v0.18.2 — friction reduction

Doberman gets out of your way. This patch removes the biggest source of spurious approval prompts and hardens the secret detector against being broken.

Fixed

• No more false prompts on ordinary identifiers, paths, and UUIDs. The secret detector keyed on Shannon entropy per character, which reads a normal identifier, a relative path, or a UUID much like a short base64 token — so it fired AUTH prompts on benign shapes, and via the multi-step taint ledger a single UUID-bearing temp path could gate a whole session's egress. It now recognizes digest/UUID ids and short word+number build tags (py311, x86) and lets them through. Raise-only: every real credential still fires (recall pinned by tests), and the strong credential-shape path is untouched.

Added

• The secret rule self-checks and fails closed. It verifies its own invariants at import; if a change ever breaks it, it degrades to a fail-closed AUTH instead of erroring on every action — it can neither let a secret through nor brick tool mediation.
• Opt-in anonymous CLI telemetry — doberman telemetry on|off|status. Off by default, allowlisted counts and command names only, never on the per-tool hook or proxy hot path.
• A documentation site at docs.trydoberman.dev, plus a full docs/ + README rewrite for accuracy and voice.

Notes

• Detection is unchanged. Synthetic benchmark: attacks-stopped 1.0. The fix only removes false AUTH prompts on benign shapes; no BLOCK verdict changed.
• Also included: a per-project dashboard tab title, a macOS GUI auth-dialog thread-safety fix (#399), and a river version cap on Python 3.11.

Upgrade: pip install -U doberman-core