spec-kitty-cli 3.2.0a6__tar.gz → 3.2.0a8__tar.gz

{spec_kitty_cli-3.2.0a6 → spec_kitty_cli-3.2.0a8}/CHANGELOG.md

@@ -17,6 +17,54 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Removed
 
+## [3.2.0a8] - 2026-05-01
+
+3.2.0a8 is a prerelease that hardens direct SaaS sync ingress around the
+Private Teamspace boundary. CLI sync side effects now resolve a canonical
+Private Teamspace target, rehydrate session membership once when needed, and
+skip direct ingress with a diagnostic instead of falling back to a shared team.
+
+### Fixed
+
+- Direct sync ingress for `/api/v1/events/batch/` and `/api/v1/ws-token` now
+  uses a strict Private Teamspace resolver and refuses shared-team fallbacks
+  from stale `default_team_id`, `teams[0]`, or websocket state (#943).
+- Auth refresh and session rehydration now update team membership from
+  `/api/v1/me`, recomputing `default_team_id` from the refreshed private team
+  list instead of preserving stale shared defaults (#943).
+- `--json` command stdout remains parseable when SaaS sync cannot connect or
+  cannot resolve a Private Teamspace; sync diagnostics route to stderr or
+  structured logs rather than contaminating stdout (#943).
+
+### Internal
+
+- Added strict resolver, sync call-site, websocket, offline queue, and
+  strict-JSON regression coverage for the Private Teamspace ingress boundary.
+- Added mission review evidence for
+  `private-teamspace-ingress-safeguards-01KQH03Y`.
+
+## [3.2.0a7] - 2026-05-01
+
+3.2.0a7 is a focused prerelease that bounds WebSocket sync startup and
+shutdown behavior. Short-lived agent commands now fail over to batch sync
+instead of hanging indefinitely when a local sync socket accepts the
+connection but never emits the initial snapshot.
+
+### Fixed
+
+- WebSocket sync startup now has bounded open, initial snapshot, and close
+  deadlines so `spec-kitty agent mission setup-plan` and other short-lived
+  commands degrade to batch sync instead of blocking forever on a stalled
+  sync socket (#936).
+
+### Internal
+
+- Added regression coverage for a WebSocket connection that never sends the
+  initial snapshot and for shutdown paths where the close handshake stalls.
+- Aligned existing Bandit suppressions in touched sync/readiness callsites so
+  local and CI security scans recognize the intended safe dynamic SQL and
+  localhost URL patterns.
+
 ## [3.2.0a6] - 2026-04-30
 
 3.2.0a6 is a prerelease hardening sweep that restores the documented
@@ -1345,6 +1393,7 @@ All fixes include comprehensive test coverage (54+ new tests) and maintain backw
   - **Errors handled**: TimeoutExpired (>10s git commands), general exceptions with warning
 
 ### Added
+
 - Git commit validation for "done" status transitions - prevents completing WPs with uncommitted changes
 - Empty branch detection in merge-base creation - warns when dependencies have no commits
 - Git commit workflow section in documentation mission template (consistency with software-dev/research)
@@ -1352,11 +1401,13 @@ All fixes include comprehensive test coverage (54+ new tests) and maintain backw
 - Migration to add commit workflow section to existing projects (`m_0_13_5_add_commit_workflow_to_templates.py`)
 
 ### Changed
+
 - `move-task --to done` now validates git status (same checks as "for_review")
 - Use `--force` flag to bypass validation (not recommended)
 - Warning messages in multi-parent merge now output to stderr instead of stdout (preserves JSON output integrity)
 
 ### Fixed (Non-Critical)
+
 - WP agents can no longer mark tasks as "done" without committing implementation files
 - Multi-parent merge-bases no longer silently accept empty dependency branches
 - Documentation mission now instructs agents to commit work before review
@@ -1418,7 +1469,7 @@ All fixes include comprehensive test coverage (54+ new tests) and maintain backw
   - Unit tests: `test_implement_validation.py` (11 tests)
   - Integration tests: `test_agent_command_wrappers.py` (11 tests)
 - Added `TestMigrationRegistryCompleteness` test (prevents 0.13.2-style release blocker)
-  - Verifies all m_*.py migration files are imported in __init__.py
+  - Verifies all `m_*.py` migration files are imported in `__init__.py`
   - Prevents silent bugs where migrations exist but never run
 - Added integration tests for merge with untracked branches
 - Added unit tests for `has_tracking_branch()` function
@@ -1840,9 +1891,9 @@ The migration will remove mission-specific constitution directories:
   - `signal.SIGKILL` and `signal.SIGTERM` don't exist on Windows
   - Added `psutil>=5.9.0` dependency for cross-platform process management
   - Refactored `src/specify_cli/dashboard/lifecycle.py`:
-    * `os.kill(pid, 0)` → `psutil.Process(pid).is_running()`
-    * `signal.SIGKILL` → `psutil.Process(pid).kill()` (6 locations)
-    * `signal.SIGTERM` → `psutil.Process(pid).terminate()` with timeout
+    - `os.kill(pid, 0)` → `psutil.Process(pid).is_running()`
+    - `signal.SIGKILL` → `psutil.Process(pid).kill()` (6 locations)
+    - `signal.SIGTERM` → `psutil.Process(pid).terminate()` with timeout
   - Added proper exception handling (NoSuchProcess, AccessDenied, TimeoutExpired)
   - Dashboard now starts, serves HTML, and stops cleanly on Windows 10/11
   - All 41 dashboard tests passing

{spec_kitty_cli-3.2.0a6 → spec_kitty_cli-3.2.0a8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: spec-kitty-cli
-Version: 3.2.0a6
+Version: 3.2.0a8
 Summary: Spec Kitty, a tool for Specification Driven Development (SDD) agentic projects, with kanban and git worktree isolation.
 Project-URL: Repository, https://github.com/Priivacy-ai/spec-kitty
 Project-URL: Issues, https://github.com/Priivacy-ai/spec-kitty/issues
@@ -143,7 +143,7 @@ Spec Kitty addresses this with repository-native artifacts, work package workflo
 
 ---
 
-## 🚀 What You Get on `main` (`3.2.0a6`)
+## 🚀 What You Get on `main` (`3.2.0a8`)
 
 | Capability | What Spec Kitty provides |
 |------------|--------------------------|
@@ -205,7 +205,7 @@ graph LR
 
 **Current stable release line:** `v3.1.x` (current stable release: `3.1.8` on GitHub Releases and PyPI)
 
-**Current `main` development version:** `3.2.0a6`
+**Current `main` development version:** `3.2.0a8`
 
 **Current `main` highlights:**
 - **Brief-first and ticket-first intake** — `spec-kitty intake` ingests external plans into `.kittify/mission-brief.md`, and `spec-kitty mission create --from-ticket <provider:KEY>` seeds tracker context before `/spec-kitty.specify`
@@ -228,18 +228,18 @@ graph LR
 
 ## 📌 Release Channels
 
-Spec Kitty currently ships stable `3.1.x` releases while `main` carries the active `3.2.0a6` prerelease/dev line.
+Spec Kitty currently ships stable `3.1.x` releases while `main` carries the active `3.2.0a8` prerelease/dev line.
 The former `1.x` line is deprecated and lives on `1.x-maintenance` for maintenance-only fixes.
 
 | Source | Version | Status | Install |
 |--------|---------|--------|---------|
 | **PyPI / GitHub Releases** | **3.1.8** | Current stable line | `pip install spec-kitty-cli` |
-| **main** | **3.2.0a6** | Active prerelease / development line | Install from a source checkout or a published prerelease tag |
+| **main** | **3.2.0a8** | Active prerelease / development line | Install from a source checkout or a published prerelease tag |
 | **1.x-maintenance** | **1.x** | Deprecated, maintenance-only | Install from a pinned maintenance tag or source checkout |
 
 **For users:** install the stable line from PyPI with `pip install spec-kitty-cli`.
 **For testers following `main`:** use a source checkout or published prerelease builds to get the intake, profile-invocation, hosted tracker-read, and Teamspace-routing work that is newer than stable `3.1.x`.
-After `3.2.0a6` is published, testers can install the exact prerelease with `pip install "spec-kitty-cli==3.2.0a6"` or opt into prereleases with `pip install --pre spec-kitty-cli`.
+After `3.2.0a8` is published, testers can install the exact prerelease with `pip install "spec-kitty-cli==3.2.0a8"` or opt into prereleases with `pip install --pre spec-kitty-cli`.
 **For existing 3.0.x users:** upgrade to `3.1.x` and run `spec-kitty upgrade` in each project — the charter rename, mission identity, and prompt-neutrality migrations remain automatic.
 **For existing 1.x or 2.x users:** migrate to `3.1.x`; `1.x-maintenance` is maintenance-only and will no longer publish new PyPI releases.
 

{spec_kitty_cli-3.2.0a6 → spec_kitty_cli-3.2.0a8}/README.md

@@ -45,7 +45,7 @@ Spec Kitty addresses this with repository-native artifacts, work package workflo
 
 ---
 
-## 🚀 What You Get on `main` (`3.2.0a6`)
+## 🚀 What You Get on `main` (`3.2.0a8`)
 
 | Capability | What Spec Kitty provides |
 |------------|--------------------------|
@@ -107,7 +107,7 @@ graph LR
 
 **Current stable release line:** `v3.1.x` (current stable release: `3.1.8` on GitHub Releases and PyPI)
 
-**Current `main` development version:** `3.2.0a6`
+**Current `main` development version:** `3.2.0a8`
 
 **Current `main` highlights:**
 - **Brief-first and ticket-first intake** — `spec-kitty intake` ingests external plans into `.kittify/mission-brief.md`, and `spec-kitty mission create --from-ticket <provider:KEY>` seeds tracker context before `/spec-kitty.specify`
@@ -130,18 +130,18 @@ graph LR
 
 ## 📌 Release Channels
 
-Spec Kitty currently ships stable `3.1.x` releases while `main` carries the active `3.2.0a6` prerelease/dev line.
+Spec Kitty currently ships stable `3.1.x` releases while `main` carries the active `3.2.0a8` prerelease/dev line.
 The former `1.x` line is deprecated and lives on `1.x-maintenance` for maintenance-only fixes.
 
 | Source | Version | Status | Install |
 |--------|---------|--------|---------|
 | **PyPI / GitHub Releases** | **3.1.8** | Current stable line | `pip install spec-kitty-cli` |
-| **main** | **3.2.0a6** | Active prerelease / development line | Install from a source checkout or a published prerelease tag |
+| **main** | **3.2.0a8** | Active prerelease / development line | Install from a source checkout or a published prerelease tag |
 | **1.x-maintenance** | **1.x** | Deprecated, maintenance-only | Install from a pinned maintenance tag or source checkout |
 
 **For users:** install the stable line from PyPI with `pip install spec-kitty-cli`.
 **For testers following `main`:** use a source checkout or published prerelease builds to get the intake, profile-invocation, hosted tracker-read, and Teamspace-routing work that is newer than stable `3.1.x`.
-After `3.2.0a6` is published, testers can install the exact prerelease with `pip install "spec-kitty-cli==3.2.0a6"` or opt into prereleases with `pip install --pre spec-kitty-cli`.
+After `3.2.0a8` is published, testers can install the exact prerelease with `pip install "spec-kitty-cli==3.2.0a8"` or opt into prereleases with `pip install --pre spec-kitty-cli`.
 **For existing 3.0.x users:** upgrade to `3.1.x` and run `spec-kitty upgrade` in each project — the charter rename, mission identity, and prompt-neutrality migrations remain automatic.
 **For existing 1.x or 2.x users:** migrate to `3.1.x`; `1.x-maintenance` is maintenance-only and will no longer publish new PyPI releases.
 

spec_kitty_cli-3.2.0a8/kitty-specs/stabilization-release-core-bug-fixes-01KPQJAN/tasks/README.md

@@ -0,0 +1,64 @@
+# Tasks Directory
+
+This directory contains work package (WP) prompt files.
+
+## Directory Structure (v0.9.0+)
+
+```
+tasks/
+├── WP01-setup-infrastructure.md
+├── WP02-user-authentication.md
+├── WP03-api-endpoints.md
+└── README.md
+```
+
+All WP files are stored flat in `tasks/`. Status is tracked in `status.events.jsonl`, not in WP frontmatter.
+
+## Work Package File Format
+
+Each WP file **MUST** use YAML frontmatter:
+
+```yaml
+---
+work_package_id: "WP01"
+title: "Work Package Title"
+dependencies: []
+planning_base_branch: "main"
+merge_target_branch: "main"
+branch_strategy: "Planning artifacts were generated on main; completed changes must merge back into main."
+subtasks:
+  - "T001"
+  - "T002"
+phase: "Phase 1 - Setup"
+assignee: ""
+agent: ""
+shell_pid: ""
+history:
+  - timestamp: "2025-01-01T00:00:00Z"
+    agent: "system"
+    action: "Prompt generated via /spec-kitty.tasks"
+---
+
+# Work Package Prompt: WP01 – Work Package Title
+
+[Content follows...]
+```
+
+## Status Tracking
+
+Status is tracked via the canonical event log (`status.events.jsonl`), not in WP frontmatter.
+Use `spec-kitty agent tasks move-task` to change WP status:
+
+```bash
+spec-kitty agent tasks move-task <WPID> --to <lane>
+```
+
+Example:
+```bash
+spec-kitty agent tasks move-task WP01 --to doing
+```
+
+## File Naming
+
+- Format: `WP01-kebab-case-slug.md`
+- Examples: `WP01-setup-infrastructure.md`, `WP02-user-auth.md`

spec_kitty_cli-3.2.0a8/kitty-specs/unified-charter-bundle-chokepoint-01KP5Q2G/tasks/README.md

@@ -0,0 +1,64 @@
+# Tasks Directory
+
+This directory contains work package (WP) prompt files.
+
+## Directory Structure (v0.9.0+)
+
+```
+tasks/
+├── WP01-setup-infrastructure.md
+├── WP02-user-authentication.md
+├── WP03-api-endpoints.md
+└── README.md
+```
+
+All WP files are stored flat in `tasks/`. Status is tracked in `status.events.jsonl`, not in WP frontmatter.
+
+## Work Package File Format
+
+Each WP file **MUST** use YAML frontmatter:
+
+```yaml
+---
+work_package_id: "WP01"
+title: "Work Package Title"
+dependencies: []
+planning_base_branch: "main"
+merge_target_branch: "main"
+branch_strategy: "Planning artifacts were generated on main; completed changes must merge back into main."
+subtasks:
+  - "T001"
+  - "T002"
+phase: "Phase 1 - Setup"
+assignee: ""
+agent: ""
+shell_pid: ""
+history:
+  - timestamp: "2025-01-01T00:00:00Z"
+    agent: "system"
+    action: "Prompt generated via /spec-kitty.tasks"
+---
+
+# Work Package Prompt: WP01 – Work Package Title
+
+[Content follows...]
+```
+
+## Status Tracking
+
+Status is tracked via the canonical event log (`status.events.jsonl`), not in WP frontmatter.
+Use `spec-kitty agent tasks move-task` to change WP status:
+
+```bash
+spec-kitty agent tasks move-task <WPID> --to <lane>
+```
+
+Example:
+```bash
+spec-kitty agent tasks move-task WP01 --to doing
+```
+
+## File Naming
+
+- Format: `WP01-kebab-case-slug.md`
+- Examples: `WP01-setup-infrastructure.md`, `WP02-user-auth.md`

{spec_kitty_cli-3.2.0a6 → spec_kitty_cli-3.2.0a8}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "spec-kitty-cli"
-version = "3.2.0a6"
+version = "3.2.0a8"
 description = "Spec Kitty, a tool for Specification Driven Development (SDD) agentic projects, with kanban and git worktree isolation."
 readme = "README.md"
 license = { file = "LICENSE" }

{spec_kitty_cli-3.2.0a6 → spec_kitty_cli-3.2.0a8}/src/charter/compiler.py

@@ -119,7 +119,7 @@ def compile_charter(
 
     # Validate and normalize local support file declarations.
     valid_local, local_errors = validate_local_support_declarations(
-        list(interview.local_supporting_files)
+        list(interview.local_supporting_files or [])
     )
     diagnostics.extend(local_errors)
 
@@ -669,7 +669,11 @@ def _template_reference(*, doctrine_root: Path, mission: str, template_set: str)
     config = repo.get_mission_config(mission)
     mission_path = repo._mission_config_path(mission) or (doctrine_root / "missions" / mission / "mission.yaml")
     raw_parsed = config.parsed if config is not None else {"name": mission}
-    source: dict[str, object] = raw_parsed if isinstance(raw_parsed, dict) else {"name": mission}
+    source: dict[str, object] = (
+        {str(key): value for key, value in raw_parsed.items()}
+        if isinstance(raw_parsed, dict)
+        else {"name": mission}
+    )
 
     summary = str(source.get("description") or f"Mission template set for {mission}.")
     content = (

{spec_kitty_cli-3.2.0a6 → spec_kitty_cli-3.2.0a8}/src/charter/interview.py

@@ -6,6 +6,7 @@ import importlib.resources
 from collections.abc import Iterable
 from dataclasses import dataclass, field
 from pathlib import Path
+from typing import cast
 
 from ruamel.yaml import YAML
 
@@ -228,7 +229,12 @@ def default_interview(
     """Return deterministic default interview answers."""
     catalog = doctrine_catalog or load_doctrine_catalog()
     defaults = _load_packaged_defaults()
-    answers: dict[str, str] = dict(defaults.get("answers", {}))
+    raw_default_answers = defaults.get("answers", {})
+    answers: dict[str, str] = (
+        dict(cast(dict[str, str], raw_default_answers))
+        if isinstance(raw_default_answers, dict)
+        else {}
+    )
 
     if profile == "minimal":
         answers = {key: answers[key] for key in MINIMAL_QUESTION_ORDER}
@@ -249,19 +255,19 @@ def default_interview(
         profile=profile,
         answers=answers,
         selected_paradigms=_normalize_iterable(
-            defaults.get("selected_paradigms"),
+            cast(Iterable[str] | None, defaults.get("selected_paradigms")),
             fallback=default_paradigms,
         ),
         selected_directives=_normalize_iterable(
-            defaults.get("selected_directives"),
+            cast(Iterable[str] | None, defaults.get("selected_directives")),
             fallback=default_directives,
         ),
         available_tools=_normalize_iterable(
-            defaults.get("available_tools"),
+            cast(Iterable[str] | None, defaults.get("available_tools")),
             fallback=sorted(DEFAULT_TOOL_REGISTRY),
         ),
         selected_tactics=_normalize_iterable(
-            defaults.get("selected_tactics"),
+            cast(Iterable[str] | None, defaults.get("selected_tactics")),
             fallback=[],
         ),
     )
@@ -315,11 +321,11 @@ def apply_answer_overrides(
 
     resolved_local: list[LocalSupportDeclaration]
     if local_supporting_files is _UNSET:
-        resolved_local = list(interview.local_supporting_files)
+        resolved_local = list(interview.local_supporting_files or [])
     elif local_supporting_files is None:
         resolved_local = []
     else:
-        resolved_local = list(local_supporting_files)  # type: ignore[call-overload]
+        resolved_local = list(cast(list[LocalSupportDeclaration], local_supporting_files))
 
     return CharterInterview(
         mission=interview.mission,
@@ -380,7 +386,7 @@ def _normalize_optional_string(raw: object) -> str | None:
 
 def _load_packaged_defaults() -> dict[str, object]:
     """Load authoritative default interview content from ``defaults.yaml``."""
-    empty = {
+    empty: dict[str, object] = {
         "answers": {},
         "selected_paradigms": [],
         "selected_directives": [],

{spec_kitty_cli-3.2.0a6 → spec_kitty_cli-3.2.0a8}/src/charter/resolver.py

@@ -19,6 +19,7 @@ from charter.sync import (
 )
 
 if TYPE_CHECKING:
+    from doctrine.drg.models import DRGGraph
     from doctrine.service import DoctrineService
     from charter.interview import CharterInterview
 
@@ -197,7 +198,7 @@ def resolve_governance_for_profile(
     doctrine_service: DoctrineService,
     interview: CharterInterview,
     *,
-    graph: object | None = None,
+    graph: DRGGraph | None = None,
     repo_root: Path | None = None,
 ) -> GovernanceResolution:
     """Resolve governance selections for a specific agent profile."""

{spec_kitty_cli-3.2.0a6 → spec_kitty_cli-3.2.0a8}/src/charter/synthesizer/orchestrator.py

@@ -31,6 +31,7 @@ if TYPE_CHECKING:
 
     from .adapter import AdapterOutput, SynthesisAdapter
     from .request import SynthesisRequest
+    from .resynthesize_pipeline import ResynthesisResult
 
 
 # ---------------------------------------------------------------------------
@@ -142,7 +143,7 @@ def synthesize(
     results = _run_all(request, adapter=adapter)
 
     shipped_drg = _DRGGraph.model_validate(_shipped_drg_from_snapshot(request.drg_snapshot))
-    sections = _resolve_sections(request.interview_snapshot)
+    sections = _resolve_sections(dict(request.interview_snapshot))
     targets = _build_targets(
         interview_snapshot=dict(request.interview_snapshot),
         mappings=sections,
@@ -217,7 +218,7 @@ def resynthesize(
     request: SynthesisRequest,
     topic: str,
     adapter: SynthesisAdapter | None = None,
-) -> SynthesisResult:
+) -> SynthesisResult | ResynthesisResult:
     """Run bounded resynthesis for a single structured topic selector.
 
     Delegates to resynthesize_pipeline.run() (implemented in WP05).

{spec_kitty_cli-3.2.0a6 → spec_kitty_cli-3.2.0a8}/src/charter/synthesizer/resynthesize_pipeline.py

@@ -542,15 +542,15 @@ def _load_merged_drg(
 
     project_graph_path = repo_root / ".kittify" / "doctrine" / "graph.yaml"
     if not project_graph_path.exists():
-        return request.drg_snapshot  # type: ignore[no-any-return]
+        return request.drg_snapshot
 
     yaml = YAML()
     try:
         project_graph = yaml.load(project_graph_path.read_text(encoding="utf-8"))
         if not isinstance(project_graph, dict):
-            return request.drg_snapshot  # type: ignore[no-any-return]
+            return request.drg_snapshot
     except Exception:  # noqa: BLE001
-        return request.drg_snapshot  # type: ignore[no-any-return]
+        return request.drg_snapshot
 
     # Merge: combine nodes from both graphs (project overlay + shipped snapshot)
     shipped_nodes = list(request.drg_snapshot.get("nodes", []))

{spec_kitty_cli-3.2.0a6 → spec_kitty_cli-3.2.0a8}/src/charter/synthesizer/synthesize_pipeline.py

@@ -38,7 +38,7 @@ import io
 import json
 from collections.abc import Mapping
 from datetime import datetime, timezone
-from typing import Any, Literal
+from typing import Any, Literal, cast
 
 from pydantic import BaseModel, ConfigDict, Field, ValidationError, model_validator
 from ruamel.yaml import YAML
@@ -297,7 +297,7 @@ def _dispatch_batch(
 ) -> list[AdapterOutput]:
     """Dispatch generate_batch() if available, else fall back to sequential."""
     if hasattr(adapter, "generate_batch"):
-        raw = adapter.generate_batch(per_target_requests)  # type: ignore[union-attr]
+        raw = adapter.generate_batch(per_target_requests)
         return list(raw)
     return _dispatch_single(adapter, per_target_requests)
 
@@ -359,7 +359,7 @@ def run(
         )
 
     # Stage 1: resolve sections from the interview snapshot
-    sections = resolve_sections(request.interview_snapshot)
+    sections = resolve_sections(dict(request.interview_snapshot))
 
     # Stage 2: build targets (validates source URNs against drg_snapshot)
     all_targets = build_targets(
@@ -429,7 +429,7 @@ def run(
 
         provenance = ProvenanceEntry(
             artifact_urn=_artifact_urn_for_target(target),
-            artifact_kind=target.kind,
+            artifact_kind=cast(Literal["directive", "tactic", "styleguide"], target.kind),
             artifact_slug=target.slug,
             artifact_content_hash=content_hash,
             inputs_hash=inputs_hash,
@@ -507,7 +507,7 @@ def run_all(
             "Production adapter wiring is not yet implemented (WP05)."
         )
 
-    sections = resolve_sections(request.interview_snapshot)
+    sections = resolve_sections(dict(request.interview_snapshot))
     all_targets = build_targets(
         interview_snapshot=dict(request.interview_snapshot),
         mappings=sections,
@@ -563,7 +563,7 @@ def run_all(
 
         provenance = ProvenanceEntry(
             artifact_urn=_artifact_urn_for_target(target),
-            artifact_kind=target.kind,
+            artifact_kind=cast(Literal["directive", "tactic", "styleguide"], target.kind),
             artifact_slug=target.slug,
             artifact_content_hash=content_hash,
             inputs_hash=inputs_hash,

{spec_kitty_cli-3.2.0a6 → spec_kitty_cli-3.2.0a8}/src/specify_cli/acceptance/matrix.py

@@ -117,7 +117,11 @@ def write_acceptance_matrix(feature_dir: Path, matrix: AcceptanceMatrix) -> Path
     if (feature_dir / "meta.json").exists():
         identity = resolve_mission_identity(feature_dir)
         matrix.mission_slug = identity.mission_slug
-        matrix.mission_number = identity.mission_number
+        matrix.mission_number = (
+            str(identity.mission_number)
+            if identity.mission_number is not None
+            else None
+        )
         matrix.mission_type = identity.mission_type
     path = feature_dir / MATRIX_FILENAME
     path.write_text(

spec_kitty_cli-3.2.0a8/src/specify_cli/auth/http/me_fetch.py

@@ -0,0 +1,36 @@
+"""Sync GET /api/v1/me — used by TokenManager.rehydrate_membership_if_needed.
+
+Intentionally tiny: no state mutation, no caching, no logging. Sync so it can be
+called from sync direct-ingress paths (batch.py, queue.py, emitter.py) without
+event-loop bridging. See contracts/api.md §2.
+
+Note: this helper deliberately does NOT use ``OAuthHttpClient`` because that
+client routes through ``TokenManager.get_access_token`` and would re-enter the
+manager during rehydrate, creating a deadlock on the membership lock.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from .transport import request_with_fallback_sync
+
+
+def fetch_me_payload(saas_base_url: str, access_token: str) -> dict[str, Any]:
+    """GET ``<saas_base_url>/api/v1/me`` with ``Authorization: Bearer <access_token>``.
+
+    Issues exactly one HTTP GET. No retries inside this function (the underlying
+    ``request_with_fallback_sync`` handles transport-layer fallback once).
+
+    Raises ``httpx.HTTPStatusError`` on non-2xx (caller decides how to handle).
+    Returns the parsed JSON dict. Caller is responsible for extracting ``teams[]``.
+    """
+    url = saas_base_url.rstrip("/") + "/api/v1/me"
+    response = request_with_fallback_sync(
+        method="GET",
+        url=url,
+        headers={"Authorization": f"Bearer {access_token}"},
+    )
+    response.raise_for_status()
+    payload: dict[str, Any] = response.json()
+    return payload

{spec_kitty_cli-3.2.0a6 → spec_kitty_cli-3.2.0a8}/src/specify_cli/auth/session.py

@@ -56,9 +56,13 @@ class Team:
 
 
 def pick_default_team_id(teams: list[Team]) -> str:
-    """Return the preferred default team id for a new session.
+    """Return the preferred default team id for new-session UI/login default display.
 
-    Private Teamspace wins when present; otherwise preserve the legacy first-team fallback.
+    Private Teamspace wins when present; otherwise preserves the legacy first-team
+    fallback. This is *display-only* — it is **not** valid as a fallback for direct
+    sync ingress. Direct-ingress code paths must use ``require_private_team_id`` paired
+    with ``TokenManager.rehydrate_membership_if_needed()`` instead, which fails closed
+    (returns ``None``) rather than returning a shared team.
     """
     for team in teams:
         if team.is_private_teamspace:
@@ -74,6 +78,25 @@ def get_private_team_id(teams: list[Team]) -> str | None:
     return None
 
 
+def require_private_team_id(session: StoredSession) -> str | None:
+    """Return the Private Teamspace id for direct sync ingress, else None.
+
+    Pure function. No I/O. No mutation.
+
+    Contract:
+      - If any team in ``session.teams`` has ``is_private_teamspace=True``, return that team's id.
+        When more than one team has ``is_private_teamspace=True`` (today: not expected from SaaS),
+        the first such team is returned for determinism.
+      - Otherwise, return ``None``.
+      - NEVER returns ``session.default_team_id`` (even when set).
+      - NEVER returns ``session.teams[0].id`` as a fallback.
+
+    Pair with ``TokenManager.rehydrate_membership_if_needed()`` to recover from
+    a session whose ``teams`` list is stale.
+    """
+    return get_private_team_id(session.teams)
+
+
 @dataclass
 class StoredSession:
     """The persisted representation of an authenticated spec-kitty session.