37.0 -->
+<!-- docguard:version: 0.37.1 -->
 
 # DocGuard Review Skill
 

{docguard_cli-0.37.0/extensions/spec-kit-docguard → docguard_cli-0.37.1/.agent}/skills/docguard-score/SKILL.md

@@ -6,10 +6,10 @@ description: CDD maturity assessment with category-aware improvement roadmap. Ru
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.37.0
+  version: 0.37.1
   source: extensions/spec-kit-docguard/skills/docguard-score
 ---
-<!-- docguard:version: 0.37.0 -->
+<!-- docguard:version: 0.37.1 -->
 
 # DocGuard Score Skill
 

{docguard_cli-0.37.0 → docguard_cli-0.37.1}/.agent/skills/docguard-sync/SKILL.md

@@ -4,10 +4,10 @@ description: Keep canonical documentation ALWAYS UP TO DATE. Refreshes code-trut
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.36.2
+  version: 0.37.1
   source: extensions/spec-kit-docguard/skills/docguard-sync
 ---
-<!-- docguard:version: 0.36.2 -->
+<!-- docguard:version: 0.37.1 -->
 
 # DocGuard Sync Skill
 

{docguard_cli-0.37.0 → docguard_cli-0.37.1}/.docguard-specs.json

@@ -76,11 +76,11 @@
           },
           {
             "path": "specs/006-document-lifecycle/tasks.md",
-            "digest": "sha256:9bd8203ad8e666f7f71d6302c61ff1cfd1c1e75379da89b84cc790a69aff6a2b"
+            "digest": "sha256:f1786145b4bb77eab2bfa9c8593186e890bf50ae56236d22d5c136ca7d5ec3b2"
           }
         ],
         "taskCompletion": {
-          "checked": 14,
+          "checked": 15,
           "total": 23
         },
         "implementationEvidence": [],

{docguard_cli-0.37.0 → docguard_cli-0.37.1}/.github/scripts/speckit-submission.py

@@ -24,10 +24,48 @@ Usage: speckit-submission.py (--url|--body) <version> <download_url>
 """
 import sys
 import json
+from pathlib import Path
 from urllib.parse import urlencode, quote
 
 FORM_URL = "https://github.com/github/spec-kit/issues/new"
 TEMPLATE = "extension_submission.yml"
+MANIFEST = Path(__file__).resolve().parents[2] / "extensions/spec-kit-docguard/extension.yml"
+DESCRIPTION = (
+    "Documentation integrity for AI-assisted repositories: lifecycle registry, "
+    "drift validation, traceability, safe archival, SARIF/JUnit, MCP, GitHub "
+    "Actions, and Spec Kit hooks."
+)
+TAGS = ["documentation", "validation", "traceability", "ai-agents", "spec-kit"]
+
+
+def manifest_inventory(path: Path = MANIFEST):
+    """Read command and hook names from the extension manifest without PyYAML."""
+    commands, hooks = [], []
+    section = subsection = None
+    for raw in path.read_text(encoding="utf-8").splitlines():
+        line = raw.split("#", 1)[0].rstrip()
+        if not line.strip():
+            continue
+        content = line.lstrip()
+        indent = len(line) - len(content)
+
+        if indent == 0:
+            section = content[:-1] if content.endswith(":") else None
+            subsection = None
+            continue
+
+        if section == "provides":
+            if indent == 2:
+                subsection = content[:-1] if content.endswith(":") else None
+            elif (subsection == "commands" and indent == 4
+                  and content.startswith("- name:")):
+                commands.append(content.split(":", 1)[1].strip().strip("\"'"))
+        elif section == "hooks" and indent == 2 and content.endswith(":"):
+            hooks.append(content[:-1])
+
+    if not commands or not hooks:
+        raise RuntimeError(f"Could not read commands and hooks from {path}")
+    return commands, hooks
 
 
 def changelog_section(version: str) -> str:
@@ -56,19 +94,13 @@ def changelog_section(version: str) -> str:
 
 
 def build(version: str, download_url: str):
+    commands, hooks = manifest_inventory()
+    command_count, hook_count = len(commands), len(hooks)
     catalog_entry = {
         "docguard": {
             "name": "DocGuard — CDD Enforcement",
             "id": "docguard",
-            "description": (
-                "A documentation-integrity engine with an MCP server, "
-                "SARIF/JUnit output, and a deterministic zero-LLM core. "
-                "Validates, scores, and traces documentation against code — "
-                "27 validators, stable finding codes, adoption baseline for "
-                "legacy repos, compliance-evidence reports, GitHub Action "
-                "with PR annotations, spec-kit hooks. Pure Node.js, one "
-                "pinned dep."
-            ),
+            "description": DESCRIPTION,
             "author": "raccioly",
             "version": version,
             "download_url": download_url,
@@ -88,11 +120,8 @@ def build(version: str, download_url: str):
                     {"name": "node", "version": ">=18.0.0", "required": True}
                 ],
             },
-            "provides": {"commands": 6, "hooks": 3},
-            "tags": [
-                "documentation", "validation", "quality", "cdd",
-                "traceability", "ai-agents", "enforcement", "spec-kit",
-            ],
+            "provides": {"commands": command_count, "hooks": hook_count},
+            "tags": TAGS,
             "verified": False,
             "downloads": 0,
             "stars": 0,
@@ -120,17 +149,16 @@ def build(version: str, download_url: str):
          "- node (>=18.0.0) - required\n"
          "- npx - required\n"
          "- specify - optional (auto-initializes the SDD workflow during docguard init)"),
-        ("commands-count", "Number of Commands", "6"),
-        ("hooks-count", "Number of Hooks (optional)", "3"),
-        ("tags", "Tags",
-         "documentation, validation, quality, cdd, traceability, ai-agents, enforcement, spec-kit"),
+        ("commands-count", "Number of Commands", str(command_count)),
+        ("hooks-count", "Number of Hooks (optional)", str(hook_count)),
+        ("tags", "Tags", ", ".join(TAGS)),
         ("features", "Key Features",
          "- Configurable quality gate with severity triage and a remediation plan\n"
          "- AI-driven documentation repair with codebase research and validation loops\n"
          "- Cross-document semantic consistency analysis (read-only review)\n"
          "- CDD maturity score with an ROI-based improvement roadmap\n"
          "- Reverse-engineers canonical docs from an existing codebase\n"
-         "- spec-kit workflow hooks (after_implement, before_tasks, after_tasks)"),
+         f"- spec-kit workflow hooks ({', '.join(hooks)})"),
         ("testing", "Testing Checklist", None),
         ("requirements", "Submission Requirements", None),
         ("testing-details", "Testing Details",
@@ -139,8 +167,8 @@ def build(version: str, download_url: str):
          f"specify extension add docguard --from {download_url}\n```\n\n"
          "**Scenarios to verify for this release:**\n"
          "1. Extension installs from the release ZIP without manifest validation errors.\n"
-         "2. All six `speckit.docguard.*` commands resolve and run.\n"
-         "3. The three workflow hooks register against spec-kit's lifecycle."),
+         f"2. All {command_count} declared `speckit.docguard.*` commands resolve and run.\n"
+         f"3. All {hook_count} declared workflow hooks register against spec-kit's lifecycle."),
         ("example-usage", "Example Usage",
          "```bash\n"
          "# Install the extension\n"

docguard_cli-0.37.1/.github/scripts/sync-release-version.mjs

@@ -0,0 +1,150 @@
+#!/usr/bin/env node
+
+/**
+ * Synchronize every active release surface with package.json.
+ *
+ * The allowlist is deliberate: release metadata and copyable install templates
+ * must move together, while historical references in changelogs, roadmaps, and
+ * completed specifications must remain untouched.
+ */
+
+import { existsSync, readFileSync, readdirSync, unlinkSync } from 'node:fs';
+import { dirname, join, relative, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { safeWrite } from '../../cli/writers/generate-io.mjs';
+
+const SCRIPT_PATH = fileURLToPath(import.meta.url);
+const STABLE_VERSION = /^\d+\.\d+\.\d+$/;
+
+function replaceRequired(content, pattern, replacement, label, expected = 1) {
+  let count = 0;
+  const next = content.replace(pattern, (...args) => {
+    count++;
+    return typeof replacement === 'function' ? replacement(...args) : replacement;
+  });
+  if (count !== expected) {
+    throw new Error(`${label}: expected ${expected} version field${expected === 1 ? '' : 's'}, found ${count}`);
+  }
+  return next;
+}
+
+function stageText(staged, root, relPath, transform) {
+  const fullPath = resolve(root, relPath);
+  if (!existsSync(fullPath)) throw new Error(`${relPath}: required release surface is missing`);
+  const current = readFileSync(fullPath, 'utf8');
+  staged.set(fullPath, transform(current));
+}
+
+function stageJson(staged, root, relPath, transform) {
+  stageText(staged, root, relPath, content => {
+    let value;
+    try { value = JSON.parse(content); } catch (error) {
+      throw new Error(`${relPath}: invalid JSON: ${error.message}`);
+    }
+    transform(value);
+    return `${JSON.stringify(value, null, 2)}\n`;
+  });
+}
+
+function writeWithoutReleaseBackup(filePath, content) {
+  const previous = readFileSync(filePath, 'utf8');
+  if (previous === content) return false;
+  safeWrite(filePath, content);
+  // Git is the durable backup for these tracked release surfaces. Remove the
+  // temporary .bak only after safeWrite succeeds so it cannot enter a release.
+  const backup = `${filePath}.bak`;
+  if (existsSync(backup)) unlinkSync(backup);
+  return true;
+}
+
+export function syncReleaseVersion(root = process.cwd()) {
+  const packagePath = resolve(root, 'package.json');
+  const pkg = JSON.parse(readFileSync(packagePath, 'utf8'));
+  const version = pkg.version;
+  if (!STABLE_VERSION.test(version || '')) {
+    throw new Error(`package.json: expected a stable x.y.z version, got ${JSON.stringify(version)}`);
+  }
+
+  const staged = new Map();
+
+  stageText(staged, root, 'pyproject.toml', content => replaceRequired(
+    content,
+    /(\[project\][\s\S]*?^version\s*=\s*")[^"\n]+(")/m,
+    (_match, before, after) => `${before}${version}${after}`,
+    'pyproject.toml [project].version',
+  ));
+
+  stageJson(staged, root, 'server.json', server => {
+    if (!Array.isArray(server.packages)) throw new Error('server.json: packages must be an array');
+    const npmPackages = server.packages.filter(item => item?.registryType === 'npm' && item?.identifier === pkg.name);
+    if (npmPackages.length !== 1) {
+      throw new Error(`server.json: expected one npm package for ${pkg.name}, found ${npmPackages.length}`);
+    }
+    server.version = version;
+    npmPackages[0].version = version;
+  });
+
+  stageText(staged, root, 'extensions/spec-kit-docguard/extension.yml', content => replaceRequired(
+    content,
+    /^  version:\s*["'][^"'\n]+["']/m,
+    `  version: "${version}"`,
+    'extensions/spec-kit-docguard/extension.yml extension.version',
+  ));
+
+  for (const relPath of [
+    'templates/ci/github-actions.yml',
+    'extensions/spec-kit-docguard/templates/github-workflows/docguard-guard.yml',
+  ]) {
+    stageText(staged, root, relPath, content => replaceRequired(
+      content,
+      /docguard-cli@\d+\.\d+\.\d+/g,
+      `docguard-cli@${version}`,
+      `${relPath} DocGuard CLI pin`,
+    ));
+  }
+
+  const skillsRoot = resolve(root, 'extensions/spec-kit-docguard/skills');
+  if (!existsSync(skillsRoot)) throw new Error('extensions/spec-kit-docguard/skills: required release surface is missing');
+  const skillFiles = readdirSync(skillsRoot, { withFileTypes: true })
+    .filter(entry => entry.isDirectory())
+    .map(entry => join(skillsRoot, entry.name, 'SKILL.md'))
+    .filter(existsSync)
+    .sort();
+  if (skillFiles.length === 0) throw new Error('extensions/spec-kit-docguard/skills: no SKILL.md files found');
+
+  for (const fullPath of skillFiles) {
+    const relPath = relative(root, fullPath);
+    const current = readFileSync(fullPath, 'utf8');
+    let next = replaceRequired(
+      current,
+      /^  version:\s*\d+\.\d+\.\d+$/m,
+      `  version: ${version}`,
+      `${relPath} metadata.version`,
+    );
+    next = replaceRequired(
+      next,
+      /<!-- docguard:version:\s*\d+\.\d+\.\d+ -->/g,
+      `<!-- docguard:version: ${version} -->`,
+      `${relPath} docguard version marker`,
+    );
+    staged.set(fullPath, next);
+  }
+
+  // All parsing and cardinality checks finish before the first write. A missing
+  // or duplicated field therefore leaves every release surface untouched.
+  const changed = [];
+  for (const [filePath, content] of staged) {
+    if (writeWithoutReleaseBackup(filePath, content)) changed.push(relative(root, filePath));
+  }
+  return { version, changed };
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === SCRIPT_PATH) {
+  try {
+    const result = syncReleaseVersion();
+    console.log(`Synchronized ${result.changed.length} release surfaces to v${result.version}.`);
+  } catch (error) {
+    console.error(`Release version sync failed: ${error.message}`);
+    process.exitCode = 1;
+  }
+}

{docguard_cli-0.37.0 → docguard_cli-0.37.1}/.github/workflows/scheduled-release.yml

@@ -111,9 +111,13 @@ jobs:
           awk '/^## \[Unreleased\]/ { print; print ""; while ((getline line < "/tmp/entry.md") > 0) print line; next } { print }' \
             CHANGELOG.md > /tmp/CHANGELOG.new && mv /tmp/CHANGELOG.new CHANGELOG.md
 
-          # Keep the spec-kit extension metadata in lockstep (same thing
-          # `docguard fix --write` does locally before a manual release).
-          node cli/docguard.mjs fix --write || true
+          # Synchronize every active publication surface from package.json.
+          # This is fail-closed: missing or duplicated fields stop the release
+          # before any release metadata is written.
+          node .github/scripts/sync-release-version.mjs
+          # The extension skills are authoritative. Refresh their checked-in
+          # `.agent` copies before the parity test and release commit.
+          node --input-type=module -e "import { ensureSkills } from './cli/ensure-skills.mjs'; ensureSkills(process.cwd(), { format: 'json', noSpecKit: true });"
 
           echo "NEW_VERSION=$NEW" >> "$GITHUB_ENV"
 
@@ -148,7 +152,7 @@ jobs:
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
           git checkout -b "$BRANCH"
-          git add package.json package-lock.json CHANGELOG.md extensions/ .agent/ 2>/dev/null || true
+          git add package.json package-lock.json pyproject.toml server.json CHANGELOG.md templates/ extensions/ .agent/ 2>/dev/null || true
           git commit -m "release: v${NEW_VERSION} — automated weekly batch
 
           Cut by .github/workflows/scheduled-release.yml. Publishing itself is

{docguard_cli-0.37.0 → docguard_cli-0.37.1}/.wolf/buglog.json

@@ -5400,6 +5400,90 @@
       "related_bugs": [],
       "occurrences": 1,
       "last_seen": "2026-09-14T17:55:00.000Z"
+    },
+    {
+      "id": "bug-332",
+      "timestamp": "2026-09-14T19:45:00.000Z",
+      "error_message": "The roadmap left the merged v0.37.0 delivery task unchecked and grouped unfinished completion work under R1",
+      "file": "ROADMAP.md; specs/006-document-lifecycle/tasks.md",
+      "root_cause": "The active specification spans several increments, but release completion did not update the task ledger or separate the shipped lifecycle foundation from the next reconciliation milestone",
+      "fix": "Mark the reviewed release task complete, preserve unfinished task identities, and move completion, rollback, and post-hoc reconciliation work under R2",
+      "tags": ["documentation-drift", "roadmap", "release", "lifecycle"],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-14T19:45:00.000Z"
+    },
+    {
+      "id": "bug-333",
+      "timestamp": "2026-09-14T19:45:00.000Z",
+      "error_message": "OpenWolf bug-log append script failed with TypeError: bugs.some is not a function",
+      "file": ".wolf/buglog.json",
+      "root_cause": "The script assumed the file root was an array, but the repository schema wraps entries in a versioned bugs array",
+      "fix": "Inspect the envelope first and append through the bugs property while preserving the version field and existing formatting",
+      "tags": ["openwolf", "tooling", "operator-error"],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-14T19:45:00.000Z"
+    },
+    {
+      "id": "bug-334",
+      "timestamp": "2026-09-14T19:45:00.000Z",
+      "error_message": "Guard summary shell failed with zsh: read-only variable: status",
+      "file": "session shell commands",
+      "root_cause": "The shell wrapper reused zsh's reserved status parameter for an exit code",
+      "fix": "Use a task-specific variable such as guard_exit for captured command status",
+      "tags": ["shell", "tooling", "operator-error"],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-14T19:45:00.000Z"
+    },
+    {
+      "id": "bug-335",
+      "timestamp": "2026-09-14T20:05:00.000Z",
+      "error_message": "A repository search failed with zsh: unmatched quote",
+      "file": "session shell commands",
+      "root_cause": "A compound ripgrep expression mixed shell quotes and a literal backtick in one command string",
+      "fix": "Split the search into simple single-quoted patterns without shell-sensitive tokens",
+      "tags": ["shell", "tooling", "operator-error"],
+      "related_bugs": ["bug-327"],
+      "occurrences": 1,
+      "last_seen": "2026-09-14T20:05:00.000Z"
+    },
+    {
+      "id": "bug-336",
+      "timestamp": "2026-09-14T20:05:00.000Z",
+      "error_message": "A multi-file patch failed because one expected test context did not match",
+      "file": "session apply_patch operation",
+      "root_cause": "The patch coupled independent file edits into one context-sensitive operation",
+      "fix": "Apply independent file changes separately and verify each exact context before continuing",
+      "tags": ["patching", "tooling", "operator-error"],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-09-14T20:05:00.000Z"
+    },
+    {
+      "id": "bug-337",
+      "timestamp": "2026-09-14T20:05:00.000Z",
+      "error_message": "The full test suite changed five checked-in agent skills during a documentation-only release correction",
+      "file": "cli/docguard.mjs; .github/workflows/scheduled-release.yml",
+      "root_cause": "Read-only hooks --list and fix invocations could enter setup, while the release workflow updated extension skill versions without refreshing their checked-in agent copies",
+      "fix": "Bypass setup for read-only inventory and fix commands, synchronize managed agent skills during release preparation, and enforce byte-identical copies with regression tests",
+      "tags": ["read-only", "release", "skills", "side-effect", "regression"],
+      "related_bugs": ["bug-317", "bug-318", "bug-331"],
+      "occurrences": 1,
+      "last_seen": "2026-09-14T20:05:00.000Z"
+    },
+    {
+      "id": "bug-338",
+      "timestamp": "2026-09-14T18:09:28.000Z",
+      "error_message": "The scheduled v0.37.1 release stopped because package.json was bumped while CI templates, PyPI metadata, and MCP registry metadata remained on v0.37.0",
+      "file": ".github/workflows/scheduled-release.yml; templates/ci/github-actions.yml; extensions/spec-kit-docguard/templates/github-workflows/docguard-guard.yml; pyproject.toml; server.json",
+      "root_cause": "Release preparation delegated only Markdown and extension metadata to the general DocGuard fixer, leaving non-Markdown publication surfaces outside a single explicit release transaction",
+      "fix": "Add a fail-closed release synchronizer with an explicit active-surface allowlist, validate field cardinality before the first write, refresh managed agent copies afterward, and regression-test successful and aborted synchronization",
+      "tags": ["release", "automation", "version-sync", "publication", "regression"],
+      "related_bugs": ["bug-331", "bug-337"],
+      "occurrences": 1,
+      "last_seen": "2026-09-14T18:09:28.000Z"
     }
   ]
 }

{docguard_cli-0.37.0 → docguard_cli-0.37.1}/.wolf/cerebrum.md

@@ -10,9 +10,11 @@
 
 - On field/bug reports, Ricardo prefers **"triage & verify first"** over jumping to fixes — confirm each item against current code (reproduce where possible) and explicitly challenge the report's own stated root-cause before writing any fix. (Chosen on the websec-validator field report, 2026-06-02.)
 - **2026-09-14** — Hold lifecycle releases until the authority model, false-positive boundary, and interoperability with current Spec Kit extensions have been independently challenged. The user wants the spec tracker to become the daily source of lifecycle truth, with release only after meaningful, tested improvement.
+- **2026-09-14** — Do not call a release cycle finished while post-tag fixes remain on `main`, and keep roadmap milestones visibly separated into shipped and future work. Feature foundations use a minor release; fixes merged after that tag require a patch release before updating the external catalog submission.
 
 ## Key Learnings
 
+- **2026-09-14 — Release-generated skill parity:** The scheduled release updates extension skill metadata through `fix --write`, whose headless mode correctly skips setup. It must then run an explicit managed-agent sync before tests and staging; otherwise `.agent/skills` remains one release behind. A repository parity test should compare every managed copy byte-for-byte with its extension source.
 - **2026-09-14 — Lifecycle control plane:** Active approved prose owns behavioral intent; `.docguard-specs.json` owns reviewed lifecycle, lineage, scope, and persistence policy while regenerating observed evidence deterministically. Approval, delivery, context, retirement reason, storage, and persistence model are separate dimensions. Use immutable `specId#requirementId` identities and preserve retired tombstones; path-qualified IDs are only a migration format.
 - **2026-09-14 — Retirement is stricter than completion:** Checked tasks and `Status: Completed` are review signals. Verification requires exact-revision implementation/test evidence plus reconciled canonical outcomes. Retirement additionally requires a retained Git ref, clean replacement/evidence docs, no live backreferences, a compatible persistence model, and fresh context. The public verb is `retire` because Spec Kit Archive already means consolidation.
 - **2026-09-14 — Spec Kit ownership:** Core deliberately leaves persistence policy open and hooks are agent-mediated. DocGuard owns deterministic evidence, validation, registry freshness, and context hygiene; community Archive/Reconcile extensions own agent-authored consolidation. Use hooks as prompts and CLI/CI as the enforcement boundary. Prove a generic lifecycle/lineage contract in DocGuard before proposing it upstream on issue #620.
@@ -144,3 +146,5 @@
 - **2026-09-14 — Badge test isolation:** legacy badge aliases run init and may refresh skills even when testing output. Keep their fixtures outside the source checkout; use the current Node executable and prevent global setup tooling from entering tests. Read-only audit/score tests remain separate from mutating alias tests.
 
 - **2026-09-14 — Scoped requirement identity:** validator and feature scoring share document-qualified definitions and positive reference resolution. Bare IDs resolve only when unique; an invalid qualifier never falls back. Repeated definitions in one document collapse; cross-document IDs remain separate. Qualified paths are repository-relative with forward slashes.
+
+- **2026-09-14 — Release versions are a transaction:** package.json is the source of truth, but a release is not coherent until PyPI, MCP registry, Spec Kit metadata, skill markers, managed agent copies, and copyable CI pins match it. Synchronize only an explicit allowlist of active publication surfaces, validate every expected field before writing, and leave historical version references untouched.

{docguard_cli-0.37.0 → docguard_cli-0.37.1}/CHANGELOG.md

@@ -7,6 +7,33 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.37.1] - 2026-09-14
+
+Automated weekly release — batches everything merged since `v0.37.0`.
+
+### Changed
+
+- fix: synchronize release version surfaces (#354)
+- fix: clarify lifecycle scope and harden patch releases (#353)
+- fix: enforce Spec Kit catalog form bounds (#352)
+- fix: derive Spec Kit catalog inventory from manifest (#351)
+
+
+### Fixed
+
+- Spec Kit catalog submissions now derive command and hook counts from the
+  extension manifest, avoid hardcoded validator totals, and enforce the form's
+  description and tag bounds, preventing stale or invalid release reminders.
+- Lifecycle planning now marks the merged v0.37.0 delivery complete and separates
+  its released registry/retirement contract from the still-planned completion
+  transaction and post-hoc reconciliation work.
+- `docguard hooks --list` and non-writing `docguard fix` invocations no longer
+  enter setup or refresh agent files. Automated releases now synchronize the
+  checked-in `.agent` skills with the released extension before verification.
+- Automated releases now update PyPI metadata, MCP registry metadata, Spec Kit
+  metadata, AI skill markers, and both copyable CI pins through one fail-closed
+  synchronizer before testing or opening a release pull request.
+
 ## [0.37.0] - 2026-09-14
 
 ### Added

{docguard_cli-0.37.0 → docguard_cli-0.37.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: docguard-cli
-Version: 0.37.0
+Version: 0.37.1
 Summary: The enforcement tool for Canonical-Driven Development (CDD). Audit, generate, and guard your project documentation. No Python dependencies (requires Node.js 18+).
 Project-URL: Homepage, https://github.com/raccioly/docguard
 Project-URL: Documentation, https://github.com/raccioly/docguard#readme

{docguard_cli-0.37.0 → docguard_cli-0.37.1}/ROADMAP.md

@@ -13,7 +13,7 @@ structural score is useful, but it is not proof that arbitrary prose is true.
 
 ## Current priorities
 
-### R1 — Document lifecycle and context hygiene (in progress)
+### R1 — Document lifecycle foundation (released in v0.37.0)
 
 Give specifications and planning documents an explicit end of life.
 
@@ -26,7 +26,6 @@ Give specifications and planning documents an explicit end of life.
 - [x] Add lifecycle status validation for `active`, `completed`, `superseded`,
   and `archived`; task completion and `Completed` artifact maturity remain
   review signals rather than proof of retirement.
-- [ ] Add optional Spec Kit hooks that check archive readiness after convergence.
 - [x] Add `.docguard-specs.json`, a committed lifecycle control plane. Reviewed
   approval, delivery, context, storage, persistence policy, lineage, and scope
   are authoritative; requirement references and
@@ -46,19 +45,29 @@ Give specifications and planning documents an explicit end of life.
 - [x] Give every active spec an immutable metadata ID; use
   `specId#requirementId` for completion evidence and preserve retired identities
   as registry tombstones so bare IDs cannot rebind.
-- [ ] Add an `implemented → verified` completion transaction that appends a
-  bounded outcome record, refreshes mechanical facts, records reconciliation,
-  and regenerates active AI context.
 - [x] Cross-check spec storage state against `.docguard-archive.json`. The
   archive manifest owns document recovery; the spec registry owns governance,
   and disagreement between them blocks a transition.
+- [x] Merge the reviewed implementation in PR #349 and publish the verified
+  npm, PyPI, GHCR, MCPB, and Spec Kit extension artifacts as v0.37.0.
+
+R1 deliberately shipped the registry and safe-retirement boundary before adding
+completion writes. Transaction rollback, status adapters, monorepo identity,
+restore/re-retire handling, and reviewed completion transitions remain R2 work;
+they are not part of the v0.37.0 contract.
 
-Contribution slices: reviewed completion transitions, exact-revision
-implementation evidence, additional status formats, monorepo/workspace identity,
-restore and re-retire event handling, and Spec Kit lifecycle fixtures. Every
-detector change needs a stale example and a neighboring current example.
+### R2 — Completion and post-hoc reconciliation (planned)
 
-### R2 — Reconcile behavior changes made outside a spec (planned)
+Close the lifecycle loop without allowing current code to silently redefine
+approved intent.
+
+- [ ] Add staged registry/recovery transactions with rollback before any command
+  can update both lifecycle ledgers.
+- [ ] Add an `implemented → verified` completion transaction that appends a
+  bounded outcome record, refreshes mechanical facts, records the exact
+  reconciliation revision, and regenerates active AI context.
+- [ ] Add optional Spec Kit hooks that check archive readiness after convergence
+  or verification; CLI and CI remain the enforcement boundary.
 
 Detect post-hoc implementation changes without silently redefining approved
 intent. `docguard reconcile --since <ref>` will classify affected material:

{docguard_cli-0.37.0 → docguard_cli-0.37.1}/cli/docguard.mjs

@@ -662,10 +662,11 @@ async function main() {
   // same way runGuardInternal sees everything else.
   if (flags.noBaseline) config.baseline = false;
 
-  // Commands that only READ and REPORT — they must never mutate the working
-  // tree. Scaffolding (ensureSkills → .agent/.specify, spawning `specify`)
-  // belongs to setup/init/generate and the `init --with` family, where the
-  // user is establishing or expanding their setup, not auditing it.
+  // Commands whose normal mode only reads/reports, plus explicit writers whose
+  // mutations must stay scoped to their named output. They must never add
+  // unrelated setup files. Scaffolding (ensureSkills → .agent/.specify,
+  // spawning `specify`) belongs to setup/init/generate and `init --with`, where
+  // the user is establishing or expanding setup rather than inspecting it.
   //
   // v0.26 (field report Bug #3): a bare `docguard guard` used to run
   // ensureSkills → auto-init Spec Kit → spawn `specify` and write ~9 files into
@@ -675,7 +676,7 @@ async function main() {
   // `diff`/`impact` only read; `demo` runs against a throwaway fixture.)
   const READ_ONLY_COMMANDS = new Set([
     'guard', 'audit', 'score', 'diff', 'impact',
-    'diagnose', 'trace', 'explain', 'memory', 'demo', 'agent', 'retire', 'archive', 'specs',
+    'diagnose', 'fix', 'trace', 'explain', 'memory', 'demo', 'agent', 'retire', 'archive', 'specs',
     // feedback only writes its own .docguard/feedback/ — it must NOT scaffold
     // skills or touch source, so it's gated out of ensureSkills like the rest.
     'feedback',
@@ -703,6 +704,7 @@ async function main() {
     command !== 'setup' &&
     command !== 'init' &&
     !READ_ONLY_COMMANDS.has(command) &&
+    !(command === 'hooks' && flags.list) &&
     // Agent-family staleness checks must not bootstrap skills or Spec Kit.
     !(command === 'agents' && flags.check) &&
     !headless
@@ -798,8 +800,9 @@ async function main() {
       runAgent(projectDir, config, flags);
       break;
     case 'hooks':
-      if (flags.claude) {
-        // Agent nudge hook (.claude/settings.json) — direct path, no wizard.
+      if (flags.claude || flags.list) {
+        // Agent nudge and read-only inventory paths bypass the setup wizard.
+        // Listing hooks must not refresh unrelated skills in the repository.
         runHooks(projectDir, config, flags);
         break;
       }