Address community bundle review feedback

Ensure explicit install-allowed catalogs take precedence over built-in discovery, tighten component installability validation, and use issue-linked community branches.

Assisted-by: GitHub Copilot (model: GPT-5.6 Sol, autonomous)

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: fbe794bc-667a-4c9e-b48b-825067debc6d

Author: BenBtg

.github/workflows/add-community-bundle.lock.yml

@@ -152,9 +152,9 @@ Confirm that:
 - If non-default catalogs are required, ensure each URL is HTTPS, the README
   documents the corresponding `catalog add` command, and the testing details
   say those catalogs were registered in the clean-project test.
-- If the field says `None` but a component is not bundled and cannot be found
-  in a default Spec Kit catalog, fail validation and ask the submitter to list
-  and document its catalog.
+- If the field says `None` but a component is not bundled and cannot be
+  installed from a default Spec Kit catalog, fail validation and ask the
+  submitter to list and document an install-allowed companion catalog.
 
 The community bundle catalog itself remains discovery-only. Companion catalog
 URLs are documentation and validation metadata, not catalogs this workflow
@@ -249,8 +249,10 @@ repository README remains the source for the actual URLs.
 
 Create one draft pull request.
 
-- New entry branch: `add-<bundle-id>-bundle`
-- Update branch: `update-<bundle-id>-bundle`
+- New entry branch:
+  `community/${{ github.event.issue.number }}-add-<bundle-id>-bundle`
+- Update branch:
+  `community/${{ github.event.issue.number }}-update-<bundle-id>-bundle`
 - New title: `Add <Bundle Name> bundle to community catalog`
 - Update title: `Update <Bundle Name> bundle to v<version>`
 

.github/workflows/add-community-bundle.md

@@ -5,7 +5,7 @@
 
 Bundles compose existing Spec Kit components — extensions, presets, workflows, and steps — into a single role or team stack. They are useful when a user should be able to install a tested set of components together instead of following several separate install commands.
 
-Accepted community bundle entries are published in [`bundles/catalog.community.json`](https://github.com/github/spec-kit/blob/main/bundles/catalog.community.json) and listed below. The built-in community source is discovery-only: `specify bundle search` and `specify bundle info` can inspect entries, but installing by ID requires explicitly adding an install-allowed catalog. To submit a bundle for review, file a [Bundle Submission](https://github.com/github/spec-kit/issues/new?template=bundle_submission.yml) issue.
+Accepted community bundle entries are published in [`bundles/catalog.community.json`](https://github.com/github/spec-kit/blob/main/bundles/catalog.community.json) and listed below. The built-in community source is discovery-only: `specify bundle search` and `specify bundle info` can inspect entries, but installing by ID requires explicitly adding an install-allowed catalog. Explicit catalogs use a higher default precedence than the built-in community source. To submit a bundle for review, file a [Bundle Submission](https://github.com/github/spec-kit/issues/new?template=bundle_submission.yml) issue.
 
 | Bundle | Purpose | Role or team | Provides | Required catalogs | URL |
 |--------|---------|--------------|----------|-------------------|-----|

docs/community/bundles.md

@@ -43,7 +43,7 @@ class Scope(str, Enum):
 BUILTIN_DEFAULT_STACK: tuple[dict[str, Any], ...] = (
     {"id": "default", "url": "builtin://default", "priority": 1,
      "install_policy": InstallPolicy.INSTALL_ALLOWED.value},
-    {"id": "community", "url": "builtin://community", "priority": 2,
+    {"id": "community", "url": "builtin://community", "priority": 20,
      "install_policy": InstallPolicy.DISCOVERY_ONLY.value},
 )
 

src/specify_cli/bundler/models/catalog.py

@@ -39,6 +39,7 @@ def test_builtin_default_stack_when_no_config(tmp_path: Path):
     assert ids == ["default", "community"]
     assert sources[0].install_policy is InstallPolicy.INSTALL_ALLOWED
     assert sources[1].install_policy is InstallPolicy.DISCOVERY_ONLY
+    assert sources[1].priority == 20
     assert all(s.scope is Scope.BUILTIN for s in sources)
 
 

tests/contract/test_catalog_schema.py

@@ -38,6 +38,27 @@ def test_resolve_prefers_highest_precedence_source():
     assert resolved.install_allowed is False
 
 
+def test_explicit_catalog_shadows_builtin_community_at_default_priority():
+    sources = [
+        _source("community", 20, "discovery-only"),
+        _source("explicit", 10, "install-allowed"),
+    ]
+    payloads = {
+        "community": catalog_payload({
+            "shared": catalog_entry_dict("shared", version="1.0.0"),
+        }),
+        "explicit": catalog_payload({
+            "shared": catalog_entry_dict("shared", version="2.0.0"),
+        }),
+    }
+
+    resolved = _stack(sources, payloads).resolve("shared")
+
+    assert resolved.source.id == "explicit"
+    assert resolved.entry.version == "2.0.0"
+    assert resolved.install_allowed is True
+
+
 def test_resolve_unknown_bundle_errors():
     stack = _stack(
         [_source("only", 1, "install-allowed")],