[Extension]: Add SpecAssay Check (update to 0.5.2)

此 issue 是将 specassay-check 扩展的现有目录条目从版本 0.4.12 更新到 0.5.2。首先在 spec-kit 仓库中找到目录文件（可能是 JSON 或 YAML 文件）。将 issue 中提议的目录条目与现有条目进行比较，以更新版本、下载 URL、SHA256、命令数量和其他已更改的字段。验证该扩展是否按照测试详情中的描述安装和运行。当目录条目反映版本 0.5.2 并通过仓库的任何验证时，工作即告完成。

Extension ID

specassay-check

Extension Name

SpecAssay Check

Version

0.5.2

Description

Gate 2 refuses silent gaps and emits a trace-manifest (trace-manifest.json).

Author

Rik Dryfoos

Repository URL

https://github.com/rdryfoos/specassay

Download URL

https://github.com/rdryfoos/specassay/releases/download/v0.5.2/specassay-check-0.5.2.zip

License

MIT

Homepage (optional)

https://www.specassay.com

Documentation URL (optional)

https://github.com/rdryfoos/specassay/blob/main/extensions/specassay-check/README.md

Changelog URL (optional)

https://github.com/rdryfoos/specassay/blob/main/CHANGELOG.md

Required Spec Kit Version

=0.14.0,<2.0.0

Required Tools (optional)

- bash - required
- python3 (>=3.8) - required

Number of Commands

5

Number of Hooks (optional)

1

Tags

traceability, gate, ci, governance, sdd

Key Features

• Gate 2 refuses a silent gap: an acceptance criterion with no test and no open tracked-debt task fails the build rather than passing quietly
• Emits trace-manifest.json (v4) and trace-manifest.v5beta.json, one row per registry ID with its status and the evidence behind it
• Five statuses, including retired for an intent withdrawn on purpose, so a withdrawal is never mistaken for a gap
• Mints durable IDs at intent and refuses an ID the project's own configured grammar would reject
• Coverage matrix and portfolio snapshot for CI and for cold readers

Testing Checklist

• Extension installs successfully via download URL
• All commands execute without errors
• Documentation is complete and accurate
• No security vulnerabilities identified
• Tested on at least one real project

Submission Requirements

• Valid extension.yml manifest included
• README.md with installation and usage instructions
• LICENSE file included
• GitHub release created with version tag
• All command files exist and are properly formatted
• Extension ID follows naming conventions (lowercase-with-hyphens)

Testing Details

This updates the existing catalog entry from 0.4.12 to 0.5.2. It supersedes
issue #4252, filed at 0.4.12 and merged as catalog PR #4254. Neither v0.4.13
nor v0.5.0 was ever filed, so this one carries three releases of change.

Tested on: Linux, Spec Kit 1.0.5, Python 3.11.15, on 2026-09-23, against the
published v0.5.2 assets in a clean project.
The >=0.14.0 floor was exercised at v0.5.1 on 2026-09-17: the bundle installs
and the Gate runs on 0.14.0, though that version does not scaffold the settings
file, so the Gate reports config: MISSING and continues on defaults.

sha256 of the submitted archive, computed from the published v0.5.2 assets on 2026-09-23:

$ curl -fsSL -O https://github.com/rdryfoos/specassay/releases/download/v0.5.2/specassay-check-0.5.2.zip
$ sha256sum specassay-check-0.5.2.zip
f481c6794d0cffc6d532721c1acc378287ba291b3e74dbe1e54eef083d1e7a20 specassay-check-0.5.2.zip

Test scenarios, in a clean project (specify init . --here --force --non-interactive --integration claude):

1. Installed direct from the download URL:
   $ specify extension add specassay-check --from
   installed; specify extension list reports SpecAssay Check (v0.5.2)
2. Ran the Gate on an empty project. It refuses and names the fix:
   FAIL: registry not found: PRD.md
3. Ran the Gate on an empty-but-present registry. Exit 0, and it prints the
   on-ramp naming both mint routes.
4. Minted a first ID:
   $ bash .../mint-id.sh AC LOGIN --append "Given a wrong password, ..."
   AC-LOGIN-10
5. Ran the Gate again. It refuses honestly, which is the intended first red:
   FAIL: registry ID missing from specs: AC-LOGIN-10
   FAIL: registry ID missing from tasks: AC-LOGIN-10
   FAIL: silent gap: AC-LOGIN-10 has no test and no open tracked-debt task
   exit 1
6. Added a spec line and one open task carrying the ID, the documented way to
   clear it:
   SpecAssay Check (Gate 2): OK (1 registry IDs)
   exit 0, and trace-manifest.json reports AC-LOGIN-10 as tracked-debt.

The extension is also run against its own repository on every pull request,
where it currently reports OK on 96 registry IDs.

Example Usage

# Install from the release archive
specify extension add specassay-check --from https://github.com/rdryfoos/specassay/releases/download/v0.5.2/specassay-check-0.5.2.zip

# Mint a durable ID at intent
/speckit.specassay-check.mint AC LOGIN "Given a wrong password, when the user signs in, then the form shows an error and no session starts."

# Run Gate 2; a silent gap fails the build
/speckit.specassay-check.gate

Proposed Catalog Entry

{
  "specassay-check": {
    "name": "SpecAssay Check",
    "id": "specassay-check",
    "description": "Gate 2 refuses silent gaps and emits a trace-manifest (`trace-manifest.json`).",
    "author": "Rik Dryfoos",
    "version": "0.5.2",
    "download_url": "https://github.com/rdryfoos/specassay/releases/download/v0.5.2/specassay-check-0.5.2.zip",
    "sha256": "f481c6794d0cffc6d532721c1acc378287ba291b3e74dbe1e54eef083d1e7a20",
    "repository": "https://github.com/rdryfoos/specassay",
    "homepage": "https://www.specassay.com",
    "documentation": "https://github.com/rdryfoos/specassay/blob/main/extensions/specassay-check/README.md",
    "changelog": "https://github.com/rdryfoos/specassay/blob/main/CHANGELOG.md",
    "license": "MIT",
    "category": "visibility",
    "effect": "read-write",
    "requires": {
      "speckit_version": ">=0.14.0,<2.0.0",
      "tools": [
        { "name": "bash", "required": true },
        { "name": "python3", "version": ">=3.8", "required": true }
      ]
    },
    "provides": {
      "commands": 5,
      "hooks": 1
    },
    "tags": ["traceability", "gate", "ci", "governance", "sdd"],
    "verified": false,
    "downloads": 0,
    "stars": 0,
    "created_at": "2026-08-13T00:00:00Z",
    "updated_at": "2026-09-23T00:00:00Z"
  }
}

Additional Context

Update to an existing entry. Replaces #4690 which was filed at 0.5.1 before v0.5.2 shipped.
provides.commands moves from 2 to 5; dig, matrix and portfolio shipped after the 0.4.12 entry.