catalog: add tekimax-security community extension

[kaman1]

Summary

Adds a catalog.community.json entry for TEKIMAX Secure SDD (speckit-security), an Apache-2.0 Spec Kit extension that layers six security gates onto the spec-driven development lifecycle.

• Repository: https://github.com/TEKIMAX/speckit-security
• Docs: https://speckit.tekimax.com
• Release: v0.2.5
• License: Apache-2.0

What it adds for Spec Kit users

8 slash commands under speckit.tekimax-security.*:

• data-contract — declare sources, schemas, PII strategy, bias audit, drift thresholds
• threat-model — generate a STRIDE threat model for the active spec
• model-governance — pin model version, define eval baselines, rollback plan
• guardrails — generate versioned system prompt + guardrail YAML
• gate-check — run all six gates against the active spec, emit verdict
• audit — post-implementation scan (inline prompts, secrets, direct SDK imports)
• red-team — generate adversarial scenarios; --run hits staging with safety guards
• install-rules — install development rules into docs, constitution, and agent context

5 phase hooks wired in:

Hook	Command	Blocking?
after_specify	data-contract	Optional
after_plan	threat-model	Optional
before_implement	gate-check	Blocks on failure
after_implement	audit	Blocks on critical findings
before_analyze	red-team	Optional

Six gates (A–F) run via gate-check.sh: Data Contract, Threat Model, Model Governance, Guardrails, Red Team, Inline Content Scan.

Dependencies

bash, grep, sed, git, and python3 — all of which ship with macOS and Linux. No npm install, no pip install, no third-party Python packages. Agent-neutral (Claude Code, Copilot, Cursor, Gemini CLI, OpenCode, Windsurf, and every other agent Spec Kit supports).

Scope honesty

speckit-security is one layer of a broader security program, not a replacement for SAST, dependency scanning, runtime monitoring, or your existing compliance tooling. The docs call this out explicitly on the home page and in the FAQ.

Diff

Adds one entry (tekimax-security) in alphabetical order and bumps the catalog updated_at. Existing entries and their ordering are untouched. Diff: +36 / -1.

Verification

• Release v0.2.5 is live on GitHub: https://github.com/TEKIMAX/speckit-security/releases/tag/v0.2.5
• Download URL (https://github.com/TEKIMAX/speckit-security/archive/refs/tags/v0.2.5.zip) resolves
• Test suite: 15/15 passing (including 4 new tests for config read-back introduced in v0.2.5)
• Follows the same JSON shape as existing community entries

[Copilot]

Pull request overview

Adds the TEKIMAX Secure SDD community extension (tekimax-security) to the Spec Kit community extensions catalog so users can discover and install it via the standard catalog mechanism.

Changes:

• Bump extensions/catalog.community.json top-level updated_at.
• Add a new tekimax-security entry with metadata (repo/docs/download URL, version, tags, requires/provides).

Show a summary per file

File	Description
extensions/catalog.community.json	Adds the new community extension entry and updates catalog timestamp metadata.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 1

[mnriem]

Please address Copilot feedback and make sure to also add a row in the Community extension section in the main README (alphabetically ordered)

[kaman1]

Bumped this PR to v0.2.6 (commit 78472d0) to reflect the latest release:

• Docs chat (Ask AI) at speckit.tekimax.com/chat, grounded in the full docs corpus via Llama 3.3 70B on Cloudflare Workers AI
• Cloudflare native rate limiter on the chat endpoint (20 req/60s per IP, no external services)
• v0.2.5 config read-back is also rolled in: user entries in tekimax-security-config.yml now extend built-in secret patterns, inline-prompt patterns, and the direct-SDK allowlist

Release notes: https://github.com/TEKIMAX/speckit-security/releases/tag/v0.2.6

The catalog download_url now points at the v0.2.6 tag archive. Still a clean 4-line diff relative to the original entry.

[Copilot]

Pull request overview

Adds a new community extension entry to extensions/catalog.community.json for TEKIMAX Secure SDD and updates the catalog’s top-level updated_at timestamp.

Changes:

• Bumped extensions/catalog.community.json top-level updated_at.
• Added a new tekimax-security extension entry (metadata, download URL, tags, provides/requires).

Show a summary per file

File	Description
extensions/catalog.community.json	Updates catalog timestamp and registers the new tekimax-security community extension entry.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 1

[Copilot]

PR description states the release being added is v0.2.5, but the catalog entry sets version to 0.2.6 and the download_url points at the v0.2.6 tag. Please make these consistent (either update the PR description/verification links to v0.2.6, or change the catalog entry back to v0.2.5) so consumers download the intended release.

[mnriem]

Can you update the PR description and then we should be good to go