[Preset]: Update Security Governance to v0.7.4 #5110

Preset ID

security-governance

Preset Name

Security Governance

Version

0.7.4

Description

Adds secure coding, memory-safe-language guidance, security-gate and supply-chain evidence, and scoped GDPR, NIS2, CRA, EU AI Act, and DORA screening to Spec Kit.

Author

Thorsten Hindermann

Repository URL

https://github.com/hindermath/spec-kit-preset-security-governance

Download URL

https://github.com/hindermath/spec-kit-preset-security-governance/archive/refs/tags/v0.7.4.zip

Documentation URL

https://github.com/hindermath/spec-kit-preset-security-governance/blob/v0.7.4/README.md

License

MIT

Required Spec Kit Version

=0.8.0

Required Extensions (optional)

Templates Provided

• security-governance-model-routing — agent-neutral command-to-role routing contract
• constitution-template — appended secure-development principles
• spec-template — appended applicability and evidence requirements
• plan-template — appended security planning checks
• tasks-template — appended explicit security tasks
• security-agent-guidance-addendum-template — shared security guidance
• msl-applicability-template — memory-safe-language applicability
• standard-applicability-template — standards applicability matrix
• security-checklist-template — scoped security review checklist
• secure-coding-language-rules-template — language-specific secure coding
• dependency-audit-template — dependency and vulnerability review evidence
• asvs-verification-template — explicit ASVS verification scope
• supply-chain-evidence-template — SBOM, AI-SBOM, VEX and provenance evidence
• cra-applicability-template — CRA applicability and conformity-assessment record
• regulatory-applicability-template — regulatory screening
• gdpr-applicability-template — role-bound GDPR evidence
• ai-act-applicability-template — role-bound EU AI Act evidence
• nis2-applicability-template — role-bound NIS2 evidence
• dora-applicability-template — role-bound DORA evidence

Commands Provided

• speckit.specify — wraps Specify with security governance
• speckit.plan — wraps Plan with security governance
• speckit.tasks — wraps Tasks with security governance

Number of Scripts (optional)

0

Tags

security, governance, ssdf, sbom, regulatory

Key Features

• Update the existing community-catalog entry from 0.7.1 to 0.7.4, retaining preset ID security-governance and its established integration priority 10.
• Packages the completed documentation improvements: German-first and equivalent English user journeys, explained terminology, prerequisites, examples, troubleshooting, composition and override guidance, and clearer publication/installation/acceptance boundaries.
• Targets apprentices in all four German IHK IT occupations, including all four IT-specialist disciplines, and developers without specialist governance knowledge. CEFR B2 and applicable WCAG 2.2 AA guide the documentation; automated checks do not constitute full accessibility acceptance.
• Retains scoped GDPR, EU AI Act, CRA, NIS2 and DORA screening, language-specific secure coding, memory-safe-language guidance, security gates, ASVS and supply-chain evidence. Unknown applicability and human decisions remain explicit.
• Retains the stable routing contract. The abandoned dynamic-routing redevelopment is not included; this update introduces no new execution authority or compliance/certification guarantee.
• The version-pinned README contains the exact-release one-line installation command using the Download URL above.

Testing Checklist

• Preset installs successfully via specify preset add
• Template resolution works correctly after installation
• Documentation is complete and accurate
• Tested on at least one real project

Submission Requirements

• Valid preset.yml manifest included
• Linked README (Documentation URL) explains how to use this preset and includes a valid specify preset add ... command (preferably specify preset add --from <download-url> using the exact download URL)
• LICENSE file included
• GitHub release created with version tag
• Preset ID follows naming conventions (lowercase-with-hyphens)

Immutable package and validation evidence

Exact archive SHA-256:

222697829118be22c6ddf6675852f1375dbb415061e5fe2fd31a5c82d65a5dcb

• Regular release v0.7.4
• Source release PR #12: checked head 11db9ac18ca734e5095395f25edc58be1f85b8dc; merge/tag commit 16666d7c1f54aafa929c158d4bcdcb03bace1564.
• The published archive contains 43 files, compared against the checked source payload. Archive installation, list, info and template resolution passed; source documentation/release checks and native platform checks passed.
• The bounded real-project integration is complete in Home Baseline #345, TinyCalc #117, Show-CommandTui400 #55 and absdd-image-sandbox #99. Technical PR and post-merge CI passed; local default branches were synchronized. TinyCalc's separately authorized failed Claude review is not counted as a successful review or technical check.
• Central bounded-rollout closeout records versions, source/archive bindings, target evidence and remaining human boundaries.
• This issue submits only Security Governance v0.7.4. The other packages in the tested composition are not submissions through this issue. Existing tags and archives remain unchanged. No product, risk, regulatory or certification approval is claimed.