v0.7.4 — Documentation closeout

v0.7.4 — Dokumentationsabschluss / Documentation closeout

Deutsch

Dieses reguläre Patch-Release paketiert die abgenommenen Statuskorrekturen und verständlichen DE-/EN-Verbesserungsprofile. Historische Kandidatentexte bleiben als historische Evidence erhalten. Paketvorbereitung, tatsächliche Veröffentlichung, Installation und menschliche Abnahme sind getrennte Zustände.

Keine funktionale Änderung an Commands, Vorlagen, Routing, Prioritäten oder Ausführungsrechten.

English

This regular patch packages the accepted release-status corrections and clear bilingual improvement profiles. Historical candidate text remains historical evidence. Preparation, actual publication, installation and human acceptance are distinct states.

No functional change to commands, templates, routing, priorities or execution authority.

Quellen und Prüfung / Sources and verification

• Source PR: #12
• Exact checked head: 11db9ac
• Merge/tag commit: 16666d7
• Local documentation, stable 49-command cohort, rendered-reader smoke and relevant existing regressions passed. Native exact-head CI passed; triggered merge CI is recorded separately.
• Existing tags/archives remain unchanged. The cancelled dynamic-routing development is excluded. No model calls, consumer rollout, Home sync or community submission is implied by publication.
• Target audience: all four IHK IT occupations/all IT specialist disciplines and non-specialist developers. German first/equivalent English, CEFR B2 and applicable WCAG 2.2 AA; static checks are not full accessibility, legal, product or certification acceptance.

Verified archive / Geprüftes Archiv

• Archive: https://github.com/hindermath/spec-kit-preset-security-governance/archive/refs/tags/v0.7.4.zip
• SHA-256: 222697829118be22c6ddf6675852f1375dbb415061e5fe2fd31a5c82d65a5dcb
• Files: 43; every released file matches the checked commit payload.
• Verified at: 2026-10-24T13:36:49.4408370+00:00

v0.7.3 - Stable documentation closeout

Security v0.7.3

Deutsch

Reguläres Patch-Release nach fachlicher Sammelsichtung und Lieferfreigabe. Es enthält die abgenommenen deutschen und gleichwertigen englischen Nutzungsleitfäden, verbesserte Navigation, Command-/Starter-Hilfen und korrigierte aktuelle beziehungsweise historische Versions- und Kompatibilitätsangaben. Zielgruppe sind alle vier IHK-IT-Berufe einschließlich aller vier Fachinformatik-Fachrichtungen und Entwickelnde ohne Spezialwissen. CEFR B2 und anwendbare WCAG 2.2 AA bleiben Zielmaßstäbe, keine automatische Zertifizierung.

Keine abgebrochene Routing-Neuentwicklung, keine Modellprobe und keine neue Produkt-, Risiko-, Rechts- oder Zertifizierungsfreigabe. Keine Verbraucherinstallation, kein Rollout, kein Home Runtime Sync, keine operativen Profil-/Installed-Lock-Änderungen und keine Community-Einreichung. Vorbereitungsstatus in historischen Quellnachweisen beschreibt deren Entstehungsphase; diese Release-Notes binden den abgenommenen Veröffentlichungsstand extern an Commit und Archiv-Hash.

English

Regular patch release after collected human review and delivery approval. Packages the accepted German-first/equivalent-English user guides, navigation, command/starter help and corrected current versus historical version/compatibility statements. Audience: all four IHK IT occupations, all four IT-specialist tracks and non-specialist developers. B2 and applicable WCAG 2.2 AA are targets, not automated certification.

No cancelled dynamic-routing redevelopment, model calls, new product/risk/legal/certification approval, consumer rollout/installation, Home Runtime sync, operational profile changes or community submission. Historical preparation records retain their original scope; these release notes externally bind the accepted release to its commit and archive hash.

Package focus: Explain secure-development/regulatory evidence and safe failure help without legal or product approval claims.

Nachweise / Evidence

• Documentation Impact: UpdateRequired; owner Thorsten Hindermann.
• Approved documentation PR: #10
• Exact reviewed head: 9f1f0a2324204ff703409c24929dd2a0257acb3c
• Merge / tag commit: c66cabfbfdde532994bd3c0e63ebf843dadfa1c0
• Archive: https://github.com/hindermath/spec-kit-preset-security-governance/archive/refs/tags/v0.7.3.zip
• Archive SHA-256: e43fdbc3af2334182ded8908f160313dc085882faf96532f29bfffbb7cfd8f9d
• Verified all 39 tracked Git blobs against the actual downloaded tag ZIP; manifest and paired guides match.
• URL installation, exact installed version/priority, preset list, preset info and all 19 non-command template resolve calls: PASS in a disposable project only.
• Local documentation cohort: PASS, 262 assertions, 14 sources / 49 stable command declarations. No model calls.
• Full reader-path and regression details: https://github.com/hindermath/spec-kit-preset-security-governance/blob/v0.7.3/docs/documentation-closeout.md
• Offline rendered guides: 28 pages, structural DOM checks and bounded visual spot checks. Screenreader, Braille, comprehensive zoom/reflow and representative-user acceptance remain unperformed.
• Prior tags and ZIPs were not replaced.

Exact-head PR CI

• Reader paths (macos-15): SUCCESS
• contract (macos-latest): SUCCESS
• Reader paths (ubuntu-24.04): SUCCESS
• contract (ubuntu-latest): SUCCESS
• Reader paths (windows-2022): SUCCESS
• contract (windows-latest): SUCCESS

Native evidence applies only to the linked jobs/platforms. Current merge workflow status is independently checked before publication; repositories without push workflows do not gain a fabricated merge-CI pass.

v0.7.2 — documentation clarity patch

Deutsch

Dieses regulaere Patch-Release paketiert die abgenommene zweisprachige README: Einstieg, ausdrueckliche Aktionen, Vorlagen/Evidence und Komposition sind besser erklaert. Metadaten und Installationsbefehl binden v0.7.2. Bestehende Tags und ZIPs bleiben unveraendert.

Keine Verbraucherinstallation, kein Home Runtime Sync und keine Community-Einreichung. Keine neue Produkt-, Risiko-, Rechts- oder Zertifizierungsfreigabe.

English

Packages the accepted bilingual getting-started and composition documentation. Installation starts no run and grants no execution or delivery authority. No changes to product commands, templates, routing, priorities or professional rules.

Evidence / Nachweise

• Release PR: #9
• Exact validated head: 56b8af8
• Merge/tag target: 21df666
• Local macOS candidate checks and relevant regression suites: exit 0.
• Native PR CI: 3 successful checks; https://github.com/hindermath/spec-kit-preset-security-governance/actions/runs/39145177520/job/117727452824, https://github.com/hindermath/spec-kit-preset-security-governance/actions/runs/39145177520/job/117727452971, https://github.com/hindermath/spec-kit-preset-security-governance/actions/runs/39145177520/job/117727452989
• Triggered merge workflows: 0;
• No native Linux/Windows pass is claimed for repositories without those checks.
• Release record: https://github.com/hindermath/spec-kit-preset-security-governance/blob/v0.7.2/docs/release-0.7.2-validation.md
• Archive: https://github.com/hindermath/spec-kit-preset-security-governance/archive/refs/tags/v0.7.2.zip
• Published archive and installation verification are complete; hash and proof follow below.
• Archive SHA-256: f2079a97dbb8e9d2ffd0a701286465bba0c15a4fbc7f1c3290721709381dd600
• Published archive: all tracked Git blobs verified; temporary URL installation/list/info/resolve and exact version/priority/README checks passed (exit 0).

Security Governance v0.7.1

Security Governance v0.7.1

Korrektur / Fix

Der README-Installationsbefehl ist jetzt einzeilig und bindet das exakte
v0.7.1-Tag-ZIP. Versionsmetadaten und Katalogbeschreibung sind aktualisiert.
Der Regressionstest prueft LF/CRLF sowie falsche Version, Prioritaet und
Zeilenfortsetzungen. Normative Vorlagen, Wrapper, Routing und regulatorische
Inhalte bleiben unveraendert. Historische Tags und Archive bleiben erhalten.

The one-line README installation command now uses the exact v0.7.1 tag ZIP.
Release metadata and the concise catalog description are updated. All normative
templates, command wrappers, routing, priority 10, and regulatory contents are
unchanged. This includes the stable v0.7.0 GDPR, EU AI Act, CRA, NIS2, and DORA
evidence contracts, without a new legal reassessment or conformity claim.

Validation and package binding

• Source PR: #7
• Tested head: 775b3e43c2e5349a14a1fb10e8c77b0af5c0d86f.
• Release commit: 7204bccbdf3565d4dd22424c7fa7a15c6a6e0eb3.
• Identical tested/released tree: b2ad2b805af2e3437d17ee9fa70f5d2dc098dfbb.
• Native macOS/Linux/Windows contract CI passed: https://github.com/hindermath/spec-kit-preset-security-governance/actions/runs/37977476467
• Local structural/synthetic regressions, installation-line positive/negative cases, PSScriptAnalyzer, and whitespace checks passed.
• Exact published-tag installation, list, and GDPR/CRA template resolution passed in an isolated project.
• Release-asset and GitHub tag ZIP sources match after root normalization.

Artifact	SHA-256
security-governance-v0.7.1.zip release asset	c4e82b5dbb1a36aea6dcdb375e7e2de35c3b12eb67c75bb378585a290c894179
archive/refs/tags/v0.7.1.zip	c85a4b924e741a3981dc369adc6233b6f323013fb1d46735555038d322cda18a

Historical v0.7.0 tag-ZIP SHA-256 remains
a121ea1f9be7597a40f6f328581f680b8670ea6dc6d9ba8743095ece32af179c.
The attached Syft SPDX inventory describes source/pinned Actions, not the host
toolchain or a vulnerability audit. No runtime dependency is introduced;
AI-SBOM and provider C5/ASVS audits are N/A for this documentation/metadata
patch. Hashes, commit and exact-head CI provide bounded supply-chain evidence,
not product acceptance, legal compliance, or SLSA certification.

Documentation Impact: UpdateRequired, recorded in
docs/release-0.7.1-validation.md. Central integration, Home Runtime, and
pilot/fleet delivery remain separate and are not authorized by this release.

Security Governance v0.7.0

Stable regulatory evidence release. Adds scoped GDPR, AI Act, NIS2 and DORA records; aligns CRA scope/duty fields and reporting chains. Copilot findings addressed, including the NIS2 trust-service exception. Professionally reviewed by Thorsten Hindermann; delivered through PR #5 after all three native contract checks passed at e68433c. Existing tags unchanged. The packaged README deliberately retains the previously published install example; install this release with its v0.7.0 tag ZIP. Technical evidence does not grant legal, product or certification approval. Central integration and two pilot deliveries remain separate.

v0.6.2

Adds the provider-neutral model-routing catalog for composition with Model Routing Governance. Existing preset behavior remains unchanged.

Security Governance v0.6.1

Field-test hardening release.

• Separates provider/billing zero-step refusals from technical security-gate failures.
• Requires narrow, time-bounded N/A evidence.
• Clarifies that admin bypass is not technical evidence.
• Keeps runner and status provenance secret-free.

v0.6.0

Audit-ready Spec-Kit run evidence release for security-governance.

Changes:

• Adds Spec-Kit Run Evidence fields to generated Markdown evidence/checklist templates.
• Requires Applicable / N/A / Open decisions with rationale, evidence path, reviewer, residual risk, and follow-up.
• Strengthens plan/tasks wrappers so evidence documents must be filled for the current Spec-Kit run instead of remaining starter templates.

This release creates internal certification-readiness evidence and does not replace external audit, legal classification, or formal attestation where those are required.

security-governance v0.5.0

Adds a lightweight regulatory applicability screen for NIS2, CRA, EU AI Act, and DORA to the security-governance preset. Private training projects can record explicit N/A when no regulated service, market product, regulated customer, or regulated supply-chain role exists.

Security Governance v0.4.0

Expands the Security Governance preset with concrete secure-coding language profiles for memory-safe implementation languages.\n\n- Adds Rust, Go, Swift, Java/Kotlin, Python, and TypeScript/JavaScript secure-coding sections\n- Deepens C#/.NET review coverage for authorization, validation, SSRF, and file path handling\n- Updates task and checklist guidance to state that MSL status does not replace language-specific secure-coding review\n- Keeps AI-SBOM guidance from v0.3.0 unchanged