spec-kitty-cli 3.2.0rc7__tar.gz → 3.2.0rc10__tar.gz

{spec_kitty_cli-3.2.0rc7 → spec_kitty_cli-3.2.0rc10}/CHANGELOG.md

@@ -9,14 +9,209 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [3.2.0rc10] - 2026-05-17
+
+Rolls forward `3.2.0rc9` (never tagged) and adds the Teamspace MVP
+canonical-lifecycle / sync-daemon launch-gate followups:
+
+- **#1067 follow-up.** `core/mission_creation.py:create_mission_core`
+  now emits the canonical `SpecifyStarted` event immediately after
+  `MissionCreated`, referencing the freshly scaffolded `spec.md`
+  artifact path. Previously the constant was defined but never emitted,
+  so the canonical lifecycle stream skipped straight from
+  `MissionCreated` to `SpecifyCompleted` at setup-plan time — leaving
+  TeamSpace replay and the local dashboard blind to in-progress
+  specifying. Regression coverage in
+  `tests/specify_cli/core/test_mission_creation_specify_started.py`.
+- **#1071 follow-up.** `sync status --check` and `sync doctor` now
+  surface the daemon PID/port and any orphan `run_sync_daemon`
+  processes (via the existing `scan_sync_daemons` helper), so operators
+  see cross-checkout daemon divergence without grepping `ps`.
+  `_kill_and_cleanup` now waits for the killed PID to actually exit
+  before clearing `DAEMON_STATE_FILE` — closing the AC bullet that
+  required version-mismatch replacement not leave older daemons live.
+  Module docstring updated to be honest about state-file-scoped
+  singleton semantics. Regression coverage in
+  `tests/cli/commands/test_sync_status_singleton_diagnostics.py` and
+  `tests/sync/test_daemon_replace_on_version_mismatch.py`.
+
+Everything previously slated for rc9 (below) is included in rc10.
+
+## [3.2.0rc9] (rolled into rc10)
+
+The `quality-devex-hardening-3-2-01KRJGKH` mission closes six epic-#822
+tickets and lands the doctrine tactics, canonical-terminology glossary,
+and code-patterns catalog that underpin the 3.2.0 stable release. Push-time
+Sonar restoration (#825) is the only remaining operator-action gate.
+
 ### Added
 
+- **Stale-lane auto-rebase with conflict classification** (#771). New
+  `specify_cli.merge.conflict_classifier` rule pipeline (Validator-flavor;
+  5 conflict shapes — pyproject deps union, `__init__.py` import-block
+  union, urls.py URL list union, `uv.lock` regenerate, default manual)
+  and `specify_cli.lanes.auto_rebase` orchestrator. `spec-kitty merge`
+  now attempts `git merge <mission-branch>` inside a stale lane worktree
+  before halting, auto-resolves additive-only conflicts via a union-merge
+  driver, regenerates `uv.lock` under a global file lock, runs
+  `ruff --fix --select I001` on touched `__init__.py` files, and reports
+  auto-resolved vs manual lanes. Semantic conflicts still halt with the
+  current actionable error. ADR
+  `architecture/2.x/adr/2026-05-14-1-stale-lane-auto-rebase-classifier-policy.md`
+  documents the fail-safe-default policy.
+- **No-upgrade UX notification** (#740). New `core/upgrade_probe.py`
+  (PyPI probe + 2 s timeout-bounded channel classification:
+  ALREADY_CURRENT / AHEAD_OF_PYPI / NO_UPGRADE_PATH / UNKNOWN) and
+  `core/upgrade_notifier.py` (cache-aware emitter). Distinguishes
+  "already on the latest supported version" from "build/channel with no
+  upgrade path"; never blocks the CLI on network failure; rate-limited
+  to once per 24 h with `SPEC_KITTY_NO_UPGRADE_CHECK=1` opt-out; reuses
+  `should_check_version()` rather than introducing a parallel gate.
+  Cache-warm budget < 100 ms.
+- **`secure-regex-catastrophic-backtracking` doctrine tactic** codifying
+  the four dangerous regex shapes, the rewrite ladder, and the escape
+  hatches. Every regex change now requires a wall-clock regression test
+  asserting linear runtime on adversarial input (default budget: < 100 ms
+  for 100 000 chars) per FR-008.
+- **`chain-of-responsibility-rule-pipeline` doctrine tactic** with three
+  flavors (Validator / Transformer / Scorer) and the typed
+  `CanonicalRule` Protocol at
+  `src/specify_cli/migration/canonicalization.py` as the canonical
+  Transformer-flavor implementation.
+- **Core code-patterns catalog** at
+  `architecture/2.x/04_implementation_mapping/code-patterns.md` listing
+  the recurring shapes used across the codebase (Rule-Based Pipeline,
+  Append-Only Event Log + Reducer, etc.) with doctrine cross-references.
+- **Canonical-terminology glossary entries** for `characterization test`,
+  `pipeline-shape`, `rule pipeline`, `catastrophic backtracking`,
+  `structural debt`, `deliberate linearity`, and `Sonar quality gate`
+  in `.kittify/glossaries/spec_kitty_core.yaml`, each cross-referencing
+  the doctrine tactic or architectural document that codifies it
+  (FR-013).
+- **Targeted symlink-fallback test** for the
+  `m_0_8_0_worktree_agents_symlink` migration's `OSError -> shutil.copy2`
+  fallback (#629). Runs on every CI pass via `monkeypatch`, not gated
+  by `windows_ci`. Covers both happy-fallback and dual-failure arms.
+- **Behavior-driven coverage tests** for `cli/commands/charter.py`,
+  `cli/commands/charter_bundle.py`, `cli/commands/agent/config.py`,
+  `next/_internal_runtime/engine.py`, and `core/file_lock.py`
+  (Bucket A/B/C split; `CliRunner` + `tmp_path` real I/O; no
+  `mock.patch` on Path methods) per the `function-over-form-testing`
+  tactic (#595 workstream A).
+- **Wall-clock regression guard** at
+  `tests/regressions/test_changelog_regex_redos.py` (20 tests; < 100 ms
+  on 100 000-line adversarial input) against future re-introduction of
+  the three Sonar-flagged patterns in `release/changelog.py` (pre-fixed
+  in PR #592) (#595 workstream B / FR-008).
+- **`dev` dependency-group type stubs** (`types-jsonschema`,
+  `types-psutil`, `types-PyYAML`, `types-requests`, `types-toml`) in
+  `[dependency-groups] dev` so `uv run --with mypy mypy --strict`
+  resolves stubs from the default env.
+
 ### Changed
 
-### Fixed
+- **mypy strict baseline** is now green for `src/specify_cli`,
+  `src/charter`, `src/doctrine` per decision moment
+  `DM-01KRJHT7QD7XQMY33Y5TDTQ80V` (option A — fix the existing target;
+  #971). Includes `doctor.py::_print_overdue_details` annotation fix
+  (typed `ShimRegistryReport` under `TYPE_CHECKING`) and
+  `_resolve_fail_on` return-type tightening to
+  `tuple[Severity | None, bool]`.
+- **`_canonicalize_status_row` and `rebuild_state.py`** refactored onto
+  the typed `CanonicalRule` Protocol with characterization-test coverage
+  preceding the refactor commits (NFR-003 / `tdd-red-green-refactor`).
+- **`doctor.py::mission_state`** refactored from cognitive complexity 57
+  to a CC 3 thin orchestrator plus per-mode runners
+  (`_validate_modes`, `_resolve_fail_on`, `_resolve_audit_root`,
+  `_emit_mission_state`, `_run_audit_mode`, `_run_mission_repair`,
+  `_run_teamspace_dry_run_mode`), with 17 characterization tests
+  guarding behavior across all three dispatch arms (`--audit`, `--fix`,
+  `--teamspace-dry-run`) (#595 workstream C).
+- **`review.py` split into `cli/commands/review/` package** with sibling
+  files for cleaner ownership boundaries.
+
+### Fixed
+
+- **`doctor.py:1092` `MissionRepairResult.findings` real-branch bug**:
+  `report` variable was dual-typed as `RepairReport` /
+  `RepoAuditReport` across mutually exclusive branches; runtime correct
+  but typing broken. Now closes mypy strict on `doctor.py`.
+- **Pre-existing YAML scanner error** in
+  `.kittify/glossaries/spec_kitty_core.yaml` line 484: the `unsafe bypass`
+  definition contained an unquoted backtick-wrapped `bypass_used: true`
+  literal that `yaml.safe_load` interpreted as a nested mapping. The
+  definition value is now double-quoted; semantic content unchanged.
+  File now parses cleanly under `yaml.safe_load` and `ruamel.yaml`.
+
+### Documentation
+
+- **Mission-review report** at
+  `kitty-specs/quality-devex-hardening-3-2-01KRJGKH/mission-review.md`
+  citing every doctrine tactic applied per WP and linking the
+  code-patterns catalog (NFR-006 / FR-012).
+- **Post-merge audit report** at
+  `kitty-specs/quality-devex-hardening-3-2-01KRJGKH/post-merge-review.md` —
+  independent adversarial review confirming PASS WITH NOTES (no code
+  defects; release-readiness gated on three operator-action items:
+  Sonar hotspot rationale application, NFR-001 smoke execution, and the
+  push-time Sonar workflow flip). Documents FR coverage matrix, drift
+  findings, silent-failure scan, and security notes. All four
+  post-merge stale-assertion findings classified as false alarms.
+- **NFR-001 release-stability smoke recipe** at
+  `kitty-specs/quality-devex-hardening-3-2-01KRJGKH/nfr-001-smoke-recipe.md`
+  for operator execution post-merge.
+- **SonarCloud hotspot rationales** at
+  `kitty-specs/quality-devex-hardening-3-2-01KRJGKH/sonar-hotspot-rationales.md`
+  documenting the 4 encrypt-data hotspots for operator application in the
+  Sonar UI before push-time CI restoration (#825).
+- **ADR `2026-05-14-1-stale-lane-auto-rebase-classifier-policy`** for #771.
+
+### Deferred
+
+- **Push-time SonarCloud restoration** (#825 / FR-004): gated on the
+  operator applying the four hotspot rationales in the Sonar UI and the
+  Sonar quality gate flipping to `OK` (at audit time: ERROR —
+  `new_coverage` 58.9% vs threshold 80%; `new_security_hotspots_reviewed`
+  0% vs threshold 100%). The
+  `.github/workflows/ci-quality.yml::sonarcloud` conditional remains on
+  `schedule || workflow_dispatch` until gate is OK. See
+  `kitty-specs/quality-devex-hardening-3-2-01KRJGKH/sonar-pre-flip-verification.txt`.
 
 ### Removed
 
+## [3.2.0rc8] - 2026-05-14
+
+3.2.0rc8 rolls up the post-rc7 TeamSpace launch fixes and compatibility
+cleanup needed before the final 3.2.0 cut. It includes defensive sync batching
+for real edge-proxy limits, the Mission Dossier event-envelope migration for
+`spec-kitty-events>=5.0.0`, and the small compatibility/quality fixes that
+landed after rc7.
+
+### Changed
+
+- Reduced the CLI's default sync batch decompressed byte budget to 256 KiB and
+  added a 512 KiB hard ceiling for over-generous server-advertised limits, so
+  large TeamSpace queue drains split into safe requests instead of relying on
+  HTTP 413 retry shrinkage.
+- Migrated all four Mission Dossier event emitters to the namespaced envelope
+  required by `spec-kitty-events>=5.0.0`, including `namespace`,
+  `artifact_id`/`expected_identity`, content refs, and schema-compatible
+  diagnostics.
+- Preserved legacy queued Mission Dossier events by migrating flat queued
+  payloads on drain when namespace data is available, and kept queue coalescing
+  scoped correctly across both legacy and namespaced payload shapes.
+
+### Fixed
+
+- Restored agent profile list compatibility after the rc7 candidate.
+- Reduced SonarCloud noise in path helper and charter synthesizer code without
+  changing runtime behavior.
+- Fixed the deployed-dev TeamSpace sync canary failure where a 1200-event
+  backlog could cascade into 1000 HTTP 413 failures.
+- Fixed SaaS ingestion rejection of CLI-emitted Mission Dossier artifact events
+  caused by the old flat payload shape being rejected with
+  `Additional properties are not allowed`.
+
 ## [3.2.0rc7] - 2026-05-12
 
 3.2.0rc7 lands the `review-merge-gate-hardening-3-2-x-01KRC57C` mission

{spec_kitty_cli-3.2.0rc7 → spec_kitty_cli-3.2.0rc10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: spec-kitty-cli
-Version: 3.2.0rc7
+Version: 3.2.0rc10
 Summary: Spec Kitty, a tool for Specification Driven Development (SDD) agentic projects, with kanban and git worktree isolation.
 Project-URL: Repository, https://github.com/Priivacy-ai/spec-kitty
 Project-URL: Issues, https://github.com/Priivacy-ai/spec-kitty/issues
@@ -165,7 +165,7 @@ cd my-project
 spec-kitty verify-setup
 ```
 
-Replace `claude` with your agent key when needed. Common choices include `codex`, `cursor`, `gemini`, `copilot`, `opencode`, `qwen`, `windsurf`, `kiro`, and `vibe`.
+Replace `claude` with your agent key when needed. Common choices include `codex`, `cursor`, `gemini`, `copilot`, `opencode`, `qwen`, `windsurf`, `kiro`, `vibe`, `pi`, and `letta`.
 
 Open your AI coding agent in the project and run the core workflow:
 

{spec_kitty_cli-3.2.0rc7 → spec_kitty_cli-3.2.0rc10}/README.md

@@ -66,7 +66,7 @@ cd my-project
 spec-kitty verify-setup
 ```
 
-Replace `claude` with your agent key when needed. Common choices include `codex`, `cursor`, `gemini`, `copilot`, `opencode`, `qwen`, `windsurf`, `kiro`, and `vibe`.
+Replace `claude` with your agent key when needed. Common choices include `codex`, `cursor`, `gemini`, `copilot`, `opencode`, `qwen`, `windsurf`, `kiro`, `vibe`, `pi`, and `letta`.
 
 Open your AI coding agent in the project and run the core workflow:
 

{spec_kitty_cli-3.2.0rc7 → spec_kitty_cli-3.2.0rc10}/architecture/2.x/04_implementation_mapping/README.md

@@ -384,6 +384,17 @@ refactoring priorities.
 
 ---
 
+## Core Code Patterns
+
+The companion document [code-patterns.md](code-patterns.md) catalogs the
+recurring code patterns applied across the codebase: rule-based pipelines
+(chain-of-responsibility), append-only event log + reducer, two-source
+doctrine repository, preflight validation with structured results, and the
+pure-function finding shape. Each entry links to its doctrine tactic and
+points at canonical implementations in the tree. Reach for it when picking
+up an unfamiliar module — the patterns it documents are the codebase's
+expected shapes.
+
 ## Traceability
 
 - System Landscape: `../00_landscape/README.md`
@@ -391,5 +402,6 @@ refactoring priorities.
 - System Context: `../01_context/README.md`
 - Container View: `../02_containers/README.md`
 - Component View: `../03_components/README.md`
+- Code Patterns Catalog: [code-patterns.md](code-patterns.md)
 - Doctrine Stack Domain Model: `../03_components/README.md#doctrine-stack-domain-model`
 - Doctrine governance ADR: `../adr/2026-02-23-1-doctrine-artifact-governance-model.md`

{spec_kitty_cli-3.2.0rc7 → spec_kitty_cli-3.2.0rc10}/architecture/2.x/README.md

@@ -32,9 +32,10 @@ This removes README indirection while preserving clear expansion space.
 4. [C4 Containers](02_containers/README.md)
 5. [Runtime/Execution Domain Detail](02_containers/runtime-execution-domain.md)
 6. [C4 Components](03_components/README.md)
-7. [Audience Personas](../audience/README.md)
-8. [2.x ADR Index](adr/README.md)
-9. [2.x User Journeys](user_journey/README.md)
+7. [Implementation Mapping](04_implementation_mapping/README.md) and the [Core Code Patterns Catalog](04_implementation_mapping/code-patterns.md)
+8. [Audience Personas](../audience/README.md)
+9. [2.x ADR Index](adr/README.md)
+10. [2.x User Journeys](user_journey/README.md)
 
 ---
 

{spec_kitty_cli-3.2.0rc7 → spec_kitty_cli-3.2.0rc10}/docs/reference/README.md

@@ -18,7 +18,7 @@ Reference docs are:
 - [Environment Variables](environment-variables.md) - All environment variables
 - [File Structure](file-structure.md) - Directory layout and file purposes
 - [Missions](missions.md) - Mission types and configuration
-- [Supported Agents](supported-agents.md) - The 13 slash-command agents supported by the CLI
+- [Supported Agents](supported-agents.md) - Slash-command agents supported by the CLI
 
 ## See Also
 

spec_kitty_cli-3.2.0rc10/kitty-specs/quality-devex-hardening-3-2-01KRJGKH/tasks/README.md

@@ -0,0 +1,64 @@
+# Tasks Directory
+
+This directory contains work package (WP) prompt files.
+
+## Directory Structure (v0.9.0+)
+
+```
+tasks/
+├── WP01-setup-infrastructure.md
+├── WP02-user-authentication.md
+├── WP03-api-endpoints.md
+└── README.md
+```
+
+All WP files are stored flat in `tasks/`. Status is tracked in `status.events.jsonl`, not in WP frontmatter.
+
+## Work Package File Format
+
+Each WP file **MUST** use YAML frontmatter:
+
+```yaml
+---
+work_package_id: "WP01"
+title: "Work Package Title"
+dependencies: []
+planning_base_branch: "fix/quality-check-updates"
+merge_target_branch: "fix/quality-check-updates"
+branch_strategy: "Planning artifacts were generated on fix/quality-check-updates; completed changes must merge back into fix/quality-check-updates."
+subtasks:
+  - "T001"
+  - "T002"
+phase: "Phase 1 - Setup"
+assignee: ""
+agent: ""
+shell_pid: ""
+history:
+  - timestamp: "2025-01-01T00:00:00Z"
+    agent: "system"
+    action: "Prompt generated via /spec-kitty.tasks"
+---
+
+# Work Package Prompt: WP01 – Work Package Title
+
+[Content follows...]
+```
+
+## Status Tracking
+
+Status is tracked via the canonical event log (`status.events.jsonl`), not in WP frontmatter.
+Use `spec-kitty agent tasks move-task` to change WP status:
+
+```bash
+spec-kitty agent tasks move-task <WPID> --to <lane>
+```
+
+Example:
+```bash
+spec-kitty agent tasks move-task WP01 --to doing
+```
+
+## File Naming
+
+- Format: `WP01-kebab-case-slug.md`
+- Examples: `WP01-setup-infrastructure.md`, `WP02-user-auth.md`

spec_kitty_cli-3.2.0rc10/kitty-specs/unified-charter-bundle-chokepoint-01KP5Q2G/tasks/README.md

@@ -0,0 +1,64 @@
+# Tasks Directory
+
+This directory contains work package (WP) prompt files.
+
+## Directory Structure (v0.9.0+)
+
+```
+tasks/
+├── WP01-setup-infrastructure.md
+├── WP02-user-authentication.md
+├── WP03-api-endpoints.md
+└── README.md
+```
+
+All WP files are stored flat in `tasks/`. Status is tracked in `status.events.jsonl`, not in WP frontmatter.
+
+## Work Package File Format
+
+Each WP file **MUST** use YAML frontmatter:
+
+```yaml
+---
+work_package_id: "WP01"
+title: "Work Package Title"
+dependencies: []
+planning_base_branch: "main"
+merge_target_branch: "main"
+branch_strategy: "Planning artifacts were generated on main; completed changes must merge back into main."
+subtasks:
+  - "T001"
+  - "T002"
+phase: "Phase 1 - Setup"
+assignee: ""
+agent: ""
+shell_pid: ""
+history:
+  - timestamp: "2025-01-01T00:00:00Z"
+    agent: "system"
+    action: "Prompt generated via /spec-kitty.tasks"
+---
+
+# Work Package Prompt: WP01 – Work Package Title
+
+[Content follows...]
+```
+
+## Status Tracking
+
+Status is tracked via the canonical event log (`status.events.jsonl`), not in WP frontmatter.
+Use `spec-kitty agent tasks move-task` to change WP status:
+
+```bash
+spec-kitty agent tasks move-task <WPID> --to <lane>
+```
+
+Example:
+```bash
+spec-kitty agent tasks move-task WP01 --to doing
+```
+
+## File Naming
+
+- Format: `WP01-kebab-case-slug.md`
+- Examples: `WP01-setup-infrastructure.md`, `WP02-user-auth.md`

spec_kitty_cli-3.2.0rc10/kitty-specs/workflow-parity-988-989-991-01KRKTT5/tasks/README.md

@@ -0,0 +1,64 @@
+# Tasks Directory
+
+This directory contains work package (WP) prompt files.
+
+## Directory Structure (v0.9.0+)
+
+```
+tasks/
+├── WP01-setup-infrastructure.md
+├── WP02-user-authentication.md
+├── WP03-api-endpoints.md
+└── README.md
+```
+
+All WP files are stored flat in `tasks/`. Status is tracked in `status.events.jsonl`, not in WP frontmatter.
+
+## Work Package File Format
+
+Each WP file **MUST** use YAML frontmatter:
+
+```yaml
+---
+work_package_id: "WP01"
+title: "Work Package Title"
+dependencies: []
+planning_base_branch: "fix/workflow-parity-988-989-991"
+merge_target_branch: "fix/workflow-parity-988-989-991"
+branch_strategy: "Planning artifacts were generated on fix/workflow-parity-988-989-991; completed changes must merge back into fix/workflow-parity-988-989-991."
+subtasks:
+  - "T001"
+  - "T002"
+phase: "Phase 1 - Setup"
+assignee: ""
+agent: ""
+shell_pid: ""
+history:
+  - timestamp: "2025-01-01T00:00:00Z"
+    agent: "system"
+    action: "Prompt generated via /spec-kitty.tasks"
+---
+
+# Work Package Prompt: WP01 – Work Package Title
+
+[Content follows...]
+```
+
+## Status Tracking
+
+Status is tracked via the canonical event log (`status.events.jsonl`), not in WP frontmatter.
+Use `spec-kitty agent tasks move-task` to change WP status:
+
+```bash
+spec-kitty agent tasks move-task <WPID> --to <lane>
+```
+
+Example:
+```bash
+spec-kitty agent tasks move-task WP01 --to doing
+```
+
+## File Naming
+
+- Format: `WP01-kebab-case-slug.md`
+- Examples: `WP01-setup-infrastructure.md`, `WP02-user-auth.md`

{spec_kitty_cli-3.2.0rc7 → spec_kitty_cli-3.2.0rc10}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "spec-kitty-cli"
-version = "3.2.0rc7"
+version = "3.2.0rc10"
 description = "Spec Kitty, a tool for Specification Driven Development (SDD) agentic projects, with kanban and git worktree isolation."
 readme = "README.md"
 license = { file = "LICENSE" }
@@ -222,6 +222,12 @@ ignore = [
 "src/specify_cli/cli/commands/agent/config.py" = ["B904"]
 "src/specify_cli/cli/commands/agent/status.py" = ["B904"]
 "src/specify_cli/cli/commands/agent/workflow.py" = ["B904"]
+# F822 false positives: these acceptance-support shims populate their namespace
+# at runtime via ``globals().update(_load_acceptance_api())``; the names in
+# ``__all__`` are real but resolved dynamically and not visible to static
+# analysis. The runtime guarantee is enforced by _load_acceptance_api itself.
+"scripts/tasks/acceptance_support.py" = ["F822"]
+".kittify/overrides/scripts/tasks/acceptance_support.py" = ["F822"]
 
 [tool.ruff.lint.mccabe]
 max-complexity = 15  # Match SonarCloud S3776 threshold
@@ -323,6 +329,19 @@ module = [
 ]
 ignore_errors = true
 
+[dependency-groups]
+dev = [
+    # Type stubs for dev tooling (mypy --strict gate).
+    # These mirror the entries in [project.optional-dependencies] lint so that
+    # `uv run --with mypy mypy --strict ...` resolves them from the default
+    # environment without requiring `--extra lint`.
+    "types-jsonschema>=4.0.0",
+    "types-psutil>=5.9.0",
+    "types-PyYAML>=6.0",
+    "types-requests>=2.33.0",
+    "types-toml>=0.10.0",
+]
+
 [tool.mutmut]
 paths_to_mutate = [
     "src/",

{spec_kitty_cli-3.2.0rc7 → spec_kitty_cli-3.2.0rc10}/src/charter/neutrality/language_scoped_allowlist.yaml

@@ -69,3 +69,8 @@ paths:
     owner: "charter team"
     reason: "Maven review-checks toolguide; Maven/Java tool names (pytest reference is cross-check example) are the subject matter."
     added_in: "3.2.4"
+  - path: "src/doctrine/tactics/shipped/secure-regex-catastrophic-backtracking.tactic.yaml"
+    scope: python
+    owner: "charter team"
+    reason: "Secure regex remediation tactic intentionally discusses Python test tooling and timing guards."
+    added_in: "3.3.3"

{spec_kitty_cli-3.2.0rc7 → spec_kitty_cli-3.2.0rc10}/src/charter/synthesizer/evidence.py

@@ -18,7 +18,7 @@ import re
 from dataclasses import dataclass
 
 _STACK_ID_RE = re.compile(r"^[a-z][a-z0-9+]*$")
-_SNAPSHOT_ID_RE = re.compile(r"^[a-z][a-z0-9-]+-v[0-9]+\.[0-9]+\.[0-9]+$")
+_SNAPSHOT_ID_RE = re.compile(r"^[a-z][a-z0-9-]+-v\d+\.\d+\.\d+$")
 
 
 @dataclass(frozen=True)