docguard-cli 0.40.1__tar.gz → 0.40.2__tar.gz

{docguard_cli-0.40.1 → docguard_cli-0.40.2}/.agent/skills/docguard-fix/SKILL.md

@@ -6,10 +6,10 @@ description: AI-driven documentation repair with structured research workflow, t
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.40.1
+  version: 0.40.2
   source: extensions/spec-kit-docguard/skills/docguard-fix
 ---
-<!-- docguard:version: 0.40.1 -->
+<!-- docguard:version: 0.40.2 -->
 
 # DocGuard Fix Skill
 

{docguard_cli-0.40.1/extensions/spec-kit-docguard → docguard_cli-0.40.2/.agent}/skills/docguard-guard/SKILL.md

@@ -7,10 +7,10 @@ description: Run DocGuard guard validation against Canonical-Driven Development
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.40.1
+  version: 0.40.2
   source: extensions/spec-kit-docguard/skills/docguard-guard
 ---
-<!-- docguard:version: 0.40.1 -->
+<!-- docguard:version: 0.40.2 -->
 
 # DocGuard Guard Skill
 

{docguard_cli-0.40.1/extensions/spec-kit-docguard → docguard_cli-0.40.2/.agent}/skills/docguard-review/SKILL.md

@@ -6,10 +6,10 @@ description: Cross-document consistency analysis and quality assessment. Perform
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.40.1
+  version: 0.40.2
   source: extensions/spec-kit-docguard/skills/docguard-review
 ---
-<!-- docguard:version: 0.40.1 -->
+<!-- docguard:version: 0.40.2 -->
 
 # DocGuard Review Skill
 

{docguard_cli-0.40.1/extensions/spec-kit-docguard → docguard_cli-0.40.2/.agent}/skills/docguard-score/SKILL.md

@@ -6,10 +6,10 @@ description: CDD maturity assessment with category-aware improvement roadmap. Ru
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.40.1
+  version: 0.40.2
   source: extensions/spec-kit-docguard/skills/docguard-score
 ---
-<!-- docguard:version: 0.40.1 -->
+<!-- docguard:version: 0.40.2 -->
 
 # DocGuard Score Skill
 

{docguard_cli-0.40.1 → docguard_cli-0.40.2}/.agent/skills/docguard-sync/SKILL.md

@@ -4,10 +4,10 @@ description: Keep canonical documentation ALWAYS UP TO DATE. Refreshes code-trut
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.40.1
+  version: 0.40.2
   source: extensions/spec-kit-docguard/skills/docguard-sync
 ---
-<!-- docguard:version: 0.40.1 -->
+<!-- docguard:version: 0.40.2 -->
 
 # DocGuard Sync Skill
 

{docguard_cli-0.40.1 → docguard_cli-0.40.2}/.docguard-specs.json

@@ -2070,20 +2070,20 @@
         "artifacts": [
           {
             "path": "specs/011-tokenless-scheduled-releases/spec.md",
-            "digest": "sha256:c62dbe1182cf3a6e94ec8a1e1d4b6c2fce7adba57233d11a679d699634228cd5"
+            "digest": "sha256:b5e9f78c62a085b06c30a1ef2a67c45df9a2177aa75f25049c42c7c71e99e543"
           },
           {
             "path": "specs/011-tokenless-scheduled-releases/plan.md",
-            "digest": "sha256:1e52fed9a92d0bbf3e6d639bf60e434b8b2b906c43d080143cbcee653a9e4772"
+            "digest": "sha256:f833cdcbe825ab6a75ab484ac586ef3e36a984b7856f196730bb6ca5cdd0393e"
           },
           {
             "path": "specs/011-tokenless-scheduled-releases/tasks.md",
-            "digest": "sha256:38734825899c685dfbb7346d8b15c626900399b3756ea33598aeff9adc80012a"
+            "digest": "sha256:9b49cf5672efd0bea5ccca4e1c83239c77854e5733630ab64e800185e1fa44a9"
           }
         ],
         "taskCompletion": {
-          "checked": 12,
-          "total": 13
+          "checked": 14,
+          "total": 15
         },
         "implementationEvidence": [
           {
@@ -2116,82 +2116,82 @@
           {
             "requirementId": "FR-001",
             "file": "tests/scheduled-release.test.mjs",
-            "line": 11
+            "line": 15
           },
           {
             "requirementId": "FR-002",
             "file": "tests/scheduled-release.test.mjs",
-            "line": 12
+            "line": 16
           },
           {
             "requirementId": "FR-003",
             "file": "tests/scheduled-release.test.mjs",
-            "line": 13
+            "line": 17
           },
           {
             "requirementId": "FR-004",
             "file": "tests/scheduled-release.test.mjs",
-            "line": 14
+            "line": 18
           },
           {
             "requirementId": "FR-005",
             "file": "tests/scheduled-release.test.mjs",
-            "line": 15
+            "line": 19
           },
           {
             "requirementId": "FR-006",
             "file": "tests/scheduled-release.test.mjs",
-            "line": 16
+            "line": 20
           },
           {
             "requirementId": "FR-007",
             "file": "tests/scheduled-release.test.mjs",
-            "line": 17
+            "line": 21
           },
           {
             "requirementId": "FR-008",
             "file": "tests/scheduled-release.test.mjs",
-            "line": 18
+            "line": 22
           },
           {
             "requirementId": "FR-009",
             "file": "tests/scheduled-release.test.mjs",
-            "line": 19
+            "line": 23
           },
           {
             "requirementId": "FR-010",
             "file": "tests/scheduled-release.test.mjs",
-            "line": 20
+            "line": 24
           },
           {
             "requirementId": "FR-011",
             "file": "tests/scheduled-release.test.mjs",
-            "line": 21
+            "line": 25
           },
           {
             "requirementId": "FR-012",
             "file": "tests/scheduled-release.test.mjs",
-            "line": 22
+            "line": 26
           },
           {
             "requirementId": "SC-001",
             "file": "tests/scheduled-release.test.mjs",
-            "line": 23
+            "line": 27
           },
           {
             "requirementId": "SC-002",
             "file": "tests/scheduled-release.test.mjs",
-            "line": 24
+            "line": 28
           },
           {
             "requirementId": "SC-003",
             "file": "tests/scheduled-release.test.mjs",
-            "line": 25
+            "line": 29
           },
           {
             "requirementId": "SC-004",
             "file": "tests/scheduled-release.test.mjs",
-            "line": 26
+            "line": 30
           }
         ]
       }

docguard_cli-0.40.2/.github/scripts/validate-release-candidate.mjs

@@ -0,0 +1,75 @@
+#!/usr/bin/env node
+
+/**
+ * Validate the scheduler-generated release diff before it leaves the trusted
+ * default-branch checkout. GitHub's native auto-merge then enforces the
+ * repository's required pull-request checks on every candidate revision.
+ */
+
+import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { evaluateReleaseCandidate } from '../../cli/release-pr-policy.mjs';
+
+const SCRIPT_PATH = fileURLToPath(import.meta.url);
+
+function read(root, path) {
+  return readFileSync(resolve(root, path), 'utf8');
+}
+
+export function validateReleaseWorkspace({
+  root = process.cwd(),
+  baseVersion,
+  branch,
+  repository,
+  defaultBranch = 'main',
+}) {
+  const paths = execFileSync('git', ['diff', '--name-only', 'HEAD', '--'], {
+    cwd: root,
+    encoding: 'utf8',
+  }).trim().split('\n').filter(Boolean);
+  const version = JSON.parse(read(root, 'package.json')).version;
+  const result = evaluateReleaseCandidate({
+    repository,
+    headRepo: repository,
+    defaultBranch,
+    baseRef: defaultBranch,
+    headRef: branch,
+    title: `release: v${version} — automated weekly batch`,
+    author: 'github-actions[bot]',
+    baseVersion,
+    paths,
+    files: {
+      packageJson: read(root, 'package.json'),
+      packageLock: read(root, 'package-lock.json'),
+      pyproject: read(root, 'pyproject.toml'),
+      server: read(root, 'server.json'),
+      extension: read(root, 'extensions/spec-kit-docguard/extension.yml'),
+    },
+    tagExists: false,
+  });
+  if (!result.ok) {
+    throw new Error(result.errors.join('; '));
+  }
+  return { version: result.version, paths };
+}
+
+function valueAfter(flag) {
+  const index = process.argv.indexOf(flag);
+  return index >= 0 ? process.argv[index + 1] : undefined;
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === SCRIPT_PATH) {
+  try {
+    const result = validateReleaseWorkspace({
+      baseVersion: valueAfter('--base-version'),
+      branch: valueAfter('--branch'),
+      repository: process.env.GITHUB_REPOSITORY,
+    });
+    console.log(`Validated v${result.version} release candidate (${result.paths.length} changed files).`);
+  } catch (error) {
+    console.error(`Release candidate validation failed: ${error.message}`);
+    process.exitCode = 1;
+  }
+}

{docguard_cli-0.40.1 → docguard_cli-0.40.2}/.github/workflows/auto-merge.yml

@@ -2,26 +2,19 @@ name: Auto-merge (green bot PRs)
 
 # Hands-off merging for bot PRs that have ALREADY passed the full CI matrix.
 #
-# WHY workflow_run AND NOT `gh pr merge --auto`: GitHub's native auto-merge
-# requires the repo-level `allow_auto_merge` setting plus REQUIRED status
-# checks in branch protection. Without required checks configured, `--auto`
-# merges IMMEDIATELY without waiting for CI — worse than merging by hand.
-# This workflow instead fires only after "DocGuard CI" reports success for
-# the head SHA, re-verifies every matrix leg via the API, and merges itself.
-# No repo settings required, and it is fail-closed: anything unexpected → skip.
+# Release PRs use GitHub's native auto-merge because main now has four required
+# runtime checks. This workflow remains the stricter policy gate for Dependabot
+# and Jules PRs, which have separate version and changed-file restrictions.
 #
 # SECURITY: workflow_run runs in the BASE repo context with write scope. It
 # checks out only the default branch policy with persisted credentials disabled,
-# then reads PR metadata and candidate files as inert API data. It never checks
-# out or executes PR code.
+# reads PR metadata through the API, and never checks out or executes PR code.
 #
 # WHAT AUTO-MERGES:
 #   - dependabot: patch + minor only. Majors NEVER (v0.34.1 shipped a Node-18
 #     break from an auto-accepted @babel/parser major; bug-255).
 #   - jules: test-only and docs-only changes. Anything touching cli/ logic,
 #     .github/, or package.json is labeled and left for a human.
-#   - release: exact scheduler-owned next-version surfaces after a maintainer
-#     approves the repository-token PR's ordinary pull-request CI.
 
 on:
   workflow_run:
@@ -29,17 +22,16 @@ on:
     types: [completed]
 
 permissions:
-  actions: write
   contents: write
   pull-requests: write
   checks: read
 
 jobs:
   auto-merge:
-    if: github.event.workflow_run.conclusion == 'success' && (github.event.workflow_run.event == 'pull_request' || github.event.workflow_run.event == 'workflow_dispatch')
+    if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'pull_request'
     runs-on: ubuntu-latest
     steps:
-      - name: Check out trusted release policy
+      - name: Check out trusted auto-merge policy
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.repository.default_branch }}
@@ -50,7 +42,7 @@ jobs:
         with:
           script: |
             const policyPath = process.env.GITHUB_WORKSPACE + '/cli/release-pr-policy.mjs';
-            const { evaluateReleaseCandidate, evaluateReleaseJobs } = await import(policyPath);
+            const { evaluateReleaseJobs } = await import(policyPath);
             const owner = context.repo.owner;
             const repo = context.repo.repo;
             const run = context.payload.workflow_run;
@@ -67,14 +59,7 @@ jobs:
 
             const BOT_DEPENDABOT = 'dependabot[bot]';
             const BOT_JULES = 'google-labs-jules[bot]';
-            const releaseShape = pr.head.repo.full_name === `${owner}/${repo}` &&
-              /^release\/v\d+\.\d+\.\d+$/.test(pr.head.ref || '') &&
-              /^release: v\d+\.\d+\.\d+ — automated weekly batch$/.test(pr.title || '');
-            if (run.event === 'workflow_dispatch' && !releaseShape) {
-              core.info(`#${num} is not a release PR — dispatched recovery CI cannot auto-merge it.`);
-              return;
-            }
-            if (![BOT_DEPENDABOT, BOT_JULES].includes(author) && !releaseShape) {
+            if (![BOT_DEPENDABOT, BOT_JULES].includes(author)) {
               core.info(`#${num} authored by ${author} (not a handled bot) — leaving alone.`);
               return;
             }
@@ -110,55 +95,7 @@ jobs:
             });
             const paths = files.map((f) => f.filename);
 
-            if (releaseShape) {
-              const textAt = async (path, ref) => {
-                const { data } = await github.rest.repos.getContent({ owner, repo, path, ref });
-                if (Array.isArray(data) || !data.content) throw new Error(`${path}: expected a file`);
-                return Buffer.from(data.content, 'base64').toString('utf8');
-              };
-              try {
-                const candidateFiles = {
-                  packageJson: await textAt('package.json', headSha),
-                  packageLock: await textAt('package-lock.json', headSha),
-                  pyproject: await textAt('pyproject.toml', headSha),
-                  server: await textAt('server.json', headSha),
-                  extension: await textAt('extensions/spec-kit-docguard/extension.yml', headSha),
-                };
-                const baseVersion = JSON.parse(await textAt('package.json', pr.base.sha)).version;
-                const policyInput = {
-                  repository: `${owner}/${repo}`,
-                  headRepo: pr.head.repo.full_name,
-                  defaultBranch: context.payload.repository.default_branch,
-                  baseRef: pr.base.ref,
-                  headRef: pr.head.ref,
-                  title: pr.title,
-                  author,
-                  baseVersion,
-                  paths,
-                  files: candidateFiles,
-                  tagExists: false,
-                };
-                const preliminary = evaluateReleaseCandidate(policyInput);
-                let tagExists = false;
-                if (preliminary.version && /^\d+\.\d+\.\d+$/.test(preliminary.version)) {
-                  try {
-                    await github.rest.git.getRef({ owner, repo, ref: `tags/v${preliminary.version}` });
-                    tagExists = true;
-                  } catch (e) {
-                    if (e.status !== 404) throw e;
-                  }
-                }
-                const candidatePolicy = evaluateReleaseCandidate({ ...policyInput, tagExists });
-                if (!candidatePolicy.ok) {
-                  await hold('needs-review', `release policy rejected the candidate:\n${candidatePolicy.errors.map((error) => `- ${error}`).join('\n')}`);
-                  return;
-                }
-                core.info(`#${num} authenticated tokenless release PR (${pr.head.ref}) — eligible.`);
-              } catch (e) {
-                await hold('needs-review', `release metadata could not be verified: ${e.message}`);
-                return;
-              }
-            } else if (author === BOT_DEPENDABOT) {
+            if (author === BOT_DEPENDABOT) {
               // Version delta from the title: "bump X from 1.2.3 to 1.2.4"
               const m = /from (\d+)\.(\d+)\.(\d+)\S* to (\d+)\.(\d+)\.(\d+)/.exec(pr.title || '');
               if (!m) { await hold('needs-review', 'could not parse the version delta from the PR title.'); return; }
@@ -187,28 +124,9 @@ jobs:
                 owner, repo, pull_number: num, merge_method: 'squash',
               });
               if (!merge.merged) throw new Error(merge.message || 'GitHub declined the merge');
-              if (releaseShape) {
-                try {
-                  await github.rest.actions.createWorkflowDispatch({
-                    owner,
-                    repo,
-                    workflow_id: 'release.yml',
-                    ref: context.payload.repository.default_branch,
-                  });
-                } catch (dispatchError) {
-                  await github.rest.issues.createComment({
-                    owner,
-                    repo,
-                    issue_number: num,
-                    body: `⚠️ **Merged, publication dispatch failed** — ${dispatchError.message}. The next scheduled release run will retry the untagged package version.`,
-                  });
-                  core.setFailed(`Merged #${num}, but release dispatch failed: ${dispatchError.message}`);
-                  return;
-                }
-              }
               await github.rest.issues.createComment({
                 owner, repo, issue_number: num,
-                body: `🤖 **Auto-merged** — the exact CI run passed all four Node legs (18/20/22/24), stayed within the test-runtime budget, and satisfied the policy in \`.github/workflows/auto-merge.yml\`.${releaseShape ? ' Publication was dispatched on main.' : ''}`,
+                body: `🤖 **Auto-merged** — the exact CI run passed all four Node legs (18/20/22/24), stayed within the test-runtime budget, and satisfied the policy in \`.github/workflows/auto-merge.yml\`.`,
               });
               core.notice(`Merged #${num}.`);
             } catch (e) {

{docguard_cli-0.40.1 → docguard_cli-0.40.2}/.github/workflows/scheduled-release.yml

@@ -8,11 +8,12 @@ name: Scheduled Release
 # patch and publish constantly. Weekly batching keeps releases hands-off
 # without turning the registry into a changelog.
 #
-# HOW IT TRIGGERS THE ACTUAL RELEASE: the repository token opens a protected PR.
-# GitHub intentionally holds that PR's workflows for one maintainer approval.
-# Once approved, ordinary PR CI satisfies branch protection and the metadata-only
-# auto-merge gate dispatches release.yml. A later schedule retries publication
-# when package.json has no corresponding tag.
+# HOW IT TRIGGERS THE ACTUAL RELEASE: the repository token validates and opens a
+# protected PR, then arms GitHub's native squash auto-merge. GitHub intentionally
+# holds that PR's workflows for one maintainer approval. Once approved, ordinary
+# PR CI satisfies the required checks, native auto-merge updates main, and the
+# package.json push starts release.yml. A later schedule retries publication when
+# package.json has no corresponding tag.
 #
 # NO-OP WHEN NOTHING CHANGED: if there are no commits since the last release
 # tag, this exits without bumping — no empty releases.
@@ -148,7 +149,8 @@ jobs:
       # workflows for PRs opened by GITHUB_TOKEN until a maintainer approves them;
       # workflow_dispatch jobs do not satisfy those required PR contexts. The
       # approval is the deliberate human boundary that avoids a stored PAT or App
-      # private key. After approval, auto-merge validates the exact PR run.
+      # private key. Native auto-merge remains blocked until all required checks
+      # succeed and resets if the candidate head changes.
       #
       #   1. main requires a pull request. github-actions[bot] is not an admin
       #      and has no bypass, so a direct push is rejected outright.
@@ -158,6 +160,9 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           BRANCH="release/v${NEW_VERSION}"
+          node .github/scripts/validate-release-candidate.mjs \
+            --base-version "${{ steps.check.outputs.current }}" \
+            --branch "$BRANCH"
           EXISTING=$(gh pr list --base main --head "$BRANCH" --state open --json url --jq '.[0].url // ""')
           if [ -n "$EXISTING" ]; then
             echo "Reusing existing release PR: $EXISTING"
@@ -166,7 +171,8 @@ jobs:
               echo "::error::Existing $BRANCH does not contain current main; refusing to validate a stale release."
               exit 1
             fi
-            echo "Maintainer action required: approve the PR workflows in GitHub."
+            gh pr merge --auto --squash "$EXISTING"
+            echo "Auto-merge armed. Maintainer action required: approve the PR workflows in GitHub."
             exit 0
           fi
           if git ls-remote --exit-code --heads origin "$BRANCH" >/dev/null 2>&1; then
@@ -180,10 +186,10 @@ jobs:
           git commit -m "release: v${NEW_VERSION} — automated weekly batch
 
           Cut by .github/workflows/scheduled-release.yml. Publishing itself is
-          handled by release.yml, which the merge gate dispatches on main."
+          handled by release.yml after protected native auto-merge updates main."
           git push origin "$BRANCH"
 
-          gh pr create \
+          PR_URL=$(gh pr create \
             --base main \
             --head "$BRANCH" \
             --title "release: v${NEW_VERSION} — automated weekly batch" \
@@ -191,6 +197,7 @@ jobs:
 
           Batches everything merged since \`${{ steps.check.outputs.last_tag }}\`. Tests and \`guard\` already passed on this tree before the PR was opened.
 
-          **Maintainer action required:** select **Approve workflows to run** in GitHub. The ordinary pull-request CI then satisfies branch protection; once green, \`auto-merge.yml\` validates the exact run, merges this PR, and dispatches \`release.yml\` to tag and publish."
+          **Maintainer action required:** select **Approve workflows to run** in GitHub. The ordinary pull-request CI then satisfies branch protection; GitHub's protected native auto-merge merges the exact green head, and the resulting \`package.json\` push starts \`release.yml\` to tag and publish.")
 
-          echo "Opened $BRANCH. Approve its workflows in GitHub to continue the release."
+          gh pr merge --auto --squash "$PR_URL"
+          echo "Opened $BRANCH with auto-merge armed. Approve its workflows in GitHub to continue the release."

{docguard_cli-0.40.1 → docguard_cli-0.40.2}/.wolf/buglog.json

@@ -5689,7 +5689,7 @@
       "error_message": "Repository-token-dispatched CI passed for release PR #376 but did not emit the workflow_run event required to merge and publish",
       "file": ".github/workflows/scheduled-release.yml",
       "root_cause": "The design applied GitHub's workflow_dispatch recursion exception to the dispatched CI run but incorrectly assumed that the later workflow_run event was also exempt; the live probe used a user token and did not reproduce github-actions[bot] provenance",
-      "fix": "Expose GitHub's required maintainer approval for repository-token-created PR workflows, then let the existing trusted workflow_run gate validate, merge, and publish",
+      "fix": "Expose GitHub's required maintainer approval for repository-token-created PR workflows, prevalidate the candidate in the trusted scheduler, and arm protected native auto-merge instead of relying on a downstream callback",
       "tags": [
         "release",
         "github-actions",
@@ -5722,6 +5722,27 @@
       ],
       "occurrences": 1,
       "last_seen": "2026-09-15T02:05:05.000Z"
+    },
+    {
+      "id": "bug-346",
+      "timestamp": "2026-09-15T02:18:57.000Z",
+      "error_message": "Release PR #380 passed approved pull-request CI but the workflow_run auto-merge listener did not wake again",
+      "file": ".github/workflows/scheduled-release.yml; .github/workflows/auto-merge.yml",
+      "root_cause": "GitHub emitted the workflow_run completion when the repository-token PR entered action_required; approving that run executed its jobs without emitting a second completion event for the listener",
+      "fix": "Validate the generated release diff before push, enable repository native auto-merge with all four runtime checks required, arm squash auto-merge when opening or reusing the PR, and leave the workflow_run gate scoped to Dependabot and Jules",
+      "tags": [
+        "release",
+        "github-actions",
+        "workflow-run",
+        "native-auto-merge",
+        "branch-protection"
+      ],
+      "related_bugs": [
+        "bug-344",
+        "bug-345"
+      ],
+      "occurrences": 1,
+      "last_seen": "2026-09-15T02:18:57.000Z"
     }
   ]
 }

{docguard_cli-0.40.1 → docguard_cli-0.40.2}/.wolf/cerebrum.md

@@ -78,7 +78,7 @@
 - **2026-09-14** — Never treat a Git object ID as durable recovery by itself; unreachable commits and blobs can be garbage-collected after squash merges or branch deletion. Require the source revision to be an ancestor of a recorded retention ref and report recoverability explicitly.
 - **2026-09-14** — Never count a bare requirement ID as feature-completion evidence. Once the original spec is retired, a formerly ambiguous `FR-012` can become unique and silently rebind to another feature. Feature gates require a qualified stable identity; retired identities remain tombstoned.
 - **2026-09-14** — A document retirement command must reject source files, submodules, untracked/ignored leftovers, dirty evidence, and live links before mutation. `Completed` artifact maturity does not authorize removal, especially when the Spec Kit Archive extension intentionally retains completed feature files.
-- **2026-09-14** — Protected scheduled releases can avoid a persistent credential, but GitHub requires one maintainer approval for workflows on a PR created by `GITHUB_TOKEN`. A bot-authored `workflow_dispatch` does not emit the downstream `workflow_run`, and its successful jobs do not satisfy required pull-request checks. After approval, the default-branch `workflow_run` gate verifies the exact PR run, candidate SHA, bot identity, paths, and synchronized versions without executing candidate code. A missing tag is recovered before another bump; retain failed release attempts as evidence and close their generated PRs and branches.
+- **2026-09-14** — Protected scheduled releases can avoid a persistent credential, but GitHub requires one maintainer approval for workflows on a PR created by `GITHUB_TOKEN`. Dispatched jobs do not satisfy required pull-request checks, and approving an `action_required` run does not emit a second `workflow_run` completion. Validate the generated candidate in the trusted scheduler before push, arm native auto-merge only where required checks are configured, and let the merged version push start publication. A missing tag is recovered before another bump; retain failed release attempts as evidence and close their generated PRs and branches.
 
 - **2026-07-15** — `docguard ci` was silently routed through `runInit --with ci` since v0.20: the pipeline gate scaffolded missing docs into the workspace and corrupted `--format json` stdout with init chrome (bug-228). Un-deprecated in v0.33 (direct runCI dispatch). Lesson: when a command is deprecated-with-routing, verify the ROUTE preserves the command's contract (read-only? machine stdout?) — a passing test suite didn't catch it because the consolidation test only asserted the warning text, not the side effects.
 - **2026-07-03** — Adding a machine output format to a command is TWO changes, not one: the format branch in the command AND the dispatcher's `jsonMode` gate (docguard.mjs ~line 515). `guard --format sarif` initially emitted the banner + ensureSkills chrome INTO the SARIF stream because `jsonMode` only recognized `'json'` — caught by the spawn test's no-ANSI assertion before ship. Any future format (`junit`, `csv`, …) must join that gate or stdout is corrupted for parsers. Same class as the READ_ONLY_COMMANDS gotcha (learning #17).

{docguard_cli-0.40.1 → docguard_cli-0.40.2}/CHANGELOG.md

@@ -7,6 +7,30 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.40.2] - 2026-09-15
+
+Automated weekly release — batches everything merged since `v0.40.1`.
+
+### Changed
+
+- fix: use protected native release auto-merge (#382)
+
+
+### Changed
+
+- Prevalidate scheduler-generated release identity, synchronized versions, and
+  changed paths before push, then arm GitHub's protected native squash
+  auto-merge for both new and reused release PRs.
+- Keep the privileged `workflow_run` auto-merge gate scoped to Dependabot and
+  Jules; release publication continues from the merged `package.json` push.
+
+### Fixed
+
+- Replace the missing post-approval `workflow_run` continuation discovered by
+  release PR #380. GitHub executes an approved `action_required` run without
+  emitting a second completion event, so the old listener could not merge an
+  otherwise green release PR.
+
 ## [0.40.1] - 2026-09-15
 
 Automated weekly release — batches everything merged since `v0.40.0`.

{docguard_cli-0.40.1 → docguard_cli-0.40.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: docguard-cli
-Version: 0.40.1
+Version: 0.40.2
 Summary: The enforcement tool for Canonical-Driven Development (CDD). Audit, generate, and guard your project documentation. No Python dependencies (requires Node.js 18+).
 Project-URL: Homepage, https://github.com/raccioly/docguard
 Project-URL: Documentation, https://github.com/raccioly/docguard#readme

{docguard_cli-0.40.1 → docguard_cli-0.40.2}/ROADMAP.md

@@ -222,9 +222,9 @@ Governing spec: `specs/011-tokenless-scheduled-releases/spec.md`.
 
 Replace the long-lived release PR credential with an ephemeral repository token
 and one explicit maintainer approval for the generated PR's workflows. The
-implementation keeps the privileged merge gate metadata-only, validates exact
-candidate and CI identity, dispatches publication after merge, and recovers a
-missing tag before another version increment.
+implementation validates the generated candidate before push, arms protected
+native auto-merge, starts publication from the merged version push, and recovers
+a missing tag before another version increment.
 
 - [x] Freeze the security and recovery contract before implementation.
 - [x] Add pure release-candidate and exact-run policy tests.
@@ -233,6 +233,10 @@ missing tag before another version increment.
 - [x] Preserve Dependabot/Jules policy and pinned-action controls.
 - [x] Record the reviewed lifecycle outcome at durable revision `46531e4` with
   no accepted deviations.
+- [x] Publish v0.40.1 through release PR #380 and verify npm, PyPI, GHCR, GitHub
+  release assets, and the Spec Kit catalog reminder.
+- [ ] Verify the corrected repository-token native auto-merge continuation on
+  the next release and retain exact evidence.
 
 The retained live probe used CI run `34912654565` and privileged gate run
 `34912788971`. All Node 18, 20, 22, and 24 jobs passed. The trusted gate
@@ -240,6 +244,12 @@ identified pull request #372 as a non-release candidate and refused to merge it;
 the temporary pull request and branch were then removed. The complete reviewed
 evidence landed through pull requests #371, #373, and #374.
 
+Release PR #380 passed CI run `34920481989` and supply-chain run `34920482409`,
+merged at `5b2dfe4`, and published v0.40.1 in run `34920702346`. That run also
+proved the final GitHub boundary: approving the held workflow does not emit a
+second `workflow_run` completion. Native auto-merge is now the continuation;
+its repository-token provenance proof remains the only open R8 evidence item.
+
 ## Contribution standard
 
 Before opening work, search existing open and closed issues and pull requests.