mirror of
https://github.com/github/spec-kit.git
synced 2026-08-15 14:02:04 +02:00
Manfred RiemandCopilot App
9cd07fb8c8
Address the second review round on github/spec-kit#3568: - Slug path traversal: intake and all four downstream commands (research, define, shape, decide) now normalize an explicit or user-supplied slug to the [a-z0-9-] alphabet (dropping '.', '/', '\\') and reject an empty normalized result before constructing ASSESS_DIR. This guarantees a slug like `../..` cannot escape .specify/assessments/. - Metadata accuracy: the extension.yml and catalog.json descriptions no longer imply a "build/kill" call is handed to /speckit.specify — only a `go` hands off; a `kill` closes the assessment. - Verdict determinism (decide): a `go` now explicitly requires evidence strength `adequate`+ (never weak/unknown), resolving the conflict with the thin-evidence guardrail. - Risk polarity (decide): renamed the "Risk" criterion to "Risk posture" with positive polarity (strong = risks understood and mitigated) so it composes with the other scores that feed the verdict. - README: aligned the go-threshold guardrail with the evidence rule and documented the slug-normalization safety property. The PR description was also updated to drop the stale before_specify hook claim (the hook was removed in the previous commit). Assisted-by: GitHub Copilot (model: Claude Opus 4.8, supervised) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1f25cf9d-b7eb-4b2b-b811-3e91d8db8f6a
68 lines
2.1 KiB
JSON
68 lines
2.1 KiB
JSON
{
|
|
"schema_version": "1.0",
|
|
"updated_at": "2026-07-17T00:00:00Z",
|
|
"catalog_url": "https://raw.githubusercontent.com/github/spec-kit/main/extensions/catalog.json",
|
|
"extensions": {
|
|
"agent-context": {
|
|
"name": "Coding Agent Context",
|
|
"id": "agent-context",
|
|
"version": "1.0.0",
|
|
"description": "Manages coding agent context/instruction files (e.g., CLAUDE.md, copilot-instructions.md) with project-specific plan references and configurable markers",
|
|
"author": "spec-kit-core",
|
|
"repository": "https://github.com/github/spec-kit",
|
|
"bundled": true,
|
|
"tags": [
|
|
"agent",
|
|
"context",
|
|
"core"
|
|
]
|
|
},
|
|
"assess": {
|
|
"name": "Idea Assessment Pipeline",
|
|
"id": "assess",
|
|
"version": "1.0.0",
|
|
"description": "Assess an idea before Spec-Driven Development via intake, research, define, shape, and decide. A go verdict hands off to /speckit.specify; a kill closes it. Lives under .specify/assessments/<slug>/",
|
|
"author": "spec-kit-core",
|
|
"repository": "https://github.com/github/spec-kit",
|
|
"bundled": true,
|
|
"tags": [
|
|
"assessment",
|
|
"discovery",
|
|
"triage",
|
|
"product",
|
|
"workflow"
|
|
]
|
|
},
|
|
"bug": {
|
|
"name": "Bug Triage Workflow",
|
|
"id": "bug",
|
|
"version": "1.0.0",
|
|
"description": "Assess, fix, and validate bug reports against the codebase with per-bug reports stored under .specify/bugs/<slug>/",
|
|
"author": "spec-kit-core",
|
|
"repository": "https://github.com/github/spec-kit",
|
|
"bundled": true,
|
|
"tags": [
|
|
"bug",
|
|
"triage",
|
|
"workflow",
|
|
"qa"
|
|
]
|
|
},
|
|
"git": {
|
|
"name": "Git Branching Workflow",
|
|
"id": "git",
|
|
"version": "1.0.0",
|
|
"description": "Feature branch creation, numbering (sequential/timestamp), validation, and Git remote detection",
|
|
"author": "spec-kit-core",
|
|
"repository": "https://github.com/github/spec-kit",
|
|
"bundled": true,
|
|
"tags": [
|
|
"git",
|
|
"branching",
|
|
"workflow",
|
|
"core"
|
|
]
|
|
}
|
|
}
|
|
}
|