[Extension]: Update brownkit to 1.2.0

[MaksimShevtsov]

Thanks for contributing an extension! This template helps you submit your extension to the community catalog.

Note from the submitter: this is an update to the existing brownkit entry (originally submitted 2026-05-10, currently version: 1.0.1). The catalog entry's download_url was left at v1.0.1.zip by the previous update cycle, and provides.commands is stale (10 → 11 since v1.1.0 added speckit.brownkit.scaffold). This submission brings the entry to 1.2.0.

Extension ID

brownkit

Extension Name

BrownKit — Brownfield Discovery for Spec-Kit

Version

1.2.0

Description

Evidence-driven capability discovery, security and QA risk assessment for existing codebases.

Author

Maksim Shautsou

Repository URL

https://github.com/MaksimShevtsov/BrownKit

Download URL

https://github.com/MaksimShevtsov/BrownKit/archive/refs/tags/v1.2.0.zip

License

MIT

Homepage (optional)

https://github.com/MaksimShevtsov/BrownKit/blob/main/README.md

Documentation URL (optional)

https://github.com/MaksimShevtsov/BrownKit/blob/main/docs/methodology.md

Changelog URL (optional)

https://github.com/MaksimShevtsov/BrownKit/blob/main/CHANGELOG.md

Required Spec Kit Version

=0.1.0

Required Tools (optional)

• python (>=3.9) — optional; stdlib-only helper scripts (coverage parsers, secret scan, deterministic gate verdict). The pipeline works without them, degraded.

Number of Commands

11

Number of Hooks (optional)

5

Tags

brownfield, discovery, security, qa, capabilities

Key Features

• EDCR pipeline (/init → /scan → /discover → /assess → /generate → /scaffold → /finish) turning an existing codebase into a locked L1/L2 capability model
• Capability-aware STRIDE threat modeling, vulnerability classification with false-positive markers, and control mapping across five families
• QA risk overlay: coverage gaps, testability findings, defect density, change velocity — null for absent signals, never fabricated zeros
• Unified per-capability risk score with 1–3 specific drivers
• Per-team handoff bundles sliced by ownership boundaries
• New in 1.2.0: deterministic gate-verdict script — PASS/WARN/BLOCK/NOT-ASSESSED computed from evidence with fail-closed semantics; the /gate hook quotes its canonical verdict line verbatim instead of classifying risk itself

Testing Checklist

• Extension installs successfully via download URL
• All commands execute without errors
• Documentation is complete and accurate
• No security vulnerabilities identified
• Tested on at least one real project

Submission Requirements

• Valid extension.yml manifest included
• README.md with installation and usage instructions
• LICENSE file included
• GitHub release created with version tag
• All command files exist and are properly formatted
• Extension ID follows naming conventions (lowercase-with-hyphens)

Testing Details

• In-repo test suite: 118 tests + 16 subtests (stdlib unittest, run via pytest) — green at the v1.2.0 tag; includes a full verdict matrix for the new gate-verdict script (boundaries 0.6/0.8, sentinel composites, fail-closed absence paths, CLI exit codes).
• scripts/python/check_prompt_refs.py validates every context.json → path reference in command prompts against the JSON schema — 0 unresolved at the tag.
• Release archive verified: v1.2.0.zip resolves (HTTP 200); extension.yml inside the tag carries version: 1.2.0 and all 11 command files.
• Helper-script shims executed live on Windows (PowerShell 5.1) and follow the repo's bash shim convention.
• Dogfooded on the maintainer's brownfield projects; hooks exercised against the spec-kit specify → clarify → implement workflow.

Example Usage

# Install extension
specify extension add brownkit --from https://github.com/MaksimShevtsov/BrownKit/archive/refs/tags/v1.2.0.zip

# Run the discovery pipeline
/speckit.brownkit.init
/speckit.brownkit.scan
/speckit.brownkit.discover
/speckit.brownkit.assess

# Deterministic gate before implementing a feature (new in 1.2.0)
/speckit.brownkit.gate --capability BC-007 --strict
# → BROWNKIT-GATE v1 BC-007 BLOCK composite=0.83 confirmed_open=1 ...

Proposed Catalog Entry

{
  "brownkit": {
    "name": "BrownKit — Brownfield Discovery for Spec-Kit",
    "id": "brownkit",
    "description": "Evidence-driven capability discovery, security and QA risk assessment for existing codebases.",
    "author": "Maksim Shautsou",
    "version": "1.2.0",
    "download_url": "https://github.com/MaksimShevtsov/BrownKit/archive/refs/tags/v1.2.0.zip",
    "repository": "https://github.com/MaksimShevtsov/BrownKit",
    "homepage": "https://github.com/MaksimShevtsov/BrownKit/blob/main/README.md",
    "documentation": "https://github.com/MaksimShevtsov/BrownKit/blob/main/docs/methodology.md",
    "changelog": "https://github.com/MaksimShevtsov/BrownKit/blob/main/CHANGELOG.md",
    "license": "MIT",
    "category": "process",
    "effect": "read-write",
    "requires": {
      "speckit_version": ">=0.1.0"
    },
    "provides": {
      "commands": 11,
      "hooks": 5
    },
    "tags": ["brownfield", "discovery", "security", "qa", "capabilities"],
    "verified": false,
    "downloads": 0,
    "stars": 0,
    "created_at": "2026-05-10T00:00:00Z",
    "updated_at": "2026-09-03T00:00:00Z"
  }
}

Additional Context

• What changed between the catalogged 1.0.1 and this submission: 1.1.0 added the /scaffold command (split from /generate), the context.json stack/paths/tools contract, and templates/clients.yml; 1.2.0 made the /gate hook verdict deterministic (new gate-verdict script, canonical BROWNKIT-GATE v1 verdict line, fail-closed semantics). Full history: CHANGELOG.md.
• Install-by-URL already works for 1.2.0 independent of the catalog; this update keeps the community catalog and the community website from advertising a stale version and a v1.0.1 download URL.