docguard-cli 0.40.2__tar.gz → 0.40.3__tar.gz

{docguard_cli-0.40.2 → docguard_cli-0.40.3}/.agent/skills/docguard-fix/SKILL.md

@@ -6,10 +6,10 @@ description: AI-driven documentation repair with structured research workflow, t
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.40.2
+  version: 0.40.3
   source: extensions/spec-kit-docguard/skills/docguard-fix
 ---
-<!-- docguard:version: 0.40.2 -->
+<!-- docguard:version: 0.40.3 -->
 
 # DocGuard Fix Skill
 

{docguard_cli-0.40.2/extensions/spec-kit-docguard → docguard_cli-0.40.3/.agent}/skills/docguard-guard/SKILL.md

@@ -7,10 +7,10 @@ description: Run DocGuard guard validation against Canonical-Driven Development
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.40.2
+  version: 0.40.3
   source: extensions/spec-kit-docguard/skills/docguard-guard
 ---
-<!-- docguard:version: 0.40.2 -->
+<!-- docguard:version: 0.40.3 -->
 
 # DocGuard Guard Skill
 

{docguard_cli-0.40.2/extensions/spec-kit-docguard → docguard_cli-0.40.3/.agent}/skills/docguard-review/SKILL.md

@@ -6,10 +6,10 @@ description: Cross-document consistency analysis and quality assessment. Perform
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.40.2
+  version: 0.40.3
   source: extensions/spec-kit-docguard/skills/docguard-review
 ---
-<!-- docguard:version: 0.40.2 -->
+<!-- docguard:version: 0.40.3 -->
 
 # DocGuard Review Skill
 

{docguard_cli-0.40.2/extensions/spec-kit-docguard → docguard_cli-0.40.3/.agent}/skills/docguard-score/SKILL.md

@@ -6,10 +6,10 @@ description: CDD maturity assessment with category-aware improvement roadmap. Ru
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.40.2
+  version: 0.40.3
   source: extensions/spec-kit-docguard/skills/docguard-score
 ---
-<!-- docguard:version: 0.40.2 -->
+<!-- docguard:version: 0.40.3 -->
 
 # DocGuard Score Skill
 

{docguard_cli-0.40.2 → docguard_cli-0.40.3}/.agent/skills/docguard-sync/SKILL.md

@@ -4,10 +4,10 @@ description: Keep canonical documentation ALWAYS UP TO DATE. Refreshes code-trut
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.40.2
+  version: 0.40.3
   source: extensions/spec-kit-docguard/skills/docguard-sync
 ---
-<!-- docguard:version: 0.40.2 -->
+<!-- docguard:version: 0.40.3 -->
 
 # DocGuard Sync Skill
 

{docguard_cli-0.40.2 → docguard_cli-0.40.3}/.docguard-specs.json

@@ -2070,15 +2070,15 @@
         "artifacts": [
           {
             "path": "specs/011-tokenless-scheduled-releases/spec.md",
-            "digest": "sha256:b5e9f78c62a085b06c30a1ef2a67c45df9a2177aa75f25049c42c7c71e99e543"
+            "digest": "sha256:507528b6a9e43ae748a000fa8b6bf166d1408e271ee1e9c6348729eda172e30c"
           },
           {
             "path": "specs/011-tokenless-scheduled-releases/plan.md",
-            "digest": "sha256:f833cdcbe825ab6a75ab484ac586ef3e36a984b7856f196730bb6ca5cdd0393e"
+            "digest": "sha256:f902658d4173718522335f70ec436040db5a7a8ee7677975d38d4984c832d30a"
           },
           {
             "path": "specs/011-tokenless-scheduled-releases/tasks.md",
-            "digest": "sha256:9b49cf5672efd0bea5ccca4e1c83239c77854e5733630ab64e800185e1fa44a9"
+            "digest": "sha256:1af12c52080eaa54711646ced72490094d17383b157510c98e7df7012e9ace22"
           }
         ],
         "taskCompletion": {

{docguard_cli-0.40.2 → docguard_cli-0.40.3}/.github/workflows/release.yml

@@ -3,6 +3,11 @@ name: Auto Release — Tag, GitHub Release, npm, PyPI
 # Triggers on push to main — detects version bumps automatically
 on:
   workflow_dispatch: # Allow manual trigger for recovery
+  schedule:
+    # GitHub suppresses push workflows when native auto-merge was armed by
+    # GITHUB_TOKEN. This cheap tag-driven sweep makes late approvals recover
+    # within an hour without a PAT, App key, or continuously polling runner.
+    - cron: '17 * * * *'
   push:
     branches: [main]
     paths:

{docguard_cli-0.40.2 → docguard_cli-0.40.3}/.github/workflows/scheduled-release.yml

@@ -11,9 +11,9 @@ name: Scheduled Release
 # HOW IT TRIGGERS THE ACTUAL RELEASE: the repository token validates and opens a
 # protected PR, then arms GitHub's native squash auto-merge. GitHub intentionally
 # holds that PR's workflows for one maintainer approval. Once approved, ordinary
-# PR CI satisfies the required checks, native auto-merge updates main, and the
-# package.json push starts release.yml. A later schedule retries publication when
-# package.json has no corresponding tag.
+# PR CI satisfies the required checks and native auto-merge updates main. The
+# scheduler waits briefly and dispatches release.yml after that merge; an hourly
+# tag-driven sweep recovers approvals that happen after the wait ends.
 #
 # NO-OP WHEN NOTHING CHANGED: if there are no commits since the last release
 # tag, this exits without bumping — no empty releases.
@@ -159,6 +159,24 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
+          wait_for_merge_and_publish() {
+            PR_URL="$1"
+            for ATTEMPT in $(seq 1 40); do
+              STATE=$(gh pr view "$PR_URL" --json state --jq '.state')
+              if [ "$STATE" = "MERGED" ]; then
+                echo "Release PR merged; dispatching tag-driven publication."
+                gh workflow run release.yml --ref main
+                return 0
+              fi
+              if [ "$STATE" = "CLOSED" ]; then
+                echo "::error::Release PR closed without merge."
+                return 1
+              fi
+              sleep 15
+            done
+            echo "::notice::Release PR remains open after 10 minutes. The hourly tag-driven release sweep will publish after later approval and merge."
+          }
+
           BRANCH="release/v${NEW_VERSION}"
           node .github/scripts/validate-release-candidate.mjs \
             --base-version "${{ steps.check.outputs.current }}" \
@@ -173,6 +191,7 @@ jobs:
             fi
             gh pr merge --auto --squash "$EXISTING"
             echo "Auto-merge armed. Maintainer action required: approve the PR workflows in GitHub."
+            wait_for_merge_and_publish "$EXISTING"
             exit 0
           fi
           if git ls-remote --exit-code --heads origin "$BRANCH" >/dev/null 2>&1; then
@@ -186,7 +205,7 @@ jobs:
           git commit -m "release: v${NEW_VERSION} — automated weekly batch
 
           Cut by .github/workflows/scheduled-release.yml. Publishing itself is
-          handled by release.yml after protected native auto-merge updates main."
+          dispatched after protected native auto-merge updates main."
           git push origin "$BRANCH"
 
           PR_URL=$(gh pr create \
@@ -197,7 +216,8 @@ jobs:
 
           Batches everything merged since \`${{ steps.check.outputs.last_tag }}\`. Tests and \`guard\` already passed on this tree before the PR was opened.
 
-          **Maintainer action required:** select **Approve workflows to run** in GitHub. The ordinary pull-request CI then satisfies branch protection; GitHub's protected native auto-merge merges the exact green head, and the resulting \`package.json\` push starts \`release.yml\` to tag and publish.")
+          **Maintainer action required:** select **Approve workflows to run** in GitHub. The ordinary pull-request CI then satisfies branch protection; GitHub's protected native auto-merge merges the exact green head, and the waiting scheduler dispatches \`release.yml\`. An hourly tag-driven sweep recovers later approvals.")
 
           gh pr merge --auto --squash "$PR_URL"
           echo "Opened $BRANCH with auto-merge armed. Approve its workflows in GitHub to continue the release."
+          wait_for_merge_and_publish "$PR_URL"

{docguard_cli-0.40.2 → docguard_cli-0.40.3}/.wolf/buglog.json

@@ -5743,6 +5743,26 @@
       ],
       "occurrences": 1,
       "last_seen": "2026-09-15T02:18:57.000Z"
+    },
+    {
+      "id": "bug-347",
+      "timestamp": "2026-09-15T02:37:35.000Z",
+      "error_message": "Repository-token native auto-merge completed release PR #383 but its package.json push did not start release.yml",
+      "file": ".github/workflows/scheduled-release.yml; .github/workflows/release.yml",
+      "root_cause": "GitHub treated the native merge armed by GITHUB_TOKEN as repository-token-originated activity and suppressed the downstream push workflow",
+      "fix": "Keep the scheduler alive for a bounded merge wait and dispatch publication explicitly, with an hourly tag-driven release sweep for approvals after that window and interrupted publication",
+      "tags": [
+        "release",
+        "github-token",
+        "native-auto-merge",
+        "workflow-recursion",
+        "recovery"
+      ],
+      "related_bugs": [
+        "bug-346"
+      ],
+      "occurrences": 1,
+      "last_seen": "2026-09-15T02:37:35.000Z"
     }
   ]
 }

{docguard_cli-0.40.2 → docguard_cli-0.40.3}/.wolf/cerebrum.md

@@ -78,7 +78,7 @@
 - **2026-09-14** — Never treat a Git object ID as durable recovery by itself; unreachable commits and blobs can be garbage-collected after squash merges or branch deletion. Require the source revision to be an ancestor of a recorded retention ref and report recoverability explicitly.
 - **2026-09-14** — Never count a bare requirement ID as feature-completion evidence. Once the original spec is retired, a formerly ambiguous `FR-012` can become unique and silently rebind to another feature. Feature gates require a qualified stable identity; retired identities remain tombstoned.
 - **2026-09-14** — A document retirement command must reject source files, submodules, untracked/ignored leftovers, dirty evidence, and live links before mutation. `Completed` artifact maturity does not authorize removal, especially when the Spec Kit Archive extension intentionally retains completed feature files.
-- **2026-09-14** — Protected scheduled releases can avoid a persistent credential, but GitHub requires one maintainer approval for workflows on a PR created by `GITHUB_TOKEN`. Dispatched jobs do not satisfy required pull-request checks, and approving an `action_required` run does not emit a second `workflow_run` completion. Validate the generated candidate in the trusted scheduler before push, arm native auto-merge only where required checks are configured, and let the merged version push start publication. A missing tag is recovered before another bump; retain failed release attempts as evidence and close their generated PRs and branches.
+- **2026-09-14** — Protected scheduled releases can avoid a persistent credential, but GitHub requires one maintainer approval for workflows on a PR created by `GITHUB_TOKEN`. Dispatched jobs do not satisfy required pull-request checks, approving an `action_required` run does not emit a second `workflow_run` completion, and a native merge armed by the repository token suppresses downstream push workflows. Validate the candidate in the trusted scheduler before push, arm native auto-merge only where required checks exist, wait briefly to dispatch publication after merge, and run an hourly tag-driven recovery for later approvals. Retain failed release attempts as evidence and close their generated PRs and branches.
 
 - **2026-07-15** — `docguard ci` was silently routed through `runInit --with ci` since v0.20: the pipeline gate scaffolded missing docs into the workspace and corrupted `--format json` stdout with init chrome (bug-228). Un-deprecated in v0.33 (direct runCI dispatch). Lesson: when a command is deprecated-with-routing, verify the ROUTE preserves the command's contract (read-only? machine stdout?) — a passing test suite didn't catch it because the consolidation test only asserted the warning text, not the side effects.
 - **2026-07-03** — Adding a machine output format to a command is TWO changes, not one: the format branch in the command AND the dispatcher's `jsonMode` gate (docguard.mjs ~line 515). `guard --format sarif` initially emitted the banner + ensureSkills chrome INTO the SARIF stream because `jsonMode` only recognized `'json'` — caught by the spawn test's no-ANSI assertion before ship. Any future format (`junit`, `csv`, …) must join that gate or stdout is corrupted for parsers. Same class as the READ_ONLY_COMMANDS gotcha (learning #17).

{docguard_cli-0.40.2 → docguard_cli-0.40.3}/CHANGELOG.md

@@ -7,6 +7,29 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.40.3] - 2026-09-15
+
+Automated weekly release — batches everything merged since `v0.40.2`.
+
+### Changed
+
+- fix: recover tokenless release publication (#385)
+
+
+### Added
+
+- Add an hourly tag-driven release recovery sweep. Already tagged versions stop
+  after detection, while a merged but unpublished package version enters the
+  existing serialized test, tag, and registry publication transaction.
+
+### Fixed
+
+- Keep the scheduled release job alive for a bounded ten-minute approval window
+  and dispatch publication once native auto-merge completes. This covers the
+  normal operator flow without a persistent credential or an always-on poller.
+- Stop relying on the `package.json` push from a native auto-merge armed by
+  `GITHUB_TOKEN`; GitHub suppresses downstream push workflows for that merge.
+
 ## [0.40.2] - 2026-09-15
 
 Automated weekly release — batches everything merged since `v0.40.1`.

{docguard_cli-0.40.2 → docguard_cli-0.40.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: docguard-cli
-Version: 0.40.2
+Version: 0.40.3
 Summary: The enforcement tool for Canonical-Driven Development (CDD). Audit, generate, and guard your project documentation. No Python dependencies (requires Node.js 18+).
 Project-URL: Homepage, https://github.com/raccioly/docguard
 Project-URL: Documentation, https://github.com/raccioly/docguard#readme

{docguard_cli-0.40.2 → docguard_cli-0.40.3}/ROADMAP.md

@@ -248,7 +248,11 @@ Release PR #380 passed CI run `34920481989` and supply-chain run `34920482409`,
 merged at `5b2dfe4`, and published v0.40.1 in run `34920702346`. That run also
 proved the final GitHub boundary: approving the held workflow does not emit a
 second `workflow_run` completion. Native auto-merge is now the continuation;
-its repository-token provenance proof remains the only open R8 evidence item.
+release PR #383 proved the repository token can arm it and GitHub can merge after
+approved checks. That merge also proved its bot-originated push does not trigger
+publication. A bounded scheduler wait plus hourly tag-driven recovery is the
+final continuation under verification; exact publication evidence remains the
+only open R8 item.
 
 ## Contribution standard
 

{docguard_cli-0.40.2 → docguard_cli-0.40.3}/docs-canonical/CI-RECIPES.md

@@ -62,18 +62,24 @@ Before the branch is pushed, the trusted scheduler validates the base repository
 bot author, branch/title/version agreement, next-version increment, synchronized
 package surfaces, and changed-file allowlist. It then arms GitHub's native squash
 auto-merge. Native auto-merge remains blocked by the four required checks, binds
-eligibility to the current PR head, and resets when that head changes. The merged
-`package.json` push starts the idempotent release workflow. If publication is
-interrupted, the next schedule sees the current package version without a tag and
-retries publication before considering another bump. An orphaned release branch
-fails closed; an existing open release PR is reused and has auto-merge re-armed.
+eligibility to the current PR head, and resets when that head changes. The
+scheduler waits up to ten minutes for the merge and then dispatches the
+idempotent release workflow. An hourly tag-driven release sweep covers approvals
+that happen after this bounded wait; tagged versions exit after the small detect
+job. If publication is interrupted, either the hourly sweep or the next release
+schedule sees the current package version without a tag and retries publication
+before considering another bump. An orphaned release branch fails closed; an
+existing open release PR is reused and has auto-merge re-armed.
 
 Do not use a post-approval `workflow_run` listener as the release continuation.
 The approval-required completion is the event that listener observes; approving
 the held run executes its jobs without producing a second completion event for
 the listener. Release PR #380 demonstrated this boundary while publishing
-v0.40.1. Repository native auto-merge avoids polling and another credential while
-leaving the required checks as the merge authority.
+v0.40.1. Release PR #383 then proved repository-token native auto-merge, while
+also proving that its resulting push is recursion-suppressed and cannot be the
+sole publication trigger. The bounded wait handles the normal approval path; the
+hourly tag sweep supplies durable recovery without continuous polling or another
+credential.
 
 ## Recipe 3b — Spec completion and post-hoc reconciliation
 

{docguard_cli-0.40.2 → docguard_cli-0.40.3}/extensions/spec-kit-docguard/extension.yml

@@ -3,7 +3,7 @@ schema_version: "1.0"
 extension:
   id: "docguard"
   name: "DocGuard — CDD Enforcement"
-  version: "0.40.2"
+  version: "0.40.3"
   description: "Canonical-Driven Development enforcement as a true spec-kit extension. LLM-first design with automated validators, 5 AI behavior skills, spec-kit skill chaining, and workflow hooks. One pinned runtime dependency (@babel/parser); pure Node.js otherwise."
   author: "Ricardo Accioly"
   repository: "https://github.com/raccioly/docguard"

{docguard_cli-0.40.2 → docguard_cli-0.40.3}/extensions/spec-kit-docguard/skills/docguard-fix/SKILL.md

@@ -6,10 +6,10 @@ description: AI-driven documentation repair with structured research workflow, t
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.40.2
+  version: 0.40.3
   source: extensions/spec-kit-docguard/skills/docguard-fix
 ---
-<!-- docguard:version: 0.40.2 -->
+<!-- docguard:version: 0.40.3 -->
 
 # DocGuard Fix Skill
 

{docguard_cli-0.40.2/.agent → docguard_cli-0.40.3/extensions/spec-kit-docguard}/skills/docguard-guard/SKILL.md

@@ -7,10 +7,10 @@ description: Run DocGuard guard validation against Canonical-Driven Development
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.40.2
+  version: 0.40.3
   source: extensions/spec-kit-docguard/skills/docguard-guard
 ---
-<!-- docguard:version: 0.40.2 -->
+<!-- docguard:version: 0.40.3 -->
 
 # DocGuard Guard Skill
 

{docguard_cli-0.40.2/.agent → docguard_cli-0.40.3/extensions/spec-kit-docguard}/skills/docguard-review/SKILL.md

@@ -6,10 +6,10 @@ description: Cross-document consistency analysis and quality assessment. Perform
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.40.2
+  version: 0.40.3
   source: extensions/spec-kit-docguard/skills/docguard-review
 ---
-<!-- docguard:version: 0.40.2 -->
+<!-- docguard:version: 0.40.3 -->
 
 # DocGuard Review Skill
 

{docguard_cli-0.40.2/.agent → docguard_cli-0.40.3/extensions/spec-kit-docguard}/skills/docguard-score/SKILL.md

@@ -6,10 +6,10 @@ description: CDD maturity assessment with category-aware improvement roadmap. Ru
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.40.2
+  version: 0.40.3
   source: extensions/spec-kit-docguard/skills/docguard-score
 ---
-<!-- docguard:version: 0.40.2 -->
+<!-- docguard:version: 0.40.3 -->
 
 # DocGuard Score Skill
 

{docguard_cli-0.40.2 → docguard_cli-0.40.3}/extensions/spec-kit-docguard/skills/docguard-sync/SKILL.md

@@ -4,10 +4,10 @@ description: Keep canonical documentation ALWAYS UP TO DATE. Refreshes code-trut
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.40.2
+  version: 0.40.3
   source: extensions/spec-kit-docguard/skills/docguard-sync
 ---
-<!-- docguard:version: 0.40.2 -->
+<!-- docguard:version: 0.40.3 -->
 
 # DocGuard Sync Skill
 

{docguard_cli-0.40.2 → docguard_cli-0.40.3}/extensions/spec-kit-docguard/templates/github-workflows/docguard-autofix.yml

@@ -44,7 +44,7 @@ jobs:
           fetch-depth: 0
 
       - name: Run DocGuard fix --write + auto-commit + PR comment
-        uses: raccioly/docguard@v0.40.2
+        uses: raccioly/docguard@v0.40.3
         with:
           command: fix
           auto-commit: 'true'

{docguard_cli-0.40.2 → docguard_cli-0.40.3}/extensions/spec-kit-docguard/templates/github-workflows/docguard-guard.yml

@@ -35,7 +35,7 @@ jobs:
           node-version: '20'
 
       - name: Install DocGuard
-        run: npm install --global --ignore-scripts docguard-cli@0.40.2
+        run: npm install --global --ignore-scripts docguard-cli@0.40.3
 
       - name: Run DocGuard
         shell: bash

{docguard_cli-0.40.2 → docguard_cli-0.40.3}/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "docguard-cli",
-  "version": "0.40.2",
+  "version": "0.40.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "docguard-cli",
-      "version": "0.40.2",
+      "version": "0.40.3",
       "license": "MIT",
       "dependencies": {
         "@babel/parser": "7.29.8"

{docguard_cli-0.40.2 → docguard_cli-0.40.3}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "docguard-cli",
-  "version": "0.40.2",
+  "version": "0.40.3",
   "description": "The enforcement tool for Canonical-Driven Development (CDD). Audit, generate, and guard your project documentation.",
   "type": "module",
   "bin": {

{docguard_cli-0.40.2 → docguard_cli-0.40.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "docguard-cli"
-version = "0.40.2"
+version = "0.40.3"
 description = "The enforcement tool for Canonical-Driven Development (CDD). Audit, generate, and guard your project documentation. No Python dependencies (requires Node.js 18+)."
 readme = "README.md"
 license = { text = "MIT" }

{docguard_cli-0.40.2 → docguard_cli-0.40.3}/server.json

@@ -3,7 +3,7 @@
   "name": "io.github.raccioly/docguard",
   "title": "DocGuard",
   "description": "Deterministic doc-drift detection: guard, score, explain, verify-claims and diagnose MCP tools.",
-  "version": "0.40.2",
+  "version": "0.40.3",
   "websiteUrl": "https://github.com/raccioly/docguard#readme",
   "repository": {
     "url": "https://github.com/raccioly/docguard",
@@ -14,7 +14,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "docguard-cli",
-      "version": "0.40.2",
+      "version": "0.40.3",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"

{docguard_cli-0.40.2 → docguard_cli-0.40.3}/specs/011-tokenless-scheduled-releases/plan.md

@@ -20,7 +20,7 @@ recovery before any new bump.
 - Permissions: the scheduler receives `contents`, `pull-requests`, and `actions`
   write. No release-specific workflow receives a persistent credential.
 - Recovery: `release.yml` remains tag-driven and idempotent. A missing current
-  tag is dispatched before the scheduler considers another version.
+  tag is checked hourly and before the scheduler considers another version.
 
 ## Project Structure
 
@@ -46,7 +46,8 @@ Use `GITHUB_TOKEN` to push and open the release PR. Reuse an existing open relea
 PR and reject an orphaned same-name branch. Require a maintainer to approve the
 held pull-request workflows in GitHub. Validate the generated diff before push
 and arm GitHub native auto-merge. Once ordinary CI passes all required checks,
-native auto-merge updates `main` and its version push starts `release.yml`.
+native auto-merge updates `main`; the waiting scheduler dispatches `release.yml`.
+An hourly tag-driven sweep covers approvals after the bounded wait.
 
 ## Phase 3 — Recovery, verification, and closeout
 
@@ -76,3 +77,9 @@ runtime checks. Prevalidate the release diff in the trusted scheduler, arm squas
 auto-merge on both new and reused release PRs, and remove release handling from
 the Dependabot/Jules `workflow_run` gate. Prove repository-token provenance with
 the next live release before closing corrective verification.
+
+Release PR #383 proved the repository token can arm native auto-merge and that
+GitHub merges after approved required checks. It also showed that the resulting
+bot-originated push does not trigger publication. Add a ten-minute bounded wait
+to dispatch the normal path and an hourly idempotent sweep for later approvals;
+prove both continuation and publication on the next live release.

{docguard_cli-0.40.2 → docguard_cli-0.40.3}/specs/011-tokenless-scheduled-releases/spec.md

@@ -76,9 +76,10 @@ considers another version bump.
   before pushing the branch. Candidate identity, synchronized version surfaces,
   and the changed-file allowlist MUST fail closed without executing code supplied
   by a previously opened release branch.
-- **FR-010**: A successful native release-PR merge MUST trigger the existing
-  idempotent release workflow through the default branch `package.json` push.
-  Missing-tag recovery MUST provide a later retry path.
+- **FR-010**: After arming native auto-merge, the scheduler MUST wait for a
+  bounded interval and dispatch the existing idempotent release workflow when
+  the PR merges. An hourly tag-driven sweep MUST recover later approvals and
+  interrupted publication before another version increment.
 - **FR-011**: Existing Dependabot and Jules auto-merge policies MUST preserve
   their current pull-request-only behavior and file/version restrictions.
 - **FR-012**: All executable third-party actions MUST remain pinned to reviewed
@@ -91,7 +92,7 @@ considers another version bump.
 - **SC-002**: Workflow contract tests prove the explicit maintainer-approval
   boundary, absence of a stored release credential, missing-tag recovery,
   stale-branch refusal, pre-push candidate validation, protected native
-  auto-merge, and push-triggered publication.
+  auto-merge, bounded publication dispatch, and hourly missing-tag recovery.
 - **SC-003**: The complete Node 18, 20, 22, and 24 CI matrix, supply-chain scan,
   self-guard, and action-pin checks pass.
 - **SC-004**: A live repository-token-generated release PR proves that one

{docguard_cli-0.40.2 → docguard_cli-0.40.3}/specs/011-tokenless-scheduled-releases/tasks.md

@@ -41,5 +41,6 @@
 - [x] T014 Replace the missing post-approval `workflow_run` callback with
   pre-push candidate validation and GitHub protected native auto-merge while
   preserving the separate Dependabot/Jules gate.
-- [ ] T015 Prove the repository-token auto-merge arm and end-to-end publication
-  on the next live release, then record the exact merge and registry evidence.
+- [ ] T015 Prove the repository-token auto-merge arm, bounded publication
+  continuation, and end-to-end registries on the next live release, then record
+  the exact merge and publication evidence.

{docguard_cli-0.40.2 → docguard_cli-0.40.3}/templates/ci/github-actions.yml

@@ -31,7 +31,7 @@ jobs:
           node-version: '20'
 
       - name: Install DocGuard
-        run: npm install --global --ignore-scripts docguard-cli@0.40.2
+        run: npm install --global --ignore-scripts docguard-cli@0.40.3
 
       - name: Run DocGuard
         shell: bash

{docguard_cli-0.40.2 → docguard_cli-0.40.3}/tests/scheduled-release.test.mjs

@@ -49,11 +49,15 @@ describe('scheduled release workflow', () => {
     assert.match(workflow, /gh pr merge --auto --squash "\$EXISTING"/);
     assert.match(workflow, /validate-release-candidate\.mjs/);
     assert.match(workflow, /gh workflow run release\.yml --ref main/);
+    assert.match(workflow, /wait_for_merge_and_publish/);
+    assert.match(workflow, /seq 1 40/);
+    assert.match(workflow, /hourly tag-driven release sweep/);
     assert.match(workflow, /gh pr list[\s\S]*--head "\$BRANCH"[\s\S]*--state open/);
     assert.match(workflow, /git merge-base --is-ancestor HEAD "origin\/\$BRANCH"/);
     assert.match(workflow, /git ls-remote --exit-code --heads origin "\$BRANCH"/);
     assert.match(workflow, /concurrency:\n  group: scheduled-release\n  cancel-in-progress: false/);
     assert.match(release, /concurrency:\n  group: docguard-release\n  cancel-in-progress: false/);
+    assert.match(release, /schedule:\n[\s\S]*cron: '17 \* \* \* \*'/);
   });
 
   it('prevalidates release identity, synchronized versions, and changed paths before push', () => {