[Bundle]: Add SpecAssay (update to 0.5.2)

这是一个将 SpecAssay 现有捆绑包目录条目从版本 0.4.12 更新到 0.5.2 的请求。工作涉及使用新的版本详情、SHA256 哈希值和任何更改的元数据来更新目录 JSON 文件。首先找到捆绑包目录文件（可能在类似 catalogs/ 的目录中）。验证 'specassay' 的现有条目，并根据提供的 JSON 块更新版本、download_url、sha256 以及任何其他更改的字段。通过运行 issue 中提到的捆绑包验证命令进行测试，以确保目录条目正确。

Bundle ID

specassay

Bundle Name

SpecAssay

Version

0.5.2

Role or Team

developer

Description

Durable-ID promotion for stock Spec Kit: templates, Gate 2 refusal, and trace-manifest emission.

Author

Rik Dryfoos

Repository URL

https://github.com/rdryfoos/specassay

Download URL

https://github.com/rdryfoos/specassay/releases/download/v0.5.2/specassay-0.5.2.zip

Documentation URL

https://github.com/rdryfoos/specassay/blob/main/README.md

License

MIT

Required Spec Kit Version

=0.14.0,<2.0.0

Integration Target (optional)

No response

Components Provided

• extensions: specassay-check@0.5.2
• presets: specassay@0.5.2
• workflows: none
• steps: none

Required Component Catalogs

The three SpecAssay catalogs, added as install-allowed, because the community
catalog is discovery-only and cannot install:

specify preset catalog add https://raw.githubusercontent.com/rdryfoos/specassay/main/catalogs/presets.json --name specassay --install-allowed
specify extension catalog add https://raw.githubusercontent.com/rdryfoos/specassay/main/catalogs/extensions.json --name specassay --install-allowed
specify bundle catalog add https://raw.githubusercontent.com/rdryfoos/specassay/main/catalogs/bundles.json --id specassay --policy install-allowed

Both components can alternatively be installed directly with
specify extension add ... --from <url> and specify preset add ... --from <url>.

Tags

traceability, governance, durable-ids, gate, sdd

Key Features

• One install provisions the whole thread: templates that mint durable IDs, and the Gate that refuses a silent gap
• Registry, specs and tasks must agree as an exact set; drift fails rather than passing quietly
• Emits a trace-manifest any viewer can read, so proof is a file rather than a claim
• Components are pinned to matching versions, so a partial upgrade cannot leave the bundle half-resolved

Testing Checklist

• Validation succeeds with specify bundle validate --path <bundle-directory>
• Build succeeds with specify bundle build --path <bundle-directory> and produces the submitted artifact
• Bundle installs successfully from the built artifact
• The submitted distribution path was tested end to end, including bundle-ID installation from an install-allowed catalog when a catalog entry is proposed
• Installation was tested in a clean Spec Kit project
• Required component catalogs are documented and were included in testing, or no extra catalogs are required
• Documentation is complete and accurate

Submission Requirements

• Valid bundle.yml manifest included
• README.md explains the bundle's intended role, installed components, and installation steps
• LICENSE file included
• GitHub release created with a version tag
• Bundle ID matches the manifest and follows naming conventions
• Every extension, preset, workflow, and step reference is pinned where the manifest requires a version

Testing Details

This updates the existing catalog entry from 0.4.12 to 0.5.2, superseding
issue #4255 (merged as catalog PR #4257). Neither v0.4.13 nor v0.5.0 was ever
filed, so this carries three releases of change.

Tested on: Linux, Spec Kit 1.0.5, Python 3.11.15, on 2026-09-23, against the
published v0.5.2 assets in a clean project.

sha256 of the submitted artifact, computed from the published v0.5.2 assets on 2026-09-23:

$ curl -fsSL -O https://github.com/rdryfoos/specassay/releases/download/v0.5.2/specassay-0.5.2.zip
$ sha256sum specassay-0.5.2.zip
a9acd0848132bee975be7ca6759a531ff02b736c99a98b1bc4e7d8da90da7c82 specassay-0.5.2.zip

Component digests, same run:
f481c6794d0cffc6d532721c1acc378287ba291b3e74dbe1e54eef083d1e7a20 specassay-check-0.5.2.zip
9920daf8b7ebe2d5e0d5e723409719afeaaa7c59788a6f3ecda67e2f7543d0b9 specassay-preset-0.5.2.zip

Test scenarios, clean project:

$ specify init . --here --force --non-interactive --integration claude
$
$ specify bundle install specassay
Installed 'specassay' (2 added, 0 already present).

$ specify bundle list
specassay v0.5.2 (2 components, installed 2026-09-23T17:41:00Z)
$ specify preset list
SpecAssay (specassay) v0.5.2 - enabled - priority 10
$ specify extension list
SpecAssay Check (v0.5.2)

All three resolve 0.5.2 on the first try. A thread was then driven from an
empty registry through mint, the Gate's honest refusal, and a clear to green as
tracked debt.

Example Usage

# Add the three SpecAssay catalogs as install-allowed (community is discovery-only)
specify preset catalog add https://raw.githubusercontent.com/rdryfoos/specassay/main/catalogs/presets.json --name specassay --install-allowed
specify extension catalog add https://raw.githubusercontent.com/rdryfoos/specassay/main/catalogs/extensions.json --name specassay --install-allowed
specify bundle catalog add https://raw.githubusercontent.com/rdryfoos/specassay/main/catalogs/bundles.json --id specassay --policy install-allowed

# Install the bundle
specify bundle install specassay

# Mint an ID at intent, then let the Gate refuse anything unproven
/speckit.specassay-check.mint AC LOGIN "Given a wrong password, when the user signs in, then the form shows an error."
/speckit.specassay-check.gate

Proposed Catalog Entry

{
  "specassay": {
    "name": "SpecAssay",
    "id": "specassay",
    "version": "0.5.2",
    "role": "developer",
    "description": "Durable-ID promotion for stock Spec Kit: templates, Gate 2 refusal, and trace-manifest emission.",
    "author": "Rik Dryfoos",
    "license": "MIT",
    "download_url": "https://github.com/rdryfoos/specassay/releases/download/v0.5.2/specassay-0.5.2.zip",
    "sha256": "a9acd0848132bee975be7ca6759a531ff02b736c99a98b1bc4e7d8da90da7c82",
    "repository": "https://github.com/rdryfoos/specassay",
    "requires": {
      "speckit_version": ">=0.14.0,<2.0.0"
    },
    "provides": {
      "extensions": 1,
      "presets": 1,
      "steps": 0,
      "workflows": 0
    },
    "tags": ["traceability", "governance", "durable-ids", "gate", "sdd"],
    "verified": false
  }
}

Additional Context

Update to an existing entry.
Replaces #4692 which was filed at 0.5.1 before v0.5.2 shipped.
Companion issues: the extension and the preset filed just before this one; the bundle pins both component versions, so all three land together:

https://github.com/github/spec-kit/issues/4713
https://github.com/github/spec-kit/issues/4711