v0.3.4

DocGraph v0.3.4

v0.3.3

v0.3.3 — 2026-06-14

Code-quality and dependency maintenance release. No behavior, API, output, or schema changes; fully backward-compatible (same inputs produce identical results).

• Cyclomatic-complexity reduction — 21 test functions decomposed via helper extraction; GetDriftFindings refactored from 12 repeated blocks into a finder-table loop. Gocyclo file-ratio improved from 91.3% to 98.63%. Modernization sweep: range-over-int, min/max builtins, strings.FieldsSeq, b.Loop(), and maps.Copy replacing hand-rolled equivalents.
• Dependency bump — github.com/Detective-XH/gopdf updated from v0.7.9 to v0.8.0 (additive and fix-only; no breaking API changes).

Verified with full -race tests, security-audit (0 failures), ax-audit Layer-1 (14/14 assertions), and govulncheck (clean).

v0.3.2

v0.3.2 — 2026-06-14

Code-quality maintenance release. Internal refactoring only — 28 of the highest-complexity functions were decomposed into smaller, well-named units to improve readability and maintainability. No behavior, API, output, or schema changes; fully backward-compatible (same inputs produce identical results). Decomposed areas include the MCP tool handlers, the SQLite search/ranking layer, the HTML/DOCX extractors, the Markdown parser, and the file scanner. Verified with full -race tests, golden/equivalence tests, and an adversarial review.

v0.3.1

v0.3.1 — 2026-06-13

Maintenance + agent-experience release. Drift and metadata-quality findings are now actionable, binary documents are no longer mis-scored for governance fields they cannot hold, and .docgraphignore exclusions are discoverable from the tools and apply on a running server. Dependency bump; backward-compatible, no schema change.

Added

• Every drift and metadata-quality finding now carries a remediation (Fix:) line — what to do about it, not just the symptom.
• docgraph_status gains an Index Configuration section: which ignore sources are active (.gitignore / .docgraphignore / --no-gitignore) and how to exclude files from the index.

Changed

• docgraph_context format=drift_audit now honors the project= filter; previously it always scanned the whole workspace.
• Editing .docgraphignore while docgraph serve is running applies the change automatically — newly-excluded files are pruned from the index (guarded so an over-broad rule can't empty it), instead of lingering until a --force rebuild.
• Bumped the PDF-extraction dependency (gopdf) to v0.7.9.

Fixed

• PDF and Word (.docx) documents are no longer flagged for a missing status, owner, or review_due — frontmatter fields those formats structurally cannot carry. Git- and graph-based findings (stale-by-git, isolated document) still apply to them.

v0.3.0

v0.3.0 — 2026-06-02

Feature release: PDF CJK text extraction, workspace per-project filtering, and a search/indexing performance pass. Backward-compatible; no schema change.

Added

• PDF CJK extraction — Shift-JIS (90ms-RKSJ), GBK, Big5-ETen, UHC, and UCS-2 CMap decoding via the Detective-XH/pdf fork (v0.6.0). PDF Info-dict fields are indexed as metadata; pdf.creation_date is normalized to an RFC3339 UTC timestamp.
• Workspace per-project filter on all workspace query tools, for scoped fan-out.
• Exact filename match surfaces the named document first in search.

Changed

• Search/graph performance — FTS5 trigram MATCH replaces full-table query expansion; per-candidate ranking and operation=impact traversal are batched (N+1 → set-based).
• serve reconcile — startup deletion-reconcile is always-on and warm-start reconciles downtime-deleted files, closing a watcher-gap staleness window.
• Internal: split the workspace.go and similarity.go god files; extracted shared indexing helpers.

Fixed

• Agent-experience (AX) surface fixes across the tool set: context dedup, similar/node provenance and parity, distinct-document counting guidance, and trace description accuracy.
• docgraph_context summary payload soft-capped at 20 KB.
• watcher caps fsnotify watches per process to bound fd usage under serve --workspace.

Security

• Context-pack integer args clamped at retrieval (H-24); content-trust test guard (S-1); supply-chain hardening (S-6) with govulncheck + SBOM CI gates.

---

v0.2.3

v0.2.3 — 2026-05-29

Maintenance release: LLM-facing UX fixes, indexing-correctness fixes, and internal cleanup. No breaking changes.

Fixed

• docgraph_node section= now accepts heading slug anchors (e.g. neural-embeddings) in addition to exact heading text.
• docgraph_similar returns actionable guidance when no similar documents are found, instead of an empty result.
• Agent worktree copies under .claude/worktrees/ are no longer indexed, preventing duplicate-document pollution in the graph.
• Closed a trace-invocation gap in the graph tool surface.
• Corrected LLM callout token accounting for batch-bound enrichment/embeddings operations.

Changed

• Consolidated duplicated metadata-projection logic and extracted shared store helpers; simplified the C-style doc comment scanner. All behavior-preserving, verified under go test -race.

Docs

• Rewrote AGENTS.md as a pre-install fit guide (when DocGraph helps a project and when to reach for it).
• Clarified scanner skip-dir behavior, code_doc fit signals, schema notes, and corrected codebase metrics in the README.

v0.2.2

LLM callout opt-in, scope confirmation, and cost transparency.

Added

• --enable-embeddings and --enable-enrichment CLI flags; both tools are off by default and must be explicitly opted in via mcp.json args.
• docgraph_enrichment action=pending returns a pre-written ASCII scope tree with per-folder file counts, token estimates, per-model cost table, and sensitive path flags before any writes occur.
• docgraph_embeddings action=pending now generates a one-time confirmation token; action=store requires the token before processing.
• engine= parameter for docgraph_similar: auto (default), tfidf, or neural. Neural mode returns a clear error when embeddings are not enabled.
• docgraph_status now includes a LLM Callout Tools section showing enabled/disabled state and pending counts for both tools.

Security

• Vector payload cap (2 MB) enforced before deserialisation in docgraph_embeddings action=store.
• Enrichment metadata payload cap (1 MB) enforced before deserialisation in docgraph_enrichment action=process.
• Confirmation tokens use crypto/rand (16 bytes, 32-char hex); embeddings and enrichment tokens are kept in separate stores to prevent cross-tool reuse; 30-minute TTL with lazy sweep.
• When 100% of pending documents are in sensitive-flagged paths, no token is generated and action=store/action=process are rejected.

Breaking Changes

• docgraph_embeddings and docgraph_enrichment are no longer registered by default. Add --enable-embeddings / --enable-enrichment to mcp.json args to restore access.
• docgraph_enrichment API changed: operation=pending/store → action=pending/process; action=process requires a confirmation_token from the preceding action=pending call.

v0.2.1

v0.2.1 — 2026-05-27

Dependency update patch release.

Changed

• Bump modernc.org/sqlite 1.37.1 → 1.50.1: SQLite 3.53.1 upgrade; fixes mutex data race, vtab -race checkptr failure, Exec RETURNING drain, and memory allocator issues in (*conn).Deserialize
• Bump github.com/mark3labs/mcp-go 0.32.0 → 0.54.1: 22 releases of bug fixes including OAuth, resource subscription, and MCP 2025-11-25 spec support
• Bump actions/checkout v5 → v6 in CI: credentials stored under $RUNNER_TEMP (security hardening, no binary impact)
• Bump actions/upload-artifact v6 → v7 in CI: no impact on existing SBOM workflow

Verify

gpg --verify SHA256SUMS.asc SHA256SUMS
shasum -a 256 -c SHA256SUMS

v0.2.0

v0.2.0 — governance knowledge graph milestone

Packages 18 shipped features (F-18 through F-35) as the first stable governance knowledge graph release.

Added

• Schema migrations — forward-only migrations 001–009; checksum validation; reindex markers
• Section snapshots — section_chunks table; TOCTOU resolved; section-level reads for all tools
• Governance metadata — document_metadata + governance_metadata; authority ordering (frontmatter > extractor > skill_advisory)
• Research provenance — research_metadata; claim/evidence/confidence/temporal fields
• Domain pack framework — declarative registry; governance, research, entity, code_doc, policy_process, assessment_drift packs
• Search quality — section-level FTS (section_chunks_fts); field-weighted ranking; graph-aware reranking; local query expansion
• Governance-aware retrieval — SearchOptions governance/research constraints; status/canonical/audience/date ranking signals
• Context pack export — format=context_pack reviewable evidence packs
• Metadata quality scoring — advisory scoring; missing-field, stale-date, weak-citation signals
• Multi-format indexing — .docx, .html, .htm, .pdf extractors with zip-slip and bomb protection
• Entity graph runtime — entities + entity_mentions tables; entity_type/entity_id search filters
• Policy/process drift audit — policy.* finding codes via format=drift_audit
• Assessment drift audit — research.* finding codes; stale/unverified/competing/superseded signals
• Code documentation surface — opt-in code_doc pack; 21 languages; code_file nodes
• Docs-code drift audit — code.* finding codes; missing symbols, undocumented exports, unanchored features
• Interactive installer — --dry-run and --interactive for docgraph init and docgraph install
• CodeGraph interop — advisory handoff guidance in serverInstructions

Stats

Metric	Value
Go source	~50,940 non-test lines
Tests	~45,090 lines (1074 top-level test functions)
MCP tools	16
Schema migrations	009
Security hardening measures	22
Dependencies	45 modules (7 direct)

Verify

gpg --verify SHA256SUMS.asc SHA256SUMS
shasum -a 256 -c SHA256SUMS

v0.1.9

[0.1.9] - 2026-05-25

Added

• --update-skills flag on init and install — force-overwrites existing skill directories with the latest bundled version. No more manual deletion needed to upgrade skills after a DocGraph update.
• install.IsClaudeResult(r Result) bool — exported helper; replaces the hardcoded "claude" string comparison in claudeInstalled, making the API stable for future refactors.
• skills_test.go (155 lines) — unit tests for claudeInstalled (empty / non-claude / claude-not-on-PATH) and installSkills (fresh install / skip-existing / overwrite).

Fixed

• claudeInstalled PATH check — skills are now only auto-installed when the claude CLI is actually present on PATH. Previously, auto mode installed skills to .claude/skills/ even on machines without Claude Code.