[Extension]: Update DocGuard — CDD Enforcement (v0.26.0)

[raccioly]

Extension ID

docguard

Extension Name

DocGuard — CDD Enforcement

Version

0.26.0

Description

Canonical-Driven Development enforcement. Validates, scores, and traces project documentation with automated checks, AI-driven workflows, and spec-kit hooks. One pinned runtime dependency; pure Node.js otherwise.

Author

raccioly

Repository URL

https://github.com/raccioly/docguard

Download URL

https://github.com/raccioly/docguard/releases/download/v0.26.0/spec-kit-docguard-v0.26.0.zip

License

MIT

Homepage (optional)

https://www.npmjs.com/package/docguard-cli

Documentation URL (optional)

https://github.com/raccioly/docguard/blob/main/extensions/spec-kit-docguard/README.md

Changelog URL (optional)

https://github.com/raccioly/docguard/blob/main/CHANGELOG.md

Required Spec Kit Version

=0.1.0

Required Tools (optional)

- node (>=18.0.0) - required
- npx - required
- specify - optional (auto-initializes the SDD workflow during docguard init)

Number of Commands

6

Number of Hooks (optional)

3

Tags

documentation, validation, quality, cdd, traceability, ai-agents, enforcement, spec-kit

Key Features

• 19-validator quality gate with severity triage and a remediation plan
• AI-driven documentation repair with codebase research and validation loops
• Cross-document semantic consistency analysis (read-only review)
• CDD maturity score with an ROI-based improvement roadmap
• Reverse-engineers canonical docs from an existing codebase
• spec-kit workflow hooks (after_implement, before_tasks, after_tasks)

Testing Checklist

• Extension installs successfully via download URL
• All commands execute without errors
• Documentation is complete and accurate
• No security vulnerabilities identified
• Tested on at least one real project

Submission Requirements

• Valid extension.yml manifest included
• README.md with installation and usage instructions
• LICENSE file included
• GitHub release created with version tag
• All command files exist and are properly formatted
• Extension ID follows naming conventions (lowercase-with-hyphens)

Testing Details

Tested on: Linux + macOS with the spec-kit CLI.

Install:

specify extension add docguard --from https://github.com/raccioly/docguard/releases/download/v0.26.0/spec-kit-docguard-v0.26.0.zip

Scenarios verified:

1. Extension installs from the release ZIP without manifest validation errors.
2. All six speckit.docguard.* commands resolve and run.
3. The three workflow hooks register against spec-kit's lifecycle.

Example Usage

# Install the extension
specify extension add docguard --from https://github.com/raccioly/docguard/releases/download/v0.26.0/spec-kit-docguard-v0.26.0.zip

# Run the documentation quality gate
/speckit.docguard.guard

Proposed Catalog Entry

{
  "docguard": {
    "name": "DocGuard \u2014 CDD Enforcement",
    "id": "docguard",
    "description": "Canonical-Driven Development enforcement. Validates, scores, and traces project documentation with automated checks, AI-driven workflows, and spec-kit hooks. One pinned runtime dependency; pure Node.js otherwise.",
    "author": "raccioly",
    "version": "0.26.0",
    "download_url": "https://github.com/raccioly/docguard/releases/download/v0.26.0/spec-kit-docguard-v0.26.0.zip",
    "repository": "https://github.com/raccioly/docguard",
    "homepage": "https://www.npmjs.com/package/docguard-cli",
    "documentation": "https://github.com/raccioly/docguard/blob/main/extensions/spec-kit-docguard/README.md",
    "changelog": "https://github.com/raccioly/docguard/blob/main/CHANGELOG.md",
    "license": "MIT",
    "requires": {
      "speckit_version": ">=0.1.0",
      "tools": [
        {
          "name": "node",
          "version": ">=18.0.0",
          "required": true
        }
      ]
    },
    "provides": {
      "commands": 6,
      "hooks": 3
    },
    "tags": [
      "documentation",
      "validation",
      "quality",
      "cdd",
      "traceability",
      "ai-agents",
      "enforcement",
      "spec-kit"
    ],
    "verified": false,
    "downloads": 0,
    "stars": 0
  }
}

Additional Context

This is an update to an existing catalog entry (docguard) for a new release — please bump the version and download URL on the current entry rather than adding a duplicate.

Release notes (v0.26.0):

Acting on a second end-to-end LLM field report (a coding agent ran DocGuard on a
stdlib-only Python security CLI). The report verified that the v0.25.0 "all
fixed" claim was real but narrow — it patched the specific repros, not the
general class — so several issues recurred. This round fixes the class and
adds regression tests that assert the agent's actual scenario.

Fixed

• Read-only commands are strictly side-effect-free — guard/score/diff/
  impact/diagnose/trace/explain/memory/demo no longer run
  ensureSkills (auto-init Spec Kit, spawn specify, write .agent/.specify).
  A validate command must never mutate the tree. Scaffolding stays on
  init/generate/init --with. (Bug Update README.md #3)
• Surface detection ignores test fixtures by default — a stdlib CLI was
  documented as an Express/Flask/AWS web app because the manifest/route/env
  scanners ingested the tool's own tests/fixtures/. Non-product dirs
  (fixtures/tests/examples/testdata/samples) are now excluded from detection by
  default (no .docguardignore required), overridable via
  detection.includeNonProduct, and never applied to guard's structural checks. (Bug Add John Lam as contributor and release badge #1)
• Metrics-Consistency no longer corrupts correct numbers — it only validates
  a "N checks/validators" claim bound to DocGuard, stamps actualSource
  provenance on every fix, and the auto-fix applier is fail-closed: it refuses to
  overwrite a number without provenance and only rewrites DocGuard-bound lines.
  (Previously "10 checks" describing a proof harness would be "fixed" to
  DocGuard's own count.) (Bug Fix release workflow to work with repository rules #2)
• Project name comes from the manifest, not the directory — reads
  pyproject [project].name / package.json / Cargo.toml / composer.json /
  go.mod before falling back to the dir basename (which is an auto-generated
  slug inside a git worktree). (Bug doco(spec-driven): Fix small typo in spec-driven.md #4)
• generate respects the active profile's doc set — a cli/library
  profile no longer proposes API-REFERENCE/INTEGRATIONS/SCREENS from an
  incidental surface; suppressed docs surface a recoverable note. (Bug feat: implement in Japanese #5)
• Freshness warning states both remedies (commit or a last-reviewed
  marker) and is suppressed for docs marked <!-- docguard:status approved -->
  in the same session. (Bug shell scripts in the scripts directory fail to execute #6)
• Env-var detection counts reads, not mentions — a single-pass lexer skips
  env tokens inside comments and string literals (e.g. a detection signature
  like r"os.environ.get('JWT_SECRET')") and inside test dirs, so only genuine
  runtime reads are reported. (Bug adding executable permission to the scripts so they execute when the … #7)

Added

• Pre-filled code-truth in generate — the source:"code" sections now ship
  real extracted content instead of empty templates: an ARCHITECTURE Component
  Map (real source modules) and a TEST-SPEC doc with a pre-filled test
  inventory (files + per-file case counts). The agent annotates responsibilities
  instead of hand-grepping the structure.
• docguard agent — a one-shot, dependency-ordered agent task graph
  (--format json for the machine artifact). Phases config → canonical-docs → verify; each task is code-truth (ships pre-filled content) or
  human-judgment (instruction + grounding, never a committed guess), carries an
  acceptance/verify command, and propagates confidence. Collapses ~10 manual
  round-trips into one. --profile <name> previews a profile without running
  init first.

[github-actions]

cc @github/spec-kit-maintainers — new catalog submission for review.

[mnriem]

Thank you!