[Bundle]: Add SicarioSpec Security & Governance Bundle

[SiCar10mw]

Bundle ID

sicario-spec

Bundle Name

SicarioSpec Security & Governance Bundle

Version

0.5.1

Role or Team

security-engineer

Description

Secure-by-default governance bundle for GitHub Spec Kit. Enforces data classification, threat modeling, code-owned verification gates, compliance evidence, and secure delivery workflows.

Author

SicarioSpec Contributors

Repository URL

https://github.com/dfirs1car1o/sicario-spec

Download URL

https://github.com/dfirs1car1o/sicario-spec/releases/download/v0.5.1/sicario-spec-0.5.1.zip

Documentation URL

https://github.com/dfirs1car1o/sicario-spec/blob/main/README.md

License

MIT

Required Spec Kit Version

=0.9.0

Integration Target (optional)

No response

Components Provided

• extensions: sicario-guard@0.5.1
• presets: sicario-core@0.5.1, sicario-docs@0.5.1, sicario-appsec@0.5.1, sicario-ai-system@0.5.1, sicario-agent-fleet@0.5.1, sicario-cloud-iac@0.5.1, sicario-supply-chain@0.5.1, sicario-compliance@0.5.1, sicario-saas@0.5.1, sicario-security-toolchain@0.5.1, sicario-enterprise-strict@0.5.1
• workflows: none
• steps: none

Required Component Catalogs

• Presets: https://github.com/dfirs1car1o/sicario-spec/releases/download/v0.5.1/presets.json
• Extensions: https://github.com/dfirs1car1o/sicario-spec/releases/download/v0.5.1/extensions.json

Tags

security, governance, compliance, appsec, threat-modeling

Key Features

• Installs an evidence-first security and compliance governance baseline
• Adds deterministic verification through the sicario-guard extension
• Provides secure application, AI-system, agent-fleet, cloud-IaC, SaaS, supply-chain, and documentation governance presets
• Pins every installed component to the release-tested 0.5.1 version
• Supports the roadmap-to-right workflow from governed specification through reviewable evidence

Testing Checklist

• Validation succeeds with specify bundle validate --path <bundle-directory>
• Build succeeds with specify bundle build --path <bundle-directory> and produces the submitted artifact
• Bundle installs successfully from the built artifact
• The submitted distribution path was tested end to end, including bundle-ID installation from an install-allowed catalog when a catalog entry is proposed
• Installation was tested in a clean Spec Kit project
• Required component catalogs are documented and were included in testing, or no extra catalogs are required
• Documentation is complete and accurate

Submission Requirements

• Valid bundle.yml manifest included
• README.md explains the bundle's intended role, installed components, and installation steps
• LICENSE file included
• GitHub release created with a version tag
• Bundle ID matches the manifest and follows naming conventions
• Every extension, preset, workflow, and step reference is pinned where the manifest requires a version

Testing Details

Tested on:

• macOS with Spec Kit 0.11.8 on 2026-07-21

Test environment:

• Two disposable, clean Spec Kit projects initialized with the Codex integration
• Release-pinned preset, extension, and bundle catalogs registered as install-allowed

Validation performed:

1. Downloaded and extracted the published sicario-spec-0.5.1.zip release asset.
2. Ran specify bundle validate --path <extracted-bundle> with the required catalogs active; validation passed.
3. Ran specify bundle build --path <extracted-bundle>; it produced a versioned two-file bundle artifact containing the matching bundle.yml and README.
4. Installed the published ZIP directly in a clean project; 12 components were added.
5. Installed sicario-spec by bundle ID from the release-pinned, install-allowed bundle catalog in a second clean project; 12 components were added.
6. Confirmed specify bundle list reports sicario-spec v0.5.1 and specify bundle info sicario-spec resolves the expected extension and 11 presets.

Published artifact SHA-256:
c4444a50ed0371a6de1a74c587cc545b2204c6a9f5902db221e45e74122c3c23

Example Usage

# Add the required release-pinned component catalogs
specify preset catalog add https://github.com/dfirs1car1o/sicario-spec/releases/download/v0.5.1/presets.json --name sicario --priority 1 --install-allowed
specify extension catalog add https://github.com/dfirs1car1o/sicario-spec/releases/download/v0.5.1/extensions.json --name sicario --priority 1 --install-allowed

# Install the downloaded release artifact
curl -L -o sicario-spec-0.5.1.zip https://github.com/dfirs1car1o/sicario-spec/releases/download/v0.5.1/sicario-spec-0.5.1.zip
specify bundle install ./sicario-spec-0.5.1.zip

# Or install by ID from the release-pinned, install-allowed bundle catalog
specify bundle catalog add https://github.com/dfirs1car1o/sicario-spec/releases/download/v0.5.1/bundles.json --id sicario --priority 1 --policy install-allowed
specify bundle install sicario-spec

# Inspect the installed bundle
specify bundle list
specify bundle info sicario-spec

Proposed Catalog Entry

{
  "sicario-spec": {
    "name": "SicarioSpec Security & Governance Bundle",
    "id": "sicario-spec",
    "version": "0.5.1",
    "role": "security-engineer",
    "description": "Secure-by-default governance bundle for GitHub Spec Kit. Enforces data classification, threat modeling, and code-owned verification gates.",
    "author": "SicarioSpec Contributors",
    "license": "MIT",
    "download_url": "https://github.com/dfirs1car1o/sicario-spec/releases/download/v0.5.1/sicario-spec-0.5.1.zip",
    "repository": "https://github.com/dfirs1car1o/sicario-spec",
    "requires": {
      "speckit_version": ">=0.9.0"
    },
    "provides": {
      "extensions": 1,
      "presets": 11,
      "steps": 0,
      "workflows": 0
    },
    "tags": [
      "security",
      "governance",
      "compliance",
      "appsec",
      "threat-modeling"
    ],
    "verified": false
  }
}

Additional Context

This submission follows the community bundle intake and maintainer-owned automation delivered through #3161, #3162, and #3553.

SicarioSpec Core is already present in the Spec Kit community preset catalog at v0.5.1 through #3164 and #3165. This bundle composes that preset with ten additional SicarioSpec presets and the sicario-guard extension.

The upstream community bundle catalog is discovery-only. The release-pinned companion preset and extension catalogs above must be registered as install-allowed before bundle-ID installation; the repository README documents that trust boundary and setup.

[SiCar10mw]

cc @github/spec-kit-maintainers — the community bundle automation added in #3553 is gated on the bundle-submission label. This issue was created through the official Bundle Submission form, but it opened with only the enhancement label, so the initial bundle-validation and catalog-assignment runs were skipped. Please apply bundle-submission when this is ready for automated validation.