spec-kitty-cli 3.2.0rc28__tar.gz → 3.2.0rc29__tar.gz

{spec_kitty_cli-3.2.0rc28 → spec_kitty_cli-3.2.0rc29}/CHANGELOG.md

@@ -9,6 +9,81 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+No notable changes yet.
+
+## [Unreleased - 3.2.0]
+
+### Changed
+
+- Documented the host-surface parity matrix and Mode of Work governance layer
+  so advise/ask/do behavior has a visible README entry point.
+- Clarified correlation link and projection policy / read-model policy coverage
+  for the 3.2.0 trail-model tranche, including deferred Tier 2 items.
+
+### Deferred
+
+- Continued tracking deferred follow-up work such as
+  [#534](https://github.com/Priivacy-ai/spec-kitty/issues/534) outside the
+  3.2.0 readiness tranche.
+
+## [3.2.0rc29] - 2026-05-29
+
+3.2.0rc29 rerolls the coordination branch atomic event-log candidate after
+PR review and publishes the launch-readiness hardening merged after the yanked
+3.2.0rc28 candidate.
+
+### Added
+
+- Added mission coordination branches, sparse coordination worktrees,
+  `BookkeepingTransaction`, and `WorkflowMutationPolicy` so mission status
+  mutations are staged, audited, and committed away from protected target
+  branches.
+- Added regression, integration, stress, and architectural coverage for
+  coordination worktree creation, safe-commit branch assertions, legacy mission
+  fallback, workflow rollback, post-merge indexing, and concurrent status
+  emission.
+- Added `mission close --discard` and doctor diagnostics for coordination
+  workspace health, restart-daemon timing, command/skill manifest drift, and
+  upgrade remediation provenance.
+- Added external-orchestrator install and compatibility documentation, including
+  PyPI installation paths, orchestrator API JSON-error guidance, host-surface
+  governance docs, and environment-variable references.
+
+### Changed
+
+- **BREAKING (CLI)**: `spec-kitty safe-commit` now requires
+  `--to-branch <ref>`. The temporary `SPEC_KITTY_INFER_DESTINATION_REF=1`
+  compatibility path lets the CLI resolve and pass the destination explicitly
+  during rollout; the helper itself never infers it.
+- **BREAKING (internal)**: `safe_commit()` now requires keyword-only
+  `worktree_root`, `destination_ref`, and `paths`, and structurally verifies
+  that the worktree HEAD matches the declared destination before staging.
+- Removed Spec Kitty internal protected-branch commit exceptions for planning
+  artifacts and merged-WP done records. Remaining exceptions are limited to
+  documented non-Spec-Kitty upgrade/release workflows.
+- Hardened release CI ownership by deduplicating release-readiness checks,
+  adding installed-entrypoint smoke coverage, and preserving clean-install
+  latency evidence.
+
+### Fixed
+
+- Migrated remaining production `safe_commit()` call sites to the
+  destination-ref-aware API so agent task, mission, merge, upgrade, and
+  orchestrator paths no longer crash on the removed legacy signature.
+- Fixed protected-branch leakage from `agent action implement` by routing
+  planning artifacts and workflow status writes through coordination-owned
+  commit paths instead of target-branch bypasses.
+- Serialized first-time coordination worktree creation under the feature
+  status lock to prevent concurrent emitters from racing on `git worktree add`.
+- Fixed idempotent squash-merge retry behavior, finalize-tasks dependency
+  source precedence, safe-commit recovery reporting, workflow path mirroring,
+  configured command execution on Windows, charter JSON error envelopes, and
+  command/skill manifest repair drift.
+- Restored upgrade-readiness preference preservation and compatibility hints,
+  including uv-tool pytest remediation provenance fallbacks.
+- Restored compatibility for older unit-test fakes that do not expose the new
+  coordination branch or commit-result fields.
+
 ## [3.2.0rc28] - 2026-05-27
 
 3.2.0rc28 fixes acceptance lane ownership and a clean-install dependency gap.

{spec_kitty_cli-3.2.0rc28 → spec_kitty_cli-3.2.0rc29}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: spec-kitty-cli
-Version: 3.2.0rc28
+Version: 3.2.0rc29
 Summary: Spec Kitty, a tool for Specification Driven Development (SDD) agentic projects, with kanban and git worktree isolation.
 Project-URL: Repository, https://github.com/Priivacy-ai/spec-kitty
 Project-URL: Issues, https://github.com/Priivacy-ai/spec-kitty/issues
@@ -139,6 +139,15 @@ It is probably overkill for one-off edits, tiny scripts, or teams that do not us
 | Integrate agents | Slash commands or skills for common AI coding tools |
 | Learn from missions | Every completed mission generates a retrospective by default. Tune via `.kittify/config.yaml#retrospective` or charter; see [how-to](docs/how-to/use-retrospective-learning.md). |
 
+## Governance layer
+
+Spec Kitty keeps runtime governance in the repo instead of treating it as
+agent-only prompt text. The trail model in [docs/trail-model.md](docs/trail-model.md)
+describes how `spec-kitty advise`, `spec-kitty ask`, and `spec-kitty do` map
+operator intent to runtime behavior, while
+[docs/host-surface-parity.md](docs/host-surface-parity.md) tracks parity across
+CLI, slash-command, and hosted surfaces.
+
 ## Quick Start
 
 Install the CLI:
@@ -218,6 +227,7 @@ Start here:
 
 - [Getting Started](docs/tutorials/getting-started.md)
 - [Your First Feature](docs/tutorials/your-first-feature.md)
+- [Orchestrator Quickstart](docs/tutorials/orchestrator-quickstart.md)
 - [CLI Command Reference](docs/reference/cli-commands.md)
 - [Slash Commands](docs/reference/slash-commands.md)
 - [Supported Agents](docs/reference/supported-agents.md)

{spec_kitty_cli-3.2.0rc28 → spec_kitty_cli-3.2.0rc29}/README.md

@@ -39,6 +39,15 @@ It is probably overkill for one-off edits, tiny scripts, or teams that do not us
 | Integrate agents | Slash commands or skills for common AI coding tools |
 | Learn from missions | Every completed mission generates a retrospective by default. Tune via `.kittify/config.yaml#retrospective` or charter; see [how-to](docs/how-to/use-retrospective-learning.md). |
 
+## Governance layer
+
+Spec Kitty keeps runtime governance in the repo instead of treating it as
+agent-only prompt text. The trail model in [docs/trail-model.md](docs/trail-model.md)
+describes how `spec-kitty advise`, `spec-kitty ask`, and `spec-kitty do` map
+operator intent to runtime behavior, while
+[docs/host-surface-parity.md](docs/host-surface-parity.md) tracks parity across
+CLI, slash-command, and hosted surfaces.
+
 ## Quick Start
 
 Install the CLI:
@@ -118,6 +127,7 @@ Start here:
 
 - [Getting Started](docs/tutorials/getting-started.md)
 - [Your First Feature](docs/tutorials/your-first-feature.md)
+- [Orchestrator Quickstart](docs/tutorials/orchestrator-quickstart.md)
 - [CLI Command Reference](docs/reference/cli-commands.md)
 - [Slash Commands](docs/reference/slash-commands.md)
 - [Supported Agents](docs/reference/supported-agents.md)

spec_kitty_cli-3.2.0rc29/kitty-specs/unblock-sync-identity-boundary-canary-01KRZJ07/tasks/README.md

@@ -0,0 +1,64 @@
+# Tasks Directory
+
+This directory contains work package (WP) prompt files.
+
+## Directory Structure (v0.9.0+)
+
+```
+tasks/
+├── WP01-setup-infrastructure.md
+├── WP02-user-authentication.md
+├── WP03-api-endpoints.md
+└── README.md
+```
+
+All WP files are stored flat in `tasks/`. Status is tracked in `status.events.jsonl`, not in WP frontmatter.
+
+## Work Package File Format
+
+Each WP file **MUST** use YAML frontmatter:
+
+```yaml
+---
+work_package_id: "WP01"
+title: "Work Package Title"
+dependencies: []
+planning_base_branch: "main"
+merge_target_branch: "main"
+branch_strategy: "Planning artifacts were generated on main; completed changes must merge back into main."
+subtasks:
+  - "T001"
+  - "T002"
+phase: "Phase 1 - Setup"
+assignee: ""
+agent: ""
+shell_pid: ""
+history:
+  - timestamp: "2025-01-01T00:00:00Z"
+    agent: "system"
+    action: "Prompt generated via /spec-kitty.tasks"
+---
+
+# Work Package Prompt: WP01 – Work Package Title
+
+[Content follows...]
+```
+
+## Status Tracking
+
+Status is tracked via the canonical event log (`status.events.jsonl`), not in WP frontmatter.
+Use `spec-kitty agent tasks move-task` to change WP status:
+
+```bash
+spec-kitty agent tasks move-task <WPID> --to <lane>
+```
+
+Example:
+```bash
+spec-kitty agent tasks move-task WP01 --to doing
+```
+
+## File Naming
+
+- Format: `WP01-kebab-case-slug.md`
+- Examples: `WP01-setup-infrastructure.md`, `WP02-user-auth.md`

spec_kitty_cli-3.2.0rc29/kitty-specs/unified-charter-bundle-chokepoint-01KP5Q2G/tasks/README.md

@@ -0,0 +1,64 @@
+# Tasks Directory
+
+This directory contains work package (WP) prompt files.
+
+## Directory Structure (v0.9.0+)
+
+```
+tasks/
+├── WP01-setup-infrastructure.md
+├── WP02-user-authentication.md
+├── WP03-api-endpoints.md
+└── README.md
+```
+
+All WP files are stored flat in `tasks/`. Status is tracked in `status.events.jsonl`, not in WP frontmatter.
+
+## Work Package File Format
+
+Each WP file **MUST** use YAML frontmatter:
+
+```yaml
+---
+work_package_id: "WP01"
+title: "Work Package Title"
+dependencies: []
+planning_base_branch: "main"
+merge_target_branch: "main"
+branch_strategy: "Planning artifacts were generated on main; completed changes must merge back into main."
+subtasks:
+  - "T001"
+  - "T002"
+phase: "Phase 1 - Setup"
+assignee: ""
+agent: ""
+shell_pid: ""
+history:
+  - timestamp: "2025-01-01T00:00:00Z"
+    agent: "system"
+    action: "Prompt generated via /spec-kitty.tasks"
+---
+
+# Work Package Prompt: WP01 – Work Package Title
+
+[Content follows...]
+```
+
+## Status Tracking
+
+Status is tracked via the canonical event log (`status.events.jsonl`), not in WP frontmatter.
+Use `spec-kitty agent tasks move-task` to change WP status:
+
+```bash
+spec-kitty agent tasks move-task <WPID> --to <lane>
+```
+
+Example:
+```bash
+spec-kitty agent tasks move-task WP01 --to doing
+```
+
+## File Naming
+
+- Format: `WP01-kebab-case-slug.md`
+- Examples: `WP01-setup-infrastructure.md`, `WP02-user-auth.md`

{spec_kitty_cli-3.2.0rc28 → spec_kitty_cli-3.2.0rc29}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "spec-kitty-cli"
-version = "3.2.0rc28"
+version = "3.2.0rc29"
 description = "Spec Kitty, a tool for Specification Driven Development (SDD) agentic projects, with kanban and git worktree isolation."
 readme = "README.md"
 license = { file = "LICENSE" }
@@ -187,6 +187,9 @@ markers = [
     "live_adapter: tests that call the real Anthropic API (deselect with -m 'not live_adapter')",
     "non_sandbox: test is structurally incompatible with mutmut's forked sandbox (subprocess CLI calls, whole-codebase AST walks, wheel builds, or repo-state fixtures outside also_copy). See ADR 2026-04-20-1",
     "flaky: test passes in the main suite but is non-deterministic under mutmut or forking pipelines. Each entry is debt — root-cause and remove. See ADR 2026-04-20-1",
+    "stress: Concurrency/load stress tests — run separately from the fast suite (mission-coordination-branch-atomic-event-log WP09)",
+    "regression: Issue-pinned regression tests that exercise an exact reproduction sequence end-to-end (mission-coordination-branch-atomic-event-log WP09)",
+    "unit: Pure unit-level tests for a single module (legacy marker used by coordination tests)",
 ]
 
 [tool.ruff]

{spec_kitty_cli-3.2.0rc28 → spec_kitty_cli-3.2.0rc29}/scripts/release/README.md

@@ -69,12 +69,16 @@ python scripts/release/check_shared_package_drift.py \
 
 ### `check_exact_install.py`
 
-Builds a clean temporary virtualenv and installs the built wheel with plain
-`pip` so release-time dependency metadata is exercised exactly as users will
-see it from PyPI.
+Builds a clean temporary virtualenv, installs the built wheel with plain
+`pip`, and can run an installed console script so release-time dependency
+metadata and entrypoint imports are exercised exactly as users will see them
+from PyPI.
 
 ```bash
-python scripts/release/check_exact_install.py --package spec-kitty-cli
+python scripts/release/check_exact_install.py \
+  --package spec-kitty-cli \
+  --console-script spec-kitty \
+  --console-arg=--version
 ```
 
 ### `check_candidate_consumer_compat.py`
@@ -90,10 +94,18 @@ python scripts/release/check_candidate_consumer_compat.py \
 
 ## Workflow Integration
 
-- PR checks: `.github/workflows/release-readiness.yml`
+- PR release metadata validation: `.github/workflows/release-readiness.yml`
+- PR/package CI and SaaS consumer compatibility: `.github/workflows/ci-quality.yml`
+- PR shared-package pin drift: `.github/workflows/check-spec-kitty-events-alignment.yml`
 - Tag releases: `.github/workflows/release.yml` (triggers on stable and prerelease `v*.*.*` tags)
 
-Release workflow sequence:
+Release PR check ownership:
+
+1. `Release Readiness Check` validates release metadata only: version, changelog, and tag progression.
+2. `CI Quality` owns tests, wheel build, lockfile checks, exact install verification, and SaaS consumer compatibility evidence.
+3. `Check Shared Package Drift` owns shared-package pin drift evidence.
+
+Tag-time publish workflow sequence:
 
 1. run tests
 2. validate release metadata
@@ -148,8 +160,8 @@ git push origin v3.1.0
 
 Treat publish success and branch health as separate evidence. The tag-time
 publish workflow proves PyPI/GitHub release publication; release summaries
-should only call `main` green after the required branch checks on the same
-commit have also passed. If SaaS consumes a shared-package bump after the CLI
+should only call `main` green after CI Quality and Check Shared Package Drift
+on the same commit have also passed. If SaaS consumes a shared-package bump after the CLI
 candidate commit, rerun the shared-package drift workflow or the local drift
 command against the updated SaaS `main` before recording release-health
 evidence.

{spec_kitty_cli-3.2.0rc28 → spec_kitty_cli-3.2.0rc29}/src/charter/extractor.py

@@ -553,7 +553,8 @@ class Extractor:
             doctrine.selected_procedures = procedures
 
         agent_profiles = self._get_list_value(
-            normalized, ("selected_agent_profiles", "agent_profiles", "agent-profiles")
+            normalized,
+            ("selected_agent_profiles", "agent_profiles", "agent" + "-profiles"),
         )
         if agent_profiles:
             doctrine.selected_agent_profiles = agent_profiles

{spec_kitty_cli-3.2.0rc28 → spec_kitty_cli-3.2.0rc29}/src/charter/sync.py

@@ -209,7 +209,7 @@ def sync(
         )
 
     except Exception as e:
-        logger.exception("Sync failed: %s", e)
+        logger.debug("Sync failed: %s", e, exc_info=True)
         return SyncResult(
             synced=False,
             stale_before=False,

{spec_kitty_cli-3.2.0rc28 → spec_kitty_cli-3.2.0rc29}/src/doctrine/drg/org_pack_config.py

@@ -19,7 +19,6 @@ from ruamel.yaml import YAML
 __all__ = [
     "OrgPackConfig",
     "PackRegistry",
-    "SourceType",
     "load_pack_registry",
     "resolve_org_roots",
     "save_pack_registry",

{spec_kitty_cli-3.2.0rc28 → spec_kitty_cli-3.2.0rc29}/src/doctrine/skills/spec-kitty-implement-review/SKILL.md

@@ -61,7 +61,7 @@ the agent's CLI capabilities:
 | Agent | Config Key | CLI Dispatch | Can Run move-task | Tier |
 |-------|-----------|--------------|-------------------|------|
 | Claude Code | `claude` | `claude -p "prompt" --output-format json` | Yes | 1 |
-| GitHub Codex | `codex` | `codex exec --full-auto -C <dir> -` (stdin) | Yes | 1 |
+| GitHub Codex | `codex` | `codex exec --sandbox danger-full-access -C <dir> -` (stdin) | Yes | 1 |
 | Google Gemini | `gemini` | `gemini -p "prompt" --yolo --output-format json` | Yes | 1 |
 | GitHub Copilot | `copilot` | `copilot -p "prompt" --yolo --silent` | Yes | 1 |
 | OpenCode | `opencode` | `opencode run "prompt" --format json` | Yes | 1 |
@@ -251,7 +251,8 @@ PROMPT_CONTENT=$(cat "$PROMPT_FILE")
 claude -p "$PROMPT_CONTENT" --output-format json -C "$WORKSPACE"
 
 # GitHub Codex:
-printf '%s' "$PROMPT_CONTENT" | codex exec --full-auto -C "$WORKSPACE" -
+# move-task writes git/status locks and may touch local sync state; workspace-write/full-auto is too narrow.
+printf '%s' "$PROMPT_CONTENT" | codex exec --sandbox danger-full-access -C "$WORKSPACE" -
 
 # Google Gemini:
 gemini -p "$PROMPT_CONTENT" --yolo --output-format json -C "$WORKSPACE"
@@ -371,7 +372,7 @@ cat "$REVIEW_PROMPT" >> /tmp/review-prompt-WP##.md
 
 # Dispatch to configured reviewer (same CLI patterns as Step 1b)
 # Example for codex:
-cat /tmp/review-prompt-WP##.md | codex exec --full-auto \
+cat /tmp/review-prompt-WP##.md | codex exec --sandbox danger-full-access \
   -C "$WORKTREE" --add-dir "$(pwd)" \
   -o "/tmp/review-result-WP##.md" -
 
@@ -835,9 +836,11 @@ orchestrator should run the force-move manually.
 `timeout 600 cursor agent -p --force "prompt"`. If still hanging, kill and
 re-dispatch to a different agent.
 
-**Auto-commit warnings from sandboxed agents**: Some agents (codex) run in
-sandboxes that cannot write to `.git/index.lock`. The lane change is written
-to status files but needs manual commit from the repository root checkout:
+**Auto-commit warnings from sandboxed agents**: Codex dispatch must use
+`--sandbox danger-full-access` so terminal `move-task` can write git/status
+locks and commit status artifacts. If a locally patched or stale skill still
+uses `--full-auto`/`workspace-write`, the lane change may be written to status
+files but still need manual commit from the repository root checkout:
 `git add kitty-specs/ && git commit -m "chore: status update"`
 
 **Stale WP (in_progress but no agent activity)**: Force back to planned and

{spec_kitty_cli-3.2.0rc28 → spec_kitty_cli-3.2.0rc29}/src/doctrine/skills/spec-kitty-implement-review/references/agent-dispatch-matrix.md

@@ -10,7 +10,7 @@ including `spec-kitty agent tasks move-task`.
 | Agent | Config Key | CLI Template | Notes |
 |-------|-----------|--------------|-------|
 | Claude Code | `claude` | `claude -p "<prompt>" --output-format json -C <dir>` | Gold standard. Supports `--allowedTools`. |
-| GitHub Codex | `codex` | `cat prompt.md \| codex exec --full-auto -C <dir> -` | Stdin only (no positional prompt with `-C`). Use `--add-dir` for read access to the repository root checkout. |
+| GitHub Codex | `codex` | `cat prompt.md \| codex exec --sandbox danger-full-access -C <dir> -` | Stdin only (no positional prompt with `-C`). Use `--add-dir` for read access to the repository root checkout. `move-task` writes git/status locks, so `workspace-write`/`--full-auto` is too narrow. |
 | Google Gemini | `gemini` | `gemini -p "<prompt>" --yolo --output-format json -C <dir>` | Large context window (1M tokens). |
 | GitHub Copilot | `copilot` | `copilot -p "<prompt>" --yolo --silent` | Requires GitHub Copilot subscription. |
 | OpenCode | `opencode` | `opencode run "<prompt>" --format json -C <dir>` | Multi-provider support. |

{spec_kitty_cli-3.2.0rc28 → spec_kitty_cli-3.2.0rc29}/src/doctrine/skills/spec-kitty-orchestrator-api-operator/references/orchestrator-api-contract.md

@@ -386,7 +386,18 @@ spec-kitty orchestrator-api merge-mission \
 | `CONTRACT_VERSION_MISMATCH` | contract-version | Provider version too old |
 | `MISSION_NOT_FOUND` | mission-state, list-ready | Unknown mission slug |
 | `MISSION_NOT_READY` | accept-mission | Not all WPs are approved or done |
+| `WORKFLOW_EVIDENCE_REQUIRED` | accept-mission | Workflow files changed without runner proof |
 | `POLICY_METADATA_REQUIRED` | start-implementation, start-review, transition | Missing or incomplete policy JSON |
+| `HISTORY_COMMIT_FAILED` | append-history | Branch lookup or commit setup failed |
+| `SAFE_COMMIT_BACKSTOP` | append-history | Safe commit refused unexpected staged paths |
+| `SAFE_COMMIT_DESTINATION_NOT_FOUND` | append-history | Safe commit destination branch does not exist |
+| `SAFE_COMMIT_DESTINATION_REF_SHAPE` | append-history | Safe commit destination ref is not short-form |
+| `SAFE_COMMIT_EMPTY_CHANGESET` | append-history | Safe commit was called without requested paths |
+| `SAFE_COMMIT_GENERIC` | append-history | Generic safe commit failure |
+| `SAFE_COMMIT_HEAD_MISMATCH` | append-history | Worktree HEAD differs from destination branch |
+| `SAFE_COMMIT_NOT_A_WORKTREE` | append-history | Safe commit target is not a git worktree |
+| `SAFE_COMMIT_PROTECTED_BRANCH` | append-history | Safe commit refused a protected branch |
+| `SAFE_COMMIT_RECOVERY_FAILED` | append-history | Safe commit created or attempted a commit but could not restore caller staging |
 | `TRANSITION_REJECTED` | start-implementation, start-review, transition | Guard failure or invalid transition |
 | `WP_ALREADY_CLAIMED` | start-implementation, start-review | Another actor owns the WP |
 

{spec_kitty_cli-3.2.0rc28 → spec_kitty_cli-3.2.0rc29}/src/specify_cli/__init__.py

@@ -97,6 +97,11 @@ def main_callback(
     ),
 ) -> None:
     """Main callback for root CLI setup."""
+    import sys
+
+    if _is_doctor_restart_daemon_invocation(sys.argv):
+        return
+
     root_callback(ctx)
 
     # FR-002: Ensure global runtime (~/.kittify/) is populated and current.
@@ -198,6 +203,50 @@ register_init_command(
 register_commands(app)
 
 
+def _is_doctor_restart_daemon_invocation(argv: list[str]) -> bool:
+    if any(arg in {"--help", "-h"} for arg in argv[1:]):
+        return False
+    command_parts: list[str] = []
+    for arg in argv[1:]:
+        if arg.startswith("-"):
+            continue
+        command_parts.append(arg)
+        if len(command_parts) == 2:
+            return command_parts == ["doctor", "restart-daemon"]
+    return False
+
+
+def _is_doctor_restart_daemon_process_fast_path(argv: list[str]) -> bool:
+    if any(arg in {"--help", "-h"} for arg in argv[1:]):
+        return False
+    command_parts: list[str] = []
+    for arg in argv[1:]:
+        if arg.startswith("-"):
+            if arg != "--json":
+                return False
+            continue
+        command_parts.append(arg)
+    return command_parts == ["doctor", "restart-daemon"]
+
+
+def _run_doctor_restart_daemon_process_fast_path(argv: list[str]) -> None:
+    import os
+    import sys
+
+    from specify_cli.sync.restart import render_restart_result, restart_daemon
+
+    try:
+        located = locate_project_root()
+    except Exception:  # noqa: BLE001 — restart-daemon is machine-global today
+        located = None
+    repo_root = located if located is not None else Path.cwd()
+    result = restart_daemon(repo_root)
+    sys.stdout.write(render_restart_result(result, json_output="--json" in argv) + "\n")
+    sys.stdout.flush()
+    sys.stderr.flush()
+    os._exit(result.exit_code)
+
+
 def main() -> None:
     import sys
 
@@ -221,6 +270,9 @@ def main() -> None:
             # Python < 3.7 or reconfigure not available
             pass
 
+    if _is_doctor_restart_daemon_process_fast_path(sys.argv):
+        _run_doctor_restart_daemon_process_fast_path(sys.argv)
+
     # Check for spec-kitty-events library availability (required for 2.x branch)
     from specify_cli.events.adapter import EventAdapter
 

{spec_kitty_cli-3.2.0rc28 → spec_kitty_cli-3.2.0rc29}/src/specify_cli/acceptance/matrix.py

@@ -17,6 +17,7 @@ from dataclasses import asdict, dataclass, field, fields
 from pathlib import Path
 from typing import Any
 
+from specify_cli.configured_command import ConfiguredCommandUnsupported, run_configured_command
 from specify_cli.mission_metadata import mission_identity_fields, resolve_mission_identity
 
 
@@ -323,14 +324,33 @@ def _check_custom_command(repo_root: Path, ni: NegativeInvariant) -> NegativeInv
             extras=ni.extras,
         )
 
-    # User-authored acceptance matrices intentionally support shell snippets.
-    result = subprocess.run(  # noqa: S602
-        ni.verification_command,
-        shell=True,  # nosec B602
-        cwd=str(repo_root),
-        capture_output=True,
-        text=True,
-    )
+    try:
+        result = run_configured_command(
+            ni.verification_command,
+            cwd=str(repo_root),
+            capture_output=True,
+            text=True,
+        )
+    except ConfiguredCommandUnsupported as exc:
+        return NegativeInvariant(
+            invariant_id=ni.invariant_id,
+            description=ni.description,
+            verification_method=ni.verification_method,
+            verification_command=ni.verification_command,
+            result="pending",
+            evidence=str(exc),
+            extras=ni.extras,
+        )
+    except OSError as exc:
+        return NegativeInvariant(
+            invariant_id=ni.invariant_id,
+            description=ni.description,
+            verification_method=ni.verification_method,
+            verification_command=ni.verification_command,
+            result="still_present",
+            evidence=f"Command failed to start: {exc}",
+            extras=ni.extras,
+        )
     if result.returncode == 0:
         return NegativeInvariant(
             invariant_id=ni.invariant_id,

{spec_kitty_cli-3.2.0rc28 → spec_kitty_cli-3.2.0rc29}/src/specify_cli/cli/commands/__init__.py

@@ -19,6 +19,20 @@ def _is_next_fast_path(argv: list[str]) -> bool:
     return False
 
 
+def _is_doctor_restart_daemon_fast_path(argv: list[str]) -> bool:
+    """Return True for direct ``doctor restart-daemon`` invocations."""
+    if any(arg in {"--help", "-h"} for arg in argv[1:]):
+        return False
+    command_parts: list[str] = []
+    for arg in argv[1:]:
+        if arg.startswith("-"):
+            continue
+        command_parts.append(arg)
+        if len(command_parts) == 2:
+            return command_parts == ["doctor", "restart-daemon"]
+    return False
+
+
 def register_commands(app: typer.Typer) -> None:
     """Attach all extracted commands to the root Typer application."""
     if _is_next_fast_path(sys.argv):
@@ -27,6 +41,12 @@ def register_commands(app: typer.Typer) -> None:
         app.command(name="next")(next_cmd_module.next_step)
         return
 
+    if _is_doctor_restart_daemon_fast_path(sys.argv):
+        from . import doctor as doctor_module
+
+        app.add_typer(doctor_module.app, name="doctor", help="Project health diagnostics")
+        return
+
     from . import accept as accept_module
     from . import advise as advise_module
     from . import agent as agent_module