Spec-kit upstream review and consumer command sync (2026-09-07)

[pylot-app]

Spec-kit upstream review and consumer command sync (2026-09-07)

Canonical source identity

Every parity and delivery claim in this issue is bound to repository fellowship-dev/spec-kit, immutable ref/head de8114818566742bef02773940457e23db7b6f36, and remote https://github.com/fellowship-dev/spec-kit.git. A local bootstrap clone name is not an authority.

The canonical installation is six files from presets/lean/commands/ plus three standard templates, renamed under .claude/commands/:

Destination	Source	Git blob	SHA-256
speckit.analyze.md	presets/lean/commands/speckit.analyze.md	bb29b295b6a0e25b9dc75c1acffefbbde7c3a063	61942ce3bf98a19c19665b1986994b62e6172e058aa2b66134dab69533540631
speckit.constitution.md	presets/lean/commands/speckit.constitution.md	920337003e91150ef2d579c035aa64a45ab64b76	86e2ba8188fb77dfc4e8d915cf284ac65172c27d15528a4ee22d37d276533c7a
speckit.implement.md	presets/lean/commands/speckit.implement.md	fc68a1f8b17798d813524c8c89dfcba237f17578	d50654ebfad997092a939d7020e546c48be47aa676c7ddeb90eb70b5cf20767c
speckit.plan.md	presets/lean/commands/speckit.plan.md	9fbbe4c3713203a363169b9ca4d7f0dedbd0d1e0	d4dbd594dc8ea9853583353cfc556ac419ffedf2300c207d4ce75c24debe2ab9
speckit.specify.md	presets/lean/commands/speckit.specify.md	c15353557aa941b18e811c15aef605c41ff64133	9d68997ce418cc3293f66f946681bed0a33328c64a05757c0554ded19eec0ce2
speckit.tasks.md	presets/lean/commands/speckit.tasks.md	724a7b840074b8e34cf107f2ca37d211745d15be	b363acd5cdbc3312b2fa03c763913515947feb214702281fe13355401ebd0210
speckit.checklist.md	templates/commands/checklist.md	833adf1e0d31452739fd63d69ad992b753b58f6a	03bd50e4fb58b0b62191749229320c8c6f3e05a0a34c19b12762d36971c50d8d
speckit.clarify.md	templates/commands/clarify.md	a8acc6b84eb0f38dc13d04c264acd24c82922760	216a30181351ef085e39fc5be4f1ea16fc627f6c15b8fc343cea50695b078454
speckit.taskstoissues.md	templates/commands/taskstoissues.md	42b66b5d02f4402bc2473dfafffd0ea98c18b7b2	9ea431c4d884ebc314db56cbfa6f03660d033e3f6fe608b611ee952701422610

Consumer delivery status

• booster-pack@d0c807235ae67d02b7e347fd97e3b6563723426e: nine exact; no-op and no PR.
• inbox-angel-worker@8a99b41c4f46a47f30b8e6f0d568efda5e55e75c: seven drifted. Existing PR Docs setup github/spec-kit#100 was updated in the authorized delivery phase; actual head f767b6b676019017dc9eaff6ed219c6387ff7e23 changes exactly seven command files and produces all nine canonical hashes. Checklist-only Tech Proposal: Model Context Protocol (MCP) Implementation github/spec-kit#99 was consolidated into Docs setup github/spec-kit#100 and closed unmerged. Docs setup github/spec-kit#100 is the single live sync PR; no duplicate was opened.
• mtg-lotr@ce9001800fea09b6dcddd15c139e860934d2412f: six drifted. Existing PR [suggestion] Support for models using api keys github/spec-kit#45 at 3a70e0d94592f41f17d9d1ff8192a23932dbb8d2 changes exactly those six files and produces all nine canonical hashes.
• rails-backend and clapes: state remains unknown/blocked. Two distinct access paths failed: direct Git credential mint returned HTTP 502 on three attempts, and neither repository has a repo-scoped registration in devbox_configs. These facts do not imply the repositories are nonexistent or universally inaccessible. No mutation or PR occurred.

Planning itself made no consumer mutation. A later authorized delivery phase updated/reused existing PRs and closed superseded github#99; it opened no duplicate and merged no PR.

Targeted upstream recommendations

Comparison: fork fellowship-dev/spec-kit@de8114818566742bef02773940457e23db7b6f36; upstream github/spec-kit@4a7341a93d944d6efe153b71da4a1adb9c2b578c; merge-base 76cca342932d07a59abf1b766732f8097def55e8.

1. High — applicable: semantic one-file port of 0121cabd3e3bd4f2c14209515ac3f5ae93f4f3dd for task IDs above 999 and converge placeholder correctness. Coordinate overlap with Upstream spec-kit improvements to cherry-pick (v0.13.1–v0.16.4) #11; preserve fork prose. Test arbitrary-length IDs and converge substitution.
2. High — applicable: Bash-focused semantic port of 18ea13fdc51ac45cde9df583281433050efc81a2 for safe branch-name sanitization. A direct cherry-pick spans unshipped runtimes/extensions. Test Bash parity and unsafe characters.
3. Medium — conditional on Upstream spec-kit improvements to cherry-pick (v0.13.1–v0.16.4) #11/converge: evaluate ac55a7a9558fcb9f2b60d19332c03e648e123fd5 for explicit spec prerequisites after the dependency lands. Test missing/existing spec paths.
4. Medium — applicable: port af8f5a49ddb451c25af4dcd4fe5e186730132076 atomically across Bash and shipped callers to correct SPECS_DIR to FEATURE_DIR. Test the JSON contract and every shipped caller.
5. Medium — applicable: Bash semantic port of b9c9403b5f41cc3ef3db880af3a5f544817b73d7 to reject ignored setup-plan arguments. Test rejection and supported options.
6. Low — applicable: semantic Bash port of 6bfeea6b110f3ca1d42a107d2355d8654e0fca63. Inspection of the pinned fork proves scripts/bash/common.sh lines 631–636 retains layered {CORE_TEMPLATE} composition and rewrites/re-scans layer_content, so inserted core content containing that literal token can hang. Port the bounded left-to-right consumption logic; test termination with a timeout, preservation of the inserted literal, and cross-runtime parity.

Adoption boundary and non-goals

These are recommendations only: do not auto-merge, cherry-pick, or bulk-sync upstream. Each accepted change requires a separate reviewed fellowship-dev/spec-kit PR, with conflicts resolved for the fork’s lean templates and shipped runtimes. Only after such a PR merges may a new consumer baseline be created. No upstream commit was applied and no consumer was re-baselined in this mission.

Out of scope: broad v1.0 sync, adding .specify/ to command-only consumers, merging consumer PRs, or claiming inaccessible repositories are clean.