[Extension]: Update DocGuard — CDD Enforcement (v0.44.3) #4918

Extension ID

docguard

Extension Name

DocGuard — CDD Enforcement

Version

0.44.3

Description

Documentation integrity for AI-assisted repositories: lifecycle registry, drift validation, traceability, safe archival, SARIF/JUnit, MCP, GitHub Actions, and Spec Kit hooks.

Author

raccioly

Repository URL

https://github.com/raccioly/docguard

Download URL

https://github.com/raccioly/docguard/releases/download/v0.44.3/spec-kit-docguard-v0.44.3.zip

License

MIT

Homepage (optional)

https://www.npmjs.com/package/docguard-cli

Documentation URL (optional)

https://raccioly.github.io/docguard/guides/spec-kit.html

Changelog URL (optional)

https://github.com/raccioly/docguard/blob/main/CHANGELOG.md

Required Spec Kit Version

=0.11.2

Required Tools (optional)

• node (>=18.0.0) - required
• npx - required
• specify - optional (auto-initializes the SDD workflow during docguard init)

Number of Commands

12

Number of Hooks (optional)

5

Tags

documentation, validation, traceability, ai-agents, spec-kit

Key Features

• Configurable quality gate with severity triage and a remediation plan
• AI-driven documentation repair with codebase research and validation loops
• Cross-document semantic consistency analysis (read-only review)
• CDD maturity score with an ROI-based improvement roadmap
• Reverse-engineers canonical docs from an existing codebase
• spec-kit workflow hooks (before_specify, after_implement, after_converge, before_tasks, after_tasks)

Testing Checklist

• Extension installs successfully via download URL
• All commands execute without errors
• Documentation is complete and accurate
• No security vulnerabilities identified
• Tested on at least one real project

Submission Requirements

• Valid extension.yml manifest included
• README.md with installation and usage instructions
• LICENSE file included
• GitHub release created with version tag
• All command files exist and are properly formatted
• Extension ID follows naming conventions (lowercase-with-hyphens)

Testing Details

Verified on macOS (Darwin 25.5), Node 24, specify-cli 1.1.3, in a fresh specify init --here --integration claude project:

1. specify extension add docguard --from <download URL> → "Extension installed successfully", no manifest errors.
2. All 12 speckit.docguard.* commands are installed as Claude skills (brief, complete, diagnose, fix, generate, guard, init, preflight, review, score, sync, trace).
3. The 5 hook events register in .specify/extensions.yml: before_specify (brief), before_tasks (preflight), after_tasks (score), after_implement (guard, complete), after_converge (complete).
4. The CLI commands the skills call (init, guard, score, diagnose, specs preflight, specs --check, sync, generate --plan, review, fix --doc architecture) run with npx docguard-cli@0.44.3 without errors (exit 0, or 2 = WARN on an empty project).
5. Real projects: DocGuard's own repository runs the extension on every change.
6. npm audit --omit=dev: 0 vulnerabilities; 0 open code-scanning and Dependabot alerts.

The ZIP contains extension.yml, README.md, LICENSE and the 12 files under commands/.

Example Usage

# Install the extension
specify extension add docguard --from https://github.com/raccioly/docguard/releases/download/v0.44.3/spec-kit-docguard-v0.44.3.zip

# Run the documentation quality gate
/speckit.docguard.guard

Proposed Catalog Entry

{
  "docguard": {
    "name": "DocGuard \u2014 CDD Enforcement",
    "id": "docguard",
    "description": "Documentation integrity for AI-assisted repositories: lifecycle registry, drift validation, traceability, safe archival, SARIF/JUnit, MCP, GitHub Actions, and Spec Kit hooks.",
    "category": "docs",
    "effect": "read-write",
    "author": "raccioly",
    "version": "0.44.3",
    "download_url": "https://github.com/raccioly/docguard/releases/download/v0.44.3/spec-kit-docguard-v0.44.3.zip",
    "repository": "https://github.com/raccioly/docguard",
    "homepage": "https://www.npmjs.com/package/docguard-cli",
    "documentation": "https://raccioly.github.io/docguard/guides/spec-kit.html",
    "changelog": "https://github.com/raccioly/docguard/blob/main/CHANGELOG.md",
    "license": "MIT",
    "requires": {
      "speckit_version": ">=0.11.2",
      "tools": [
        {
          "name": "node",
          "version": ">=18.0.0",
          "required": true
        }
      ]
    },
    "provides": {
      "commands": 12,
      "hooks": 5
    },
    "tags": [
      "documentation",
      "validation",
      "traceability",
      "ai-agents",
      "spec-kit"
    ],
    "verified": false,
    "downloads": 0,
    "stars": 0
  }
}

Additional Context

This is an update to an existing catalog entry (docguard) for a new release — please bump the version and download URL on the current entry rather than adding a duplicate.

Release notes (v0.44.3):

Fixed

• Route readers that undercounted real projects
  (specs/071-real-project-route-gaps). Run on the public RealWorld example
  applications, which all serve the same 19 endpoints:
  • Actix Web read 0 routes and reported nothing missing. The builder
    style (web::scope("/api").service(web::resource("users").route(web::post().to(h))),
    .configure(f), functions returning a Scope) is now read, with scope
    prefixes composed across functions and files, and #[get("/p")] handlers
    take the prefix of the scope that registers them. Rocket's
    .mount("/p", routes![a, b]) prefixes its handlers the same way.
  • Axum kept only the first method of .route("/x", get(a).put(b))
    (12 of 19). Every chained method is now reported, with on(MethodFilter::…),
    any and *_service, and .nest("/p", r) / .merge(r) prefixes apply.
  • Symfony read 0: an invokable controller declares its route on the
    class (@Route or #[Route] above a class with __invoke), which was read
    only as a prefix. It is now the route of __invoke when no method declares
    one, as Symfony's loader does.
  • Koa dropped /api from all 19 paths: a module ending
    module.exports = router.routes() mounted with api.use(users) lost the
    prefix above it. Such exports (and router.middleware(),
    export default router.routes()) are now followed.
  • A JWT middleware built to let unauthenticated requests through (koa-jwt
    passthrough: true, express-jwt credentialsRequired: false) no longer
    marks every route below it as requiring auth; route-level auth middleware
    still does. On the Koa app, auth now sits on exactly the 12 routes that
    carry auth, not on POST /api/users/login.
  • A declaration an Actix, Axum, Rocket, Symfony or Laravel reader recognises
    but cannot turn into a route is listed in scan.unresolved
    (route-unresolved-path, -prefix, -method, -declaration), so the
    API-surface check reports partial instead of a silent zero; a Laravel
    route file no application loads is one of them.

Commits

• chore: verify spec 071; review docs after specs 065-071 (Codex-cli Spec-kit Not visible #559)
• fix: route readers that undercounted real projects (spec 071) (Wish List Item - give me an option to disable the Context Updating of the Agent File #558)
• chore: verify spec 051 maintenance; map sync-tests.mjs in TEST-SPEC (Updateing Spec-Kit for a project using CLI with Here and Force should not overwrite Constitutuion #557)
• test: replace typeof-only export checks with behaviour tests (Checkpoint from VS Code for coding agent session #556)