docguard-cli 0.40.3__tar.gz → 0.40.4__tar.gz

{docguard_cli-0.40.3 → docguard_cli-0.40.4}/.agent/skills/docguard-fix/SKILL.md

@@ -6,10 +6,10 @@ description: AI-driven documentation repair with structured research workflow, t
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.40.3
+  version: 0.40.4
   source: extensions/spec-kit-docguard/skills/docguard-fix
 ---
-<!-- docguard:version: 0.40.3 -->
+<!-- docguard:version: 0.40.4 -->
 
 # DocGuard Fix Skill
 

{docguard_cli-0.40.3/extensions/spec-kit-docguard → docguard_cli-0.40.4/.agent}/skills/docguard-guard/SKILL.md

@@ -7,10 +7,10 @@ description: Run DocGuard guard validation against Canonical-Driven Development
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.40.3
+  version: 0.40.4
   source: extensions/spec-kit-docguard/skills/docguard-guard
 ---
-<!-- docguard:version: 0.40.3 -->
+<!-- docguard:version: 0.40.4 -->
 
 # DocGuard Guard Skill
 

{docguard_cli-0.40.3/extensions/spec-kit-docguard → docguard_cli-0.40.4/.agent}/skills/docguard-review/SKILL.md

@@ -6,10 +6,10 @@ description: Cross-document consistency analysis and quality assessment. Perform
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.40.3
+  version: 0.40.4
   source: extensions/spec-kit-docguard/skills/docguard-review
 ---
-<!-- docguard:version: 0.40.3 -->
+<!-- docguard:version: 0.40.4 -->
 
 # DocGuard Review Skill
 

{docguard_cli-0.40.3/extensions/spec-kit-docguard → docguard_cli-0.40.4/.agent}/skills/docguard-score/SKILL.md

@@ -6,10 +6,10 @@ description: CDD maturity assessment with category-aware improvement roadmap. Ru
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.40.3
+  version: 0.40.4
   source: extensions/spec-kit-docguard/skills/docguard-score
 ---
-<!-- docguard:version: 0.40.3 -->
+<!-- docguard:version: 0.40.4 -->
 
 # DocGuard Score Skill
 

{docguard_cli-0.40.3 → docguard_cli-0.40.4}/.agent/skills/docguard-sync/SKILL.md

@@ -4,10 +4,10 @@ description: Keep canonical documentation ALWAYS UP TO DATE. Refreshes code-trut
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.40.3
+  version: 0.40.4
   source: extensions/spec-kit-docguard/skills/docguard-sync
 ---
-<!-- docguard:version: 0.40.3 -->
+<!-- docguard:version: 0.40.4 -->
 
 # DocGuard Sync Skill
 

{docguard_cli-0.40.3 → docguard_cli-0.40.4}/.docguard-specs.json

@@ -2030,7 +2030,7 @@
           ]
         },
         "reconciliation": {
-          "lastReviewedRevision": "46531e4918f9479b81ffb52e6e27c24b533575da",
+          "lastReviewedRevision": "9e4a68f5a79d3439806396e7dcf4e5729b90bb57",
           "outcomes": [
             {
               "revision": "46531e4918f9479b81ffb52e6e27c24b533575da",
@@ -2042,6 +2042,30 @@
               ],
               "deviations": [],
               "successor": null
+            },
+            {
+              "revision": "f4bb00638da2d1a53ad1a67928e35e1dfe1b401d",
+              "reason": "Verified v0.40.3 repository-token release PR #386: scheduled run 34922506777 armed native auto-merge; approved CI 34922605581 and supply-chain 34922605917 passed; merge e27d6bf triggered publication run 34922784629; npm, PyPI, GHCR, GitHub Release, extension ZIP, MCPB, and catalog reminder completed with no accepted deviations.",
+              "evidence": [
+                ".github/scripts/validate-release-candidate.mjs",
+                "cli/release-pr-policy.mjs",
+                "docs-canonical/CI-RECIPES.md",
+                "tests/scheduled-release.test.mjs"
+              ],
+              "deviations": [],
+              "successor": null
+            },
+            {
+              "revision": "9e4a68f5a79d3439806396e7dcf4e5729b90bb57",
+              "reason": "Finalized the v0.40.3 tokenless release evidence at durable main revision 9e4a68f: scheduled run 34922506777 created release PR #386; approved CI 34922605581 and supply-chain 34922605917 passed; native auto-merge produced e27d6bf; publication run 34922784629 completed npm, PyPI, GHCR, GitHub Release, extension ZIP, MCPB, and catalog reminder with no accepted deviations.",
+              "evidence": [
+                ".github/scripts/validate-release-candidate.mjs",
+                "cli/release-pr-policy.mjs",
+                "docs-canonical/CI-RECIPES.md",
+                "tests/scheduled-release.test.mjs"
+              ],
+              "deviations": [],
+              "successor": null
             }
           ]
         }
@@ -2070,19 +2094,19 @@
         "artifacts": [
           {
             "path": "specs/011-tokenless-scheduled-releases/spec.md",
-            "digest": "sha256:507528b6a9e43ae748a000fa8b6bf166d1408e271ee1e9c6348729eda172e30c"
+            "digest": "sha256:a69909db1d7c93b320eb330e2fc23336eb31029c2a17aa6db09337078ac0d45a"
           },
           {
             "path": "specs/011-tokenless-scheduled-releases/plan.md",
-            "digest": "sha256:f902658d4173718522335f70ec436040db5a7a8ee7677975d38d4984c832d30a"
+            "digest": "sha256:c28be466978c5e7ba99229ab0c0a6c58614dc1f649039d068be3219278c9be8b"
           },
           {
             "path": "specs/011-tokenless-scheduled-releases/tasks.md",
-            "digest": "sha256:1af12c52080eaa54711646ced72490094d17383b157510c98e7df7012e9ace22"
+            "digest": "sha256:2930c32b2128cb0dbfaa98a1cf84ddce037e0639fcdcb49bafdef74e2d500361"
           }
         ],
         "taskCompletion": {
-          "checked": 14,
+          "checked": 15,
           "total": 15
         },
         "implementationEvidence": [
@@ -2106,6 +2130,11 @@
             "file": "cli/release-pr-policy.mjs",
             "line": 7
           },
+          {
+            "requirementId": "FR-009",
+            "file": ".github/scripts/validate-release-candidate.mjs",
+            "line": 8
+          },
           {
             "requirementId": "FR-011",
             "file": "cli/release-pr-policy.mjs",

docguard_cli-0.40.4/.github/scripts/upsert-catalog-reminder.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+VERSION="${1:?usage: upsert-catalog-reminder.sh <version> <body-file>}"
+BODY_FILE="${2:?usage: upsert-catalog-reminder.sh <version> <body-file>}"
+REPOSITORY="${GITHUB_REPOSITORY:?GITHUB_REPOSITORY is required}"
+TITLE="📦 Submit DocGuard v${VERSION} to the spec-kit community catalog"
+
+if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+  echo "Invalid release version: $VERSION" >&2
+  exit 1
+fi
+if [[ ! -f "$BODY_FILE" ]]; then
+  echo "Reminder body does not exist: $BODY_FILE" >&2
+  exit 1
+fi
+
+reminders=$(
+  gh issue list \
+    --repo "$REPOSITORY" \
+    --state open \
+    --limit 100 \
+    --json number,title \
+    --jq '.[] | select(.title | startswith("📦 Submit DocGuard v") and endswith(" to the spec-kit community catalog")) | .number' \
+    | sort -n
+)
+
+if [[ -z "$reminders" ]]; then
+  gh issue create --repo "$REPOSITORY" --title "$TITLE" --body-file "$BODY_FILE"
+  echo "✅ Opened catalog-submission reminder issue"
+  exit 0
+fi
+
+current=$(printf '%s\n' "$reminders" | tail -n 1)
+gh issue edit "$current" --repo "$REPOSITORY" --title "$TITLE" --body-file "$BODY_FILE"
+echo "✅ Refreshed reminder issue #${current}"
+
+while IFS= read -r duplicate; do
+  if [[ -z "$duplicate" ]]; then
+    continue
+  fi
+  if [[ "$duplicate" == "$current" ]]; then
+    continue
+  fi
+  gh issue close "$duplicate" \
+    --repo "$REPOSITORY" \
+    --comment "Superseded by the current catalog reminder #${current}."
+  echo "✅ Closed superseded reminder issue #${duplicate}"
+done <<< "$reminders"

{docguard_cli-0.40.3 → docguard_cli-0.40.4}/.github/scripts/validate-release-candidate.mjs

@@ -4,6 +4,8 @@
  * Validate the scheduler-generated release diff before it leaves the trusted
  * default-branch checkout. GitHub's native auto-merge then enforces the
  * repository's required pull-request checks on every candidate revision.
+ *
+ * @implements docguard.tokenless-scheduled-releases#FR-009
  */
 
 import { execFileSync } from 'node:child_process';

{docguard_cli-0.40.3 → docguard_cli-0.40.4}/.github/workflows/release.yml

@@ -459,7 +459,6 @@ jobs:
         run: |
           VERSION="${{ steps.meta.outputs.version }}"
           SUBMIT_URL=$(cat /tmp/submit-url.txt)
-          TITLE="📦 Submit DocGuard v${VERSION} to the spec-kit community catalog"
 
           # Compose the reminder body: one-click prefilled form link + the full
           # field-by-field body as a paste fallback (URL prefill can truncate).
@@ -485,21 +484,7 @@ jobs:
             echo "</details>"
           } > /tmp/reminder.md
 
-          # Idempotent per-version: refresh the existing reminder, else open one.
-          EXISTING=$(gh issue list \
-            --repo "$GITHUB_REPOSITORY" \
-            --state open \
-            --search "in:title \"DocGuard v${VERSION}\" spec-kit catalog" \
-            --json number,title \
-            --jq "[.[] | select(.title | contains(\"v${VERSION}\"))][0].number" 2>/dev/null || echo "")
-
-          if [ -n "$EXISTING" ] && [ "$EXISTING" != "null" ]; then
-            gh issue edit "$EXISTING" --repo "$GITHUB_REPOSITORY" --body-file /tmp/reminder.md
-            echo "✅ Refreshed reminder issue #${EXISTING}"
-          else
-            gh issue create --repo "$GITHUB_REPOSITORY" --title "$TITLE" --body-file /tmp/reminder.md
-            echo "✅ Opened catalog-submission reminder issue"
-          fi
+          bash .github/scripts/upsert-catalog-reminder.sh "$VERSION" /tmp/reminder.md
 
       - name: Write run summary
         run: |

{docguard_cli-0.40.3 → docguard_cli-0.40.4}/.github/workflows/sync-speckit-catalog.yml

@@ -58,7 +58,6 @@ jobs:
         run: |
           VERSION="${{ steps.meta.outputs.version }}"
           SUBMIT_URL=$(cat /tmp/submit-url.txt)
-          TITLE="📦 Submit DocGuard v${VERSION} to the spec-kit community catalog"
 
           {
             echo "Update the spec-kit community catalog for **v${VERSION}**"
@@ -82,20 +81,7 @@ jobs:
             echo "</details>"
           } > /tmp/reminder.md
 
-          EXISTING=$(gh issue list \
-            --repo "$GITHUB_REPOSITORY" \
-            --state open \
-            --search "in:title \"DocGuard v${VERSION}\" spec-kit catalog" \
-            --json number,title \
-            --jq "[.[] | select(.title | contains(\"v${VERSION}\"))][0].number" 2>/dev/null || echo "")
-
-          if [ -n "$EXISTING" ] && [ "$EXISTING" != "null" ]; then
-            gh issue edit "$EXISTING" --repo "$GITHUB_REPOSITORY" --body-file /tmp/reminder.md
-            echo "✅ Refreshed reminder issue #${EXISTING}"
-          else
-            gh issue create --repo "$GITHUB_REPOSITORY" --title "$TITLE" --body-file /tmp/reminder.md
-            echo "✅ Opened catalog-submission reminder issue"
-          fi
+          bash .github/scripts/upsert-catalog-reminder.sh "$VERSION" /tmp/reminder.md
 
       - name: Write run summary
         run: |

{docguard_cli-0.40.3 → docguard_cli-0.40.4}/.wolf/buglog.json

@@ -5763,6 +5763,24 @@
       ],
       "occurrences": 1,
       "last_seen": "2026-09-15T02:37:35.000Z"
+    },
+    {
+      "id": "bug-348",
+      "timestamp": "2026-09-15T03:05:00.000Z",
+      "error_message": "Each successful release opened another version-specific Spec Kit catalog reminder and left all prior reminders open",
+      "file": ".github/workflows/release.yml; .github/workflows/sync-speckit-catalog.yml; .github/scripts/upsert-catalog-reminder.sh",
+      "root_cause": "Both workflows searched only for an open issue containing the current release version, so the documented refresh path could never find a reminder from an earlier version",
+      "fix": "Route both workflows through one tested helper that refreshes the newest open DocGuard catalog reminder and closes every older matching reminder as superseded",
+      "tags": [
+        "release",
+        "catalog",
+        "github-issues",
+        "idempotency",
+        "cleanup"
+      ],
+      "related_bugs": [],
+      "occurrences": 5,
+      "last_seen": "2026-09-15T03:05:00.000Z"
     }
   ]
 }

{docguard_cli-0.40.3 → docguard_cli-0.40.4}/CHANGELOG.md

@@ -7,6 +7,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.40.4] - 2026-09-15
+
+Automated weekly release — batches everything merged since `v0.40.3`.
+
+### Changed
+
+- fix: consolidate catalog reminders (#390)
+- docs: finalize durable R8 outcome (#389)
+- docs: close R8 release verification (#388)
+
+
+### Changed
+
+- Reuse one open Spec Kit catalog reminder across releases and close older
+  reminders as superseded, preventing the release workflow from accumulating a
+  stale version-specific issue queue.
+- Close the R8 living release contract with exact v0.40.3 evidence: the
+  repository-token release PR armed protected native auto-merge, passed the
+  approved CI and supply-chain checks, merged automatically, and triggered the
+  complete npm, PyPI, GHCR, GitHub Release, extension, MCPB, and catalog flow
+  through the scheduler's bounded continuation.
+
 ## [0.40.3] - 2026-09-15
 
 Automated weekly release — batches everything merged since `v0.40.2`.

{docguard_cli-0.40.3 → docguard_cli-0.40.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: docguard-cli
-Version: 0.40.3
+Version: 0.40.4
 Summary: The enforcement tool for Canonical-Driven Development (CDD). Audit, generate, and guard your project documentation. No Python dependencies (requires Node.js 18+).
 Project-URL: Homepage, https://github.com/raccioly/docguard
 Project-URL: Documentation, https://github.com/raccioly/docguard#readme

{docguard_cli-0.40.3 → docguard_cli-0.40.4}/ROADMAP.md

@@ -1,6 +1,6 @@
 # DocGuard Roadmap
 
-<!-- docguard:last-reviewed 2026-09-14 -->
+<!-- docguard:last-reviewed 2026-09-15 -->
 
 This file contains current product intent only. Released work belongs in
 `CHANGELOG.md`; implementation history remains recoverable from Git. Completed or
@@ -19,8 +19,7 @@ ideas below are research candidates rather than unfinished commitments.
 
 ## Delivered roadmap
 
-R1–R8 are implemented and evidence-reviewed. R1–R7 are released; R8 is verified
-on `main` and will ship with the next substantive release. The maintained living
+R1–R8 are implemented, evidence-reviewed, and released. The maintained living
 specifications remain current verification contracts; historical implementation
 plans are recoverable from Git and do not create a second source of truth.
 
@@ -216,7 +215,7 @@ Node 18, 20, 22, and 24. Packed-package tests run task context without the
 optional parser, and the independent detector corpus remains regression-free
 across 24 evaluable cases plus one explicit unsupported case.
 
-### R8 — Tokenless scheduled releases (verified on `main`)
+### R8 — Tokenless scheduled releases (released in v0.40.3)
 
 Governing spec: `specs/011-tokenless-scheduled-releases/spec.md`.
 
@@ -235,8 +234,8 @@ a missing tag before another version increment.
   no accepted deviations.
 - [x] Publish v0.40.1 through release PR #380 and verify npm, PyPI, GHCR, GitHub
   release assets, and the Spec Kit catalog reminder.
-- [ ] Verify the corrected repository-token native auto-merge continuation on
-  the next release and retain exact evidence.
+- [x] Verify the corrected repository-token native auto-merge continuation on
+  v0.40.3 and retain exact evidence.
 
 The retained live probe used CI run `34912654565` and privileged gate run
 `34912788971`. All Node 18, 20, 22, and 24 jobs passed. The trusted gate
@@ -247,12 +246,18 @@ evidence landed through pull requests #371, #373, and #374.
 Release PR #380 passed CI run `34920481989` and supply-chain run `34920482409`,
 merged at `5b2dfe4`, and published v0.40.1 in run `34920702346`. That run also
 proved the final GitHub boundary: approving the held workflow does not emit a
-second `workflow_run` completion. Native auto-merge is now the continuation;
-release PR #383 proved the repository token can arm it and GitHub can merge after
-approved checks. That merge also proved its bot-originated push does not trigger
-publication. A bounded scheduler wait plus hourly tag-driven recovery is the
-final continuation under verification; exact publication evidence remains the
-only open R8 item.
+second `workflow_run` completion. Release PR #383 proved the repository token
+can arm native auto-merge and GitHub can merge after approved checks, while its
+bot-originated push proved publication needs an explicit continuation.
+
+Scheduled run `34922506777` created repository-token release PR #386 and armed
+native auto-merge. After one maintainer approval, CI run `34922605581` and
+supply-chain run `34922605917` passed; GitHub merged the exact head at
+`e27d6bf0203708ee8206a1434eb292520f4c4494`. The bounded scheduler wait then
+dispatched publication run `34922784629`, which passed the four-runtime matrix,
+self-guard, npm, PyPI, GHCR, GitHub Release, extension ZIP, MCPB, and catalog
+reminder jobs. The published npm and PyPI versions and GitHub tag all resolve to
+v0.40.3, completing R8 without a stored release credential.
 
 ## Contribution standard
 

{docguard_cli-0.40.3 → docguard_cli-0.40.4}/docs-canonical/CI-RECIPES.md

@@ -1,6 +1,6 @@
 # CI Recipes
 
-<!-- docguard:last-reviewed 2026-09-14 -->
+<!-- docguard:last-reviewed 2026-09-15 -->
 <!-- docguard:status active -->
 
 ## Recipe 1 — Guard (mandatory CI gate)
@@ -81,6 +81,19 @@ sole publication trigger. The bounded wait handles the normal approval path; the
 hourly tag sweep supplies durable recovery without continuous polling or another
 credential.
 
+The v0.40.3 release is the retained end-to-end proof. Scheduled run
+`34922506777` opened repository-token PR #386 and armed native auto-merge. After
+one maintainer workflow approval, CI run `34922605581` and supply-chain run
+`34922605917` passed, GitHub merged
+`e27d6bf0203708ee8206a1434eb292520f4c4494`, and the bounded wait dispatched
+publication run `34922784629`. That run published npm, PyPI, GHCR, the GitHub
+Release, extension ZIP, and MCPB and refreshed the catalog reminder.
+
+Catalog submission remains an explicit human action. The release and manual
+catalog workflows maintain one open reminder in this repository: each run
+refreshes the newest matching issue to the current version and closes older
+matching reminders as superseded.
+
 ## Recipe 3b — Spec completion and post-hoc reconciliation
 
 Run `docguard reconcile --since <merge-base> --format json` when implementation

{docguard_cli-0.40.3 → docguard_cli-0.40.4}/extensions/spec-kit-docguard/extension.yml

@@ -3,7 +3,7 @@ schema_version: "1.0"
 extension:
   id: "docguard"
   name: "DocGuard — CDD Enforcement"
-  version: "0.40.3"
+  version: "0.40.4"
   description: "Canonical-Driven Development enforcement as a true spec-kit extension. LLM-first design with automated validators, 5 AI behavior skills, spec-kit skill chaining, and workflow hooks. One pinned runtime dependency (@babel/parser); pure Node.js otherwise."
   author: "Ricardo Accioly"
   repository: "https://github.com/raccioly/docguard"

{docguard_cli-0.40.3 → docguard_cli-0.40.4}/extensions/spec-kit-docguard/skills/docguard-fix/SKILL.md

@@ -6,10 +6,10 @@ description: AI-driven documentation repair with structured research workflow, t
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.40.3
+  version: 0.40.4
   source: extensions/spec-kit-docguard/skills/docguard-fix
 ---
-<!-- docguard:version: 0.40.3 -->
+<!-- docguard:version: 0.40.4 -->
 
 # DocGuard Fix Skill
 

{docguard_cli-0.40.3/.agent → docguard_cli-0.40.4/extensions/spec-kit-docguard}/skills/docguard-guard/SKILL.md

@@ -7,10 +7,10 @@ description: Run DocGuard guard validation against Canonical-Driven Development
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.40.3
+  version: 0.40.4
   source: extensions/spec-kit-docguard/skills/docguard-guard
 ---
-<!-- docguard:version: 0.40.3 -->
+<!-- docguard:version: 0.40.4 -->
 
 # DocGuard Guard Skill
 

{docguard_cli-0.40.3/.agent → docguard_cli-0.40.4/extensions/spec-kit-docguard}/skills/docguard-review/SKILL.md

@@ -6,10 +6,10 @@ description: Cross-document consistency analysis and quality assessment. Perform
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.40.3
+  version: 0.40.4
   source: extensions/spec-kit-docguard/skills/docguard-review
 ---
-<!-- docguard:version: 0.40.3 -->
+<!-- docguard:version: 0.40.4 -->
 
 # DocGuard Review Skill
 

{docguard_cli-0.40.3/.agent → docguard_cli-0.40.4/extensions/spec-kit-docguard}/skills/docguard-score/SKILL.md

@@ -6,10 +6,10 @@ description: CDD maturity assessment with category-aware improvement roadmap. Ru
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.40.3
+  version: 0.40.4
   source: extensions/spec-kit-docguard/skills/docguard-score
 ---
-<!-- docguard:version: 0.40.3 -->
+<!-- docguard:version: 0.40.4 -->
 
 # DocGuard Score Skill
 

{docguard_cli-0.40.3 → docguard_cli-0.40.4}/extensions/spec-kit-docguard/skills/docguard-sync/SKILL.md

@@ -4,10 +4,10 @@ description: Keep canonical documentation ALWAYS UP TO DATE. Refreshes code-trut
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.40.3
+  version: 0.40.4
   source: extensions/spec-kit-docguard/skills/docguard-sync
 ---
-<!-- docguard:version: 0.40.3 -->
+<!-- docguard:version: 0.40.4 -->
 
 # DocGuard Sync Skill
 

{docguard_cli-0.40.3 → docguard_cli-0.40.4}/extensions/spec-kit-docguard/templates/github-workflows/docguard-autofix.yml

@@ -44,7 +44,7 @@ jobs:
           fetch-depth: 0
 
       - name: Run DocGuard fix --write + auto-commit + PR comment
-        uses: raccioly/docguard@v0.40.3
+        uses: raccioly/docguard@v0.40.4
         with:
           command: fix
           auto-commit: 'true'

{docguard_cli-0.40.3 → docguard_cli-0.40.4}/extensions/spec-kit-docguard/templates/github-workflows/docguard-guard.yml

@@ -35,7 +35,7 @@ jobs:
           node-version: '20'
 
       - name: Install DocGuard
-        run: npm install --global --ignore-scripts docguard-cli@0.40.3
+        run: npm install --global --ignore-scripts docguard-cli@0.40.4
 
       - name: Run DocGuard
         shell: bash

{docguard_cli-0.40.3 → docguard_cli-0.40.4}/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "docguard-cli",
-  "version": "0.40.3",
+  "version": "0.40.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "docguard-cli",
-      "version": "0.40.3",
+      "version": "0.40.4",
       "license": "MIT",
       "dependencies": {
         "@babel/parser": "7.29.8"

{docguard_cli-0.40.3 → docguard_cli-0.40.4}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "docguard-cli",
-  "version": "0.40.3",
+  "version": "0.40.4",
   "description": "The enforcement tool for Canonical-Driven Development (CDD). Audit, generate, and guard your project documentation.",
   "type": "module",
   "bin": {

{docguard_cli-0.40.3 → docguard_cli-0.40.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "docguard-cli"
-version = "0.40.3"
+version = "0.40.4"
 description = "The enforcement tool for Canonical-Driven Development (CDD). Audit, generate, and guard your project documentation. No Python dependencies (requires Node.js 18+)."
 readme = "README.md"
 license = { text = "MIT" }

{docguard_cli-0.40.3 → docguard_cli-0.40.4}/server.json

@@ -3,7 +3,7 @@
   "name": "io.github.raccioly/docguard",
   "title": "DocGuard",
   "description": "Deterministic doc-drift detection: guard, score, explain, verify-claims and diagnose MCP tools.",
-  "version": "0.40.3",
+  "version": "0.40.4",
   "websiteUrl": "https://github.com/raccioly/docguard#readme",
   "repository": {
     "url": "https://github.com/raccioly/docguard",
@@ -14,7 +14,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "docguard-cli",
-      "version": "0.40.3",
+      "version": "0.40.4",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"

{docguard_cli-0.40.3 → docguard_cli-0.40.4}/specs/011-tokenless-scheduled-releases/plan.md

@@ -1,6 +1,6 @@
 # Implementation Plan: Tokenless Scheduled Releases
 
-**Status**: Corrective live verification pending
+**Status**: Verified; living release contract
 **Spec**: `specs/011-tokenless-scheduled-releases/spec.md`
 
 ## Summary
@@ -83,3 +83,11 @@ GitHub merges after approved required checks. It also showed that the resulting
 bot-originated push does not trigger publication. Add a ten-minute bounded wait
 to dispatch the normal path and an hourly idempotent sweep for later approvals;
 prove both continuation and publication on the next live release.
+
+Release PR #386 completed that proof. Scheduled run `34922506777` created the
+repository-token candidate and armed native auto-merge. After one maintainer
+workflow approval, CI run `34922605581` and supply-chain run `34922605917`
+passed, GitHub merged `e27d6bf0203708ee8206a1434eb292520f4c4494`, and the
+still-running scheduler dispatched publication run `34922784629`. Every test,
+registry, container, release-asset, and catalog-reminder job passed; npm, PyPI,
+and the GitHub tag all report v0.40.3.

{docguard_cli-0.40.3 → docguard_cli-0.40.4}/specs/011-tokenless-scheduled-releases/spec.md

@@ -110,4 +110,6 @@ considers another version bump.
 ## Implementation Outcomes
 
 - `46531e4918f9479b81ffb52e6e27c24b533575da` — Reviewed tokenless scheduled-release policy, exact-run gates, missing-tag recovery, Node 18/20/22/24 CI, supply-chain scan, live dispatch-chain refusal probe, and durable evidence approval with no accepted deviations. Evidence: `cli/release-pr-policy.mjs`, `docs-canonical/CI-RECIPES.md`, `tests/scheduled-release.test.mjs`. Accepted deviations: none. Successor: none.
+- `f4bb00638da2d1a53ad1a67928e35e1dfe1b401d` — Verified v0.40.3 repository-token release PR #386: scheduled run 34922506777 armed native auto-merge; approved CI 34922605581 and supply-chain 34922605917 passed; merge e27d6bf triggered publication run 34922784629; npm, PyPI, GHCR, GitHub Release, extension ZIP, MCPB, and catalog reminder completed with no accepted deviations. Evidence: `.github/scripts/validate-release-candidate.mjs`, `cli/release-pr-policy.mjs`, `docs-canonical/CI-RECIPES.md`, `tests/scheduled-release.test.mjs`. Accepted deviations: none. Successor: none.
+- `9e4a68f5a79d3439806396e7dcf4e5729b90bb57` — Finalized the v0.40.3 tokenless release evidence at durable main revision 9e4a68f: scheduled run 34922506777 created release PR #386; approved CI 34922605581 and supply-chain 34922605917 passed; native auto-merge produced e27d6bf; publication run 34922784629 completed npm, PyPI, GHCR, GitHub Release, extension ZIP, MCPB, and catalog reminder with no accepted deviations. Evidence: `.github/scripts/validate-release-candidate.mjs`, `cli/release-pr-policy.mjs`, `docs-canonical/CI-RECIPES.md`, `tests/scheduled-release.test.mjs`. Accepted deviations: none. Successor: none.
 <!-- docguard:implementation-outcomes:end -->

{docguard_cli-0.40.3 → docguard_cli-0.40.4}/specs/011-tokenless-scheduled-releases/tasks.md

@@ -1,6 +1,6 @@
 # Tasks: Tokenless Scheduled Releases
 
-**Status**: Corrective live verification pending
+**Status**: Verified; living release contract
 **Spec**: `specs/011-tokenless-scheduled-releases/spec.md`
 
 ## Phase 1: Contract and policy
@@ -41,6 +41,8 @@
 - [x] T014 Replace the missing post-approval `workflow_run` callback with
   pre-push candidate validation and GitHub protected native auto-merge while
   preserving the separate Dependabot/Jules gate.
-- [ ] T015 Prove the repository-token auto-merge arm, bounded publication
-  continuation, and end-to-end registries on the next live release, then record
-  the exact merge and publication evidence.
+- [x] T015 Prove the repository-token auto-merge arm, bounded publication
+  continuation, and end-to-end registries on v0.40.3: scheduled run
+  `34922506777`, release PR #386, CI run `34922605581`, supply-chain run
+  `34922605917`, merge `e27d6bf0203708ee8206a1434eb292520f4c4494`, and
+  publication run `34922784629`.

{docguard_cli-0.40.3 → docguard_cli-0.40.4}/templates/ci/github-actions.yml

@@ -31,7 +31,7 @@ jobs:
           node-version: '20'
 
       - name: Install DocGuard
-        run: npm install --global --ignore-scripts docguard-cli@0.40.3
+        run: npm install --global --ignore-scripts docguard-cli@0.40.4
 
       - name: Run DocGuard
         shell: bash