[Bundle]: Add SpecAssay (update to 0.5.1)

Start by comparing the existing SpecAssay catalog entry with the proposed catalog JSON in this issue. Run specify bundle validate --path <bundle-directory> and specify bundle build --path <bundle-directory>, then verify that the catalog points to version 0.5.1 and keeps both component references pinned to matching versions.

Bundle ID

specassay

Bundle Name

SpecAssay

Version

0.5.1

Role or Team

developer

Description

Durable-ID promotion for stock Spec Kit: templates, Gate 2 refusal, and trace-manifest emission.

Author

Rik Dryfoos

Repository URL

https://github.com/rdryfoos/specassay

Download URL

https://github.com/rdryfoos/specassay/releases/download/v0.5.1/specassay-0.5.1.zip

Documentation URL

https://github.com/rdryfoos/specassay/blob/main/README.md

License

MIT

Required Spec Kit Version

=0.14.0

Integration Target (optional)

No response

Components Provided

• extensions: specassay-check@0.5.1
• presets: specassay@0.5.1
• workflows: none
• steps: none

Required Component Catalogs

The three SpecAssay catalogs, added as install-allowed, because the community
catalog is discovery-only and cannot install:

specify preset catalog add https://raw.githubusercontent.com/rdryfoos/specassay/main/catalogs/presets.json --name specassay --install-allowed
specify extension catalog add https://raw.githubusercontent.com/rdryfoos/specassay/main/catalogs/extensions.json --name specassay --install-allowed
specify bundle catalog add https://raw.githubusercontent.com/rdryfoos/specassay/main/catalogs/bundles.json --id specassay --policy install-allowed

Both components can alternatively be installed directly with
specify extension add ... --from <url> and specify preset add ... --from <url>,
which was also tested today.

Tags

traceability, governance, durable-ids, gate, sdd

Key Features

• One install provisions the whole thread: templates that mint durable IDs, and the Gate that refuses a silent gap
• Registry, specs and tasks must agree as an exact set; drift fails rather than passing quietly
• Emits a trace-manifest any viewer can read, so proof is a file rather than a claim
• Components are pinned to matching versions, so a partial upgrade cannot leave the bundle half-resolved

Testing Checklist

• Validation succeeds with specify bundle validate --path <bundle-directory>
• Build succeeds with specify bundle build --path <bundle-directory> and produces the submitted artifact
• Bundle installs successfully from the built artifact
• The submitted distribution path was tested end to end, including bundle-ID installation from an install-allowed catalog when a catalog entry is proposed
• Installation was tested in a clean Spec Kit project
• Required component catalogs are documented and were included in testing, or no extra catalogs are required
• Documentation is complete and accurate

Submission Requirements

• Valid bundle.yml manifest included
• README.md explains the bundle's intended role, installed components, and installation steps
• LICENSE file included
• GitHub release created with a version tag
• Bundle ID matches the manifest and follows naming conventions
• Every extension, preset, workflow, and step reference is pinned where the manifest requires a version

Testing Details

This updates the existing catalog entry from 0.4.12 to 0.5.1, superseding
issue #4255 (merged as catalog PR #4257). Neither v0.4.13 nor v0.5.0 was ever
filed, so this carries three releases of change.

Tested on: Linux, Spec Kit 1.0.5, Python 3.11.15, on 2026-09-20.
Previously captured on Spec Kit 1.0.4 at release time, 2026-09-17.

sha256 of the submitted artifact, computed from the v0.5.1 tag on 2026-09-20:

$ curl -fsSL -O https://github.com/rdryfoos/specassay/releases/download/v0.5.1/specassay-0.5.1.zip
$ sha256sum specassay-0.5.1.zip
962421be236991f5afa4a93f48bd16a9b2e61cd9221985b9f233b93407132246 specassay-0.5.1.zip

Component digests, same run:
874728251c850e84d71f7a94dbdc326073703a8b408690d87a62b68d43dc6eff specassay-check-0.5.1.zip
41e5b5e807bbb2b7d4d90253886122416109465af023d85a110cd522c16848fc specassay-preset-0.5.1.zip

All three match the digests this project recorded independently at release on
2026-09-17.

Test scenarios, clean project:

$ specify init . --here --force --non-interactive --integration claude
$
$ specify bundle install specassay
✓ Installed 'specassay' (2 added, 0 already present).

$ specify bundle list
specassay v0.5.1 (2 components, installed 2026-09-20T14:17:25Z)
$ specify preset list
SpecAssay (specassay) v0.5.1 — enabled — priority 10
$ specify extension list
✓ SpecAssay Check (v0.5.1)

All three resolve 0.5.1 on the first try. A thread was then driven from an
empty registry through mint, the Gate's honest refusal, and a clear to green as
tracked debt.

Example Usage

# Add the three SpecAssay catalogs as install-allowed (community is discovery-only)
specify preset catalog add https://raw.githubusercontent.com/rdryfoos/specassay/main/catalogs/presets.json --name specassay --install-allowed
specify extension catalog add https://raw.githubusercontent.com/rdryfoos/specassay/main/catalogs/extensions.json --name specassay --install-allowed
specify bundle catalog add https://raw.githubusercontent.com/rdryfoos/specassay/main/catalogs/bundles.json --id specassay --policy install-allowed

# Install the bundle
specify bundle install specassay

# Mint an ID at intent, then let the Gate refuse anything unproven
/speckit.specassay-check.mint AC LOGIN "Given a wrong password, when the user signs in, then the form shows an error."
/speckit.specassay-check.gate

Proposed Catalog Entry

{
  "specassay": {
    "name": "SpecAssay",
    "id": "specassay",
    "version": "0.5.1",
    "role": "developer",
    "description": "Durable-ID promotion for stock Spec Kit: templates, Gate 2 refusal, and trace-manifest emission.",
    "author": "Rik Dryfoos",
    "license": "MIT",
    "download_url": "https://github.com/rdryfoos/specassay/releases/download/v0.5.1/specassay-0.5.1.zip",
    "repository": "https://github.com/rdryfoos/specassay",
    "requires": {
      "speckit_version": ">=0.14.0"
    },
    "provides": {
      "extensions": 1,
      "presets": 1,
      "steps": 0,
      "workflows": 0
    },
    "tags": ["traceability", "governance", "durable-ids", "gate", "sdd"],
    "verified": false
  }
}

Additional Context

Update to an existing entry, not a new bundle.

This bundle pins specassay-check@0.5.1 and specassay@0.5.1, so a partial bump
leaves specify bundle install unable to resolve. The two component updates
are filed alongside it:

extension: #4649 (updates #4252, merged as #4254)
preset: #4650 (updates #4253, merged as #4256)
bundle: this issue (updates #4255, merged as #4257)