Priivacy-ai/spec-kitty v3.2.0rc33

on GitHub

Changed

• Tag-time PyPI publishing now stays focused on release-local checks. Live
  canary evidence and the cross-repo end-to-end consumer scenario are no longer
  blocking jobs in .github/workflows/release.yml; operators can still run
  those suites locally before cutting a release.
• Release metadata now aligns .kittify/metadata.yaml with pyproject.toml
  for 3.2.0rc33.

[Unreleased - rc32 follow-ups]

Added

• Charter governance references: governance_references declarations in charter.md
  now surface supporting public governance docs in charter context text/JSON and
  charter status diagnostics, with repo-root-scoped path safety.
• Release authority now has a machine-readable shared-package compatibility
  manifest, plus gates that validate CLI ranges, uv.lock, SaaS consumer
  contracts, and exact PyPI installability for published artifacts.

Fixed

• spec-kitty agent decision open --json now emits exactly one parseable JSON
  object on stdout. The response includes a retry-safe idempotency key so callers
  can rerun the same logical open by mission slug and recover the same
  decision_id after wrapper parse/process failures. Idempotent retries repair
  a missing opened event when local decision files were persisted before event
  emission failed, and dry-run output no longer advertises persisted recovery.
• charter generate --force now refuses to overwrite symlinked charter.md paths,
  preventing silent writes through symlink targets.
• Sync WebSocket connections now send ephemeral ws_token credentials in the
  Authorization: Bearer upgrade header instead of an ignored ?token= query
  parameter, restoring authenticated live event delivery.
• Prerelease PyPI publishing no longer waives downstream consumer evidence; the
  release workflow now requires the private consumer suite before any PyPI
  promotion.
• A circular work-package dependency in tasks.md no longer leaves the canonical
  status uninitialized with a misleading, looping error (#1589). finalize-tasks
  aborts on the cycle before bootstrapping status; spec-kitty next/move-task
  and lane reads now name the dependency cycle as the root cause instead of an
  infinite "run finalize-tasks to bootstrap the event log" hint.
• spec-kitty agent status doctor no longer reports a mission as "Healthy" when
  it has work-package definitions but no canonical status (e.g. after a
  cycle-aborted finalize-tasks); it now emits an uninitialized_status warning
  naming the cycle when present (#1589).
• CI: the shared-package drift check now skips gracefully when
  SPEC_KITTY_SAAS_READ_TOKEN is unavailable (fork PRs) instead of hard-failing;
  the cross-repo drift is still enforced by the push-to-main CI that holds the
  secret.

Documentation

• Clarified that .kittify/charter/charter.md is the Spec Kitty runtime governance
  center, while public docs such as spec/constitution.md are supporting context
  rather than alternate authoritative charter paths.
• Added migration guidance for constitution-era .kittify/memory/constitution.md
  and .kittify/constitution/* layouts.