Repository navigation
Spec-kit upstream review and consumer command sync (2026-09-07) #12
Description
Spec-kit upstream review and consumer command sync (2026-09-07)
Canonical source identity
Every parity and delivery claim in this issue is bound to repository fellowship-dev/spec-kit, immutable ref/head de8114818566742bef02773940457e23db7b6f36, and remote https://github.com/fellowship-dev/spec-kit.git. A local bootstrap clone name is not an authority.
The canonical installation is six files from presets/lean/commands/ plus three standard templates, renamed under .claude/commands/:
| Destination | Source | Git blob | SHA-256 |
|---|---|---|---|
speckit.analyze.md |
presets/lean/commands/speckit.analyze.md |
bb29b295b6a0e25b9dc75c1acffefbbde7c3a063 |
61942ce3bf98a19c19665b1986994b62e6172e058aa2b66134dab69533540631 |
speckit.constitution.md |
presets/lean/commands/speckit.constitution.md |
920337003e91150ef2d579c035aa64a45ab64b76 |
86e2ba8188fb77dfc4e8d915cf284ac65172c27d15528a4ee22d37d276533c7a |
speckit.implement.md |
presets/lean/commands/speckit.implement.md |
fc68a1f8b17798d813524c8c89dfcba237f17578 |
d50654ebfad997092a939d7020e546c48be47aa676c7ddeb90eb70b5cf20767c |
speckit.plan.md |
presets/lean/commands/speckit.plan.md |
9fbbe4c3713203a363169b9ca4d7f0dedbd0d1e0 |
d4dbd594dc8ea9853583353cfc556ac419ffedf2300c207d4ce75c24debe2ab9 |
speckit.specify.md |
presets/lean/commands/speckit.specify.md |
c15353557aa941b18e811c15aef605c41ff64133 |
9d68997ce418cc3293f66f946681bed0a33328c64a05757c0554ded19eec0ce2 |
speckit.tasks.md |
presets/lean/commands/speckit.tasks.md |
724a7b840074b8e34cf107f2ca37d211745d15be |
b363acd5cdbc3312b2fa03c763913515947feb214702281fe13355401ebd0210 |
speckit.checklist.md |
templates/commands/checklist.md |
833adf1e0d31452739fd63d69ad992b753b58f6a |
03bd50e4fb58b0b62191749229320c8c6f3e05a0a34c19b12762d36971c50d8d |
speckit.clarify.md |
templates/commands/clarify.md |
a8acc6b84eb0f38dc13d04c264acd24c82922760 |
216a30181351ef085e39fc5be4f1ea16fc627f6c15b8fc343cea50695b078454 |
speckit.taskstoissues.md |
templates/commands/taskstoissues.md |
42b66b5d02f4402bc2473dfafffd0ea98c18b7b2 |
9ea431c4d884ebc314db56cbfa6f03660d033e3f6fe608b611ee952701422610 |
Consumer delivery status
booster-pack@d0c807235ae67d02b7e347fd97e3b6563723426e: nine exact; no-op and no PR.inbox-angel-worker@8a99b41c4f46a47f30b8e6f0d568efda5e55e75c: seven drifted. Existing PR Docs setup github/spec-kit#100 was updated in the authorized delivery phase; actual headf767b6b676019017dc9eaff6ed219c6387ff7e23changes exactly seven command files and produces all nine canonical hashes. Checklist-only Tech Proposal: Model Context Protocol (MCP) Implementation github/spec-kit#99 was consolidated into Docs setup github/spec-kit#100 and closed unmerged. Docs setup github/spec-kit#100 is the single live sync PR; no duplicate was opened.mtg-lotr@ce9001800fea09b6dcddd15c139e860934d2412f: six drifted. Existing PR [suggestion] Support for models using api keys github/spec-kit#45 at3a70e0d94592f41f17d9d1ff8192a23932dbb8d2changes exactly those six files and produces all nine canonical hashes.rails-backendandclapes: state remains unknown/blocked. Two distinct access paths failed: direct Git credential mint returned HTTP 502 on three attempts, and neither repository has a repo-scoped registration indevbox_configs. These facts do not imply the repositories are nonexistent or universally inaccessible. No mutation or PR occurred.
Planning itself made no consumer mutation. A later authorized delivery phase updated/reused existing PRs and closed superseded github#99; it opened no duplicate and merged no PR.
Targeted upstream recommendations
Comparison: fork fellowship-dev/spec-kit@de8114818566742bef02773940457e23db7b6f36; upstream github/spec-kit@4a7341a93d944d6efe153b71da4a1adb9c2b578c; merge-base 76cca342932d07a59abf1b766732f8097def55e8.
- High — applicable: semantic one-file port of
0121cabd3e3bd4f2c14209515ac3f5ae93f4f3ddfor task IDs above 999 and converge placeholder correctness. Coordinate overlap with Upstream spec-kit improvements to cherry-pick (v0.13.1–v0.16.4) #11; preserve fork prose. Test arbitrary-length IDs and converge substitution. - High — applicable: Bash-focused semantic port of
18ea13fdc51ac45cde9df583281433050efc81a2for safe branch-name sanitization. A direct cherry-pick spans unshipped runtimes/extensions. Test Bash parity and unsafe characters. - Medium — conditional on Upstream spec-kit improvements to cherry-pick (v0.13.1–v0.16.4) #11/converge: evaluate
ac55a7a9558fcb9f2b60d19332c03e648e123fd5for explicit spec prerequisites after the dependency lands. Test missing/existing spec paths. - Medium — applicable: port
af8f5a49ddb451c25af4dcd4fe5e186730132076atomically across Bash and shipped callers to correctSPECS_DIRtoFEATURE_DIR. Test the JSON contract and every shipped caller. - Medium — applicable: Bash semantic port of
b9c9403b5f41cc3ef3db880af3a5f544817b73d7to reject ignored setup-plan arguments. Test rejection and supported options. - Low — applicable: semantic Bash port of
6bfeea6b110f3ca1d42a107d2355d8654e0fca63. Inspection of the pinned fork provesscripts/bash/common.shlines 631–636 retains layered{CORE_TEMPLATE}composition and rewrites/re-scanslayer_content, so inserted core content containing that literal token can hang. Port the bounded left-to-right consumption logic; test termination with a timeout, preservation of the inserted literal, and cross-runtime parity.
Adoption boundary and non-goals
These are recommendations only: do not auto-merge, cherry-pick, or bulk-sync upstream. Each accepted change requires a separate reviewed fellowship-dev/spec-kit PR, with conflicts resolved for the fork’s lean templates and shipped runtimes. Only after such a PR merges may a new consumer baseline be created. No upstream commit was applied and no consumer was re-baselined in this mission.
Out of scope: broad v1.0 sync, adding .specify/ to command-only consumers, merging consumer PRs, or claiming inaccessible repositories are clean.
Activity
pylot-app commentedon Oct 5, 2026
Weekly sync update (2026-10-05)
Fork HEAD is unchanged since this issue was filed:
de8114818566742bef02773940457e23db7b6f36. None of the six recommendations below have been cherry-picked yet — all still open and applicable as written.Consumer delivery status (re-verified)
booster-pack: still nine-of-nine exact match againstpresets/lean/commands/+templates/commands/{checklist,clarify}.md. No-op, no PR.inbox-angel-worker: PR Docs setup github/spec-kit#100 (sync/spec-kit-commands-20260817) is still open and still the single live sync PR; confirmed it covers the current drift (includingspeckit.checklist.md). No duplicate opened.mtg-lotr: now zero drift — PR [suggestion] Support for models using api keys github/spec-kit#45 appears to have merged since this issue was filed. Confirmed clean againsttemplates/commands/.rails-backend: no longer blocked. Git credential mint and repo access both succeeded this run (Lexgo-cl/rails-backend, read via its own org-scoped token). Three of nine files differ fromtemplates/commands/:speckit.checklist.md— genuine drift, byte-identical to the stale content found ininbox-angel-workerbefore its sync. Opened Lexgo-cl/rails-backend#2137 for this file only. Not merged.speckit.constitution.md,speckit.implement.md— not drift. Commit history on these files (ad348a9,7c6c55d,c149c30,666ba8e) shows deliberate rails-backend-specific process content: a mandatorydocs/product-principles.mdread, references to aproduct-shapingskill, and bespoke execution-contract language. Left untouched.CLAPES-UC: still blocked, but the cause is now specific — the Pylot GitHub App is not installed on the CLAPES-UC org (gh-shim: no installation token for CLAPES-UC/... — gateway unreachable or App not installed on its org), not a transient 502 as seen previously. This needs a human to install the App on that org (or supply the specific repo name(s) through a path that doesn't depend on it) before any sync or audit of CLAPES-UC repos is possible.New upstream commits worth evaluating (merge-base advanced)
Upstream
github/spec-kithas moved from4a7341a93d944d6efe153b71da4a1adb9c2b578cto2dda0478(199 commits). Of those, the ones touching paths the fork actually ships (templates/commands/,scripts/) are:b6005769stops all ten upstream command templates from silently disabling mandatory (optional: false) hooks when.specify/extensions.ymlfails to parse — it now reports the parse error and names the skipped mandatory hooks. The fork's terse templates collapsed this whole section to one line (Run hooks.before_clarify from .specify/extensions.yml if present), so there's no silent-skip prose left to patch — but the fork's one-liner has the same underlying gap (a malformed manifest is indistinguishable from "no hooks"). Needs a terse-native rewrite, not a transplant.98eb2fb4narrowsspeckit.clarify's planning-deferral catch-all to implementation-method/tech-stack/task-breakdown only, so spec-taxonomy items (NFRs, acceptance criteria, edge cases) stop getting silently deferred. The fork'sclarify.mdalready collapsed this into a one-line coverage table with no catch-all phrase to bound — check whether the terse version still has the broader bug before deciding this is worth a line.072ab333hasspeckit.tasksquotedata-model.mdfield constraints (max length, nullable, enum, validation rules) verbatim into generated task text instead of leaving them to implementation-time discretion. The fork'stasks.mdstill has the equivalentEntities from data-model.md → map to storiesline this would attach to.68b94af0(converge.md fix) touches a command the fork still doesn't ship — tracked by item 1 in the existing recommendation list above (converge is missing entirely). Revisit once/if converge lands.0a1b5575(SPECIFY_FEATURE_NO_PERSISTenv var) and88fd17a8(SPECKIT_PYTHONoverride) in depth — both arescripts/bashchanges; flagging for a future pass since this run's budget went to the consumer-repo side.Adoption boundary (unchanged)
These remain recommendations only — no upstream commit was cherry-picked, no template rewritten, and no consumer re-baselined in this run. Each accepted item still needs its own reviewed PR against
fellowship-dev/spec-kit.Note: #10 and #11 cover overlapping ground from earlier runs of this same weekly sync and look like candidates for consolidation into this issue — not closed here since that wasn't this run's mandate, just flagging for whoever triages next.
maxfindel commentedon Oct 12, 2026
Weekly sync update (2026-10-12): source fork remains
de8114818566742bef02773940457e23db7b6f36. No consumer PR was created. Booster Pack's nine legacy commands match the six lean plus three standard baseline exactly, and it also ships spec-kit skills. Rails has seven standard-template matches and two intentional repo customizations; checklist PR Lexgo-cl/rails-backend#2137 is merged. Existing open PR fellowship-dev/inbox-angel-worker#100 and PR fellowship-dev/mtg-lotr#45 each produce nine-of-nine canonical command blobs at their current heads. The October 5 statement that MTG PR 45 appeared merged is superseded by this live open-state read.New upstream recommendation: github/spec-kit v1.1.3, released October 9, includes github/spec-kit#4879, merged October 8 as
fa4b81dad128e7130f85e67bb4af52f8a96e0f45: coretaskstoissuesis deprecated in favor of the bundled GitHub extension, with the existing workflow retained during transition. Our fork still ships coretemplates/commands/taskstoissues.md, consumed by all four repos. Recommendation: retain the fork command for now; evaluate an explicit fork-compatible GitHub-extension transition before adopting upstream's deprecation warning or removing core. Directly porting the warning would tell users to install an extension the current fork has not verified. Scope a separate reviewed proposal around the current command's deduplication/safety/hooks and actual supported installation model; no automatic extension install, command removal, issue creation or consumer rewrite. This is a compatibility decision, not a bulk upstream upgrade. Prior recommendations remain proposals and have not been applied by this run.