tikalk · kanfil · Aug 5, 2026 · Aug 3, 2026 · Aug 3, 2026 · Aug 3, 2026
diff --git a/.github/security-audit-requirements.txt b/.github/security-audit-requirements.txt
@@ -279,7 +279,3 @@ typer==0.27.0 \
     --hash=sha256:629bd12ea5d13a17148125d9a264f949eb171fb3f120f9b04d85873cab054fa5 \
     --hash=sha256:6f4b27631e47f077871b7dc30e933ec0131c1390fbe0e387ea5574b5bac9ccf1
     # via agentic-sdlc-specify-cli (pyproject.toml)
-typing-extensions==4.16.0 ; python_full_version < '3.13' \
-    --hash=sha256:481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8 \
-    --hash=sha256:dc983d19a509c94dba722ee6abd33940f7c05a89e243c47e907eb4db6f1a43e5
-    # via anyio
diff --git a/AGENTS.md b/AGENTS.md
@@ -284,7 +284,22 @@ cd my-project && specify integration uninstall <key>
 - Reduces the chance of bugs when adding new agents
 - Tool checking "just works" without additional mappings
 
-#### 7. Update Devcontainer files (Optional)
+### 6. Optional overrides
+
+The base classes handle most work automatically. Override only when the agent deviates from standard patterns:
+
+| Override | When to use | Example |
+|---|---|---|
+| `command_filename(template_name)` | Custom file naming or extension | Copilot → `speckit.{name}.agent.md` |
+| `options()` | Integration-specific CLI flags via `--integration-options` | Codex → `--skills` flag, Copilot → `--commands` flag |
+| `setup()` | Custom install logic (companion files, settings merge) | Copilot → `speckit-<name>/SKILL.md` (default) or `.agent.md` + `.prompt.md` + `.vscode/settings.json` (`--commands`) |
+| `teardown()` | Custom uninstall logic | Rarely needed; base handles manifest-tracked files |
+
+**Example — Copilot (fully custom `setup`):**
+
+Copilot extends `IntegrationBase` directly because it supports two layouts. It scaffolds `speckit-<name>/SKILL.md` under `.github/skills/` by default using composition with an internal `_CopilotSkillsHelper`. Its `--commands` mode creates `.agent.md` commands, companion `.prompt.md` files, and merges `.vscode/settings.json`. See `src/specify_cli/integrations/copilot/__init__.py` for the full implementation.
+
+### 7. Update Devcontainer files (Optional)
 
 For agents that have VS Code extensions or require CLI installation, update the devcontainer configuration files:
 
@@ -499,36 +514,28 @@ Some agents require custom processing beyond the standard template transformatio
 
 ### Copilot Integration
 
-GitHub Copilot has unique requirements:
+GitHub Copilot uses skills by default, scaffolded as
+`speckit-<name>/SKILL.md` under `.github/skills/`.
 
-- Commands use `.agent.md` extension (not `.md`)
-- Each command gets a companion `.prompt.md` file in `.github/prompts/`
-- Installs `.vscode/settings.json` with prompt file recommendations
-- Context file lives at `.github/copilot-instructions.md`
-
-Implementation: Extends `IntegrationBase` with custom `setup()` method that:
-
-1. Processes templates with `process_template()`
-2. Generates companion `.prompt.md` files
-3. Merges VS Code settings
+**Commands mode (`--commands`):** Copilot also supports a commands-based layout
+via `--integration-options="--commands"`. When enabled:
 
-**Skills mode (`--skills`):** Copilot also supports an alternative skills-based layout
-via `--integration-options="--skills"`. When enabled:
+- Commands use `.agent.md` extension under `.github/agents/`
+- Each command gets a companion `.prompt.md` file in `.github/prompts/`
+- `.vscode/settings.json` is merged with prompt file recommendations
+- `build_command_invocation()` returns bare args for `--agent` dispatch
 
-- Commands are scaffolded as `speckit-<name>/SKILL.md` under `.github/skills/`
-- No companion `.prompt.md` files are generated
-- No `.vscode/settings.json` merge
-- `post_process_skill_content()` injects a `mode: speckit.<stem>` frontmatter field
-- `build_command_invocation()` returns `/speckit-<stem>` instead of bare args
+In the default skills mode, no companion prompts or VS Code settings merge are
+created, and `build_command_invocation()` returns `/speckit-<stem>`.
 
 The two modes are mutually exclusive — a project uses one or the other:
 
 ```bash
-# Default mode: .agent.md agents + .prompt.md companions + settings merge
+# Default skills mode: speckit-<name>/SKILL.md under .github/skills/
 specify init my-project --integration copilot
 
-# Skills mode: speckit-<name>/SKILL.md under .github/skills/
-specify init my-project --integration copilot --integration-options="--skills"
+# Commands mode: .agent.md agents + .prompt.md companions + settings merge
+specify init my-project --integration copilot --integration-options="--commands"
 ```
 
 ### Forge Integration
@@ -593,6 +600,11 @@ When an issue exists, include its number immediately after the prefix — this i
 
 Disclosure is **continuous**, not a one-time event. A single AI-disclosure paragraph in the PR body does **not** cover the commits and replies you add during review rounds. Each of the following must independently attest to agent authorship.
 
+### Opening pull requests
+
+- Before opening a pull request, check whether the account that will file it already has three open pull requests in this repository.
+- If so, alert the user that additional submissions may receive lower review priority and ask for explicit permission to proceed. Do not assume consent.
+
 ### Commits
 
 - **Every commit you author must carry an `Assisted-by:` trailer** identifying the agent and whether it acted autonomously or under direct human supervision, for example:

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,108 @@
 
 All notable changes to the Specify CLI and templates are documented here.
 
+# [0.15.2+adlc2] - 2026-08-05
+
+### Added
+
+- **Upstream merge (13 commits, post-0.15.2)**: Synced with upstream
+  `github/spec-kit` main (`ab468c4d..03d71b33`). No new upstream release tag;
+  fork suffix incremented (`0.15.2+adlc1` → `0.15.2+adlc2`). New upstream
+  features adopted:
+  - `feat(copilot): default integration to skills` (#3976) — Copilot now
+    defaults to the skills layout (`speckit-<name>/SKILL.md` under
+    `.github/skills/`); the commands layout (`.agent.md` + `.prompt.md` +
+    `.vscode/settings.json`) is opt-in via `--integration-options="--commands"`.
+    Fork adapted: `is_skills_mode()` checks both `spec-`/`speckit-` prefixes
+    (fork skills use `spec-*` when presets are active);
+    `build_command_invocation()` canonicalizes bare command names before alias
+    resolution; `resolve_command_alias` + `run_and_tee` + `_get_command_prefix()`
+    customizations re-applied onto upstream's rewritten module.
+  - `feat(events): context injection for opencode and JSON-envelope agent hooks`
+    (#3934, authored by fork maintainer upstream) — first-class context
+    injection for opencode session_start/user_prompt_submit via TS plugin, and
+    JSON-envelope wrapping for Gemini/Tabnine/Qwen/Devin/Copilot/Cursor hooks.
+    Auto-merged clean.
+- Community catalog: TDD extension (#3982), Charter v0.5.1 (#3983), Archive
+  v1.1.0 (#3981). Note: fork has its own bundled `tdd` extension (separate
+  from the community catalog entry).
+
+### Fixed
+
+- Upstream fixes adopted (all auto-merged clean): non-UTF-8 preset registry
+  (#3955), non-UTF-8 `config.toml` on hook install/teardown (#3963),
+  unreadable staged backup treated as conflict (#3962), non-string
+  `requires.speckit_version` rejected (#3980), reinstall rejected when kept
+  config unreadable (#3960), `None` returned for unparseable script command
+  (#3957), migration hardening (validate target options before uninstall
+  in `_migrate_commands.py`).
+- Fork fix: `build_command_invocation()` in copilot skills mode now
+  canonicalizes bare command names (e.g. `"plan"`) to `speckit.plan` before
+  alias resolution, so the invocation produces `/{prefix}-plan` instead of
+  `/plan` (which wouldn't match any installed skill). Also applied to
+  `_invoke_cli` for consistency in the non-streaming path.
+
+### Changed
+
+- 5 conflicts resolved: `AGENTS.md` (adopted upstream's new "Optional
+  overrides" section + "Opening pull requests" PR-prioritization subsection;
+  preserved fork header/SPECKIT markers), `copilot/__init__.py` (re-applied 4
+  fork customizations onto upstream's #3976 rewrite + made `is_skills_mode()`
+  prefix-aware), `test_cli.py` (adapted skills-default assertions to fork
+  naming), `test_integration_copilot.py` (adapted `build_command_invocation`
+  tests to fork alias-aware naming), `test_integration_subcommand.py`
+  (adapted copilot switch/upgrade tests to fork naming).
+- All semantic hotspots auto-merged cleanly: `events.py`, `extensions/__init__.py`,
+  `presets/__init__.py`, `base.py`, `_migrate_commands.py`,
+  `integration_runtime.py`. No `templates/` changes upstream → no preset
+  command porting needed. Ruff clean (`ruff@0.15.0`).
+
+# [0.15.2+adlc1] - 2026-08-04
+
+### Added
+
+- **Upstream merge (0.15.1 → 0.15.2)**: Adopted upstream `github/spec-kit`
+  release `0.15.2` plus 3 post-release fixes. Package version base reset to
+  upstream `0.15.2` with fork counter reset (`0.15.1+adlc1` → `0.15.2+adlc1`).
+  Merged 14 commits since the last merge base `d1e86f63`. New upstream features:
+  - `feat(extensions): scaffold config templates on extension add/enable`
+    (#2000) — extensions declaring `provides.config` now auto-deploy their
+    config templates into `.specify/` on `extension add`/`enable`, preserving
+    existing files. Fork's bundled extensions (agent-context, git, …) declare
+    only `provides.commands`, so scaffolding is inert today; the
+    `agent-context` extension keeps its own `.template` + script self-seed
+    mechanism.
+  - `feat: allow overriding default init integration via
+    SPECKIT_INTEGRATION_DEFAULT` (#3952) — env-var picker for non-interactive
+    `specify init`, the workflow `init` step, and bundle init.
+  - `Add adrkit extension to community catalog` (#3947).
+- **New upstream hardening**: `fix(presets): restore core skills instead of
+  deleting them on preset remove` (#3929, with `restore_from_bundled_core`
+  flag + extension-restore priority), `fix(manifests): reject non-string
+  metadata instead of crashing on it` (#3943), `fix: narrow bare except
+  Exception in invoke separator resolution` (#3856), `fix(workflows): keep
+  the init step's documented ignore_agent_tools default on an explicit null`
+  (#3889), `fix(workflows): reject mismatched run state IDs` (#3899),
+  `fix: cap stdin read at 1 MiB to prevent DoS` (#3857, `MAX_STDIN_BYTES` in
+  `event.py`), non-UTF-8 tolerance for events/presets/extension manifests and
+  event overrides (#3900, #3896, #3895, #3897), `fix(presets): validate
+  required manifest mappings` (#3898).
+
+### Changed
+
+- **No conflict-heavy work this round**: the merge auto-resolved every
+  semantic hotspot (`__init__.py`, `agents.py`, `extensions/__init__.py`,
+  `extensions/_commands.py`, `presets/__init__.py`, `commands/init.py`,
+  `commands/bundle/__init__.py`, `events.py`, `event.py`, `workflows/engine.py`,
+  `workflows/steps/init/__init__.py`, `_agent_config.py`) without manual
+  intervention. Only `pyproject.toml` required manual conflict resolution to
+  preserve fork package identity and reset the version. Fork modules
+  (`_init_fork`, `_core_fork`, `_assets_fork`, `_base_fork`, `_workflows_fork`,
+  `extensions_fork`) untouched. No `templates/` changes upstream this round →
+  no preset command porting needed.
+- **Lint**: Ruff clean across `src/` and `tests/` with the pinned
+  `ruff@0.15.0`.
+
 # [0.15.1+adlc1] - 2026-08-02
 
 ### Added
@@ -4153,6 +4255,31 @@ This release migrates fork-specific customizations to a preset system to reduce
 
 The following entries are from the upstream spec-kit project and are included for reference.
 
+## [0.15.2] - 2026-08-03
+
+### Changed
+
+- fix(presets): restore core skills instead of deleting them on preset remove (#3929)
+- fix(manifests): reject non-string metadata instead of crashing on it (#3943)
+- fix: narrow bare except Exception in invoke separator resolution (#3856)
+- fix(workflows): keep the init step's documented ignore_agent_tools default on an explicit null (#3889)
+- fix(kimi): preserve non-UTF-8 user skills (#3895)
+- fix(presets): tolerate non-UTF-8 legacy commands (#3896)
+- feat: allow overriding default init integration via SPECKIT_INTEGRATION_DEFAULT (#3952)
+- Add adrkit extension to community catalog (#3947)
+- feat(extensions): scaffold config templates on extension add/enable (#2000)
+- fix(events): skip non-UTF-8 extension manifests (#3900)
+- fix(workflows): fail a gate whose on_reject is not abort/skip/retry (#3888)
+- fix(presets): validate required manifest mappings (#3898)
+- fix: eliminate TOCTOU race in zip packaging (#3855)
+- fix(workflows): fail a fan-in step whose output is not a mapping (#3887)
+- fix(workflows): refetch non-UTF-8 catalog caches (#3901)
+- fix(bundler): wrap local catalog decode failures (#3902)
+- Add `--extension` flag to `specify init` for opting into extensions at init time (#3914)
+- fix: bound response reads in extension catalog and download (#3775)
+- fix(workflows): reject a retry gate whose verdict enum forbids the reset value (#3912)
+- chore: release 0.15.1, begin 0.15.2.dev0 development (#3913)
+
 ## [0.15.1] - 2026-07-31
 
 ### Changed

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -55,6 +55,8 @@ Here are a few things you can do that will increase the likelihood of your pull
 - Write a [good commit message](http://tbaggery.com/2008/04/19/a-note-about-git-commit-messages.html).
 - Test your changes with the Spec-Driven Development workflow to ensure compatibility.
 
+Accounts with three open pull requests may continue submitting changes, but additional submissions may be placed behind contributions from other authors in the review queue. Coding agents should disclose this possibility and obtain the filer's confirmation before opening another pull request.
+
 ### Branch naming
 
 We recommend naming branches as `<type>/<number>-<short-slug>`, where `<number>` is the issue or PR number (whichever comes first) and `<type>` is one of: