4.0.0 — Hosted collaboration & the open-core structural finish

Milestone: 4.0.0 release scope (open; the GA gate) · Status: active (release-candidate stage; 4.0.0rc5 published 2026-10-02, 4.0.0rc6 open on main) · Declared: 2026-09-04 · Re-anchored: 2026-10-06 · Supersedes the retired 3.3.x declaration for the hosted/experience work · Originally advanced (see Where the goals stand for today's state): epics #1800 (SaaS sync & event-envelope hardening), #1091 (Team Kitty launch gate), #3322 (CLI auth & token-lifecycle reliability), #2173 (infra-to-logic ports), #2519 (charter authoring & lifecycle), #3549 (event-log integrity).

Direction amendment (2026-10-01). Team Kitty / SaaS work is frozen while the commercial vision is reviewed, so G1 (hosted collaboration) is off the critical path: nothing hosted gates 4.0.0 GA, which is the 4.0.0 release scope milestone alone. External interaction flows through the CLI's adapter module (the status fan-out, the seam for a publish/subscribe system); producing events and draining them are separate concerns with separate toggles; and the charter may ship as its own package once specify_cli reaches it only through a stable API (#645). The G1 text below is kept as the record of the original intent. The operator detail is in the 4.0.0 Milestone Roadmap.

Where the goals stand (2026-10-06)

The goals below are the record of what was declared on 2026-09-04. What 4.0.0 GA now means:

GA is local CLI integrity. The CLI never reports success while it loses, overwrites or strands local work. The 4.0.0 release scope milestone (14 open, 210 closed, due 2026-10-16) is the whole gate; 119 of its 201 closed issues were P0.
G1 (hosted collaboration) is frozen. Every G1 epic and P0 is closed or closed as not planned; the client-side successor epics #3892 and #3893 wait on 4.x Work. Since 2026-10-06 Team Kitty is no longer actively supported, and its CLI entries are hidden from listings (ADR 2026-10-06-1).
G2 is split. #2173 (infrastructure ports) closed on 2026-09-27; #2519 (charter authoring) continues on CLI 4.x stable.
G3 (structural strangler) continues after GA on the 4.x line: #645 (stable application API, with the Mission Status Read API as its read facet), #1619 (one execution context) and the pack-ecosystem epics. None of it gates GA.

Where the goals stand (2026-10-12). GA now ships done-when-done: there is no date gate, release candidates keep shipping, and each one still needs green CI before it is released. The GA gate has three legs: local integrity, charter modular extraction (#645, ADR 2026-10-12-2), and the mission-status API backend. (2026-10-19: the charter leg is now a frozen charter.offering.api seam and a green conformance corpus, not an extraction; ADR 2026-10-12-2 is superseded by spec-kitty-charter ADR-0008 and ADR-0010.)

The operator detail, including the open GA issues and the decisions still owed, is in the 4.0.0 Milestone Roadmap.

Why now

A release-queue reconciliation on 2026-08-23 retired the 3.3.x milestone (its open work re-triaged into 4.0.0 or Product backlog), repurposed the former 3.2.x milestone (#4) into Product backlog, and split the near-term work into discrete 3.2.6 (stabilization, code-complete), 3.2.7 (post-reconciliation follow-ups — doctrine-term renames, profile-load consolidation, perf CI, dedups), and 4.0.0 (this cycle) milestones. 4.0.0 is the largest open milestone (80 open issues) and had no declaration-of-intent, breaking the project's own release-goals convention (one durable declaration per milestone). This document is that declaration. The taxonomy re-anchor that surfaced the gap is recorded in the milestone roadmap's 2026-09-04 addendum.

Theme

With 3.2.x's core-domain single-sources-of-truth substantially in place and 3.2.6 shipped clean, 4.0.0 turns to hosted collaboration and next-generation product capabilities — the hosted Team Kitty surface (sync, consent/identity, auth, launch) and the charter/runtime depth that builds on the stabilized core. It is also the intended landing zone for the open-core structural strangler that 3.2.x exists to finish — committed to this cycle by operator decision (2026-09-04). Same discipline as the prior cycles: no new shadow paths — route or extract onto an existing authority, never build a parallel one.

Goals

G1 — Hosted collaboration (Team Kitty)

Off the critical path since 2026-10-01 (see the direction amendment above).

Make the hosted surface a coherent, trustworthy product rather than a set of bolt-ons. The durable invariants and sub-areas were held by the SaaS & Hosted Sync domain plan (retired 2026-09-06, Convergence #3881 — the surface re-homed to the authoritative upstream repos); this cycle ships their release-scoped work:

Sync & event-envelope integrity — sync never reports success while authored state is stranded; every synced event carries a contract-valid envelope. Epic #1800; load-bearing P0 #3278 (sync false success while MissionCreated stranded).
Consent & identity boundary — only explicitly consenting projects transmit, under one unambiguous project→identity resolution. Load-bearing P0 #3178 (wrong-authority egress); P1s #3197 / #3196 / #3198.
Auth & token lifecycle — a logged-in CLI stays authenticated, human auth is browser-mediated, machine/CI auth has a supported path, refresh failures are named. Epic #3322 (owns #3279 / #3277 / #3233).
Hosted rollout & launch gate — fail-closed-by-default rollout, named readiness failures, launch defaults. Epic #1091.
Event-log integrity — one canonical event store, honestly reported, delivered without silent loss. Epic #3549.

G2 — Next-generation product capabilities

Deepen the governance and runtime surfaces the stabilized core now supports:

Charter authoring & lifecycle robustness — the author/observe/reproduce paths, charter domain events, deterministic intake. Epic #2519 (moved 3.2.x → 4.0.0 in the reconciliation; see the Doctrine & Charter Domain Plan §3.1).
Infrastructure-to-logic separation — inject ports for FS, Clock, GitOps, SaaSQueue, Renderer; keep the core pure and stub-testable. Epic #2173 (moved 3.2.x → 4.0.0).

G3 — Finish the open-core structural strangler

The G1/G2 strangler spine the 3.2.x cycle exists to finish — see Structural strangler spine — committed to 4.0.0 — is the structural foundation for 4.0.0's hosted and next-gen work. Committed to 4.0.0 by operator decision (2026-09-04): the spine epics now carry milestone 4.0.0 on the live tracker.

Committed scope (verified milestone `4.0.0`, 2026-09-04)

These epics and P0s carry milestone 4.0.0 on the live tracker:

Item	Role	Goal	State (2026-10-06)
#1800	Epic: SaaS sync & event-envelope hardening	G1	Closed
#1091	Epic: Team Kitty launch gate	G1	Closed
#3322	Epic: CLI auth & token-lifecycle reliability	G1	Closed; successor #3892 frozen on 4.x Work
#3549	Epic: event-log integrity	G1	Closed; successor #3893 on 4.x Work
#3278	P0: sync reports success while `MissionCreated` stranded	G1	Closed as not planned
#3178	P0: wrong-authority egress (FR-007 not discharged by FR-002)	G1	Closed
#2519	Epic: charter authoring & lifecycle robustness	G2	Open, CLI 4.x stable
#2173	Epic: infrastructure-to-logic separation (ports)	G2	Closed

Verify live state via gh issue view <n> --repo spec-kitty/spec-kitty before acting; the milestone description carries the one-line pointer back here.

Structural strangler spine — committed to 4.0.0 (2026-09-04)

The open-core structural strangler spine — the G1/G2 structural work the 3.2.x cycle exists to finish — is committed to 4.0.0 by operator decision (2026-09-04). It had sat in Product backlog (validated, but on no committed release — exit criterion 8's anti-drift guard fired in a blind spot, and the work rode into Product backlog silently instead of onto a release). The epics below now carry milestone 4.0.0 on the live tracker:

Epic	Role	Milestone (2026-09-04)	State (2026-10-06)
#1619	mission-execution-context root (P0)	4.0.0	Open, CLI 4.x stable
#1797	degod / unshim delivery	4.0.0	Closed as not planned
#1868	seam-binding enabler (WS4 / WS6)	4.0.0	Open, CLI 4.x stable
#1746	Mission Clarity Layer (P1)	4.0.0	Open, CLI 4.x stable
#2160	coord-artifact authority (P0)	4.0.0	Closed on 4.0.0 release scope
#1676	deterministic structured authoring (P0)	4.0.0	Open, CLI 4.x stable
#2466 / #2467 / #2468	pack ecosystem + extensibility kinds	4.0.0	Open, 4.x Work
#2539	pack trust / verified distribution	4.0.0	Open, 4.x Work
#645 / #3179	stable public API surface for doctrine & charter	4.0.0	#645 open on 4.x Work; #3179 closed

Security-debt coupling. The 21 SonarCloud security findings (the sole failing quality gate — 17 S6350 subprocess + 3 S2083 path-traversal, all pre-dating any current release candidate) map almost 1:1 onto the degod slices above, so the security backlog rides with this structural remediation — now both scheduled in 4.0.0. The 3 S2083 blockers remain a called-out ~90-min targeted fix that can land independent of any wave. (2026-10-06: the security findings are tracked by #4304, #4305 and #2970 on 4.x Work, outside the GA gate.)

Non-goals

Re-opening the 3.2.x core-domain SSOTs — they are the stabilized foundation 4.0.0 builds on, not scope to re-litigate.
The 3.2.7 stabilization tail — doctrine-term renames, profile-load consolidation, perf CI, and dedups shipped under milestone 3.2.7 (released 2026-09-10), not here.

Success criteria

Rewritten 2026-10-06; the 2026-09-04 placeholder criteria are listed below as the record.

For 4.0.0 GA:

[ ] The 4.0.0 release scope milestone is closed, or each open issue is re-milestoned with a rationale.
[ ] The nightly is green on the release commit; any skip_nightly waiver is an explicit, recorded operator decision.
[ ] No command reports success while it loses, overwrites or strands local work (the consolidation, status and workflow P0s), with an explicit decision on #5780 and #5758.
[ ] No new shadow path: no re-introduced sync transport, and only the adapter seam talks to an external system.

For the 4.x line after GA:

[ ] The structural strangler spine lands or is explicitly re-dispositioned; no epic is left implicitly "cycle work" while off a release.
[ ] #645 gives CLI, UI, MCP and SDK consumers one versioned surface, and specify_cli reaches the charter only through it.

Deferred with G1 (frozen 2026-10-01): hosted no-false-success and no-loss under load; the consent/identity boundary; CLI auth across device-flow and machine paths (#3892); the Team Kitty launch gate (closed as #1091).

Emergent patches

Declared when the cycle activates (3.2.7 stabilization tail lands first). Following the emergent-milestone model: each patch advances one of the goals above; the milestone stays open until the goals are structurally met.