Merge pull request #102 from tikalk/chore/upstream-merge-0.12.14

chore: merge upstream 0.12.14–0.12.15, bump to 0.12.15+adlc2

Author: kanfil

.mcp.json

@@ -0,0 +1,20 @@
+{
+  "mcpServers": {
+    "context7": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@upstash/context7-mcp"
+      ]
+    }
+  },
+  "tools": {
+    "github": {
+      "type": "github",
+      "tokenEnv": "GITHUB_TOKEN",
+      "owner": "GITHUB_OWNER",
+      "repo": "GITHUB_REPO",
+      "baseUrl": "https://api.github.com"
+    }
+  }
+}

CHANGELOG.md

@@ -2,6 +2,156 @@
 
 All notable changes to the Specify CLI and templates are documented here.
 
+# [0.12.15+adlc2] - 2026-07-15
+
+### Changed
+
+- **Upstream merge**: Synced with `github/spec-kit` (2 commits, post-0.12.15):
+  - **While/do-while non-list steps guard (#3519)**: `WhileStep.execute()` and
+    `DoWhileStep.execute()` now return FAILED when `steps` is not a list,
+    instead of crashing with `AttributeError` on an unvalidated run. Mirrors
+    the same fail-fast pattern already applied to if/switch/fan-out steps in
+    the 0.12.14 merge. 6 new parametrized tests in `test_workflows.py`.
+  - **PyPI install docs (#3425/#3516)**: upstream added `docs/install/pypi.md`
+    and updated `docs/installation.md`, `docs/toc.yml`, `README.md` to
+    document PyPI as a second install route. Fork adopted the docs additions
+    but kept its own README install section (fork installs from
+    `tikalk/agentic-sdlc-spec-kit` under `agentic-sdlc-v*` tags, not PyPI).
+- **Conflict resolved** (1):
+  - `README.md` — kept fork's install instructions (tikalk repo, `uvx`
+    one-time option); dropped upstream's PyPI install block (fork doesn't
+    publish to PyPI under the upstream package name).
+- All other files (`while_loop/__init__.py`, `do_while/__init__.py`,
+  `test_workflows.py`, `docs/install/pypi.md`, `docs/installation.md`,
+  `docs/toc.yml`) auto-merged cleanly.
+- Test suite: 613 passed, 1 skipped (`tests/test_workflows.py`).
+- Smoke test: `specify init /tmp/merge-test2 --integration claude --script sh
+  --ignore-agent-tools` succeeds.
+
+# [0.12.15+adlc1] - 2026-07-15
+
+### Changed
+
+- **Upstream merge**: Synced with `github/spec-kit` (12 commits, 1 release
+  0.12.15):
+  - **Git extension Python port (#3400)**: Adopted upstream's 4 basic Python
+    scripts (`auto_commit.py`, `create_new_feature_branch.py`, `git_common.py`,
+    `initialize_repo.py`) under `extensions/git/scripts/python/`. Fork retains
+    its enhanced bash/PS1 scripts for fork-only commands (worktree, tasks-dag,
+    isolation mode, etc.). Python parity tests
+    (`test_git_extension_python_parity.py`) skipped via `PKG_NAMES` guard since
+    fork's bash scripts produce enhanced output upstream's basic Python scripts
+    don't replicate.
+  - **Workflow CLI / extension command surface alignment (#3419)**: Adopted
+    upstream's atomic install transaction in `workflows/_commands.py` —
+    command installation is now transactional (all-or-nothing) with rollback
+    on failure. Applied fork's `accent()` theming on top.
+  - **Goose YAML control-char escaping (#3384)**: Goose recipe YAML renderer
+    now escapes control characters that previously produced invalid YAML.
+  - **Env-var config leak fix (#3497)**: Extension env-var config no longer
+    leaks across prefix-colliding extension IDs.
+  - **init-options.json newline (#3509)**: `init-options.json` output now
+    ends with a trailing newline.
+  - **Workflow engine fixes**: non-iterable right operand in `in`/`not in`
+    membership tests (#3447/#3468); malformed catalog URL raises catalog
+    error, not raw `ValueError` (#3484).
+  - **Community catalog additions**: Multi-Repo Branch Sync extension (#3411),
+    PatchWarden Evidence Pack extension (#3514).
+  - **Community catalog updates**: DocGuard CDD Enforcement v0.32.0 (#3489),
+    Autonomous Run Governance preset v0.1.4 (#3511).
+- **Conflicts resolved** (2):
+  - `pyproject.toml` — preserved fork `name`/`description`/`httpx` dep and
+    force-include block; set version `0.12.14+adlc1` → `0.12.15+adlc1`.
+  - `src/specify_cli/workflows/_commands.py` — adopted upstream's atomic
+    install transaction (transactional command installation with rollback)
+    and applied fork's `accent()` theming on the new UI strings.
+- All other modified files (`_github_http.py`, `_init_options.py`,
+  `bundler/lib/yamlio.py`, `bundler/services/installer.py`,
+  `extensions/__init__.py`, `integrations/base.py`, `workflows/catalog.py`,
+  `workflows/engine.py`, test files, docs, catalog JSON) auto-merged cleanly.
+- Fork-only modules and tests preserved. `PKG_NAMES` skip guard added to
+  `test_git_extension_python_parity.py` to skip parity tests on fork.
+- Test suite: all passing across contract, unit, integration, scripts, and
+  integration test suites (including 366 registry tests, 115 subcommand
+  lifecycle tests, and all per-agent integration tests).
+- Smoke test: `specify init /tmp/merge-test --integration claude --script sh
+  --ignore-agent-tools` succeeds; version reports `0.12.15+adlc1`.
+
+# [0.12.14+adlc1] - 2026-07-14
+
+### Changed
+
+- **Upstream merge**: Synced with `github/spec-kit` (29 commits, 3 releases
+  0.12.12–0.12.14):
+  - **Workflow engine hardening**: fail-fast on non-list `wait_for` (#3482),
+    non-mapping `switch` cases (#3481), non-iterable membership tests (#3448),
+    falsy non-list `else` in `if` steps (#3264), bool `max_iterations` (#3270),
+    mis-shaped catalog registry & non-string fields (#3375), and command-step
+    `input`/`options` must be mappings (#3262). Engine validation is now
+    shared between `execute()` and `validate()` so callers that skip
+    `WorkflowEngine.validate()` still fail the step cleanly instead of
+    crashing or silently coercing.
+  - **Configurable shell-step timeout consolidation (#3327/#3328)**: replaces
+    the fork's simpler #3404 baseline with upstream's shared
+    `_timeout_error()` helper used by both `execute()` and `validate()`.
+    Returns FAILED instead of silently resetting to 300s, and additionally
+    rejects non-finite floats (YAML `.inf`/`.nan`).
+  - **Extension-relative subdir path rewriting (#3444)**: adopted upstream's
+    new `CommandRegistrar.rewrite_extension_paths()` static method so bundled
+    extension command bodies reference their installed location under
+    `.specify/extensions/<id>/` instead of the workspace root.
+  - **Preset manifest-authoritative template resolution (#3351)**:
+    `PresetResolver.resolve()` now honors manifest-declared `file:` entries
+    via the new `_manifest_declared_template()` helper, and does NOT fall back
+    to convention lookup when a declared file is missing — mirrors
+    `collect_all_layers()` so `resolve()` and `resolve_with_source()` agree
+    instead of returning the core template or a stray convention file.
+  - **Bundle hardening**: reject `file://`/local `download_url` — catalog URLs
+    must be HTTPS (#3344).
+  - **Extensions/presets**: `set-priority` repairs corrupted boolean priority
+    (#3268/#3269); prefix-colliding env vars handled in `_get_env_config`
+    (#3350).
+  - **Integrations**: kiro-cli declared multi-install safe (#3471/#3472/#3485);
+    exit cleanly on unbalanced quote in `--integration-options` (#3457).
+  - **Init**: don't block on confirmation for `init --here` without a TTY
+    (#3236). Fork merged this with its `accent()` theming on the `--force`
+    message.
+  - **Templates**: constitution sync checklist points at installed command
+    files (#3418); agent-file-template cleanup (#2579). Accepted upstream
+    `templates/` changes per FORK.md policy (templates stay upstream-aligned).
+  - **Community catalog additions**: Quality Gates enforcement extension
+    (#3431), Verify Review Ship extension (#3450), Spec Kit Memory extension
+    (#3455), Test-First Governance preset (#3504), Autonomous Run Governance
+    preset (#3501).
+  - **Docs**: bundle `--integration` (#3271), copilot skills mode
+    deprecation (#3313), release tag `v` prefix clarification (#3463).
+- **Conflicts resolved** (4):
+  - `pyproject.toml` — preserved fork `name`/`description`/`httpx` dep and
+    the full `[tool.hatch.build.targets.wheel.force-include]` block for
+    bundled extensions/presets; set version `0.12.11+adlc3` → `0.12.14+adlc1`.
+  - `src/specify_cli/commands/init.py` — combined fork's `accent()` theming
+    with upstream's clearer "Template files will be merged…" overwrite
+    warning on the `--force` path.
+  - `tests/test_presets.py` — kept fork's "Speckit " skill-title prefix
+    assertion AND adopted upstream's new subdir-path-rewrite assertions
+    (#2101) for skill restore.
+  - `README.md` — kept fork's tikalk-flavored install instructions and
+    `agentic-sdlc-v*` tag prefix guidance; adopted upstream's "keep the
+    leading v" clarification.
+- All other modified files (`__init__.py`, `agents.py`, `integrations/base.py`,
+  `forge/__init__.py`, `presets/__init__.py`, workflow step modules, etc.)
+  auto-merged cleanly. Fork-only modules (`_init_fork.py`, `_core_fork.py`,
+  `_assets_fork.py`, `_base_fork.py`, `_workflows_fork.py`,
+  `extensions_fork.py`, `base_fork.py`) and fork-only tests preserved.
+- Accepted legitimate upstream deletion: `workflows/feature-squad.yml`,
+  `tests/test_timestamp_branches.py`, and
+  `presets/self-test/templates/agent-file-template.md`.
+- Rejected upstream deletion of `workflows/impl-converge-loop/workflow.yml`
+  (fork intentionally keeps it per `0.12.4+adlc8`).
+- Test suite: 4335 tests collected, all passing.
+- FORK.md updated: added `_base_fork.py` and `_workflows_fork.py` to the
+  module-layout table; refreshed the fork-only test inventory.
+
 # [0.12.11+adlc3] - 2026-07-13
 
 ### Changed
@@ -3695,6 +3845,67 @@ This release migrates fork-specific customizations to a preset system to reduce
 
 The following entries are from the upstream spec-kit project and are included for reference.
 
+## [0.12.15] - 2026-07-14
+
+### Changed
+
+- Update Autonomous Run Governance preset to v0.1.4 (#3511)
+- fix(workflows): raise catalog error, not raw ValueError, on a malformed catalog URL (#3484)
+- fix(workflows): evaluate 'in'/'not in' safely on a non-iterable right operand (#3447) (#3468)
+- fix: add trailing newline to init-options.json output (#3509)
+- feat(workflows): align workflow CLI with extension command surface (#3419)
+- fix(extensions): stop env-var config leaking across prefix-colliding extension IDs (#3497)
+- fix(integrations): escape control characters in goose recipe YAML renderer (#3384)
+- [extension] Update DocGuard — CDD Enforcement extension to v0.32.0 (#3489)
+- [extension] Add Multi-Repo Branch Sync extension to community catalog (#3411)
+- chore: release 0.12.14, begin 0.12.15.dev0 development (#3506)
+
+## [0.12.14] - 2026-07-13
+
+### Changed
+
+- [extension] Add Spec Kit Memory extension to community catalog (#3455)
+- Add Test-First Governance preset to community catalog (#3504)
+- Add Autonomous Run Governance preset to community catalog (#3501)
+- fix(workflows): validate command step input/options are mappings (#3262)
+- fix(presets): resolve() honors manifest-declared file: for installed presets (#3351)
+- fix(init): don't block on confirmation for 'init --here' without a TTY (#3236)
+- [extension] Add Quality Gates (Enforcement Layer) extension to community catalog (#3431)
+- fix(integrations): exit cleanly on unbalanced quote in --integration-options (#3457) (#3466)
+- fix(integrations): declare kiro-cli multi-install safe (#3471) (#3485)
+- fix(workflows): fail fan-in step on non-list wait_for instead of crashing (#3482)
+- chore: release 0.12.13, begin 0.12.14.dev0 development (#3498)
+
+## [0.12.13] - 2026-07-13
+
+### Changed
+
+- fix(workflows): fail switch step on non-mapping cases instead of crashing (#3481)
+- Cleanup agent-file-template.md (#2579)
+- fix: mark Kiro integration as multi-install safe (#3472)
+- fix: rewrite extension-relative subdir paths in generated command bodies (#3444)
+- fix(templates): point constitution sync checklist at installed command files (#3418)
+- feat(workflows): make shell step timeout configurable (#3327) (#3328)
+- docs: clarify that release tags keep the leading v prefix (#3463)
+- fix(workflows): don't crash on membership test against a non-iterable (#3448)
+- fix(workflows): if-step validate accepts falsy non-list else (#3264)
+- chore: release 0.12.12, begin 0.12.13.dev0 development (#3490)
+
+## [0.12.12] - 2026-07-13
+
+### Changed
+
+- fix(extensions): set-priority repairs corrupted boolean priority (#3268)
+- fix(presets): set-priority repairs corrupted boolean priority (#3269)
+- fix(workflows): engine loop cap ignores bool max_iterations (#3270)
+- docs(bundles): document --integration on 'bundle update' (#3271)
+- fix(workflows): harden catalog.py against mis-shaped registry & non-string fields (#3375)
+- Add Verify Review Ship extension to community catalog (#3450)
+- fix(bundle): reject file:// / local download_url — catalog URLs are HTTPS-only (#3344)
+- fix(extensions): handle prefix-colliding env vars in _get_env_config (#3350)
+- docs: document copilot skills mode (--skills) and markdown deprecation (#3313)
+- chore: release 0.12.11, begin 0.12.12.dev0 development (#3460)
+
 ## [0.12.11] - 2026-07-10
 
 ### Changed