Skip to content

Spec-kit upstream review and consumer command sync (2026-09-07) #12

Open

Description

@pylot-app

Spec-kit upstream review and consumer command sync (2026-09-07)

Canonical source identity

Every parity and delivery claim in this issue is bound to repository fellowship-dev/spec-kit, immutable ref/head de8114818566742bef02773940457e23db7b6f36, and remote https://github.com/fellowship-dev/spec-kit.git. A local bootstrap clone name is not an authority.

The canonical installation is six files from presets/lean/commands/ plus three standard templates, renamed under .claude/commands/:

Destination Source Git blob SHA-256
speckit.analyze.md presets/lean/commands/speckit.analyze.md bb29b295b6a0e25b9dc75c1acffefbbde7c3a063 61942ce3bf98a19c19665b1986994b62e6172e058aa2b66134dab69533540631
speckit.constitution.md presets/lean/commands/speckit.constitution.md 920337003e91150ef2d579c035aa64a45ab64b76 86e2ba8188fb77dfc4e8d915cf284ac65172c27d15528a4ee22d37d276533c7a
speckit.implement.md presets/lean/commands/speckit.implement.md fc68a1f8b17798d813524c8c89dfcba237f17578 d50654ebfad997092a939d7020e546c48be47aa676c7ddeb90eb70b5cf20767c
speckit.plan.md presets/lean/commands/speckit.plan.md 9fbbe4c3713203a363169b9ca4d7f0dedbd0d1e0 d4dbd594dc8ea9853583353cfc556ac419ffedf2300c207d4ce75c24debe2ab9
speckit.specify.md presets/lean/commands/speckit.specify.md c15353557aa941b18e811c15aef605c41ff64133 9d68997ce418cc3293f66f946681bed0a33328c64a05757c0554ded19eec0ce2
speckit.tasks.md presets/lean/commands/speckit.tasks.md 724a7b840074b8e34cf107f2ca37d211745d15be b363acd5cdbc3312b2fa03c763913515947feb214702281fe13355401ebd0210
speckit.checklist.md templates/commands/checklist.md 833adf1e0d31452739fd63d69ad992b753b58f6a 03bd50e4fb58b0b62191749229320c8c6f3e05a0a34c19b12762d36971c50d8d
speckit.clarify.md templates/commands/clarify.md a8acc6b84eb0f38dc13d04c264acd24c82922760 216a30181351ef085e39fc5be4f1ea16fc627f6c15b8fc343cea50695b078454
speckit.taskstoissues.md templates/commands/taskstoissues.md 42b66b5d02f4402bc2473dfafffd0ea98c18b7b2 9ea431c4d884ebc314db56cbfa6f03660d033e3f6fe608b611ee952701422610

Consumer delivery status

  • booster-pack@d0c807235ae67d02b7e347fd97e3b6563723426e: nine exact; no-op and no PR.
  • inbox-angel-worker@8a99b41c4f46a47f30b8e6f0d568efda5e55e75c: seven drifted. Existing PR Docs setup github/spec-kit#100 was updated in the authorized delivery phase; actual head f767b6b676019017dc9eaff6ed219c6387ff7e23 changes exactly seven command files and produces all nine canonical hashes. Checklist-only Tech Proposal: Model Context Protocol (MCP) Implementation github/spec-kit#99 was consolidated into Docs setup github/spec-kit#100 and closed unmerged. Docs setup github/spec-kit#100 is the single live sync PR; no duplicate was opened.
  • mtg-lotr@ce9001800fea09b6dcddd15c139e860934d2412f: six drifted. Existing PR [suggestion] Support for models using api keys github/spec-kit#45 at 3a70e0d94592f41f17d9d1ff8192a23932dbb8d2 changes exactly those six files and produces all nine canonical hashes.
  • rails-backend and clapes: state remains unknown/blocked. Two distinct access paths failed: direct Git credential mint returned HTTP 502 on three attempts, and neither repository has a repo-scoped registration in devbox_configs. These facts do not imply the repositories are nonexistent or universally inaccessible. No mutation or PR occurred.

Planning itself made no consumer mutation. A later authorized delivery phase updated/reused existing PRs and closed superseded github#99; it opened no duplicate and merged no PR.

Targeted upstream recommendations

Comparison: fork fellowship-dev/spec-kit@de8114818566742bef02773940457e23db7b6f36; upstream github/spec-kit@4a7341a93d944d6efe153b71da4a1adb9c2b578c; merge-base 76cca342932d07a59abf1b766732f8097def55e8.

  1. High — applicable: semantic one-file port of 0121cabd3e3bd4f2c14209515ac3f5ae93f4f3dd for task IDs above 999 and converge placeholder correctness. Coordinate overlap with Upstream spec-kit improvements to cherry-pick (v0.13.1–v0.16.4) #11; preserve fork prose. Test arbitrary-length IDs and converge substitution.
  2. High — applicable: Bash-focused semantic port of 18ea13fdc51ac45cde9df583281433050efc81a2 for safe branch-name sanitization. A direct cherry-pick spans unshipped runtimes/extensions. Test Bash parity and unsafe characters.
  3. Medium — conditional on Upstream spec-kit improvements to cherry-pick (v0.13.1–v0.16.4) #11/converge: evaluate ac55a7a9558fcb9f2b60d19332c03e648e123fd5 for explicit spec prerequisites after the dependency lands. Test missing/existing spec paths.
  4. Medium — applicable: port af8f5a49ddb451c25af4dcd4fe5e186730132076 atomically across Bash and shipped callers to correct SPECS_DIR to FEATURE_DIR. Test the JSON contract and every shipped caller.
  5. Medium — applicable: Bash semantic port of b9c9403b5f41cc3ef3db880af3a5f544817b73d7 to reject ignored setup-plan arguments. Test rejection and supported options.
  6. Low — applicable: semantic Bash port of 6bfeea6b110f3ca1d42a107d2355d8654e0fca63. Inspection of the pinned fork proves scripts/bash/common.sh lines 631–636 retains layered {CORE_TEMPLATE} composition and rewrites/re-scans layer_content, so inserted core content containing that literal token can hang. Port the bounded left-to-right consumption logic; test termination with a timeout, preservation of the inserted literal, and cross-runtime parity.

Adoption boundary and non-goals

These are recommendations only: do not auto-merge, cherry-pick, or bulk-sync upstream. Each accepted change requires a separate reviewed fellowship-dev/spec-kit PR, with conflicts resolved for the fork’s lean templates and shipped runtimes. Only after such a PR merges may a new consumer baseline be created. No upstream commit was applied and no consumer was re-baselined in this mission.

Out of scope: broad v1.0 sync, adding .specify/ to command-only consumers, merging consumer PRs, or claiming inaccessible repositories are clean.

Activity

  1. added
    prd-readyIssue has been structured as a PRD
    ready-to-workPRD complete, cleared for implementation dispatch
    on Sep 7, 2026
  2. pylot-app commented on Oct 5, 2026

    @pylot-app
    Author

    Weekly sync update (2026-10-05)

    Fork HEAD is unchanged since this issue was filed: de8114818566742bef02773940457e23db7b6f36. None of the six recommendations below have been cherry-picked yet — all still open and applicable as written.

    Consumer delivery status (re-verified)

    • booster-pack: still nine-of-nine exact match against presets/lean/commands/ + templates/commands/{checklist,clarify}.md. No-op, no PR.
    • inbox-angel-worker: PR Docs setup github/spec-kit#100 (sync/spec-kit-commands-20260817) is still open and still the single live sync PR; confirmed it covers the current drift (including speckit.checklist.md). No duplicate opened.
    • mtg-lotr: now zero drift — PR [suggestion] Support for models using api keys github/spec-kit#45 appears to have merged since this issue was filed. Confirmed clean against templates/commands/.
    • rails-backend: no longer blocked. Git credential mint and repo access both succeeded this run (Lexgo-cl/rails-backend, read via its own org-scoped token). Three of nine files differ from templates/commands/:
      • speckit.checklist.md — genuine drift, byte-identical to the stale content found in inbox-angel-worker before its sync. Opened Lexgo-cl/rails-backend#2137 for this file only. Not merged.
      • speckit.constitution.md, speckit.implement.md — not drift. Commit history on these files (ad348a9, 7c6c55d, c149c30, 666ba8e) shows deliberate rails-backend-specific process content: a mandatory docs/product-principles.md read, references to a product-shaping skill, and bespoke execution-contract language. Left untouched.
    • CLAPES-UC: still blocked, but the cause is now specific — the Pylot GitHub App is not installed on the CLAPES-UC org (gh-shim: no installation token for CLAPES-UC/... — gateway unreachable or App not installed on its org), not a transient 502 as seen previously. This needs a human to install the App on that org (or supply the specific repo name(s) through a path that doesn't depend on it) before any sync or audit of CLAPES-UC repos is possible.

    New upstream commits worth evaluating (merge-base advanced)

    Upstream github/spec-kit has moved from 4a7341a93d944d6efe153b71da4a1adb9c2b578c to 2dda0478 (199 commits). Of those, the ones touching paths the fork actually ships (templates/commands/, scripts/) are:

    1. Medium — needs a terseness-aware semantic port, not a direct patch: b6005769 stops all ten upstream command templates from silently disabling mandatory (optional: false) hooks when .specify/extensions.yml fails to parse — it now reports the parse error and names the skipped mandatory hooks. The fork's terse templates collapsed this whole section to one line (Run hooks.before_clarify from .specify/extensions.yml if present), so there's no silent-skip prose left to patch — but the fork's one-liner has the same underlying gap (a malformed manifest is indistinguishable from "no hooks"). Needs a terse-native rewrite, not a transplant.
    2. Low — needs the same terseness treatment: 98eb2fb4 narrows speckit.clarify's planning-deferral catch-all to implementation-method/tech-stack/task-breakdown only, so spec-taxonomy items (NFRs, acceptance criteria, edge cases) stop getting silently deferred. The fork's clarify.md already collapsed this into a one-line coverage table with no catch-all phrase to bound — check whether the terse version still has the broader bug before deciding this is worth a line.
    3. Low — straightforward, applicable as a one-line addition: 072ab333 has speckit.tasks quote data-model.md field constraints (max length, nullable, enum, validation rules) verbatim into generated task text instead of leaving them to implementation-time discretion. The fork's tasks.md still has the equivalent Entities from data-model.md → map to stories line this would attach to.
    4. Not yet applicable: 68b94af0 (converge.md fix) touches a command the fork still doesn't ship — tracked by item 1 in the existing recommendation list above (converge is missing entirely). Revisit once/if converge lands.
    5. Did not evaluate 0a1b5575 (SPECIFY_FEATURE_NO_PERSIST env var) and 88fd17a8 (SPECKIT_PYTHON override) in depth — both are scripts/bash changes; flagging for a future pass since this run's budget went to the consumer-repo side.

    Adoption boundary (unchanged)

    These remain recommendations only — no upstream commit was cherry-picked, no template rewritten, and no consumer re-baselined in this run. Each accepted item still needs its own reviewed PR against fellowship-dev/spec-kit.


    Note: #10 and #11 cover overlapping ground from earlier runs of this same weekly sync and look like candidates for consolidation into this issue — not closed here since that wasn't this run's mandate, just flagging for whoever triages next.

  3. maxfindel commented on Oct 12, 2026

    @maxfindel

    Weekly sync update (2026-10-12): source fork remains de8114818566742bef02773940457e23db7b6f36. No consumer PR was created. Booster Pack's nine legacy commands match the six lean plus three standard baseline exactly, and it also ships spec-kit skills. Rails has seven standard-template matches and two intentional repo customizations; checklist PR Lexgo-cl/rails-backend#2137 is merged. Existing open PR fellowship-dev/inbox-angel-worker#100 and PR fellowship-dev/mtg-lotr#45 each produce nine-of-nine canonical command blobs at their current heads. The October 5 statement that MTG PR 45 appeared merged is superseded by this live open-state read.

    New upstream recommendation: github/spec-kit v1.1.3, released October 9, includes github/spec-kit#4879, merged October 8 as fa4b81dad128e7130f85e67bb4af52f8a96e0f45: core taskstoissues is deprecated in favor of the bundled GitHub extension, with the existing workflow retained during transition. Our fork still ships core templates/commands/taskstoissues.md, consumed by all four repos. Recommendation: retain the fork command for now; evaluate an explicit fork-compatible GitHub-extension transition before adopting upstream's deprecation warning or removing core. Directly porting the warning would tell users to install an extension the current fork has not verified. Scope a separate reviewed proposal around the current command's deduplication/safety/hooks and actual supported installation model; no automatic extension install, command removal, issue creation or consumer rewrite. This is a compatibility decision, not a bulk upstream upgrade. Prior recommendations remain proposals and have not been applied by this run.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    prd-readyIssue has been structured as a PRDready-to-workPRD complete, cleared for implementation dispatch

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions