[Extension]: Add Sanduq Workflow #5257

Extension ID

workflow

Extension Name

Sanduq Workflow

Version

2.3.2

Description

GitHub issue decisions and resumable Scope-to-PR orchestration with optional model-aware delegation, QA, User Manual, and workflow evidence CI.

Author

Samy K. Abushanab

Repository URL

https://github.com/samykabu/sanduq

Download URL

https://github.com/samykabu/sanduq/releases/download/workflow-v2.3.2/workflow.zip

License

MIT

Homepage (optional)

https://github.com/samykabu/sanduq/tree/main/extensions/workflow

Documentation URL (optional)

https://github.com/samykabu/sanduq/blob/main/docs/extensions/workflow.md

Changelog URL (optional)

https://github.com/samykabu/sanduq/blob/main/extensions/workflow/CHANGELOG.md

Required Spec Kit Version

=1.0.0,<2.0.0

Required Tools (optional)

• python >=3.11 (required)
• git (required)
• gh (required)

Number of Commands

15

Number of Hooks (optional)

4

Tags

workflow, github, orchestration, pull-request, issues

Key Features

• Takes one GitHub issue from scope to a verified pull request: Scope, Specify, Clarify, Plan, Tasks, Analyze, task sub-issues, Execute, Verify, Review, Ready and PR, one claimed stage at a time.
• A stage passes only on a recorded receipt with real evidence; edits to earlier inputs make later receipts stale, and revalidate-upstream re-records them.
• Resumes after an interruption from the last receipt, including worker results that already landed.
• Clarification questions go to the GitHub issue and the run waits for answers.
• Optional QA (Assure) and User Manual stages, chosen at init; lite, standard and full tiers by effort score.
• Installs the companion extensions it uses (Illustrate, Project, PR, Progress) through the public Spec Kit CLI.

Testing Checklist

• Extension installs successfully via download URL
• All commands execute without errors
• Documentation is complete and accurate
• No security vulnerabilities identified
• Tested on at least one real project

Submission Requirements

• Valid extension.yml manifest included
• README.md with installation and usage instructions
• LICENSE file included
• GitHub release created with version tag
• All command files exist and are properly formatted
• Extension ID follows naming conventions (lowercase-with-hyphens)

Testing Details

Managed live runs from issue to an open pull request on Claude Code and Codex: 2026-10-21, 2026-10-28 (both hosts, QA and User Manual selected) and 2026-11-04/05 for this 2.3.0 release, whose redacted run bundles are attached to the release. CI installs it on Ubuntu with Spec Kit core and SuperSpec. The Workflow unit suite (1,834 tests) passes on Windows. A whole-repository audit in October 2026 was remediated in 2.3.0; SECURITY.md lists the trust assumptions and what runs automatically. Limits: live runs so far ran on Windows, and Claude Desktop is not supported.

Example Usage

/speckit-workflow-init Enable QA and User Manual. Use our existing GitHub Project.
/speckit-workflow-scope 412 Assess refund approval and continue through implementation. Stop before PR creation.
/speckit-workflow-finalize Create the PR for issue 412 with the verified results.

Codex uses $ instead of /.

Proposed Catalog Entry

{
  "workflow": {
    "name": "Sanduq Workflow",
    "id": "workflow",
    "version": "2.3.2",
    "description": "GitHub issue decisions and resumable Scope-to-PR orchestration with optional model-aware delegation, QA, User Manual, and workflow evidence CI.",
    "author": "Samy K. Abushanab",
    "license": "MIT",
    "repository": "https://github.com/samykabu/sanduq",
    "homepage": "https://github.com/samykabu/sanduq/tree/main/extensions/workflow",
    "documentation": "https://github.com/samykabu/sanduq/blob/main/extensions/workflow/README.md",
    "changelog": "https://github.com/samykabu/sanduq/blob/main/extensions/workflow/CHANGELOG.md",
    "download_url": "https://github.com/samykabu/sanduq/releases/download/workflow-v2.3.2/workflow.zip",
    "requires": {
      "speckit_version": ">=1.0.0,<2.0.0",
      "tools": [
        {
          "name": "python",
          "version": ">=3.11",
          "required": true
        },
        {
          "name": "git",
          "required": true
        },
        {
          "name": "gh",
          "required": true
        }
      ]
    },
    "provides": {
      "commands": 15,
      "hooks": 4
    },
    "tags": [
      "workflow",
      "qa",
      "documentation",
      "github",
      "context",
      "resumable"
    ],
    "category": "process",
    "effect": "read-write",
    "verified": false,
    "sha256": "a41329646b12bbc6ac3a0b1421ad03daea34ee60357b660c4fbd12ae498489b4",
    "updated_at": "2026-11-05T20:38:48.775002+00:00"
  }
}

Additional Context

One of the Sanduq extensions (https://github.com/samykabu/sanduq), all MIT. The full set is also published in its own catalog: https://raw.githubusercontent.com/samykabu/sanduq/main/catalog.json. The ids scope and memory from the same repository are not submitted because the community catalog already has unrelated extensions with those ids.