diff --git a/AGENTS.md b/AGENTS.md
index 3f3727e2..ed2234cb 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -164,6 +164,7 @@ fail-closed and only pauses when the agent actually proposed a reviewed output.
 │   │   ├── url.rs        # Build-reference parsing (bare ID, full ADO URL)
 │   │   ├── analyzers/    # Per-signal analyzers that populate AuditData sections
 │   │   │   ├── mod.rs
+│   │   │   ├── ado_proxy.rs    # Sanitized ado-proxy decision/lifecycle log analysis
 │   │   │   ├── custom_jobs.rs  # Job-level audit correlation for custom safe-output jobs
 │   │   │   ├── detection.rs    # Detection-stage artifact analysis
 │   │   │   ├── firewall.rs     # AWF network log analysis
@@ -395,7 +396,9 @@ index to jump to the right page.
   `check`, `mcp`, `execute`, `secrets`, `enable`, `disable`,
   `remove`, `list`, `status`, `run`, `audit`, `mcp-author`, `trace`,
   `inspect`, `graph`, `whatif`, `lint`, `catalog`; `configure` is a
-  deprecated hidden alias; `export-gate-schema` and `export-fact-catalog` are hidden build-time tools).
+  deprecated hidden alias; `export-gate-schema`, `export-fact-catalog`,
+  `export-ado-proxy-catalog-schema`, and `export-ado-proxy-catalog` are hidden
+  build-time tools).
 - [`docs/agency-plugin.md`](docs/agency-plugin.md) — the Agency / Claude Code
   plugin (`agency/plugins/ado-aw/`): canonical layout, six skills, `mcp-author`
   wiring, the self-contained root marketplace catalogs, `init --agency`
diff --git a/docs/cli.md b/docs/cli.md
index 29bee84f..0aac3104 100644
--- a/docs/cli.md
+++ b/docs/cli.md
@@ -192,6 +192,12 @@ These commands are not shown in `--help` but are available for contributors work
   - `--output, -o <path>` - Write the catalog to a file instead of stdout. Parent directories are created automatically.
   - Typical use: `cargo run -- export-fact-catalog --output scripts/ado-script/src/trigger-e2e/fact-catalog.gen.json`
 
+- `export-ado-proxy-catalog-schema` - Export the `ado-proxy` catalog JSON Schema, used by the `ado-proxy` TypeScript bundle for type codegen (`../shared/ado-proxy-catalog.types.gen.ts`).
+  - `--output, -o <path>` - Write the schema to a file instead of stdout. Parent directories are created automatically.
+
+- `export-ado-proxy-catalog` - Export the versioned `ado-proxy` operation catalog data as JSON (`catalog.gen.json`). Drift-guards the `ado-proxy` bundle's committed catalog snapshot against the Rust-side catalog in `src/ado_proxy/catalog.rs`; a `catalog_version` mismatch fails closed at ado-proxy startup.
+  - `--output, -o <path>` - Write the catalog to a file instead of stdout. Parent directories are created automatically.
+
 ### Hidden Pipeline-Internal Commands
 
 These commands are started by the pipeline itself (or by AWF on its behalf) and are not part of the authoring surface: