[Extension]: Add csdd #5061

Extension ID

csdd

Extension Name

CSDD — Controlled Spec-Driven Development

Version

1.2.0

Description

把治理规范、门禁、模板安装到已有仓库；第三方扩展按清单可选安装，默认不装。

Author

CSDD

Repository URL

https://github.com/yuansanche/csdd

Download URL

https://github.com/yuansanche/csdd/archive/refs/tags/v1.2.0.zip

License

MIT

Homepage (optional)

https://github.com/yuansanche/csdd

Documentation URL (optional)

https://github.com/yuansanche/csdd/blob/main/README.md

Changelog URL (optional)

https://github.com/yuansanche/csdd/blob/main/CHANGELOG.md

Required Spec Kit Version

=1.1.3

Required Tools (optional)

• bash (>= 3.2) - required；注：清单中第三方扩展 blueprint-index 的检查脚本需要 bash 5.2+
• python3 (>= 3.9) - required
• git (>= 2.30) - required
• curl - required
• unzip - required

Number of Commands

4

Number of Hooks (optional)

0

Tags

governance, quality-gate, spec-driven-development

Key Features

• 治理层安装：把门禁、模板、宪章、文档安装到已有仓库，默认预演（dry-run），冲突不覆盖，装完自检
• 文档只写标记区块：AGENTS.md、CONTRIBUTING.md 不整份复制，只维护 CSDD:BEGIN / CSDD:END 之间的中性区块
• 第三方扩展按清单可选安装：整包 sha256 + extension.yml 审计哈希双重校验，无哈希的组件拒绝安装，默认不装
• 只读导航：/speckit.csdd.navigate 在新增模块前汇总架构地图与技术栈，引导复用检查
• 一键部署：scripts/csdd-bootstrap.sh 串起 init → 装扩展 → 装治理层 → 可选装第三方扩展，不带 --yes 只预演

Testing Checklist

• Extension installs successfully via download URL
• All commands execute without errors
• Documentation is complete and accurate
• No security vulnerabilities identified
• Tested on at least one real project

Submission Requirements

• Valid extension.yml manifest included
• README.md with installation and usage instructions
• LICENSE file included
• GitHub release created with version tag
• All command files exist and are properly formatted
• Extension ID follows naming conventions (lowercase-with-hyphens)

Testing Details

Tested on:

• macOS 26 (arm64), Spec Kit v1.1.3 (specify 1.1.3)

Test project: 全新初始化的临时 Spec Kit 项目（specify init . --integration claude）

Test scenarios:

1. 远程安装：specify extension add csdd --from https://github.com/yuansanche/csdd/archive/refs/tags/v1.2.0.zip
   • 输出 ✓ Extension installed successfully!，注册 4 个命令
2. 本地开发安装：specify extension add --dev /path/to/csdd
   • 输出 ✓ Extension installed successfully!
3. specify extension info csdd
   • ID: csdd、Category: process、Effect: read-write、Commands: 4
4. specify extension list
   • Commands: 4 | Hooks: 0 | Priority: 10 | Status: Enabled
5. bash .specify/extensions/csdd/scripts/csdd-bootstrap.sh --yes（在容器内全新仓库）
   • 退出码 0，治理层落盘并通过自检

Example Usage

# 安装扩展
specify extension add csdd --from https://github.com/yuansanche/csdd/archive/refs/tags/v1.2.0.zip

# 在 agent 中使用
/speckit.csdd.install      # 把治理层安装到当前仓库（默认预演，加 --apply 才写盘）
/speckit.csdd.verify       # 校验已安装的治理层与包内 payload 是否一致
/speckit.csdd.extensions   # 查看或安装清单中的第三方扩展
/speckit.csdd.navigate     # 新增模块前的只读导航

Proposed Catalog Entry

{
  "csdd": {
    "name": "CSDD — Controlled Spec-Driven Development",
    "id": "csdd",
    "description": "把治理规范、门禁、模板安装到已有仓库；第三方扩展按清单可选安装，默认不装。",
    "author": "CSDD",
    "version": "1.2.0",
    "download_url": "https://github.com/yuansanche/csdd/archive/refs/tags/v1.2.0.zip",
    "sha256": "ba9230b609739c39d0b4591c5b0875bcd28aff0d35401edb808fdb1815ce1cbd",
    "repository": "https://github.com/yuansanche/csdd",
    "homepage": "https://github.com/yuansanche/csdd",
    "documentation": "https://github.com/yuansanche/csdd/blob/main/README.md",
    "changelog": "https://github.com/yuansanche/csdd/blob/main/CHANGELOG.md",
    "license": "MIT",
    "category": "process",
    "effect": "read-write",
    "requires": {
      "speckit_version": ">=1.1.3",
      "tools": [
        { "name": "bash", "required": true },
        { "name": "python3", "required": true },
        { "name": "git", "required": true },
        { "name": "curl", "required": true },
        { "name": "unzip", "required": true }
      ]
    },
    "provides": {
      "commands": 4,
      "hooks": 0
    },
    "tags": ["governance", "quality-gate", "spec-driven-development"],
    "verified": false,
    "downloads": 0,
    "stars": 0,
    "created_at": "2026-10-22T00:00:00Z",
    "updated_at": "2026-10-22T00:00:00Z"
  }
}

SHA-256

ba9230b609739c39d0b4591c5b0875bcd28aff0d35401edb808fdb1815ce1cbd

Additional Context

• 这里的 sha256 是对 GitHub 为 tag v1.2.0 自动生成的压缩包（/archive/refs/tags/v1.2.0.zip，3,050,402 bytes）计算所得，不是本地 git archive 的产物。同一 URL 两次下载哈希一致。
• 安装时会出现 Untrusted Source 确认框（--from 直装属于绕过目录的可信安装路径），确认后正常安装；进入社区目录后按目录安装不再弹该提示。
• extension.yml 已包含 category: process 与 effect: read-write。
• 未直接修改 catalog.community.json（发布指南明确禁止直接提 PR），等待维护者加 extension-submission 标签后由自动校验生成草稿 PR。