[Extension]: Update Spec Inventory (speckit-inventory) to v0.1.1

[Yash-Chindam]

This is an update to an existing catalog entry, not a new listing. speckit-inventory is already in extensions/catalog.community.json at v0.1.0, and that entry's download_url currently 404s. Filed at @mnriem's request in #4449 (comment), which closed my direct catalog PR in favour of this flow. EXTENSION-PUBLISHING-GUIDE.md:174 asks for updates to come through this template too, so this supersedes #4449.

Extension ID

speckit-inventory

Extension Name

Spec Inventory

Version

0.1.1

Description

Read-only inventory of live requirement and task IDs, with focused per-task context packs instead of whole-file dumps.

Author

Yash Chindam

Repository URL

https://github.com/Yash-Chindam/spec-kit-inventory-alignment

Download URL

https://github.com/Yash-Chindam/spec-kit-inventory-alignment/releases/download/v0.1.1/speckit-inventory.zip

License

MIT

Homepage (optional)

https://github.com/Yash-Chindam/spec-kit-inventory-alignment

Documentation URL (optional)

https://github.com/Yash-Chindam/spec-kit-inventory-alignment/blob/main/speckit-inventory/README.md

Changelog URL (optional)

https://github.com/Yash-Chindam/spec-kit-inventory-alignment/blob/main/speckit-inventory/CHANGELOG.md

Required Spec Kit Version

=0.9.0

Required Tools (optional)

None. Python 3.11+ only, no third-party dependencies.

Number of Commands

2

Number of Hooks (optional)

2

Tags

inventory, requirements, context, traceability, alignment

Key Features

Unchanged from the v0.1.0 listing in #4226 — this release restores availability, it does not change behaviour.

• Regenerates every live ID on each run. Extracts all FR-, NFR-, SC-, AC-, and T- IDs from the existing spec.md and tasks.md and prints JSON. Nothing is persisted, so there is no sidecar and no second source of truth that can drift out of sync with the Markdown.
• Read-only. The script contains no write calls. It never edits spec.md, tasks.md, or creates files.
• Focused context packs. speckit.speckit-inventory.context returns one task plus only the requirements that task covers, instead of loading whole artifacts into context.
• Dangling-reference detection. Each record reports its source artifact. spec.md is scanned first and wins as the definition site, so any ID whose source is tasks.md is a reference to a requirement that was never defined.
• Lenient task-ID matching. T014, T14, t14, and TASK-14 all resolve to the same record.
• Optional hooks. before_specify and before_analyze, both optional: true, so they prompt rather than fire automatically.

Testing Checklist

• Extension installs successfully via download URL
• All commands execute without errors
• Documentation is complete and accurate
• No security vulnerabilities identified
• Tested on at least one real project

Submission Requirements

• Valid extension.yml manifest included
• README.md with installation and usage instructions
• LICENSE file included
• GitHub release created with version tag
• All command files exist and are properly formatted
• Extension ID follows naming conventions (lowercase-with-hyphens)

Testing Details

What went wrong with v0.1.0. The repository the release assets lived under became unavailable, so repository, homepage, documentation, changelog, and download_url in the current catalog entry all 404. Installation fails at the download, before verify_archive_sha256 is ever reached. That is my fault, and I'm sorry it reached the catalog in that state.

Why the digest changes. The v0.1.0 archives are unrecoverable — nothing reproduces their pinned digests — so v0.1.1 supersedes them and the pinned SHA-256 changes with it. Release artifacts are now built with sorted members, a fixed timestamp, and two canonical permission modes, mirroring bundler/services/packager.py, and .gitattributes pins eol=lf so a Windows checkout cannot yield a different digest. A clean clone reproduces the digest byte for byte.

Verification of this release, run against the live URL rather than local files:

$ curl -sIL .../v0.1.0/speckit-inventory.zip -o /dev/null -w '%{http_code}'
404
$ curl -sIL .../v0.1.1/speckit-inventory.zip -o /dev/null -w '%{http_code}'
200
$ sha256sum speckit-inventory.zip
df735fe7c7ca7afe1ac279ffe5768061a29710a9d61956f90ee2cf2d66da04be

That digest matches the sha256 in the proposed catalog entry below, and the archive is 6,060 bytes containing extension.yml, both command files, scripts/inventory.py, README.md, and CHANGELOG.md.

Behavioural testing is carried over from #4226 and was not re-run for this release, because no code changed between v0.1.0 and v0.1.1 — the diff is the manifest version, the repository URL, and the changelog entry. The v0.1.0 scenarios (all 4 requirements plus 4 tasks extracted, context packs for linked and unlinked tasks, lenient ID matching, dangling-reference reporting, 9/9 unit tests) stand unchanged. Say the word if you'd like the full matrix re-run against the v0.1.1 archive before vetting.

Security note for the "no vulnerabilities" box: the script is dependency-free, uses no eval, exec, pickle, subprocess, or network access, and performs no writes. It only reads two Markdown files under a caller-supplied feature directory and prints JSON.

Example Usage

# Load every live requirement and task ID for a feature
speckit.speckit-inventory.list feature=specs/001-checkout

# Load only what one task needs
speckit.speckit-inventory.context feature=specs/001-checkout task=T002

Proposed Catalog Entry

"speckit-inventory": {
  "name": "Spec Inventory",
  "id": "speckit-inventory",
  "description": "Read-only inventory of live requirement and task IDs, with focused per-task context packs instead of whole-file dumps.",
  "author": "Yash Chindam",
  "version": "0.1.1",
  "download_url": "https://github.com/Yash-Chindam/spec-kit-inventory-alignment/releases/download/v0.1.1/speckit-inventory.zip",
  "sha256": "df735fe7c7ca7afe1ac279ffe5768061a29710a9d61956f90ee2cf2d66da04be",
  "repository": "https://github.com/Yash-Chindam/spec-kit-inventory-alignment",
  "homepage": "https://github.com/Yash-Chindam/spec-kit-inventory-alignment",
  "documentation": "https://github.com/Yash-Chindam/spec-kit-inventory-alignment/blob/main/speckit-inventory/README.md",
  "changelog": "https://github.com/Yash-Chindam/spec-kit-inventory-alignment/blob/main/speckit-inventory/CHANGELOG.md",
  "license": "MIT",
  "category": "visibility",
  "effect": "read-only",
  "requires": {
    "speckit_version": ">=0.9.0"
  },
  "provides": {
    "commands": 2,
    "hooks": 2
  },
  "tags": [
    "inventory",
    "requirements",
    "context",
    "traceability",
    "alignment"
  ],
  "verified": false,
  "downloads": 0,
  "stars": 0,
  "created_at": "2026-08-20T00:00:00Z",
  "updated_at": "2026-09-09T00:00:00Z"
}

Only version, download_url, sha256, and updated_at change against the entry currently on main. The existing docs row in docs/community/extensions.md needs no edit, since it carries no version or digest.

Additional Context

On the >=0.9.0 floor. I checked whether this needed raising alongside the preset's, since extension.yml declares provides.scripts, which was only accepted from Spec Kit v0.16.2 (#4012). It does not: that commit added handling for a previously unrecognised key rather than tightening validation, so an older CLI ignores the declaration, and the script file installs with the archive and is referenced by path regardless. Nothing breaks, so I've left the floor matching the packaged manifest rather than inventing drift between the two. Happy to raise it to >=0.16.2 if you'd rather the floor describe where the manifest is fully honoured.

Relationship to the preset. inventory-alignment v0.1.1 is submitted as #4487 and now declares this extension formally via requires.extensions (>=0.1.1), which is why its own floor moves to >=1.0.4. The two should be vetted together; the preset's wrappers are inert without this extension.

AI disclosure. Filed on behalf of @Yash-Chindam by Claude Code (model: Claude Opus 5), at my direction. Per CONTRIBUTING, the underlying extension used substantial AI assistance for code generation — first drafted with ChatGPT (Codex, GPT-5), then reviewed and corrected with Claude Code — as disclosed in #4226. For this submission specifically, Claude Code verified the live URLs and digests, unpacked and inspected both archives, checked the provides.scripts version floor against the repository history, and drafted this text; I reviewed it before filing.