Spec Kitty CLI v3.2.6rc2 (release candidate)

Audience: people who run spec-kitty — consumers and operators. This is a release candidate in the 3.2.6 cycle (rc1 shipped 2026-08-12); rc2 collects the fixes and improvements that have merged since. Try it, kick the tyres, and report anything odd before the stable 3.2.6 cuts.

What's in this candidate

rc2 is a large, fix-heavy candidate. The headline is that your own doctrine packs finally work end to end — templates, missions, mission types, profiles, and dependency edges that an org or project pack ships are now actually resolved and cascaded at runtime, not just declared and then silently ignored. Around that sit a wave of charter quality-of-life improvements, a long list of operator-facing bugfixes (many of them fixing silent failures you'd never have seen surface), safer operator configuration via a single .kitty.env file and an opt-in rc channel, and a broad documentation refresh. If you don't use custom packs or hosted sync, most of this is invisible upside: existing projects behave identically unless a fix applies to you.

For the complete, itemised list see the changelog:
docs/changelog/CHANGELOG.md — the 3.2.6rc2 section.

Bugfixes you'll feel

Symptom-first — if you hit one of these, it's fixed:

• Copy-pasted commands that errored out now run as-is. Protected-branch commit refusals and work-package prompts printed invocations that don't exist (--start-branch on the wrong command, agent status instead of agent tasks status). Corrected at the source. (#3577)
• Running a command from a lane worktree no longer silently writes to your main checkout. Root/workspace resolution is now honest under worktrees and clones; foreign-checkout writes fail closed and name the target instead of quietly redirecting. mission create / next also run correctly from a linked worktree, with each worktree's mission state isolated. (#3129, #3346)
• spec-kitty merge no longer deadlocks on coordination-topology missions. Review-override evidence now lands on the surface the merge gate actually reads, plus a --skip-review-artifact-check escape hatch. Several related coord/partition mis-reads that degraded silently are fixed in the same pass. (mission partition-authority-residuals, write-path-integrity)
• Review rejections reach the hosted dashboard again. A wire-contract mismatch meant sending a work package back for rework applied locally but was silently dropped by hosted sync (one reported batch surfaced 11+ days later as bulk failures). Rejections now propagate. Note: a rejection rationale (--review-feedback-file or --note) is now mandatory — it travels on the wire. (#3307)
• A reviewer on a different profile can now claim a completed WP for review — the false "already claimed for review by <implementer>" refusal is gone. (#3455)
• Stuck upgrades now have a way out. Six upgrade-wedge failures where a stalled migration left no self-service recovery are fixed, plus four read/write-consistency defects where a step trusted a stale or pre-merge view of saved state. A failed upgrade no longer wedges your project as unrecoverable. (#3383, #3320)
• First-time hosted sync stops lying to you. sync doctor/sync status no longer report "healthy" while the live drain is blocked; an unreachable or decommissioned server is named with the exact repoint command; auth login resolves the server the same way sync does; legacy work packages with retired frontmatter fields import instead of being skipped. (#3406)
• Silent zero-capture sync is fixed. Machines that never ran the layout migration were dropping every sync event while reporting success. (#3425)
• Rejecting a WP no longer wastes a cycle — the feedback-file path the review command prints is now one move-task will actually accept. (#3554)

Plenty more small fixes (bare-prose requirement coverage, finalize-tasks on main-targeted missions, retrospect synthesize error clarity, private→shared team routing drift, and others) are in the changelog.

Better support for custom packs

If your organisation or project ships its own doctrine pack, rc2 is the release where it stops being inert past activation:

• Org packs can ship templates and mission content, and spec-kitty now resolves them. A new ORG tier sits in the asset and mission-discovery chains, so a configured, activated org template or mission is actually found at runtime instead of declared-but-unreachable. charter list labels org entries with the correct ORG origin. (#3524, closes #3523)
• A custom mission type now works end to end — mission create, charter activation, and action-sequence projection resolve org- and project-tier types with a real action sequence and template set, instead of hard-failing or silently planning nothing. A registered org pack now delivers its step contracts, artifact requirements, and graph nodes at runtime, and a chain of multiple org packs merges in order. (#3424, #3520, #3525)
• One canonical pack-manifest.yaml schema replaces two divergent formats, with stable pack identity (pack_id) and declared lineage — the foundation for reliable pack composition. (closes #3500–#3503)
• Org-pack dependency edges now cascade. A requires/suggests edge authored in a pack's drg/fragment.yaml, or declared by any pack in a multi-pack chain, is now followed by charter activate --cascade — and pack validate and the runtime finally tell the same story about whether that fragment is read. Activating from a pack with no dependency graph no longer crashes. (#3572, #3534, #3399)
• pack validate catches three shapes that used to pass and then misbehave at runtime — a merge-skipped profile, a broken nested asset manifest, and DRG content that would silently zero out on adoption. (This is a breaking validation change for those pack shapes — see the changelog.) (#3387)

Nested pack subdirectories are also no longer silently dropped, so doctrine authored one directory deep loads and activates like the built-in corpus.

Charter quality-of-life

• Activating a mission type now actually reaches its governance. The cascade previously dead-ended before it hit any directive, tactic, or styleguide — every built-in mission type cascaded to zero artifacts. It now walks the full path, and proposes only kinds you can actually activate (no more spurious "could not cascade-activate" warnings). (#2829)
• spec-kitty next / implement no longer block on a missing or legacy-only charter — both are now advisory, matching what specify/plan and the dashboard already tolerated. New projects and pre-inversion projects can move forward. (#3498)
• Loaded doctrine now actually reaches the dispatched agent — glossary packs, procedure/tactic step descriptions, project-overlay profiles, and procedures in charter context --json are no longer silently dropped. (#3489)
• A hand-authored project-tier profile is now reachable by the cascade, and a procedure named in a profile's operating-procedures becomes a real, checked dependency (a fictional entry fails the build loudly instead of drifting). (#3038, #2994)

Documentation improvements

• Self-documenting repo: two audits moved a large body of workflow, CI, git, and sync mechanics out of private maintainer notes into the repo's canonical docs — review-gate and merge-gate mechanics, a real sync-drain runbook, split-brain recovery runbooks, and stale-doc corrections. (#3448, #3464)
• New spk-doctrine-show-me skill guides agents to explain their work with the smallest useful diagram, tree, or pseudocode, routed to Spec Kitty's canonical Mermaid/PlantUML/C4 sources. (#3528)
• Rendered doctrine schema diagrams on the docs site, drawn locally with no network egress and drift-guarded against the live models. (#3366)
• New architecture references tie the SaaS opt-in, .kitty.env, rc-channel, and mission-gate decisions together, and the transition-gate design is now documented as architecture. (#3378)
• durable doc status for standing references that should never be nagged as stale draft. (#3368)
• Stale README/guide links that 404'd on GitHub after the docs reorganisation are fixed.

Operator configuration

• One .kitty.env file to point at for SaaS tokens, org slugs, and path overrides — loaded before anything else runs, with secret-shaped values templated blank, never captured live. A doctor env-file facet reports its health. (#3495)
• Committed doctrine provenance is now portable — no more baked-in absolute paths that broke on a teammate's checkout, a wheel, or CI. An idempotent upgrade migration heals any already-leaked paths; doctor provenance reports remaining leaks. (#3494)
• Opt-in release-candidate channel. A default-off SPEC_KITTY_PRERELEASE preference makes the "latest version" surfaces rc-aware only when you ask — unset (the default), you still only ever see stable releases, and no one gets nagged about an rc they didn't opt into. (#3496)
• Per-project hosted-sync consent: each project owns one physically separate sync store and one explicit consent decision, so one project's data can never leak into another's. (#3262)

How to try it

rc2 is a pre-release, so pip won't pick it up unless you ask for it:

# pin the exact candidate (recommended)
pip install spec-kitty-cli==3.2.6rc2

# or allow the newest pre-release
pip install --pre spec-kitty-cli

After installing, existing projects work unchanged; run spec-kitty upgrade if you want the provenance-path heal and other migrations applied. Please file anything unexpected against the 3.2.6 milestone before the stable release.

Full details: docs/changelog/CHANGELOG.md → 3.2.6rc2.