Add workflow engine with catalog system (#2158)

* Initial plan

* Add workflow engine with step registry, expression engine, catalog system, and CLI commands

Agent-Logs-Url: https://github.com/github/spec-kit/sessions/72a7bb5d-071f-4d67-a507-7e1abae2384d

Co-authored-by: mnriem <15701806+mnriem@users.noreply.github.com>

* Add comprehensive tests for workflow engine (94 tests)

Agent-Logs-Url: https://github.com/github/spec-kit/sessions/72a7bb5d-071f-4d67-a507-7e1abae2384d

Co-authored-by: mnriem <15701806+mnriem@users.noreply.github.com>

* Address review feedback: do-while condition preservation and URL scheme validation

Agent-Logs-Url: https://github.com/github/spec-kit/sessions/72a7bb5d-071f-4d67-a507-7e1abae2384d

Co-authored-by: mnriem <15701806+mnriem@users.noreply.github.com>

* Address review feedback, add CLI dispatch, interactive gates, and docs

Review comments (7/7):
- Add explanatory comment to empty except block
- Implement workflow catalog download with cleanup on failure
- Add input type coercion for number/boolean/enum
- Fix example workflow to remove non-existent output references
- Fix while_loop and if_then condition defaults (string 'false' → bool False)
- Fix resume step index tracking with step_offset parameter

CLI dispatch:
- Add build_exec_args() and dispatch_command() to IntegrationBase
- Override for Claude (skills: /speckit-specify), Gemini (-m flag),
  Codex (codex exec), Copilot (--agent speckit.specify)
- CommandStep invokes installed commands by name via integration CLI
- Add PromptStep for arbitrary inline prompts (10th step type)
- Stream CLI output live to terminal (no silent blocking)
- Remove timeout when streaming (user can Ctrl+C)
- Ctrl+C saves state as PAUSED for clean resume

Interactive gates:
- Gate steps prompt [1] approve [2] reject in TTY
- Fall back to PAUSED in non-interactive environments
- Resume re-executes the gate for interactive prompting

Documentation:
- workflows/README.md — user guide
- workflows/ARCHITECTURE.md — internals with Mermaid diagrams
- workflows/PUBLISHING.md — catalog submission guide

Tests: 94 → 122 workflow tests, 1362 total (all passing)

* Fix ruff lint errors: unused imports, f-string placeholders, undefined name

* Address second review: registry-backed validation, shell failures, loop/fan-out execution, URL validation

- VALID_STEP_TYPES now queries STEP_REGISTRY dynamically
- Shell step returns FAILED on non-zero exit code
- Persist workflow YAML in run directory for reliable resume
- Resume loads from run copy, falls back to installed workflow
- Engine iterates while/do-while loops up to max_iterations
- Engine expands fan-out per item with context.item
- HTTPS URL validation for catalog workflow installs (HTTP allowed for localhost)
- Fix catalog merge priority docstring (lower number wins)
- Fix dispatch_command docstring (no build_exec_args_for_command)
- Gate on_reject=retry pauses for re-prompt on resume
- Update docs to 10 step types, add prompt step to tables and README

* Potential fix for pull request finding 'Empty except'

Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>

* Address third review: fan-out IDs, catalog guards, shell coercion, docs

- Fan-out generates unique per-item step IDs and collects results
- Catalog merge skips non-dict workflow entries (malformed data guard)
- Shell step coerces run_cmd to str after expression evaluation
- urlopen timeout=30 for catalog workflow installs
- yaml.dump with sort_keys=False, allow_unicode=True for catalog configs
- Document streaming timeout as intentionally unbounded (user Ctrl+C)
- Document --allow-all-tools as required for non-interactive + future enhancement
- Update test docstring and PUBLISHING.md to 10 step types with prompt

* Validate final URL after redirects in catalog fetch

urlopen follows redirects, so validate the response URL against the
same HTTPS/localhost rules to prevent redirect-based downgrade attacks.

* Address fourth review: filter arg eval, tags normalization, install redirect check

- Filter arguments now evaluated via _evaluate_simple_expression() so
  default(42) returns int not string
- Tags normalized: non-list/non-string values handled gracefully
- Install URL redirect validation (same as catalog fetch)
- Remove unused 'skipped' variable in catalog config parsing
- Author 'github' → 'GitHub' in example workflow
- Document nested step resume limitation (re-runs parent step)

* Add explanatory comment to empty except ValueError block

* Address fifth review: expression parsing, fan-out output, URL install, gate options

- Move string literal parsing before operator detection in expressions
  so quoted strings with operators (e.g. 'a in b') are not mis-parsed
- Fan-out: remove max_concurrency from persisted output, fix docstring
  to reflect sequential execution
- workflow add: support URL sources with HTTPS/redirect validation,
  validate workflow ID is non-empty before writing files
- Deduplicate local install logic via _validate_and_install_local()
- Remove 'edit' gate option from speckit workflow (not implemented)

* Add comments to empty except ValueError blocks in URL install

* Address sixth review: operator precedence, fan_in cleanup, registry resilience, docs

- Fix or/and operator precedence (or parsed first = lower precedence)
- Restore context.fan_in after fan-in step completes
- Catch JSONDecodeError in registry load for corrupted files
- Replace print() with on_step_start callback (library-safe)
- Gate validation warns when on_reject set but no reject option
- Shell step: document shell=True security tradeoff
- README: sdd-pipeline → speckit, parallel → sequential for fan-out
- ARCHITECTURE.md: parallel → fan-out/fan-in in diagram

* Address seventh review: string literal before pipe, type annotations, validate on install

- Move string literal check above pipe filter parsing so 'a | b' works
- Fix type annotations: input_values list[str] | None, run_id str | None
- Run validate_workflow() before installing from local path/URL
- Remove duplicate string literal check from expression parser

* Address eighth review: fan-out namespaced IDs, early return, catalog validation

- Fan-out per-item step IDs use _fanout_{step_id}_{base}_{idx} namespace
  to avoid collisions with user-defined step IDs
- Early return after fan-out loop when state is paused/failed/aborted
- Catalog installs parse + validate downloaded YAML before registering,
  using definition metadata instead of catalog entry for registry

* Address ninth review: populate catalog, fix indentation, priority, README

- Add speckit workflow entry to catalog.json so it's discoverable
- Fix shell step output dict indentation
- Catalog add_catalog priority derived from max existing + 1
- README Quick Start clarified with install + local file examples

* Address tenth review: max_iterations validation, catalog config guard, version alignment

- Validate max_iterations is int >= 1 in while and do-while steps
- Guard add_catalog against corrupted config (non-dict/non-list)
- Align speckit_version requirement to >=0.6.1 (current package version)
- Fan-out template validation uses separate seen_ids set to avoid
  false duplication errors with user-defined step IDs

* Address eleventh review: command step fails without CLI, ID mismatch warning, state persistence

- Command step returns FAILED when CLI not installed (was silent COMPLETED)
- Catalog install warns on workflow ID vs catalog key mismatch
- Engine persists state.save() before returning on unknown step type
- Update tests to expect FAILED for command steps without CLI
- Integration tests use shell steps for CLI-independent execution

* Address twelfth review: type annotations, version examples, streaming docs, requires

- Fix workflow_search type annotations (str | None)
- PUBLISHING.md: speckit_version >=0.15.0 → >=0.6.1
- Document that exit_code is captured and referenceable by later steps
- Mark requires as declared-but-not-enforced (planned enhancement)
- Note full stdout/stderr capture as planned enhancement

* Enforce catalog key matches workflow ID (fail instead of warn)

* Bundle speckit workflow: auto-install during specify init

- Add workflows/speckit to pyproject.toml force-include for wheel builds
- Add _locate_bundled_workflow() helper (mirrors _locate_bundled_extension)
- Auto-install speckit workflow during specify init (after git extension)
- Update all integration file inventory tests to expect workflow files

* Address fourteenth review: prompt fails without CLI, resolved step data, fan-out normalization

- PromptStep returns FAILED when CLI not installed (was silent COMPLETED)
- Engine step_data prefers resolved values from step output
- Fan-out normalizes output.results=[] for empty item lists
- subprocess.run inherits stdout/stderr (no explicit sys.stdout)
- Registry tests use issubset for extensibility

* Address fifteenth review: fan_in docstring, gate defaults, validation guards, reserved prefix

- FanInStep docstring: aggregate-only, no blocking semantics
- FanInStep: guard output_config as dict, handle None
- Gate validate: use same default options as execute
- Validate inputs is dict and steps is list before iterating
- Reserve _fanout_ prefix in step ID validation
- PUBLISHING.md: remove unenforced checklist items, add _fanout_ note

* Address sixteenth review: docs regex, fan_in try/finally, hyphenated dot-path keys

- PUBLISHING.md: update ID regex docs to match implementation (single-char OK)
- FanInStep: wrap expression evaluation in try/finally for context.fan_in
- Expression dot-path: allow hyphens in keys before list index (e.g. run-tests[0])

* Make speckit workflow integration-agnostic, document Copilot CLI requirement

- Workflow integration selectable via input (default: claude)
- Each command step uses {{ inputs.integration }} instead of hardcoded copilot
- Copilot docstring documents CLI requirement for workflow dispatch
- Added install_url for Copilot CLI docs

* Address seventeenth review: project checks, catalog robustness

- Add .specify/ project check to workflow run/resume/status/search/info
- remove_catalog validates config shape (dict + list) before indexing
- _fetch_single_catalog validates response is a dict
- _get_merged_workflows raises when all catalogs fail to fetch
- add_catalog guards against non-dict catalog entries in config

* Address eighteenth review: condition coercion, gate abort result, while default, cache guard, resume log

- evaluate_condition treats plain 'false'/'true' strings as booleans
- Gate abort returns StepResult(FAILED) instead of raising exception
  so step output is persisted in state for inspection
- while_loop max_iterations optional (default 10), validation aligned
- Catalog cache fallback catches invalid JSON gracefully
- resume() appends workflow_finished log entry like execute()

* Address nineteenth review: allow-all-tools opt-in, empty catalogs, abort dead code, while docstring

- --allow-all-tools controlled by SPECKIT_ALLOW_ALL_TOOLS env var (default: 1)
  Set to 0 to disable automatic tool approval for Copilot CLI
- Empty catalogs list falls back to built-in defaults (not an error)
- Remove unreachable WorkflowAbortError catches from execute/resume
  (gate abort now returns StepResult(FAILED) instead of raising)
- while_loop docstring updated: max_iterations is optional (default 10)

* Address twentieth review: gate abort maps to ABORTED status, do-while max_iterations optional

- Engine detects output.aborted from gate step and sets RunStatus.ABORTED
  (was unreachable — gate abort returned FAILED but status was always FAILED)
- do-while max_iterations now optional (default 10), aligned with while_loop
- do-while docstring and validation updated accordingly

* Coerce default_options to dict, align bundled workflow ID regex with validator

* Gate validates string options, prompt uses resolved integration, loop normalizes max_iterations

* Use parentId:childId convention for nested step IDs

- Fan-out per-item IDs use parentId:templateId:index (e.g. parallel:impl:0)
- Reserve ':' in user step IDs (validation rejects)
- Replaces _fanout_ prefix with cleaner namespacing
- Expressions like {{ steps.parallel:impl:0.output.file }} work naturally

* Validate workflow version is semantic versioning (X.Y.Z)

* Schema version validation, strict semver, load_workflow docstring, preserve max_concurrency

- Validate schema_version is '1.0' (reject unknown future schemas)
- Strict semver regex: ^\d+\.\d+\.\d+$ (rejects 1.0.0beta etc.)
- load_workflow docstring: 'parsed' not 'validated'
- Keep max_concurrency in fan-out output (was dropped)
- do_while docstring: engine re-evaluates step_config condition
- ARCHITECTURE.md: document nested resume limitation

* Path traversal prevention, loop step ID namespacing

- RunState validates run_id is alphanumeric+hyphens (no path separators)
- workflow_add validates catalog source doesn't escape workflows_dir
- Loop iterations namespace nested step IDs as parentId:childId:iteration
  so multiple iterations don't overwrite each other in context/state

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: mnriem <15701806+mnriem@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>

pyproject.toml

@@ -41,6 +41,8 @@ packages = ["src/specify_cli"]
 "scripts/powershell" = "specify_cli/core_pack/scripts/powershell"
 # Bundled extensions (installable via `specify extension add <name>`)
 "extensions/git" = "specify_cli/core_pack/extensions/git"
+# Bundled workflows (auto-installed during `specify init`)
+"workflows/speckit" = "specify_cli/core_pack/workflows/speckit"
 # Bundled presets (installable via `specify preset add <name>` or `specify init --preset <name>`)
 "presets/lean" = "specify_cli/core_pack/presets/lean"
 

src/specify_cli/__init__.py

@@ -621,6 +621,31 @@ def _locate_bundled_extension(extension_id: str) -> Path | None:
     return None
 
 
+def _locate_bundled_workflow(workflow_id: str) -> Path | None:
+    """Return the path to a bundled workflow directory, or None.
+
+    Checks the wheel's core_pack first, then falls back to the
+    source-checkout ``workflows/<id>/`` directory.
+    """
+    import re as _re
+    if not _re.match(r'^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$', workflow_id):
+        return None
+
+    core = _locate_core_pack()
+    if core is not None:
+        candidate = core / "workflows" / workflow_id
+        if (candidate / "workflow.yml").is_file():
+            return candidate
+
+    # Source-checkout / editable install: look relative to repo root
+    repo_root = Path(__file__).parent.parent.parent
+    candidate = repo_root / "workflows" / workflow_id
+    if (candidate / "workflow.yml").is_file():
+        return candidate
+
+    return None
+
+
 def _locate_bundled_preset(preset_id: str) -> Path | None:
     """Return the path to a bundled preset, or None.
 
@@ -1159,6 +1184,7 @@ def init(
         ("chmod", "Ensure scripts executable"),
         ("constitution", "Constitution setup"),
         ("git", "Install git extension"),
+        ("workflow", "Install bundled workflow"),
         ("final", "Finalize"),
     ]:
         tracker.add(key, label)
@@ -1262,6 +1288,37 @@ def init(
             else:
                 tracker.skip("git", "--no-git flag")
 
+            # Install bundled speckit workflow
+            try:
+                bundled_wf = _locate_bundled_workflow("speckit")
+                if bundled_wf:
+                    from .workflows.catalog import WorkflowRegistry
+                    from .workflows.engine import WorkflowDefinition
+                    wf_registry = WorkflowRegistry(project_path)
+                    if wf_registry.is_installed("speckit"):
+                        tracker.complete("workflow", "already installed")
+                    else:
+                        import shutil as _shutil
+                        dest_wf = project_path / ".specify" / "workflows" / "speckit"
+                        dest_wf.mkdir(parents=True, exist_ok=True)
+                        _shutil.copy2(
+                            bundled_wf / "workflow.yml",
+                            dest_wf / "workflow.yml",
+                        )
+                        definition = WorkflowDefinition.from_yaml(dest_wf / "workflow.yml")
+                        wf_registry.add("speckit", {
+                            "name": definition.name,
+                            "version": definition.version,
+                            "description": definition.description,
+                            "source": "bundled",
+                        })
+                        tracker.complete("workflow", "speckit installed")
+                else:
+                    tracker.skip("workflow", "bundled workflow not found")
+            except Exception as wf_err:
+                sanitized_wf = str(wf_err).replace('\n', ' ').strip()
+                tracker.error("workflow", f"install failed: {sanitized_wf[:120]}")
+
             # Fix permissions after all installs (scripts + extensions)
             ensure_executable_scripts(project_path, tracker=tracker)
 
@@ -4136,6 +4193,668 @@ def extension_set_priority(
     console.print("\n[dim]Lower priority = higher precedence in template resolution[/dim]")
 
 
+# ===== Workflow Commands =====
+
+workflow_app = typer.Typer(
+    name="workflow",
+    help="Manage and run automation workflows",
+    add_completion=False,
+)
+app.add_typer(workflow_app, name="workflow")
+
+workflow_catalog_app = typer.Typer(
+    name="catalog",
+    help="Manage workflow catalogs",
+    add_completion=False,
+)
+workflow_app.add_typer(workflow_catalog_app, name="catalog")
+
+
+@workflow_app.command("run")
+def workflow_run(
+    source: str = typer.Argument(..., help="Workflow ID or YAML file path"),
+    input_values: list[str] | None = typer.Option(
+        None, "--input", "-i", help="Input values as key=value pairs"
+    ),
+):
+    """Run a workflow from an installed ID or local YAML path."""
+    from .workflows.engine import WorkflowEngine
+
+    project_root = Path.cwd()
+    if not (project_root / ".specify").exists():
+        console.print("[red]Error:[/red] Not a spec-kit project (no .specify/ directory)")
+        raise typer.Exit(1)
+    engine = WorkflowEngine(project_root)
+    engine.on_step_start = lambda sid, label: console.print(f"  \u25b8 [{sid}] {label} \u2026")
+
+    try:
+        definition = engine.load_workflow(source)
+    except FileNotFoundError:
+        console.print(f"[red]Error:[/red] Workflow not found: {source}")
+        raise typer.Exit(1)
+    except ValueError as exc:
+        console.print(f"[red]Error:[/red] Invalid workflow: {exc}")
+        raise typer.Exit(1)
+
+    # Validate
+    errors = engine.validate(definition)
+    if errors:
+        console.print("[red]Workflow validation failed:[/red]")
+        for err in errors:
+            console.print(f"  • {err}")
+        raise typer.Exit(1)
+
+    # Parse inputs
+    inputs: dict[str, Any] = {}
+    if input_values:
+        for kv in input_values:
+            if "=" not in kv:
+                console.print(f"[red]Error:[/red] Invalid input format: {kv!r} (expected key=value)")
+                raise typer.Exit(1)
+            key, _, value = kv.partition("=")
+            inputs[key.strip()] = value.strip()
+
+    console.print(f"\n[bold cyan]Running workflow:[/bold cyan] {definition.name} ({definition.id})")
+    console.print(f"[dim]Version: {definition.version}[/dim]\n")
+
+    try:
+        state = engine.execute(definition, inputs)
+    except ValueError as exc:
+        console.print(f"[red]Error:[/red] {exc}")
+        raise typer.Exit(1)
+    except Exception as exc:
+        console.print(f"[red]Workflow failed:[/red] {exc}")
+        raise typer.Exit(1)
+
+    status_colors = {
+        "completed": "green",
+        "paused": "yellow",
+        "failed": "red",
+        "aborted": "red",
+    }
+    color = status_colors.get(state.status.value, "white")
+    console.print(f"\n[{color}]Status: {state.status.value}[/{color}]")
+    console.print(f"[dim]Run ID: {state.run_id}[/dim]")
+
+    if state.status.value == "paused":
+        console.print(f"\nResume with: [cyan]specify workflow resume {state.run_id}[/cyan]")
+
+
+@workflow_app.command("resume")
+def workflow_resume(
+    run_id: str = typer.Argument(..., help="Run ID to resume"),
+):
+    """Resume a paused or failed workflow run."""
+    from .workflows.engine import WorkflowEngine
+
+    project_root = Path.cwd()
+    if not (project_root / ".specify").exists():
+        console.print("[red]Error:[/red] Not a spec-kit project (no .specify/ directory)")
+        raise typer.Exit(1)
+    engine = WorkflowEngine(project_root)
+    engine.on_step_start = lambda sid, label: console.print(f"  \u25b8 [{sid}] {label} \u2026")
+
+    try:
+        state = engine.resume(run_id)
+    except FileNotFoundError:
+        console.print(f"[red]Error:[/red] Run not found: {run_id}")
+        raise typer.Exit(1)
+    except ValueError as exc:
+        console.print(f"[red]Error:[/red] {exc}")
+        raise typer.Exit(1)
+    except Exception as exc:
+        console.print(f"[red]Resume failed:[/red] {exc}")
+        raise typer.Exit(1)
+
+    status_colors = {
+        "completed": "green",
+        "paused": "yellow",
+        "failed": "red",
+        "aborted": "red",
+    }
+    color = status_colors.get(state.status.value, "white")
+    console.print(f"\n[{color}]Status: {state.status.value}[/{color}]")
+
+
+@workflow_app.command("status")
+def workflow_status(
+    run_id: str | None = typer.Argument(None, help="Run ID to inspect (shows all if omitted)"),
+):
+    """Show workflow run status."""
+    from .workflows.engine import WorkflowEngine
+
+    project_root = Path.cwd()
+    if not (project_root / ".specify").exists():
+        console.print("[red]Error:[/red] Not a spec-kit project (no .specify/ directory)")
+        raise typer.Exit(1)
+    engine = WorkflowEngine(project_root)
+
+    if run_id:
+        try:
+            from .workflows.engine import RunState
+            state = RunState.load(run_id, project_root)
+        except FileNotFoundError:
+            console.print(f"[red]Error:[/red] Run not found: {run_id}")
+            raise typer.Exit(1)
+
+        status_colors = {
+            "completed": "green",
+            "paused": "yellow",
+            "failed": "red",
+            "aborted": "red",
+            "running": "blue",
+            "created": "dim",
+        }
+        color = status_colors.get(state.status.value, "white")
+
+        console.print(f"\n[bold cyan]Workflow Run: {state.run_id}[/bold cyan]")
+        console.print(f"  Workflow: {state.workflow_id}")
+        console.print(f"  Status:   [{color}]{state.status.value}[/{color}]")
+        console.print(f"  Created:  {state.created_at}")
+        console.print(f"  Updated:  {state.updated_at}")
+
+        if state.current_step_id:
+            console.print(f"  Current:  {state.current_step_id}")
+
+        if state.step_results:
+            console.print(f"\n  [bold]Steps ({len(state.step_results)}):[/bold]")
+            for step_id, step_data in state.step_results.items():
+                s = step_data.get("status", "unknown")
+                sc = {"completed": "green", "failed": "red", "paused": "yellow"}.get(s, "white")
+                console.print(f"    [{sc}]●[/{sc}] {step_id}: {s}")
+    else:
+        runs = engine.list_runs()
+        if not runs:
+            console.print("[yellow]No workflow runs found.[/yellow]")
+            return
+
+        console.print("\n[bold cyan]Workflow Runs:[/bold cyan]\n")
+        for run_data in runs:
+            s = run_data.get("status", "unknown")
+            sc = {"completed": "green", "failed": "red", "paused": "yellow", "running": "blue"}.get(s, "white")
+            console.print(
+                f"  [{sc}]●[/{sc}] {run_data['run_id']}  "
+                f"{run_data.get('workflow_id', '?')}  "
+                f"[{sc}]{s}[/{sc}]  "
+                f"[dim]{run_data.get('updated_at', '?')}[/dim]"
+            )
+
+
+@workflow_app.command("list")
+def workflow_list():
+    """List installed workflows."""
+    from .workflows.catalog import WorkflowRegistry
+
+    project_root = Path.cwd()
+    specify_dir = project_root / ".specify"
+    if not specify_dir.exists():
+        console.print("[red]Error:[/red] Not a spec-kit project (no .specify/ directory)")
+        raise typer.Exit(1)
+
+    registry = WorkflowRegistry(project_root)
+    installed = registry.list()
+
+    if not installed:
+        console.print("[yellow]No workflows installed.[/yellow]")
+        console.print("\nInstall a workflow with:")
+        console.print("  [cyan]specify workflow add <workflow-id>[/cyan]")
+        return
+
+    console.print("\n[bold cyan]Installed Workflows:[/bold cyan]\n")
+    for wf_id, wf_data in installed.items():
+        console.print(f"  [bold]{wf_data.get('name', wf_id)}[/bold] ({wf_id}) v{wf_data.get('version', '?')}")
+        desc = wf_data.get("description", "")
+        if desc:
+            console.print(f"    {desc}")
+        console.print()
+
+
+@workflow_app.command("add")
+def workflow_add(
+    source: str = typer.Argument(..., help="Workflow ID, URL, or local path"),
+):
+    """Install a workflow from catalog, URL, or local path."""
+    from .workflows.catalog import WorkflowCatalog, WorkflowRegistry, WorkflowCatalogError
+    from .workflows.engine import WorkflowDefinition
+
+    project_root = Path.cwd()
+    specify_dir = project_root / ".specify"
+    if not specify_dir.exists():
+        console.print("[red]Error:[/red] Not a spec-kit project (no .specify/ directory)")
+        raise typer.Exit(1)
+
+    registry = WorkflowRegistry(project_root)
+    workflows_dir = project_root / ".specify" / "workflows"
+
+    def _validate_and_install_local(yaml_path: Path, source_label: str) -> None:
+        """Validate and install a workflow from a local YAML file."""
+        try:
+            definition = WorkflowDefinition.from_yaml(yaml_path)
+        except (ValueError, yaml.YAMLError) as exc:
+            console.print(f"[red]Error:[/red] Invalid workflow YAML: {exc}")
+            raise typer.Exit(1)
+        if not definition.id or not definition.id.strip():
+            console.print("[red]Error:[/red] Workflow definition has an empty or missing 'id'")
+            raise typer.Exit(1)
+
+        from .workflows.engine import validate_workflow
+        errors = validate_workflow(definition)
+        if errors:
+            console.print("[red]Error:[/red] Workflow validation failed:")
+            for err in errors:
+                console.print(f"  \u2022 {err}")
+            raise typer.Exit(1)
+
+        dest_dir = workflows_dir / definition.id
+        dest_dir.mkdir(parents=True, exist_ok=True)
+        import shutil
+        shutil.copy2(yaml_path, dest_dir / "workflow.yml")
+        registry.add(definition.id, {
+            "name": definition.name,
+            "version": definition.version,
+            "description": definition.description,
+            "source": source_label,
+        })
+        console.print(f"[green]✓[/green] Workflow '{definition.name}' ({definition.id}) installed")
+
+    # Try as URL (http/https)
+    if source.startswith("http://") or source.startswith("https://"):
+        from ipaddress import ip_address
+        from urllib.parse import urlparse
+        from urllib.request import urlopen  # noqa: S310
+
+        parsed_src = urlparse(source)
+        src_host = parsed_src.hostname or ""
+        src_loopback = src_host == "localhost"
+        if not src_loopback:
+            try:
+                src_loopback = ip_address(src_host).is_loopback
+            except ValueError:
+                # Host is not an IP literal (e.g., a DNS name); keep default non-loopback.
+                pass
+        if parsed_src.scheme != "https" and not (parsed_src.scheme == "http" and src_loopback):
+            console.print("[red]Error:[/red] Only HTTPS URLs are allowed, except HTTP for localhost.")
+            raise typer.Exit(1)
+
+        import tempfile
+        try:
+            with urlopen(source, timeout=30) as resp:  # noqa: S310
+                final_url = resp.geturl()
+                final_parsed = urlparse(final_url)
+                final_host = final_parsed.hostname or ""
+                final_lb = final_host == "localhost"
+                if not final_lb:
+                    try:
+                        final_lb = ip_address(final_host).is_loopback
+                    except ValueError:
+                        # Redirect host is not an IP literal; keep loopback as determined above.
+                        pass
+                if final_parsed.scheme != "https" and not (final_parsed.scheme == "http" and final_lb):
+                    console.print(f"[red]Error:[/red] URL redirected to non-HTTPS: {final_url}")
+                    raise typer.Exit(1)
+                with tempfile.NamedTemporaryFile(suffix=".yml", delete=False) as tmp:
+                    tmp.write(resp.read())
+                    tmp_path = Path(tmp.name)
+        except typer.Exit:
+            raise
+        except Exception as exc:
+            console.print(f"[red]Error:[/red] Failed to download workflow: {exc}")
+            raise typer.Exit(1)
+        try:
+            _validate_and_install_local(tmp_path, source)
+        finally:
+            tmp_path.unlink(missing_ok=True)
+        return
+
+    # Try as a local file/directory
+    source_path = Path(source)
+    if source_path.exists():
+        if source_path.is_file() and source_path.suffix in (".yml", ".yaml"):
+            _validate_and_install_local(source_path, str(source_path))
+            return
+        elif source_path.is_dir():
+            wf_file = source_path / "workflow.yml"
+            if not wf_file.exists():
+                console.print(f"[red]Error:[/red] No workflow.yml found in {source}")
+                raise typer.Exit(1)
+            _validate_and_install_local(wf_file, str(source_path))
+            return
+
+    # Try from catalog
+    catalog = WorkflowCatalog(project_root)
+    try:
+        info = catalog.get_workflow_info(source)
+    except WorkflowCatalogError as exc:
+        console.print(f"[red]Error:[/red] {exc}")
+        raise typer.Exit(1)
+
+    if not info:
+        console.print(f"[red]Error:[/red] Workflow '{source}' not found in catalog")
+        raise typer.Exit(1)
+
+    if not info.get("_install_allowed", True):
+        console.print(f"[yellow]Warning:[/yellow] Workflow '{source}' is from a discovery-only catalog")
+        console.print("Direct installation is not enabled for this catalog source.")
+        raise typer.Exit(1)
+
+    workflow_url = info.get("url")
+    if not workflow_url:
+        console.print(f"[red]Error:[/red] Workflow '{source}' does not have an install URL in the catalog")
+        raise typer.Exit(1)
+
+    # Validate URL scheme (HTTPS required, HTTP allowed for localhost only)
+    from ipaddress import ip_address
+    from urllib.parse import urlparse
+
+    parsed_url = urlparse(workflow_url)
+    url_host = parsed_url.hostname or ""
+    is_loopback = False
+    if url_host == "localhost":
+        is_loopback = True
+    else:
+        try:
+            is_loopback = ip_address(url_host).is_loopback
+        except ValueError:
+            # Host is not an IP literal (e.g., a regular hostname); treat as non-loopback.
+            pass
+    if parsed_url.scheme != "https" and not (parsed_url.scheme == "http" and is_loopback):
+        console.print(
+            f"[red]Error:[/red] Workflow '{source}' has an invalid install URL. "
+            "Only HTTPS URLs are allowed, except HTTP for localhost/loopback."
+        )
+        raise typer.Exit(1)
+
+    workflow_dir = workflows_dir / source
+    # Validate that source is a safe directory name (no path traversal)
+    try:
+        workflow_dir.resolve().relative_to(workflows_dir.resolve())
+    except ValueError:
+        console.print(f"[red]Error:[/red] Invalid workflow ID: {source!r}")
+        raise typer.Exit(1)
+    workflow_file = workflow_dir / "workflow.yml"
+
+    try:
+        from urllib.request import urlopen  # noqa: S310 — URL comes from catalog
+
+        workflow_dir.mkdir(parents=True, exist_ok=True)
+        with urlopen(workflow_url, timeout=30) as response:  # noqa: S310
+            # Validate final URL after redirects
+            final_url = response.geturl()
+            final_parsed = urlparse(final_url)
+            final_host = final_parsed.hostname or ""
+            final_loopback = final_host == "localhost"
+            if not final_loopback:
+                try:
+                    final_loopback = ip_address(final_host).is_loopback
+                except ValueError:
+                    # Host is not an IP literal (e.g., a regular hostname); treat as non-loopback.
+                    pass
+            if final_parsed.scheme != "https" and not (final_parsed.scheme == "http" and final_loopback):
+                if workflow_dir.exists():
+                    import shutil
+                    shutil.rmtree(workflow_dir, ignore_errors=True)
+                console.print(
+                    f"[red]Error:[/red] Workflow '{source}' redirected to non-HTTPS URL: {final_url}"
+                )
+                raise typer.Exit(1)
+            workflow_file.write_bytes(response.read())
+    except Exception as exc:
+        if workflow_dir.exists():
+            import shutil
+            shutil.rmtree(workflow_dir, ignore_errors=True)
+        console.print(f"[red]Error:[/red] Failed to install workflow '{source}' from catalog: {exc}")
+        raise typer.Exit(1)
+
+    # Validate the downloaded workflow before registering
+    try:
+        definition = WorkflowDefinition.from_yaml(workflow_file)
+    except (ValueError, yaml.YAMLError) as exc:
+        import shutil
+        shutil.rmtree(workflow_dir, ignore_errors=True)
+        console.print(f"[red]Error:[/red] Downloaded workflow is invalid: {exc}")
+        raise typer.Exit(1)
+
+    from .workflows.engine import validate_workflow
+    errors = validate_workflow(definition)
+    if errors:
+        import shutil
+        shutil.rmtree(workflow_dir, ignore_errors=True)
+        console.print("[red]Error:[/red] Downloaded workflow validation failed:")
+        for err in errors:
+            console.print(f"  \u2022 {err}")
+        raise typer.Exit(1)
+
+    # Enforce that the workflow's internal ID matches the catalog key
+    if definition.id and definition.id != source:
+        import shutil
+        shutil.rmtree(workflow_dir, ignore_errors=True)
+        console.print(
+            f"[red]Error:[/red] Workflow ID in YAML ({definition.id!r}) "
+            f"does not match catalog key ({source!r}). "
+            f"The catalog entry may be misconfigured."
+        )
+        raise typer.Exit(1)
+
+    registry.add(source, {
+        "name": definition.name or info.get("name", source),
+        "version": definition.version or info.get("version", "0.0.0"),
+        "description": definition.description or info.get("description", ""),
+        "source": "catalog",
+        "catalog_name": info.get("_catalog_name", ""),
+        "url": workflow_url,
+    })
+    console.print(f"[green]✓[/green] Workflow '{info.get('name', source)}' installed from catalog")
+
+
+@workflow_app.command("remove")
+def workflow_remove(
+    workflow_id: str = typer.Argument(..., help="Workflow ID to uninstall"),
+):
+    """Uninstall a workflow."""
+    from .workflows.catalog import WorkflowRegistry
+
+    project_root = Path.cwd()
+    specify_dir = project_root / ".specify"
+    if not specify_dir.exists():
+        console.print("[red]Error:[/red] Not a spec-kit project (no .specify/ directory)")
+        raise typer.Exit(1)
+
+    registry = WorkflowRegistry(project_root)
+
+    if not registry.is_installed(workflow_id):
+        console.print(f"[red]Error:[/red] Workflow '{workflow_id}' is not installed")
+        raise typer.Exit(1)
+
+    # Remove workflow files
+    workflow_dir = project_root / ".specify" / "workflows" / workflow_id
+    if workflow_dir.exists():
+        import shutil
+        shutil.rmtree(workflow_dir)
+
+    registry.remove(workflow_id)
+    console.print(f"[green]✓[/green] Workflow '{workflow_id}' removed")
+
+
+@workflow_app.command("search")
+def workflow_search(
+    query: str | None = typer.Argument(None, help="Search query"),
+    tag: str | None = typer.Option(None, "--tag", help="Filter by tag"),
+):
+    """Search workflow catalogs."""
+    from .workflows.catalog import WorkflowCatalog, WorkflowCatalogError
+
+    project_root = Path.cwd()
+    if not (project_root / ".specify").exists():
+        console.print("[red]Error:[/red] Not a spec-kit project (no .specify/ directory)")
+        raise typer.Exit(1)
+    catalog = WorkflowCatalog(project_root)
+
+    try:
+        results = catalog.search(query=query, tag=tag)
+    except WorkflowCatalogError as exc:
+        console.print(f"[red]Error:[/red] {exc}")
+        raise typer.Exit(1)
+
+    if not results:
+        console.print("[yellow]No workflows found.[/yellow]")
+        return
+
+    console.print(f"\n[bold cyan]Workflows ({len(results)}):[/bold cyan]\n")
+    for wf in results:
+        console.print(f"  [bold]{wf.get('name', wf.get('id', '?'))}[/bold] ({wf.get('id', '?')}) v{wf.get('version', '?')}")
+        desc = wf.get("description", "")
+        if desc:
+            console.print(f"    {desc}")
+        tags = wf.get("tags", [])
+        if tags:
+            console.print(f"    [dim]Tags: {', '.join(tags)}[/dim]")
+        console.print()
+
+
+@workflow_app.command("info")
+def workflow_info(
+    workflow_id: str = typer.Argument(..., help="Workflow ID"),
+):
+    """Show workflow details and step graph."""
+    from .workflows.catalog import WorkflowCatalog, WorkflowRegistry, WorkflowCatalogError
+    from .workflows.engine import WorkflowEngine
+
+    project_root = Path.cwd()
+    if not (project_root / ".specify").exists():
+        console.print("[red]Error:[/red] Not a spec-kit project (no .specify/ directory)")
+        raise typer.Exit(1)
+
+    # Check installed first
+    registry = WorkflowRegistry(project_root)
+    installed = registry.get(workflow_id)
+
+    engine = WorkflowEngine(project_root)
+
+    definition = None
+    try:
+        definition = engine.load_workflow(workflow_id)
+    except FileNotFoundError:
+        # Local workflow definition not found on disk; fall back to
+        # catalog/registry lookup below.
+        pass
+
+    if definition:
+        console.print(f"\n[bold cyan]{definition.name}[/bold cyan] ({definition.id})")
+        console.print(f"  Version:     {definition.version}")
+        if definition.author:
+            console.print(f"  Author:      {definition.author}")
+        if definition.description:
+            console.print(f"  Description: {definition.description}")
+        if definition.default_integration:
+            console.print(f"  Integration: {definition.default_integration}")
+        if installed:
+            console.print("  [green]Installed[/green]")
+
+        if definition.inputs:
+            console.print("\n  [bold]Inputs:[/bold]")
+            for name, inp in definition.inputs.items():
+                if isinstance(inp, dict):
+                    req = "required" if inp.get("required") else "optional"
+                    console.print(f"    {name} ({inp.get('type', 'string')}) — {req}")
+
+        if definition.steps:
+            console.print(f"\n  [bold]Steps ({len(definition.steps)}):[/bold]")
+            for step in definition.steps:
+                stype = step.get("type", "command")
+                console.print(f"    → {step.get('id', '?')} [{stype}]")
+        return
+
+    # Try catalog
+    catalog = WorkflowCatalog(project_root)
+    try:
+        info = catalog.get_workflow_info(workflow_id)
+    except WorkflowCatalogError:
+        info = None
+
+    if info:
+        console.print(f"\n[bold cyan]{info.get('name', workflow_id)}[/bold cyan] ({workflow_id})")
+        console.print(f"  Version:     {info.get('version', '?')}")
+        if info.get("description"):
+            console.print(f"  Description: {info['description']}")
+        if info.get("tags"):
+            console.print(f"  Tags:        {', '.join(info['tags'])}")
+        console.print("  [yellow]Not installed[/yellow]")
+    else:
+        console.print(f"[red]Error:[/red] Workflow '{workflow_id}' not found")
+        raise typer.Exit(1)
+
+
+@workflow_catalog_app.command("list")
+def workflow_catalog_list():
+    """List configured workflow catalog sources."""
+    from .workflows.catalog import WorkflowCatalog, WorkflowCatalogError
+
+    project_root = Path.cwd()
+    catalog = WorkflowCatalog(project_root)
+
+    try:
+        configs = catalog.get_catalog_configs()
+    except WorkflowCatalogError as exc:
+        console.print(f"[red]Error:[/red] {exc}")
+        raise typer.Exit(1)
+
+    console.print("\n[bold cyan]Workflow Catalog Sources:[/bold cyan]\n")
+    for i, cfg in enumerate(configs):
+        install_status = "[green]install allowed[/green]" if cfg["install_allowed"] else "[yellow]discovery only[/yellow]"
+        console.print(f"  [{i}] [bold]{cfg['name']}[/bold] — {install_status}")
+        console.print(f"      {cfg['url']}")
+        if cfg.get("description"):
+            console.print(f"      [dim]{cfg['description']}[/dim]")
+        console.print()
+
+
+@workflow_catalog_app.command("add")
+def workflow_catalog_add(
+    url: str = typer.Argument(..., help="Catalog URL to add"),
+    name: str = typer.Option(None, "--name", help="Catalog name"),
+):
+    """Add a workflow catalog source."""
+    from .workflows.catalog import WorkflowCatalog, WorkflowValidationError
+
+    project_root = Path.cwd()
+    specify_dir = project_root / ".specify"
+    if not specify_dir.exists():
+        console.print("[red]Error:[/red] Not a spec-kit project (no .specify/ directory)")
+        raise typer.Exit(1)
+
+    catalog = WorkflowCatalog(project_root)
+    try:
+        catalog.add_catalog(url, name)
+    except WorkflowValidationError as exc:
+        console.print(f"[red]Error:[/red] {exc}")
+        raise typer.Exit(1)
+
+    console.print(f"[green]✓[/green] Catalog source added: {url}")
+
+
+@workflow_catalog_app.command("remove")
+def workflow_catalog_remove(
+    index: int = typer.Argument(..., help="Catalog index to remove (from 'catalog list')"),
+):
+    """Remove a workflow catalog source by index."""
+    from .workflows.catalog import WorkflowCatalog, WorkflowValidationError
+
+    project_root = Path.cwd()
+    specify_dir = project_root / ".specify"
+    if not specify_dir.exists():
+        console.print("[red]Error:[/red] Not a spec-kit project (no .specify/ directory)")
+        raise typer.Exit(1)
+
+    catalog = WorkflowCatalog(project_root)
+    try:
+        removed_name = catalog.remove_catalog(index)
+    except WorkflowValidationError as exc:
+        console.print(f"[red]Error:[/red] {exc}")
+        raise typer.Exit(1)
+
+    console.print(f"[green]✓[/green] Catalog source '{removed_name}' removed")
+
+
 def main():
     app()
 

src/specify_cli/integrations/base.py

@@ -91,6 +91,123 @@ class IntegrationBase(ABC):
         """Return options this integration accepts. Default: none."""
         return []
 
+    def build_exec_args(
+        self,
+        prompt: str,
+        *,
+        model: str | None = None,
+        output_json: bool = True,
+    ) -> list[str] | None:
+        """Build CLI arguments for non-interactive execution.
+
+        Returns a list of command-line tokens that will execute *prompt*
+        non-interactively using this integration's CLI tool, or ``None``
+        if the integration does not support CLI dispatch.
+
+        Subclasses for CLI-based integrations should override this.
+        """
+        return None
+
+    def build_command_invocation(self, command_name: str, args: str = "") -> str:
+        """Build the native slash-command invocation for a Spec Kit command.
+
+        The CLI tools discover and execute commands from installed files
+        on disk.  This method builds the invocation string the CLI
+        expects — e.g. ``"/speckit.specify my-feature"`` for markdown
+        agents or ``"/speckit-specify my-feature"`` for skills agents.
+
+        *command_name* may be a full dotted name like
+        ``"speckit.specify"`` or a bare stem like ``"specify"``.
+        """
+        stem = command_name
+        if "." in stem:
+            stem = stem.rsplit(".", 1)[-1]
+
+        invocation = f"/speckit.{stem}"
+        if args:
+            invocation = f"{invocation} {args}"
+        return invocation
+
+    def dispatch_command(
+        self,
+        command_name: str,
+        args: str = "",
+        *,
+        project_root: Path | None = None,
+        model: str | None = None,
+        timeout: int = 600,
+        stream: bool = True,
+    ) -> dict[str, Any]:
+        """Dispatch a Spec Kit command through this integration's CLI.
+
+        By default this builds a slash-command invocation with
+        ``build_command_invocation()`` and passes that prompt to
+        ``build_exec_args()`` to construct the CLI command line.
+        Integrations with custom dispatch behavior can override
+        ``build_command_invocation()``, ``build_exec_args()``, or
+        ``dispatch_command()`` directly.
+
+        When *stream* is ``True`` (the default), stdout and stderr are
+        piped directly to the terminal so the user sees live output.
+        When ``False``, output is captured and returned in the dict.
+
+        Returns a dict with ``exit_code``, ``stdout``, and ``stderr``.
+        Raises ``NotImplementedError`` if the integration does not
+        support CLI dispatch.
+        """
+        import subprocess
+
+        prompt = self.build_command_invocation(command_name, args)
+        # When streaming to the terminal, request text output so the
+        # user sees readable output instead of raw JSONL events.
+        exec_args = self.build_exec_args(
+            prompt, model=model, output_json=not stream
+        )
+
+        if exec_args is None:
+            msg = (
+                f"Integration {self.key!r} does not support CLI dispatch. "
+                f"Override build_exec_args() to enable it."
+            )
+            raise NotImplementedError(msg)
+
+        cwd = str(project_root) if project_root else None
+
+        if stream:
+            # No timeout when streaming — the user sees live output and
+            # can Ctrl+C at any time.  The timeout parameter is only
+            # applied in the captured (non-streaming) branch below.
+            try:
+                result = subprocess.run(
+                    exec_args,
+                    text=True,
+                    cwd=cwd,
+                )
+            except KeyboardInterrupt:
+                return {
+                    "exit_code": 130,
+                    "stdout": "",
+                    "stderr": "Interrupted by user",
+                }
+            return {
+                "exit_code": result.returncode,
+                "stdout": "",
+                "stderr": "",
+            }
+
+        result = subprocess.run(
+            exec_args,
+            capture_output=True,
+            text=True,
+            cwd=cwd,
+            timeout=timeout,
+        )
+        return {
+            "exit_code": result.returncode,
+            "stdout": result.stdout,
+            "stderr": result.stderr,
+        }
+
     # -- Primitives — building blocks for setup() -------------------------
 
     def shared_commands_dir(self) -> Path | None:
@@ -466,6 +583,22 @@ class MarkdownIntegration(IntegrationBase):
     integration-specific scripts (``update-context.sh`` / ``.ps1``).
     """
 
+    def build_exec_args(
+        self,
+        prompt: str,
+        *,
+        model: str | None = None,
+        output_json: bool = True,
+    ) -> list[str] | None:
+        if not self.config or not self.config.get("requires_cli"):
+            return None
+        args = [self.key, "-p", prompt]
+        if model:
+            args.extend(["--model", model])
+        if output_json:
+            args.extend(["--output-format", "json"])
+        return args
+
     def setup(
         self,
         project_root: Path,
@@ -534,6 +667,22 @@ class TomlIntegration(IntegrationBase):
     TOML format (``description`` key + ``prompt`` multiline string).
     """
 
+    def build_exec_args(
+        self,
+        prompt: str,
+        *,
+        model: str | None = None,
+        output_json: bool = True,
+    ) -> list[str] | None:
+        if not self.config or not self.config.get("requires_cli"):
+            return None
+        args = [self.key, "-p", prompt]
+        if model:
+            args.extend(["-m", model])
+        if output_json:
+            args.extend(["--output-format", "json"])
+        return args
+
     def command_filename(self, template_name: str) -> str:
         """TOML commands use ``.toml`` extension."""
         return f"speckit.{template_name}.toml"
@@ -908,6 +1057,22 @@ class SkillsIntegration(IntegrationBase):
     ``speckit-<name>/SKILL.md`` file with skills-oriented frontmatter.
     """
 
+    def build_exec_args(
+        self,
+        prompt: str,
+        *,
+        model: str | None = None,
+        output_json: bool = True,
+    ) -> list[str] | None:
+        if not self.config or not self.config.get("requires_cli"):
+            return None
+        args = [self.key, "-p", prompt]
+        if model:
+            args.extend(["--model", model])
+        if output_json:
+            args.extend(["--output-format", "json"])
+        return args
+
     def skills_dest(self, project_root: Path) -> Path:
         """Return the absolute path to the skills output directory.
 
@@ -926,6 +1091,17 @@ class SkillsIntegration(IntegrationBase):
         subdir = self.config.get("commands_subdir", "skills")
         return project_root / folder / subdir
 
+    def build_command_invocation(self, command_name: str, args: str = "") -> str:
+        """Skills use ``/speckit-<stem>`` (hyphenated directory name)."""
+        stem = command_name
+        if "." in stem:
+            stem = stem.rsplit(".", 1)[-1]
+
+        invocation = f"/speckit-{stem}"
+        if args:
+            invocation = f"{invocation} {args}"
+        return invocation
+
     def setup(
         self,
         project_root: Path,

src/specify_cli/integrations/codex/__init__.py

@@ -28,6 +28,21 @@ class CodexIntegration(SkillsIntegration):
     }
     context_file = "AGENTS.md"
 
+    def build_exec_args(
+        self,
+        prompt: str,
+        *,
+        model: str | None = None,
+        output_json: bool = True,
+    ) -> list[str] | None:
+        # Codex uses ``codex exec "prompt"`` for non-interactive mode.
+        args: list[str] = ["codex", "exec", prompt]
+        if model:
+            args.extend(["--model", model])
+        if output_json:
+            args.append("--json")
+        return args
+
     @classmethod
     def options(cls) -> list[IntegrationOption]:
         return [

src/specify_cli/integrations/copilot/__init__.py

@@ -19,14 +19,19 @@ from ..manifest import IntegrationManifest
 
 
 class CopilotIntegration(IntegrationBase):
-    """Integration for GitHub Copilot in VS Code."""
+    """Integration for GitHub Copilot (VS Code IDE + CLI).
+
+    The IDE integration (``requires_cli: False``) installs ``.agent.md``
+    command files.  Workflow dispatch additionally requires the
+    ``copilot`` CLI to be installed separately.
+    """
 
     key = "copilot"
     config = {
         "name": "GitHub Copilot",
         "folder": ".github/",
         "commands_subdir": "agents",
-        "install_url": None,
+        "install_url": "https://docs.github.com/en/copilot/concepts/agents/copilot-cli/about-copilot-cli",
         "requires_cli": False,
     }
     registrar_config = {
@@ -37,6 +42,101 @@ class CopilotIntegration(IntegrationBase):
     }
     context_file = ".github/copilot-instructions.md"
 
+    def build_exec_args(
+        self,
+        prompt: str,
+        *,
+        model: str | None = None,
+        output_json: bool = True,
+    ) -> list[str] | None:
+        # GitHub Copilot CLI uses ``copilot -p "prompt"`` for
+        # non-interactive mode.  --allow-all-tools is required for the
+        # agent to perform file edits and shell commands.  Controlled
+        # by SPECKIT_ALLOW_ALL_TOOLS env var (default: enabled).
+        import os
+        args = ["copilot", "-p", prompt]
+        if os.environ.get("SPECKIT_ALLOW_ALL_TOOLS", "1") != "0":
+            args.append("--allow-all-tools")
+        if model:
+            args.extend(["--model", model])
+        if output_json:
+            args.extend(["--output-format", "json"])
+        return args
+
+    def build_command_invocation(self, command_name: str, args: str = "") -> str:
+        """Copilot agents are not slash-commands — just return the args as prompt."""
+        return args or ""
+
+    def dispatch_command(
+        self,
+        command_name: str,
+        args: str = "",
+        *,
+        project_root: Path | None = None,
+        model: str | None = None,
+        timeout: int = 600,
+        stream: bool = True,
+    ) -> dict[str, Any]:
+        """Dispatch via ``--agent speckit.<stem>`` instead of slash-commands.
+
+        Copilot ``.agent.md`` files are agents, not skills.  The CLI
+        selects them with ``--agent <name>`` and the prompt is just
+        the user's arguments.
+        """
+        import subprocess
+
+        stem = command_name
+        if "." in stem:
+            stem = stem.rsplit(".", 1)[-1]
+        agent_name = f"speckit.{stem}"
+
+        prompt = args or ""
+        import os
+        cli_args = [
+            "copilot", "-p", prompt,
+            "--agent", agent_name,
+        ]
+        if os.environ.get("SPECKIT_ALLOW_ALL_TOOLS", "1") != "0":
+            cli_args.append("--allow-all-tools")
+        if model:
+            cli_args.extend(["--model", model])
+        if not stream:
+            cli_args.extend(["--output-format", "json"])
+
+        cwd = str(project_root) if project_root else None
+
+        if stream:
+            try:
+                result = subprocess.run(
+                    cli_args,
+                    text=True,
+                    cwd=cwd,
+                )
+            except KeyboardInterrupt:
+                return {
+                    "exit_code": 130,
+                    "stdout": "",
+                    "stderr": "Interrupted by user",
+                }
+            return {
+                "exit_code": result.returncode,
+                "stdout": "",
+                "stderr": "",
+            }
+
+        result = subprocess.run(
+            cli_args,
+            capture_output=True,
+            text=True,
+            cwd=cwd,
+            timeout=timeout,
+        )
+        return {
+            "exit_code": result.returncode,
+            "stdout": result.stdout,
+            "stderr": result.stderr,
+        }
+
     def command_filename(self, template_name: str) -> str:
         """Copilot commands use ``.agent.md`` extension."""
         return f"speckit.{template_name}.agent.md"

src/specify_cli/workflows/__init__.py

@@ -0,0 +1,68 @@
+"""Workflow engine for multi-step, resumable automation workflows.
+
+Provides:
+- ``StepBase`` — abstract base every step type must implement.
+- ``StepContext`` — execution context passed to each step.
+- ``StepResult`` — return value from step execution.
+- ``STEP_REGISTRY`` — maps ``type_key`` to ``StepBase`` subclass instances.
+- ``WorkflowEngine`` — orchestrator that loads, validates, and executes
+  workflow YAML definitions.
+"""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from .base import StepBase
+
+# Maps step type_key → StepBase instance.
+STEP_REGISTRY: dict[str, StepBase] = {}
+
+
+def _register_step(step: StepBase) -> None:
+    """Register a step type instance in the global registry.
+
+    Raises ``ValueError`` for falsy keys and ``KeyError`` for duplicates.
+    """
+    key = step.type_key
+    if not key:
+        raise ValueError("Cannot register step type with an empty type_key.")
+    if key in STEP_REGISTRY:
+        raise KeyError(f"Step type with key {key!r} is already registered.")
+    STEP_REGISTRY[key] = step
+
+
+def get_step_type(type_key: str) -> StepBase | None:
+    """Return the step type for *type_key*, or ``None`` if not registered."""
+    return STEP_REGISTRY.get(type_key)
+
+
+# -- Register built-in step types ----------------------------------------
+
+def _register_builtin_steps() -> None:
+    """Register all built-in step types."""
+    from .steps.command import CommandStep
+    from .steps.do_while import DoWhileStep
+    from .steps.fan_in import FanInStep
+    from .steps.fan_out import FanOutStep
+    from .steps.gate import GateStep
+    from .steps.if_then import IfThenStep
+    from .steps.prompt import PromptStep
+    from .steps.shell import ShellStep
+    from .steps.switch import SwitchStep
+    from .steps.while_loop import WhileStep
+
+    _register_step(CommandStep())
+    _register_step(DoWhileStep())
+    _register_step(FanInStep())
+    _register_step(FanOutStep())
+    _register_step(GateStep())
+    _register_step(IfThenStep())
+    _register_step(PromptStep())
+    _register_step(ShellStep())
+    _register_step(SwitchStep())
+    _register_step(WhileStep())
+
+
+_register_builtin_steps()

src/specify_cli/workflows/base.py

@@ -0,0 +1,132 @@
+"""Base classes for workflow step types.
+
+Provides:
+- ``StepBase`` — abstract base every step type must implement.
+- ``StepContext`` — execution context passed to each step.
+- ``StepResult`` — return value from step execution.
+"""
+
+from __future__ import annotations
+
+from abc import ABC, abstractmethod
+from dataclasses import dataclass, field
+from enum import Enum
+from typing import Any
+
+
+class StepStatus(str, Enum):
+    """Status of a step execution."""
+
+    PENDING = "pending"
+    RUNNING = "running"
+    COMPLETED = "completed"
+    FAILED = "failed"
+    SKIPPED = "skipped"
+    PAUSED = "paused"
+
+
+class RunStatus(str, Enum):
+    """Status of a workflow run."""
+
+    CREATED = "created"
+    RUNNING = "running"
+    PAUSED = "paused"
+    COMPLETED = "completed"
+    FAILED = "failed"
+    ABORTED = "aborted"
+
+
+@dataclass
+class StepContext:
+    """Execution context passed to each step.
+
+    Contains everything the step needs to resolve expressions, dispatch
+    commands, and record results.
+    """
+
+    #: Resolved workflow inputs (from user prompts / defaults).
+    inputs: dict[str, Any] = field(default_factory=dict)
+
+    #: Accumulated step results keyed by step ID.
+    #: Each entry is ``{"integration": ..., "model": ..., "options": ...,
+    #:   "input": ..., "output": ...}``.
+    steps: dict[str, dict[str, Any]] = field(default_factory=dict)
+
+    #: Current fan-out item (set only inside fan-out iterations).
+    item: Any = None
+
+    #: Fan-in aggregated results (set only for fan-in steps).
+    fan_in: dict[str, Any] = field(default_factory=dict)
+
+    #: Workflow-level default integration key.
+    default_integration: str | None = None
+
+    #: Workflow-level default model.
+    default_model: str | None = None
+
+    #: Workflow-level default options.
+    default_options: dict[str, Any] = field(default_factory=dict)
+
+    #: Project root path.
+    project_root: str | None = None
+
+    #: Current run ID.
+    run_id: str | None = None
+
+
+@dataclass
+class StepResult:
+    """Return value from a step execution."""
+
+    #: Step status.
+    status: StepStatus = StepStatus.COMPLETED
+
+    #: Output data (stored as ``steps.<id>.output``).
+    output: dict[str, Any] = field(default_factory=dict)
+
+    #: Nested steps to execute (for control-flow steps like if/then).
+    next_steps: list[dict[str, Any]] = field(default_factory=list)
+
+    #: Error message if step failed.
+    error: str | None = None
+
+
+class StepBase(ABC):
+    """Abstract base class for workflow step types.
+
+    Every step type — built-in or extension-provided — implements this
+    interface and registers in ``STEP_REGISTRY``.
+    """
+
+    #: Matches the ``type:`` value in workflow YAML.
+    type_key: str = ""
+
+    @abstractmethod
+    def execute(self, config: dict[str, Any], context: StepContext) -> StepResult:
+        """Execute the step with the given config and context.
+
+        Parameters
+        ----------
+        config:
+            The step configuration from workflow YAML.
+        context:
+            The execution context with inputs, accumulated step results, etc.
+
+        Returns
+        -------
+        StepResult with status, output data, and optional nested steps.
+        """
+
+    def validate(self, config: dict[str, Any]) -> list[str]:
+        """Validate step configuration and return a list of error messages.
+
+        An empty list means the configuration is valid.
+        """
+        errors: list[str] = []
+        if "id" not in config:
+            errors.append("Step is missing required 'id' field.")
+        return errors
+
+    def can_resume(self, state: dict[str, Any]) -> bool:
+        """Return whether this step can be resumed from the given state."""
+        return True

src/specify_cli/workflows/catalog.py

@@ -0,0 +1,540 @@
+"""Workflow catalog — discovery, install, and management of workflows.
+
+Mirrors the existing extension/preset catalog pattern with:
+- Multi-catalog stack (env var → project → user → built-in)
+- SHA256-hashed per-URL caching with 1-hour TTL
+- Workflow registry for installed workflow tracking
+- Search across all configured catalog sources
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import time
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+import yaml
+
+
+# ---------------------------------------------------------------------------
+# Errors
+# ---------------------------------------------------------------------------
+
+
+class WorkflowCatalogError(Exception):
+    """Base error for workflow catalog operations."""
+
+
+class WorkflowValidationError(WorkflowCatalogError):
+    """Validation error for catalog config or workflow data."""
+
+
+# ---------------------------------------------------------------------------
+# CatalogEntry
+# ---------------------------------------------------------------------------
+
+
+@dataclass
+class WorkflowCatalogEntry:
+    """Represents a single catalog source in the catalog stack."""
+
+    url: str
+    name: str
+    priority: int
+    install_allowed: bool
+    description: str = ""
+
+
+# ---------------------------------------------------------------------------
+# WorkflowRegistry
+# ---------------------------------------------------------------------------
+
+
+class WorkflowRegistry:
+    """Manages the registry of installed workflows.
+
+    Tracks installed workflows and their metadata in
+    ``.specify/workflows/workflow-registry.json``.
+    """
+
+    REGISTRY_FILE = "workflow-registry.json"
+    SCHEMA_VERSION = "1.0"
+
+    def __init__(self, project_root: Path) -> None:
+        self.project_root = project_root
+        self.workflows_dir = project_root / ".specify" / "workflows"
+        self.registry_path = self.workflows_dir / self.REGISTRY_FILE
+        self.data = self._load()
+
+    def _load(self) -> dict[str, Any]:
+        """Load registry from disk or create default."""
+        if self.registry_path.exists():
+            try:
+                with open(self.registry_path, encoding="utf-8") as f:
+                    return json.load(f)
+            except (json.JSONDecodeError, ValueError):
+                # Corrupted registry file — reset to default
+                return {"schema_version": self.SCHEMA_VERSION, "workflows": {}}
+        return {"schema_version": self.SCHEMA_VERSION, "workflows": {}}
+
+    def save(self) -> None:
+        """Persist registry to disk."""
+        self.workflows_dir.mkdir(parents=True, exist_ok=True)
+        with open(self.registry_path, "w", encoding="utf-8") as f:
+            json.dump(self.data, f, indent=2)
+
+    def add(self, workflow_id: str, metadata: dict[str, Any]) -> None:
+        """Add or update an installed workflow entry."""
+        from datetime import datetime, timezone
+
+        existing = self.data["workflows"].get(workflow_id, {})
+        metadata["installed_at"] = existing.get(
+            "installed_at", datetime.now(timezone.utc).isoformat()
+        )
+        metadata["updated_at"] = datetime.now(timezone.utc).isoformat()
+        self.data["workflows"][workflow_id] = metadata
+        self.save()
+
+    def remove(self, workflow_id: str) -> bool:
+        """Remove an installed workflow entry. Returns True if found."""
+        if workflow_id in self.data["workflows"]:
+            del self.data["workflows"][workflow_id]
+            self.save()
+            return True
+        return False
+
+    def get(self, workflow_id: str) -> dict[str, Any] | None:
+        """Get metadata for an installed workflow."""
+        return self.data["workflows"].get(workflow_id)
+
+    def list(self) -> dict[str, dict[str, Any]]:
+        """Return all installed workflows."""
+        return dict(self.data["workflows"])
+
+    def is_installed(self, workflow_id: str) -> bool:
+        """Check if a workflow is installed."""
+        return workflow_id in self.data["workflows"]
+
+
+# ---------------------------------------------------------------------------
+# WorkflowCatalog
+# ---------------------------------------------------------------------------
+
+
+class WorkflowCatalog:
+    """Manages workflow catalog fetching, caching, and searching.
+
+    Resolution order for catalog sources:
+    1. ``SPECKIT_WORKFLOW_CATALOG_URL`` env var (overrides all)
+    2. Project-level ``.specify/workflow-catalogs.yml``
+    3. User-level ``~/.specify/workflow-catalogs.yml``
+    4. Built-in defaults (official + community)
+    """
+
+    DEFAULT_CATALOG_URL = (
+        "https://raw.githubusercontent.com/github/spec-kit/main/"
+        "workflows/catalog.json"
+    )
+    COMMUNITY_CATALOG_URL = (
+        "https://raw.githubusercontent.com/github/spec-kit/main/"
+        "workflows/catalog.community.json"
+    )
+    CACHE_DURATION = 3600  # 1 hour
+
+    def __init__(self, project_root: Path) -> None:
+        self.project_root = project_root
+        self.workflows_dir = project_root / ".specify" / "workflows"
+        self.cache_dir = self.workflows_dir / ".cache"
+
+    # -- Catalog resolution -----------------------------------------------
+
+    def _validate_catalog_url(self, url: str) -> None:
+        """Validate that a catalog URL uses HTTPS (localhost HTTP allowed)."""
+        from urllib.parse import urlparse
+
+        parsed = urlparse(url)
+        is_localhost = parsed.hostname in ("localhost", "127.0.0.1", "::1")
+        if parsed.scheme != "https" and not (
+            parsed.scheme == "http" and is_localhost
+        ):
+            raise WorkflowValidationError(
+                f"Catalog URL must use HTTPS (got {parsed.scheme}://). "
+                "HTTP is only allowed for localhost."
+            )
+        if not parsed.netloc:
+            raise WorkflowValidationError(
+                "Catalog URL must be a valid URL with a host."
+            )
+
+    def _load_catalog_config(
+        self, config_path: Path
+    ) -> list[WorkflowCatalogEntry] | None:
+        """Load catalog stack configuration from a YAML file."""
+        if not config_path.exists():
+            return None
+        try:
+            data = yaml.safe_load(config_path.read_text(encoding="utf-8")) or {}
+        except (yaml.YAMLError, OSError, UnicodeError) as exc:
+            raise WorkflowValidationError(
+                f"Failed to read catalog config {config_path}: {exc}"
+            )
+        catalogs_data = data.get("catalogs", [])
+        if not catalogs_data:
+            # Empty catalogs list (e.g. after removing last entry)
+            # is valid — fall back to built-in defaults.
+            return None
+        if not isinstance(catalogs_data, list):
+            raise WorkflowValidationError(
+                f"Invalid catalog config: 'catalogs' must be a list, "
+                f"got {type(catalogs_data).__name__}"
+            )
+
+        entries: list[WorkflowCatalogEntry] = []
+        for idx, item in enumerate(catalogs_data):
+            if not isinstance(item, dict):
+                raise WorkflowValidationError(
+                    f"Invalid catalog entry at index {idx}: "
+                    f"expected a mapping, got {type(item).__name__}"
+                )
+            url = str(item.get("url", "")).strip()
+            if not url:
+                continue
+            self._validate_catalog_url(url)
+            try:
+                priority = int(item.get("priority", idx + 1))
+            except (TypeError, ValueError):
+                raise WorkflowValidationError(
+                    f"Invalid priority for catalog "
+                    f"'{item.get('name', idx + 1)}': "
+                    f"expected integer, got {item.get('priority')!r}"
+                )
+            raw_install = item.get("install_allowed", False)
+            if isinstance(raw_install, str):
+                install_allowed = raw_install.strip().lower() in (
+                    "true",
+                    "yes",
+                    "1",
+                )
+            else:
+                install_allowed = bool(raw_install)
+            entries.append(
+                WorkflowCatalogEntry(
+                    url=url,
+                    name=str(item.get("name", f"catalog-{idx + 1}")),
+                    priority=priority,
+                    install_allowed=install_allowed,
+                    description=str(item.get("description", "")),
+                )
+            )
+        entries.sort(key=lambda e: e.priority)
+        if not entries:
+            raise WorkflowValidationError(
+                f"Catalog config {config_path} contains {len(catalogs_data)} "
+                f"entries but none have valid URLs."
+            )
+        return entries
+
+    def get_active_catalogs(self) -> list[WorkflowCatalogEntry]:
+        """Get the ordered list of active catalogs."""
+        # 1. Environment variable override
+        env_url = os.environ.get("SPECKIT_WORKFLOW_CATALOG_URL", "").strip()
+        if env_url:
+            self._validate_catalog_url(env_url)
+            return [
+                WorkflowCatalogEntry(
+                    url=env_url,
+                    name="env-override",
+                    priority=1,
+                    install_allowed=True,
+                    description="From SPECKIT_WORKFLOW_CATALOG_URL",
+                )
+            ]
+
+        # 2. Project-level config
+        project_config = self.project_root / ".specify" / "workflow-catalogs.yml"
+        project_entries = self._load_catalog_config(project_config)
+        if project_entries is not None:
+            return project_entries
+
+        # 3. User-level config
+        home = Path.home()
+        user_config = home / ".specify" / "workflow-catalogs.yml"
+        user_entries = self._load_catalog_config(user_config)
+        if user_entries is not None:
+            return user_entries
+
+        # 4. Built-in defaults
+        return [
+            WorkflowCatalogEntry(
+                url=self.DEFAULT_CATALOG_URL,
+                name="default",
+                priority=1,
+                install_allowed=True,
+                description="Official workflows",
+            ),
+            WorkflowCatalogEntry(
+                url=self.COMMUNITY_CATALOG_URL,
+                name="community",
+                priority=2,
+                install_allowed=False,
+                description="Community-contributed workflows (discovery only)",
+            ),
+        ]
+
+    # -- Caching ----------------------------------------------------------
+
+    def _get_cache_paths(self, url: str) -> tuple[Path, Path]:
+        """Get cache file paths for a URL (hash-based)."""
+        url_hash = hashlib.sha256(url.encode()).hexdigest()[:16]
+        cache_file = self.cache_dir / f"workflow-catalog-{url_hash}.json"
+        meta_file = self.cache_dir / f"workflow-catalog-{url_hash}-meta.json"
+        return cache_file, meta_file
+
+    def _is_url_cache_valid(self, url: str) -> bool:
+        """Check if cached data for a URL is still fresh."""
+        _, meta_file = self._get_cache_paths(url)
+        if not meta_file.exists():
+            return False
+        try:
+            with open(meta_file, encoding="utf-8") as f:
+                meta = json.load(f)
+            fetched_at = meta.get("fetched_at", 0)
+            return (time.time() - fetched_at) < self.CACHE_DURATION
+        except (json.JSONDecodeError, OSError):
+            return False
+
+    def _fetch_single_catalog(
+        self, entry: WorkflowCatalogEntry, force_refresh: bool = False
+    ) -> dict[str, Any]:
+        """Fetch a single catalog, using cache when possible."""
+        cache_file, meta_file = self._get_cache_paths(entry.url)
+
+        if not force_refresh and self._is_url_cache_valid(entry.url):
+            try:
+                with open(cache_file, encoding="utf-8") as f:
+                    return json.load(f)
+            except (json.JSONDecodeError, OSError):
+                pass
+
+        # Fetch from URL — validate scheme before opening and after redirects
+        from urllib.parse import urlparse
+        from urllib.request import urlopen
+
+        def _validate_catalog_url(url: str) -> None:
+            parsed = urlparse(url)
+            is_localhost = parsed.hostname in ("localhost", "127.0.0.1", "::1")
+            if parsed.scheme != "https" and not (
+                parsed.scheme == "http" and is_localhost
+            ):
+                raise WorkflowCatalogError(
+                    f"Refusing to fetch catalog from non-HTTPS URL: {url}"
+                )
+
+        _validate_catalog_url(entry.url)
+
+        try:
+            with urlopen(entry.url, timeout=30) as resp:  # noqa: S310
+                _validate_catalog_url(resp.geturl())
+                data = json.loads(resp.read().decode("utf-8"))
+        except Exception as exc:
+            # Fall back to cache if available
+            if cache_file.exists():
+                try:
+                    with open(cache_file, encoding="utf-8") as f:
+                        return json.load(f)
+                except (json.JSONDecodeError, ValueError, OSError):
+                    pass
+            raise WorkflowCatalogError(
+                f"Failed to fetch catalog from {entry.url}: {exc}"
+            ) from exc
+
+        if not isinstance(data, dict):
+            raise WorkflowCatalogError(
+                f"Catalog from {entry.url} is not a valid JSON object."
+            )
+
+        # Write cache
+        self.cache_dir.mkdir(parents=True, exist_ok=True)
+        with open(cache_file, "w", encoding="utf-8") as f:
+            json.dump(data, f, indent=2)
+        with open(meta_file, "w", encoding="utf-8") as f:
+            json.dump({"url": entry.url, "fetched_at": time.time()}, f)
+
+        return data
+
+    def _get_merged_workflows(
+        self, force_refresh: bool = False
+    ) -> dict[str, dict[str, Any]]:
+        """Merge workflows from all active catalogs (lower priority number wins)."""
+        catalogs = self.get_active_catalogs()
+        merged: dict[str, dict[str, Any]] = {}
+        fetch_errors = 0
+
+        # Process later/higher-numbered entries first so earlier/lower-numbered
+        # entries overwrite them on workflow ID conflicts.
+        for entry in reversed(catalogs):
+            try:
+                data = self._fetch_single_catalog(entry, force_refresh)
+            except WorkflowCatalogError:
+                fetch_errors += 1
+                continue
+            workflows = data.get("workflows", {})
+            # Handle both dict and list formats
+            if isinstance(workflows, dict):
+                for wf_id, wf_data in workflows.items():
+                    if not isinstance(wf_data, dict):
+                        continue
+                    wf_data["_catalog_name"] = entry.name
+                    wf_data["_install_allowed"] = entry.install_allowed
+                    merged[wf_id] = wf_data
+            elif isinstance(workflows, list):
+                for wf_data in workflows:
+                    if not isinstance(wf_data, dict):
+                        continue
+                    wf_id = wf_data.get("id", "")
+                    if wf_id:
+                        wf_data["_catalog_name"] = entry.name
+                        wf_data["_install_allowed"] = entry.install_allowed
+                        merged[wf_id] = wf_data
+        if fetch_errors == len(catalogs) and catalogs:
+            raise WorkflowCatalogError(
+                "All configured catalogs failed to fetch."
+            )
+        return merged
+
+    # -- Public API -------------------------------------------------------
+
+    def search(
+        self,
+        query: str | None = None,
+        tag: str | None = None,
+    ) -> list[dict[str, Any]]:
+        """Search workflows across all configured catalogs."""
+        merged = self._get_merged_workflows()
+        results: list[dict[str, Any]] = []
+
+        for wf_id, wf_data in merged.items():
+            wf_data.setdefault("id", wf_id)
+            if query:
+                q = query.lower()
+                searchable = " ".join(
+                    [
+                        wf_data.get("name", ""),
+                        wf_data.get("description", ""),
+                        wf_data.get("id", ""),
+                    ]
+                ).lower()
+                if q not in searchable:
+                    continue
+            if tag:
+                raw_tags = wf_data.get("tags", [])
+                tags = raw_tags if isinstance(raw_tags, list) else []
+                normalized_tags = [t.lower() for t in tags if isinstance(t, str)]
+                if tag.lower() not in normalized_tags:
+                    continue
+            results.append(wf_data)
+        return results
+
+    def get_workflow_info(self, workflow_id: str) -> dict[str, Any] | None:
+        """Get details for a specific workflow from the catalog."""
+        merged = self._get_merged_workflows()
+        wf = merged.get(workflow_id)
+        if wf:
+            wf.setdefault("id", workflow_id)
+        return wf
+
+    def get_catalog_configs(self) -> list[dict[str, Any]]:
+        """Return current catalog configuration as a list of dicts."""
+        entries = self.get_active_catalogs()
+        return [
+            {
+                "name": e.name,
+                "url": e.url,
+                "priority": e.priority,
+                "install_allowed": e.install_allowed,
+                "description": e.description,
+            }
+            for e in entries
+        ]
+
+    def add_catalog(self, url: str, name: str | None = None) -> None:
+        """Add a catalog source to the project-level config."""
+        self._validate_catalog_url(url)
+        config_path = self.project_root / ".specify" / "workflow-catalogs.yml"
+
+        data: dict[str, Any] = {"catalogs": []}
+        if config_path.exists():
+            raw = yaml.safe_load(config_path.read_text(encoding="utf-8"))
+            if not isinstance(raw, dict):
+                raise WorkflowValidationError(
+                    "Catalog config file is corrupted (expected a mapping)."
+                )
+            data = raw
+
+        catalogs = data.get("catalogs", [])
+        if not isinstance(catalogs, list):
+            raise WorkflowValidationError(
+                "Catalog config 'catalogs' must be a list."
+            )
+        # Check for duplicate URL (guard against non-dict entries)
+        for cat in catalogs:
+            if isinstance(cat, dict) and cat.get("url") == url:
+                raise WorkflowValidationError(
+                    f"Catalog URL already configured: {url}"
+                )
+
+        # Derive priority from the highest existing priority + 1
+        max_priority = max(
+            (cat.get("priority", 0) for cat in catalogs if isinstance(cat, dict)),
+            default=0,
+        )
+        catalogs.append(
+            {
+                "name": name or f"catalog-{len(catalogs) + 1}",
+                "url": url,
+                "priority": max_priority + 1,
+                "install_allowed": True,
+                "description": "",
+            }
+        )
+        data["catalogs"] = catalogs
+
+        config_path.parent.mkdir(parents=True, exist_ok=True)
+        with open(config_path, "w", encoding="utf-8") as f:
+            yaml.dump(data, f, default_flow_style=False, sort_keys=False, allow_unicode=True)
+
+    def remove_catalog(self, index: int) -> str:
+        """Remove a catalog source by index (0-based). Returns the removed name."""
+        config_path = self.project_root / ".specify" / "workflow-catalogs.yml"
+        if not config_path.exists():
+            raise WorkflowValidationError("No catalog config file found.")
+
+        data = yaml.safe_load(config_path.read_text(encoding="utf-8")) or {}
+        if not isinstance(data, dict):
+            raise WorkflowValidationError(
+                "Catalog config file is corrupted (expected a mapping)."
+            )
+        catalogs = data.get("catalogs", [])
+        if not isinstance(catalogs, list):
+            raise WorkflowValidationError(
+                "Catalog config 'catalogs' must be a list."
+            )
+
+        if index < 0 or index >= len(catalogs):
+            raise WorkflowValidationError(
+                f"Catalog index {index} out of range (0-{len(catalogs) - 1})."
+            )
+
+        removed = catalogs.pop(index)
+        data["catalogs"] = catalogs
+
+        with open(config_path, "w", encoding="utf-8") as f:
+            yaml.dump(data, f, default_flow_style=False, sort_keys=False, allow_unicode=True)
+
+        if isinstance(removed, dict):
+            return removed.get("name", f"catalog-{index + 1}")
+        return f"catalog-{index + 1}"

src/specify_cli/workflows/engine.py

@@ -0,0 +1,778 @@
+"""Workflow engine — loads, validates, and executes workflow YAML definitions.
+
+The engine is the orchestrator that:
+- Parses workflow YAML definitions
+- Validates step configurations and requirements
+- Executes steps sequentially, dispatching to the correct step type
+- Manages state persistence for resume capability
+- Handles control flow (branching, loops, fan-out/fan-in)
+"""
+
+from __future__ import annotations
+
+import json
+import re
+import uuid
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any
+
+import yaml
+
+from .base import RunStatus, StepContext, StepResult, StepStatus
+
+
+# -- Workflow Definition --------------------------------------------------
+
+
+class WorkflowDefinition:
+    """Parsed and validated workflow YAML definition."""
+
+    def __init__(self, data: dict[str, Any], source_path: Path | None = None) -> None:
+        self.data = data
+        self.source_path = source_path
+
+        workflow = data.get("workflow", {})
+        self.id: str = workflow.get("id", "")
+        self.name: str = workflow.get("name", "")
+        self.version: str = workflow.get("version", "0.0.0")
+        self.author: str = workflow.get("author", "")
+        self.description: str = workflow.get("description", "")
+        self.schema_version: str = data.get("schema_version", "1.0")
+
+        # Defaults
+        self.default_integration: str | None = workflow.get("integration")
+        self.default_model: str | None = workflow.get("model")
+        self.default_options: dict[str, Any] = workflow.get("options") or {}
+        if not isinstance(self.default_options, dict):
+            self.default_options = {}
+
+        # Requirements (declared but not yet enforced at runtime;
+        # enforcement is a planned enhancement)
+        self.requires: dict[str, Any] = data.get("requires", {})
+
+        # Inputs
+        self.inputs: dict[str, Any] = data.get("inputs", {})
+
+        # Steps
+        self.steps: list[dict[str, Any]] = data.get("steps", [])
+
+    @classmethod
+    def from_yaml(cls, path: Path) -> WorkflowDefinition:
+        """Load a workflow definition from a YAML file."""
+        with open(path, encoding="utf-8") as f:
+            data = yaml.safe_load(f)
+        if not isinstance(data, dict):
+            msg = f"Workflow YAML must be a mapping, got {type(data).__name__}."
+            raise ValueError(msg)
+        return cls(data, source_path=path)
+
+    @classmethod
+    def from_string(cls, content: str) -> WorkflowDefinition:
+        """Load a workflow definition from a YAML string."""
+        data = yaml.safe_load(content)
+        if not isinstance(data, dict):
+            msg = f"Workflow YAML must be a mapping, got {type(data).__name__}."
+            raise ValueError(msg)
+        return cls(data)
+
+
+# -- Workflow Validation --------------------------------------------------
+
+# ID format: lowercase alphanumeric with hyphens
+_ID_PATTERN = re.compile(r"^[a-z0-9][a-z0-9-]*[a-z0-9]$|^[a-z0-9]$")
+
+# Valid step types (matching STEP_REGISTRY keys)
+def _get_valid_step_types() -> set[str]:
+    """Return valid step types from the registry, with a built-in fallback."""
+    from . import STEP_REGISTRY
+    if STEP_REGISTRY:
+        return set(STEP_REGISTRY.keys())
+    return {
+        "command", "shell", "prompt", "gate", "if",
+        "switch", "while", "do-while", "fan-out", "fan-in",
+    }
+
+
+def validate_workflow(definition: WorkflowDefinition) -> list[str]:
+    """Validate a workflow definition and return a list of error messages.
+
+    An empty list means the workflow is valid.
+    """
+    errors: list[str] = []
+
+    # -- Schema version ---------------------------------------------------
+    if definition.schema_version not in ("1.0", "1"):
+        errors.append(
+            f"Unsupported schema_version {definition.schema_version!r}. "
+            f"Expected '1.0'."
+        )
+
+    # -- Top-level fields -------------------------------------------------
+    if not definition.id:
+        errors.append("Workflow is missing 'workflow.id'.")
+    elif not _ID_PATTERN.match(definition.id):
+        errors.append(
+            f"Workflow ID {definition.id!r} must be lowercase alphanumeric "
+            f"with hyphens."
+        )
+
+    if not definition.name:
+        errors.append("Workflow is missing 'workflow.name'.")
+
+    if not definition.version:
+        errors.append("Workflow is missing 'workflow.version'.")
+    elif not re.match(r"^\d+\.\d+\.\d+$", definition.version):
+        errors.append(
+            f"Workflow version {definition.version!r} is not valid "
+            f"semantic versioning (expected X.Y.Z)."
+        )
+
+    # -- Inputs -----------------------------------------------------------
+    if not isinstance(definition.inputs, dict):
+        errors.append("'inputs' must be a mapping (or omitted).")
+    else:
+        for input_name, input_def in definition.inputs.items():
+            if not isinstance(input_def, dict):
+                errors.append(f"Input {input_name!r} must be a mapping.")
+                continue
+            input_type = input_def.get("type")
+            if input_type and input_type not in ("string", "number", "boolean"):
+                errors.append(
+                    f"Input {input_name!r} has invalid type {input_type!r}. "
+                    f"Must be 'string', 'number', or 'boolean'."
+                )
+
+    # -- Steps ------------------------------------------------------------
+    if not isinstance(definition.steps, list):
+        errors.append("'steps' must be a list.")
+        return errors
+    if not definition.steps:
+        errors.append("Workflow has no steps defined.")
+
+    seen_ids: set[str] = set()
+    _validate_steps(definition.steps, seen_ids, errors)
+
+    return errors
+
+
+def _validate_steps(
+    steps: list[dict[str, Any]],
+    seen_ids: set[str],
+    errors: list[str],
+) -> None:
+    """Recursively validate a list of steps."""
+    from . import STEP_REGISTRY
+
+    for step_config in steps:
+        if not isinstance(step_config, dict):
+            errors.append(f"Step must be a mapping, got {type(step_config).__name__}.")
+            continue
+
+        step_id = step_config.get("id")
+        if not step_id:
+            errors.append("Step is missing 'id' field.")
+            continue
+
+        if ":" in step_id:
+            errors.append(
+                f"Step ID {step_id!r} contains ':' which is reserved "
+                f"for engine-generated nested IDs (parentId:childId)."
+            )
+
+        if step_id in seen_ids:
+            errors.append(f"Duplicate step ID {step_id!r}.")
+        seen_ids.add(step_id)
+
+        # Determine step type
+        step_type = step_config.get("type", "command")
+        if step_type not in _get_valid_step_types():
+            errors.append(
+                f"Step {step_id!r} has invalid type {step_type!r}."
+            )
+            continue
+
+        # Delegate to step-specific validation
+        step_impl = STEP_REGISTRY.get(step_type)
+        if step_impl:
+            step_errors = step_impl.validate(step_config)
+            errors.extend(step_errors)
+
+        # Recursively validate nested steps
+        for nested_key in ("then", "else", "steps"):
+            nested = step_config.get(nested_key)
+            if isinstance(nested, list):
+                _validate_steps(nested, seen_ids, errors)
+
+        # Validate switch cases
+        cases = step_config.get("cases")
+        if isinstance(cases, dict):
+            for _case_key, case_steps in cases.items():
+                if isinstance(case_steps, list):
+                    _validate_steps(case_steps, seen_ids, errors)
+
+        # Validate switch default
+        default = step_config.get("default")
+        if isinstance(default, list):
+            _validate_steps(default, seen_ids, errors)
+
+        # Validate fan-out nested step (template — not added to seen_ids
+        # since the engine generates parentId:templateId:index at runtime)
+        fan_step = step_config.get("step")
+        if isinstance(fan_step, dict):
+            fan_errors: list[str] = []
+            _validate_steps([fan_step], set(), fan_errors)
+            errors.extend(fan_errors)
+
+
+# -- Run State Persistence ------------------------------------------------
+
+
+class RunState:
+    """Manages workflow run state for persistence and resume."""
+
+    def __init__(
+        self,
+        run_id: str | None = None,
+        workflow_id: str = "",
+        project_root: Path | None = None,
+    ) -> None:
+        self.run_id = run_id or str(uuid.uuid4())[:8]
+        if not re.match(r'^[a-zA-Z0-9][a-zA-Z0-9_-]*$', self.run_id):
+            msg = f"Invalid run_id {self.run_id!r}: must be alphanumeric with hyphens/underscores only."
+            raise ValueError(msg)
+        self.workflow_id = workflow_id
+        self.project_root = project_root or Path(".")
+        self.status = RunStatus.CREATED
+        self.current_step_index = 0
+        self.current_step_id: str | None = None
+        self.step_results: dict[str, dict[str, Any]] = {}
+        self.inputs: dict[str, Any] = {}
+        self.created_at = datetime.now(timezone.utc).isoformat()
+        self.updated_at = self.created_at
+        self.log_entries: list[dict[str, Any]] = []
+
+    @property
+    def runs_dir(self) -> Path:
+        return self.project_root / ".specify" / "workflows" / "runs" / self.run_id
+
+    def save(self) -> None:
+        """Persist current state to disk."""
+        self.updated_at = datetime.now(timezone.utc).isoformat()
+        runs_dir = self.runs_dir
+        runs_dir.mkdir(parents=True, exist_ok=True)
+
+        state_data = {
+            "run_id": self.run_id,
+            "workflow_id": self.workflow_id,
+            "status": self.status.value,
+            "current_step_index": self.current_step_index,
+            "current_step_id": self.current_step_id,
+            "step_results": self.step_results,
+            "created_at": self.created_at,
+            "updated_at": self.updated_at,
+        }
+        with open(runs_dir / "state.json", "w", encoding="utf-8") as f:
+            json.dump(state_data, f, indent=2)
+
+        inputs_data = {"inputs": self.inputs}
+        with open(runs_dir / "inputs.json", "w", encoding="utf-8") as f:
+            json.dump(inputs_data, f, indent=2)
+
+    @classmethod
+    def load(cls, run_id: str, project_root: Path) -> RunState:
+        """Load a run state from disk."""
+        runs_dir = project_root / ".specify" / "workflows" / "runs" / run_id
+        state_path = runs_dir / "state.json"
+        if not state_path.exists():
+            msg = f"Run state not found: {state_path}"
+            raise FileNotFoundError(msg)
+
+        with open(state_path, encoding="utf-8") as f:
+            state_data = json.load(f)
+
+        state = cls(
+            run_id=state_data["run_id"],
+            workflow_id=state_data["workflow_id"],
+            project_root=project_root,
+        )
+        state.status = RunStatus(state_data["status"])
+        state.current_step_index = state_data.get("current_step_index", 0)
+        state.current_step_id = state_data.get("current_step_id")
+        state.step_results = state_data.get("step_results", {})
+        state.created_at = state_data.get("created_at", "")
+        state.updated_at = state_data.get("updated_at", "")
+
+        inputs_path = runs_dir / "inputs.json"
+        if inputs_path.exists():
+            with open(inputs_path, encoding="utf-8") as f:
+                inputs_data = json.load(f)
+            state.inputs = inputs_data.get("inputs", {})
+
+        return state
+
+    def append_log(self, entry: dict[str, Any]) -> None:
+        """Append a log entry to the run log."""
+        entry["timestamp"] = datetime.now(timezone.utc).isoformat()
+        self.log_entries.append(entry)
+
+        runs_dir = self.runs_dir
+        runs_dir.mkdir(parents=True, exist_ok=True)
+        with open(runs_dir / "log.jsonl", "a", encoding="utf-8") as f:
+            f.write(json.dumps(entry) + "\n")
+
+
+# -- Workflow Engine ------------------------------------------------------
+
+
+class WorkflowEngine:
+    """Orchestrator that loads, validates, and executes workflow definitions."""
+
+    def __init__(self, project_root: Path | None = None) -> None:
+        self.project_root = project_root or Path(".")
+        self.on_step_start: Any = None  # Callable[[str, str], None] | None
+
+    def load_workflow(self, source: str | Path) -> WorkflowDefinition:
+        """Load a workflow from an installed ID or a local YAML path.
+
+        Parameters
+        ----------
+        source:
+            Either a workflow ID (looked up in the installed workflows
+            directory) or a path to a YAML file.
+
+        Returns
+        -------
+        A parsed ``WorkflowDefinition`` (not yet validated; call
+        ``validate_workflow()`` or ``engine.validate()`` separately).
+
+        Raises
+        ------
+        FileNotFoundError:
+            If the workflow file cannot be found.
+        ValueError:
+            If the workflow YAML is invalid.
+        """
+        path = Path(source)
+
+        # Try as a direct file path first
+        if path.suffix in (".yml", ".yaml") and path.exists():
+            return WorkflowDefinition.from_yaml(path)
+
+        # Try as an installed workflow ID
+        installed_path = (
+            self.project_root
+            / ".specify"
+            / "workflows"
+            / str(source)
+            / "workflow.yml"
+        )
+        if installed_path.exists():
+            return WorkflowDefinition.from_yaml(installed_path)
+
+        msg = f"Workflow not found: {source}"
+        raise FileNotFoundError(msg)
+
+    def validate(self, definition: WorkflowDefinition) -> list[str]:
+        """Validate a workflow definition."""
+        return validate_workflow(definition)
+
+    def execute(
+        self,
+        definition: WorkflowDefinition,
+        inputs: dict[str, Any] | None = None,
+        run_id: str | None = None,
+    ) -> RunState:
+        """Execute a workflow definition.
+
+        Parameters
+        ----------
+        definition:
+            The validated workflow definition.
+        inputs:
+            User-provided input values.
+        run_id:
+            Optional run ID (auto-generated if not provided).
+
+        Returns
+        -------
+        The final ``RunState`` after execution completes (or pauses).
+        """
+        from . import STEP_REGISTRY
+
+        state = RunState(
+            run_id=run_id,
+            workflow_id=definition.id,
+            project_root=self.project_root,
+        )
+
+        # Persist a copy of the workflow definition so resume can
+        # reload it even if the original source is no longer available
+        # (e.g. a local YAML path that was moved or deleted).
+        run_dir = self.project_root / ".specify" / "workflows" / "runs" / state.run_id
+        run_dir.mkdir(parents=True, exist_ok=True)
+        workflow_copy = run_dir / "workflow.yml"
+        import yaml
+        with open(workflow_copy, "w", encoding="utf-8") as f:
+            yaml.safe_dump(definition.data, f, sort_keys=False)
+
+        # Resolve inputs
+        resolved_inputs = self._resolve_inputs(definition, inputs or {})
+        state.inputs = resolved_inputs
+        state.status = RunStatus.RUNNING
+        state.save()
+
+        context = StepContext(
+            inputs=resolved_inputs,
+            default_integration=definition.default_integration,
+            default_model=definition.default_model,
+            default_options=definition.default_options,
+            project_root=str(self.project_root),
+            run_id=state.run_id,
+        )
+
+        # Execute steps
+        try:
+            self._execute_steps(definition.steps, context, state, STEP_REGISTRY)
+        except KeyboardInterrupt:
+            state.status = RunStatus.PAUSED
+            state.append_log({"event": "workflow_interrupted"})
+            state.save()
+            return state
+        except Exception as exc:
+            state.status = RunStatus.FAILED
+            state.append_log({"event": "workflow_failed", "error": str(exc)})
+            state.save()
+            raise
+
+        if state.status == RunStatus.RUNNING:
+            state.status = RunStatus.COMPLETED
+        state.append_log({"event": "workflow_finished", "status": state.status.value})
+        state.save()
+        return state
+
+    def resume(self, run_id: str) -> RunState:
+        """Resume a paused or failed workflow run."""
+        state = RunState.load(run_id, self.project_root)
+        if state.status not in (RunStatus.PAUSED, RunStatus.FAILED):
+            msg = f"Cannot resume run {run_id!r} with status {state.status.value!r}."
+            raise ValueError(msg)
+
+        # Load the workflow definition — try the persisted copy in the
+        # run directory first so resume works even if the original
+        # source (e.g. a local YAML path) is no longer available.
+        run_dir = self.project_root / ".specify" / "workflows" / "runs" / run_id
+        run_copy = run_dir / "workflow.yml"
+        if run_copy.exists():
+            definition = WorkflowDefinition.from_yaml(run_copy)
+        else:
+            definition = self.load_workflow(state.workflow_id)
+
+        # Restore context
+        context = StepContext(
+            inputs=state.inputs,
+            steps=state.step_results,
+            default_integration=definition.default_integration,
+            default_model=definition.default_model,
+            default_options=definition.default_options,
+            project_root=str(self.project_root),
+            run_id=state.run_id,
+        )
+
+        from . import STEP_REGISTRY
+
+        state.status = RunStatus.RUNNING
+        state.save()
+
+        # Resume from the current step — re-execute it so gates
+        # can prompt interactively again.
+        remaining_steps = definition.steps[state.current_step_index :]
+        step_offset = state.current_step_index
+
+        try:
+            self._execute_steps(
+                remaining_steps, context, state, STEP_REGISTRY,
+                step_offset=step_offset,
+            )
+        except KeyboardInterrupt:
+            state.status = RunStatus.PAUSED
+            state.append_log({"event": "workflow_interrupted"})
+            state.save()
+            return state
+        except Exception as exc:
+            state.status = RunStatus.FAILED
+            state.append_log({"event": "resume_failed", "error": str(exc)})
+            state.save()
+            raise
+
+        if state.status == RunStatus.RUNNING:
+            state.status = RunStatus.COMPLETED
+        state.append_log({"event": "workflow_finished", "status": state.status.value})
+        state.save()
+        return state
+
+    def _execute_steps(
+        self,
+        steps: list[dict[str, Any]],
+        context: StepContext,
+        state: RunState,
+        registry: dict[str, Any],
+        *,
+        step_offset: int = 0,
+    ) -> None:
+        """Execute a list of steps sequentially."""
+        for i, step_config in enumerate(steps):
+            step_id = step_config.get("id", f"step-{i}")
+            step_type = step_config.get("type", "command")
+
+            state.current_step_id = step_id
+            if step_offset >= 0:
+                state.current_step_index = step_offset + i
+            state.save()
+
+            state.append_log(
+                {"event": "step_started", "step_id": step_id, "type": step_type}
+            )
+
+            # Log progress — use the engine's on_step_start callback if set,
+            # otherwise stay silent (library-safe default).
+            label = step_config.get("command", "") or step_type
+            if self.on_step_start is not None:
+                self.on_step_start(step_id, label)
+
+            step_impl = registry.get(step_type)
+            if not step_impl:
+                state.status = RunStatus.FAILED
+                state.append_log(
+                    {
+                        "event": "step_failed",
+                        "step_id": step_id,
+                        "error": f"Unknown step type: {step_type!r}",
+                    }
+                )
+                state.save()
+                return
+
+            result: StepResult = step_impl.execute(step_config, context)
+
+            # Record step results — prefer resolved values from step output
+            step_data = {
+                "integration": result.output.get("integration")
+                or step_config.get("integration")
+                or context.default_integration,
+                "model": result.output.get("model")
+                or step_config.get("model")
+                or context.default_model,
+                "options": result.output.get("options")
+                or step_config.get("options", {}),
+                "input": result.output.get("input")
+                or step_config.get("input", {}),
+                "output": result.output,
+                "status": result.status.value,
+            }
+            context.steps[step_id] = step_data
+            state.step_results[step_id] = step_data
+
+            state.append_log(
+                {
+                    "event": "step_completed",
+                    "step_id": step_id,
+                    "status": result.status.value,
+                }
+            )
+
+            # Handle gate pauses
+            if result.status == StepStatus.PAUSED:
+                state.status = RunStatus.PAUSED
+                state.save()
+                return
+
+            # Handle failures
+            if result.status == StepStatus.FAILED:
+                # Gate abort (output.aborted) maps to ABORTED status
+                if result.output.get("aborted"):
+                    state.status = RunStatus.ABORTED
+                    state.append_log(
+                        {
+                            "event": "workflow_aborted",
+                            "step_id": step_id,
+                        }
+                    )
+                else:
+                    state.status = RunStatus.FAILED
+                    state.append_log(
+                        {
+                            "event": "step_failed",
+                            "step_id": step_id,
+                            "error": result.error,
+                        }
+                    )
+                state.save()
+                return
+
+            # Execute nested steps (from control flow)
+            # NOTE: Nested steps run with step_offset=-1 so they don't
+            # update current_step_index.  If a nested step pauses,
+            # resume will re-run the parent step and its nested body.
+            # A step-path stack for exact nested resume is a future
+            # enhancement.
+            if result.next_steps:
+                self._execute_steps(
+                    result.next_steps, context, state, registry,
+                    step_offset=-1,
+                )
+                if state.status in (
+                    RunStatus.PAUSED,
+                    RunStatus.FAILED,
+                    RunStatus.ABORTED,
+                ):
+                    return
+
+                # Loop iteration: while/do-while re-evaluate after body
+                if step_type in ("while", "do-while"):
+                    from .expressions import evaluate_condition
+
+                    max_iters = step_config.get("max_iterations")
+                    if not isinstance(max_iters, int) or max_iters < 1:
+                        max_iters = 10
+                    condition = step_config.get("condition", False)
+                    for _loop_iter in range(max_iters - 1):
+                        if not evaluate_condition(condition, context):
+                            break
+                        # Namespace nested step IDs per iteration
+                        iter_steps = []
+                        for ns in result.next_steps:
+                            ns_copy = dict(ns)
+                            if "id" in ns_copy:
+                                ns_copy["id"] = f"{step_id}:{ns_copy['id']}:{_loop_iter + 1}"
+                            iter_steps.append(ns_copy)
+                        self._execute_steps(
+                            iter_steps, context, state, registry,
+                            step_offset=-1,
+                        )
+                        if state.status in (
+                            RunStatus.PAUSED,
+                            RunStatus.FAILED,
+                            RunStatus.ABORTED,
+                        ):
+                            return
+
+            # Fan-out: execute nested step template per item with unique IDs
+            if step_type == "fan-out":
+                items = result.output.get("items", [])
+                template = result.output.get("step_template", {})
+                if template and items:
+                    fan_out_results = []
+                    for item_idx, item_val in enumerate(result.output["items"]):
+                        context.item = item_val
+                        # Per-item ID: parentId:templateId:index
+                        item_step = dict(template)
+                        base_id = item_step.get("id", "item")
+                        item_step["id"] = f"{step_id}:{base_id}:{item_idx}"
+                        self._execute_steps(
+                            [item_step], context, state, registry,
+                            step_offset=-1,
+                        )
+                        # Collect per-item result for fan-in
+                        item_result = context.steps.get(item_step["id"], {})
+                        fan_out_results.append(item_result.get("output", {}))
+                        if state.status in (
+                            RunStatus.PAUSED,
+                            RunStatus.FAILED,
+                            RunStatus.ABORTED,
+                        ):
+                            break
+                    context.item = None
+                    # Preserve original output and add collected results
+                    fan_out_output = dict(result.output)
+                    fan_out_output["results"] = fan_out_results
+                    context.steps[step_id]["output"] = fan_out_output
+                    state.step_results[step_id]["output"] = fan_out_output
+                    if state.status in (
+                        RunStatus.PAUSED,
+                        RunStatus.FAILED,
+                        RunStatus.ABORTED,
+                    ):
+                        return
+                else:
+                    # Empty items or no template — normalize output
+                    result.output["results"] = []
+                    context.steps[step_id]["output"] = result.output
+                    state.step_results[step_id]["output"] = result.output
+
+    def _resolve_inputs(
+        self,
+        definition: WorkflowDefinition,
+        provided: dict[str, Any],
+    ) -> dict[str, Any]:
+        """Resolve workflow inputs against definitions and provided values."""
+        resolved: dict[str, Any] = {}
+        for name, input_def in definition.inputs.items():
+            if not isinstance(input_def, dict):
+                continue
+            if name in provided:
+                resolved[name] = self._coerce_input(
+                    name, provided[name], input_def
+                )
+            elif "default" in input_def:
+                resolved[name] = input_def["default"]
+            elif input_def.get("required", False):
+                msg = f"Required input {name!r} not provided."
+                raise ValueError(msg)
+        return resolved
+
+    @staticmethod
+    def _coerce_input(
+        name: str, value: Any, input_def: dict[str, Any]
+    ) -> Any:
+        """Coerce a provided input value to the declared type."""
+        input_type = input_def.get("type", "string")
+        enum_values = input_def.get("enum")
+
+        if input_type == "number":
+            try:
+                value = float(value)
+                if value == int(value):
+                    value = int(value)
+            except (ValueError, TypeError):
+                msg = f"Input {name!r} expected a number, got {value!r}."
+                raise ValueError(msg) from None
+        elif input_type == "boolean":
+            if isinstance(value, str):
+                if value.lower() in ("true", "1", "yes"):
+                    value = True
+                elif value.lower() in ("false", "0", "no"):
+                    value = False
+                else:
+                    msg = f"Input {name!r} expected a boolean, got {value!r}."
+                    raise ValueError(msg)
+
+        if enum_values is not None and value not in enum_values:
+            msg = (
+                f"Input {name!r} value {value!r} not in allowed "
+                f"values: {enum_values}."
+            )
+            raise ValueError(msg)
+
+        return value
+
+    def list_runs(self) -> list[dict[str, Any]]:
+        """List all workflow runs in the project."""
+        runs_dir = self.project_root / ".specify" / "workflows" / "runs"
+        if not runs_dir.exists():
+            return []
+
+        runs: list[dict[str, Any]] = []
+        for run_dir in sorted(runs_dir.iterdir()):
+            if not run_dir.is_dir():
+                continue
+            state_path = run_dir / "state.json"
+            if state_path.exists():
+                with open(state_path, encoding="utf-8") as f:
+                    state_data = json.load(f)
+                runs.append(state_data)
+        return runs
+
+
+class WorkflowAbortError(Exception):
+    """Raised when a workflow is aborted (e.g., gate rejection)."""

src/specify_cli/workflows/expressions.py

@@ -0,0 +1,300 @@
+"""Sandboxed expression evaluator for workflow templates.
+
+Provides a safe Jinja2 subset for evaluating expressions in workflow YAML.
+No file I/O, no imports, no arbitrary code execution.
+"""
+
+from __future__ import annotations
+
+import re
+from typing import Any
+
+
+# -- Custom filters -------------------------------------------------------
+
+def _filter_default(value: Any, default_value: Any = "") -> Any:
+    """Return *default_value* when *value* is ``None`` or empty string."""
+    if value is None or value == "":
+        return default_value
+    return value
+
+
+def _filter_join(value: Any, separator: str = ", ") -> str:
+    """Join a list into a string with *separator*."""
+    if isinstance(value, list):
+        return separator.join(str(v) for v in value)
+    return str(value)
+
+
+def _filter_map(value: Any, attr: str) -> list[Any]:
+    """Map a list of dicts to a specific attribute."""
+    if isinstance(value, list):
+        result = []
+        for item in value:
+            if isinstance(item, dict):
+                # Support dot notation: "result.status" → item["result"]["status"]
+                parts = attr.split(".")
+                v = item
+                for part in parts:
+                    if isinstance(v, dict):
+                        v = v.get(part)
+                    else:
+                        v = None
+                        break
+                result.append(v)
+            else:
+                result.append(item)
+        return result
+    return []
+
+
+def _filter_contains(value: Any, substring: str) -> bool:
+    """Check if a string or list contains *substring*."""
+    if isinstance(value, str):
+        return substring in value
+    if isinstance(value, list):
+        return substring in value
+    return False
+
+
+# -- Expression resolution ------------------------------------------------
+
+_EXPR_PATTERN = re.compile(r"\{\{(.+?)\}\}")
+
+
+def _resolve_dot_path(obj: Any, path: str) -> Any:
+    """Resolve a dotted path like ``steps.specify.output.file`` against *obj*.
+
+    Supports dict key access and list indexing (e.g., ``task_list[0]``).
+    """
+    parts = path.split(".")
+    current = obj
+    for part in parts:
+        # Handle list indexing: name[0]
+        idx_match = re.match(r"^([\w-]+)\[(\d+)\]$", part)
+        if idx_match:
+            key, idx = idx_match.group(1), int(idx_match.group(2))
+            if isinstance(current, dict):
+                current = current.get(key)
+            else:
+                return None
+            if isinstance(current, list) and 0 <= idx < len(current):
+                current = current[idx]
+            else:
+                return None
+        elif isinstance(current, dict):
+            current = current.get(part)
+        else:
+            return None
+        if current is None:
+            return None
+    return current
+
+
+def _build_namespace(context: Any) -> dict[str, Any]:
+    """Build the variable namespace from a StepContext."""
+    ns: dict[str, Any] = {}
+    if hasattr(context, "inputs"):
+        ns["inputs"] = context.inputs or {}
+    if hasattr(context, "steps"):
+        ns["steps"] = context.steps or {}
+    if hasattr(context, "item"):
+        ns["item"] = context.item
+    if hasattr(context, "fan_in"):
+        ns["fan_in"] = context.fan_in or {}
+    return ns
+
+
+def _evaluate_simple_expression(expr: str, namespace: dict[str, Any]) -> Any:
+    """Evaluate a simple expression against the namespace.
+
+    Supports:
+    - Dot-path access: ``steps.specify.output.file``
+    - Comparisons: ``==``, ``!=``, ``>``, ``<``, ``>=``, ``<=``
+    - Boolean operators: ``and``, ``or``, ``not``
+    - ``in``, ``not in``
+    - Pipe filters: ``| default('...')``, ``| join(', ')``, ``| contains('...')``, ``| map('...')``
+    - String and numeric literals
+    """
+    expr = expr.strip()
+
+    # String literal — check before pipes and operators so quoted strings
+    # containing | or operator keywords are not mis-parsed.
+    if (expr.startswith("'") and expr.endswith("'")) or (
+        expr.startswith('"') and expr.endswith('"')
+    ):
+        return expr[1:-1]
+
+    # Handle pipe filters
+    if "|" in expr:
+        parts = expr.split("|", 1)
+        value = _evaluate_simple_expression(parts[0].strip(), namespace)
+        filter_expr = parts[1].strip()
+
+        # Parse filter name and argument
+        filter_match = re.match(r"(\w+)\((.+)\)", filter_expr)
+        if filter_match:
+            fname = filter_match.group(1)
+            farg = _evaluate_simple_expression(filter_match.group(2).strip(), namespace)
+            if fname == "default":
+                return _filter_default(value, farg)
+            if fname == "join":
+                return _filter_join(value, farg)
+            if fname == "map":
+                return _filter_map(value, farg)
+            if fname == "contains":
+                return _filter_contains(value, farg)
+        # Filter without args
+        filter_name = filter_expr.strip()
+        if filter_name == "default":
+            return _filter_default(value)
+        return value
+
+    # Boolean operators — parse 'or' first (lower precedence) so that
+    # 'a or b and c' is evaluated as 'a or (b and c)'.
+    if " or " in expr:
+        parts = expr.split(" or ", 1)
+        left = _evaluate_simple_expression(parts[0].strip(), namespace)
+        right = _evaluate_simple_expression(parts[1].strip(), namespace)
+        return bool(left) or bool(right)
+
+    if " and " in expr:
+        parts = expr.split(" and ", 1)
+        left = _evaluate_simple_expression(parts[0].strip(), namespace)
+        right = _evaluate_simple_expression(parts[1].strip(), namespace)
+        return bool(left) and bool(right)
+
+    if expr.startswith("not "):
+        inner = _evaluate_simple_expression(expr[4:].strip(), namespace)
+        return not bool(inner)
+
+    # Comparison operators (order matters — check multi-char ops first)
+    for op in ("!=", "==", ">=", "<=", ">", "<", " not in ", " in "):
+        if op in expr:
+            parts = expr.split(op, 1)
+            left = _evaluate_simple_expression(parts[0].strip(), namespace)
+            right = _evaluate_simple_expression(parts[1].strip(), namespace)
+            if op == "==":
+                return left == right
+            if op == "!=":
+                return left != right
+            if op == ">":
+                return _safe_compare(left, right, ">")
+            if op == "<":
+                return _safe_compare(left, right, "<")
+            if op == ">=":
+                return _safe_compare(left, right, ">=")
+            if op == "<=":
+                return _safe_compare(left, right, "<=")
+            if op == " in ":
+                return left in right if right is not None else False
+            if op == " not in ":
+                return left not in right if right is not None else True
+
+    # Numeric literal
+    try:
+        if "." in expr:
+            return float(expr)
+        return int(expr)
+    except (ValueError, TypeError):
+        pass
+
+    # Boolean literal
+    if expr.lower() == "true":
+        return True
+    if expr.lower() == "false":
+        return False
+
+    # Null
+    if expr.lower() in ("none", "null"):
+        return None
+
+    # List literal (simple)
+    if expr.startswith("[") and expr.endswith("]"):
+        inner = expr[1:-1].strip()
+        if not inner:
+            return []
+        items = [_evaluate_simple_expression(i.strip(), namespace) for i in inner.split(",")]
+        return items
+
+    # Variable reference (dot-path)
+    return _resolve_dot_path(namespace, expr)
+
+
+def _safe_compare(left: Any, right: Any, op: str) -> bool:
+    """Safely compare two values, coercing types when possible."""
+    try:
+        if isinstance(left, str):
+            left = float(left) if "." in left else int(left)
+        if isinstance(right, str):
+            right = float(right) if "." in right else int(right)
+    except (ValueError, TypeError):
+        return False
+    try:
+        if op == ">":
+            return left > right  # type: ignore[operator]
+        if op == "<":
+            return left < right  # type: ignore[operator]
+        if op == ">=":
+            return left >= right  # type: ignore[operator]
+        if op == "<=":
+            return left <= right  # type: ignore[operator]
+    except TypeError:
+        return False
+    return False
+
+
+def evaluate_expression(template: str, context: Any) -> Any:
+    """Evaluate a template string with ``{{ ... }}`` expressions.
+
+    If the entire string is a single expression, returns the raw value
+    (preserving type).  Otherwise, substitutes each expression inline
+    and returns a string.
+
+    Parameters
+    ----------
+    template:
+        The template string (e.g., ``"{{ steps.plan.output.task_count }}"``
+        or ``"Processed {{ inputs.feature_name }}"``.
+    context:
+        A ``StepContext`` or compatible object.
+
+    Returns
+    -------
+    The resolved value (any type for single-expression templates,
+    string for multi-expression or mixed templates).
+    """
+    if not isinstance(template, str):
+        return template
+
+    namespace = _build_namespace(context)
+
+    # Single expression: return typed value
+    match = _EXPR_PATTERN.fullmatch(template.strip())
+    if match:
+        return _evaluate_simple_expression(match.group(1).strip(), namespace)
+
+    # Multi-expression: string interpolation
+    def _replacer(m: re.Match[str]) -> str:
+        val = _evaluate_simple_expression(m.group(1).strip(), namespace)
+        return str(val) if val is not None else ""
+
+    return _EXPR_PATTERN.sub(_replacer, template)
+
+
+def evaluate_condition(condition: str, context: Any) -> bool:
+    """Evaluate a condition expression and return a boolean.
+
+    Convenience wrapper around ``evaluate_expression`` that coerces
+    the result to bool.
+    """
+    result = evaluate_expression(condition, context)
+    # Treat plain "false"/"true" strings as booleans so that
+    # condition: "false" (without {{ }}) behaves as expected.
+    if isinstance(result, str):
+        lower = result.lower()
+        if lower == "false":
+            return False
+        if lower == "true":
+            return True
+    return bool(result)

src/specify_cli/workflows/steps/__init__.py

@@ -0,0 +1 @@
+"""Auto-discovery for built-in step types."""

src/specify_cli/workflows/steps/command/__init__.py

@@ -0,0 +1,155 @@
+"""Command step — dispatches a Spec Kit command to an integration CLI."""
+
+from __future__ import annotations
+
+import shutil
+from pathlib import Path
+from typing import Any
+
+from specify_cli.workflows.base import StepBase, StepContext, StepResult, StepStatus
+from specify_cli.workflows.expressions import evaluate_expression
+
+
+class CommandStep(StepBase):
+    """Default step type — invokes a Spec Kit command via the integration CLI.
+
+    The command files (skills, markdown, TOML) are already installed in
+    the integration's directory on disk.  This step tells the CLI to
+    execute the command by name (e.g. ``/speckit.specify`` or
+    ``/speckit-specify``) rather than reading the file contents.
+
+    .. note::
+
+        CLI output is streamed to the terminal for live progress.
+        ``output.exit_code`` is always captured and can be referenced
+        by later steps (e.g. ``{{ steps.specify.output.exit_code }}``).
+        Full ``stdout``/``stderr`` capture is a planned enhancement.
+    """
+
+    type_key = "command"
+
+    def execute(self, config: dict[str, Any], context: StepContext) -> StepResult:
+        command = config.get("command", "")
+        input_data = config.get("input", {})
+
+        # Resolve expressions in input
+        resolved_input: dict[str, Any] = {}
+        for key, value in input_data.items():
+            resolved_input[key] = evaluate_expression(value, context)
+
+        # Resolve integration (step → workflow default → project default)
+        integration = config.get("integration") or context.default_integration
+        if integration and isinstance(integration, str) and "{{" in integration:
+            integration = evaluate_expression(integration, context)
+
+        # Resolve model
+        model = config.get("model") or context.default_model
+        if model and isinstance(model, str) and "{{" in model:
+            model = evaluate_expression(model, context)
+
+        # Merge options (workflow defaults ← step overrides)
+        options = dict(context.default_options)
+        step_options = config.get("options", {})
+        if step_options:
+            options.update(step_options)
+
+        # Attempt CLI dispatch
+        args_str = str(resolved_input.get("args", ""))
+        dispatch_result = self._try_dispatch(
+            command, integration, model, args_str, context
+        )
+
+        output: dict[str, Any] = {
+            "command": command,
+            "integration": integration,
+            "model": model,
+            "options": options,
+            "input": resolved_input,
+        }
+
+        if dispatch_result is not None:
+            output["exit_code"] = dispatch_result["exit_code"]
+            output["stdout"] = dispatch_result["stdout"]
+            output["stderr"] = dispatch_result["stderr"]
+            output["dispatched"] = True
+            if dispatch_result["exit_code"] != 0:
+                return StepResult(
+                    status=StepStatus.FAILED,
+                    output=output,
+                    error=dispatch_result["stderr"] or f"Command exited with code {dispatch_result['exit_code']}",
+                )
+            return StepResult(
+                status=StepStatus.COMPLETED,
+                output=output,
+            )
+        else:
+            output["exit_code"] = 1
+            output["dispatched"] = False
+            return StepResult(
+                status=StepStatus.FAILED,
+                output=output,
+                error=(
+                    f"Cannot dispatch command {command!r}: "
+                    f"integration {integration!r} CLI not found or not installed. "
+                    f"Install the CLI tool or check 'specify integration list'."
+                ),
+            )
+
+    @staticmethod
+    def _try_dispatch(
+        command: str,
+        integration_key: str | None,
+        model: str | None,
+        args: str,
+        context: StepContext,
+    ) -> dict[str, Any] | None:
+        """Invoke *command* by name through the integration CLI.
+
+        The integration's ``dispatch_command`` builds the native
+        slash-command invocation (e.g. ``/speckit.specify`` for
+        markdown agents, ``/speckit-specify`` for skills agents),
+        then executes the CLI non-interactively.
+
+        Returns the dispatch result dict, or ``None`` if dispatch is
+        not possible (integration not found, CLI not installed, or
+        dispatch not supported).
+        """
+        if not integration_key:
+            return None
+
+        try:
+            from specify_cli.integrations import get_integration
+        except ImportError:
+            return None
+
+        impl = get_integration(integration_key)
+        if impl is None:
+            return None
+
+        # Check if the integration supports CLI dispatch
+        if impl.build_exec_args("test") is None:
+            return None
+
+        # Check if the CLI tool is actually installed
+        if not shutil.which(impl.key):
+            return None
+
+        project_root = Path(context.project_root) if context.project_root else None
+
+        try:
+            return impl.dispatch_command(
+                command,
+                args=args,
+                project_root=project_root,
+                model=model,
+            )
+        except (NotImplementedError, OSError):
+            return None
+
+    def validate(self, config: dict[str, Any]) -> list[str]:
+        errors = super().validate(config)
+        if "command" not in config:
+            errors.append(
+                f"Command step {config.get('id', '?')!r} is missing 'command' field."
+            )
+        return errors

src/specify_cli/workflows/steps/do_while/__init__.py

@@ -0,0 +1,61 @@
+"""Do-While loop step — execute at least once, then repeat while condition is truthy."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from specify_cli.workflows.base import StepBase, StepContext, StepResult, StepStatus
+
+
+class DoWhileStep(StepBase):
+    """Execute body at least once, then check condition.
+
+    Continues while condition is truthy.  ``max_iterations`` is an
+    optional safety cap (defaults to 10 if omitted).
+
+    The first invocation always returns the nested steps for execution.
+    The engine re-evaluates ``step_config['condition']`` after each
+    iteration to decide whether to loop again.
+    """
+
+    type_key = "do-while"
+
+    def execute(self, config: dict[str, Any], context: StepContext) -> StepResult:
+        max_iterations = config.get("max_iterations")
+        if max_iterations is None:
+            max_iterations = 10
+        nested_steps = config.get("steps", [])
+        condition = config.get("condition", "false")
+
+        # Always execute body at least once; the engine layer evaluates
+        # `condition` after each iteration to decide whether to loop.
+        return StepResult(
+            status=StepStatus.COMPLETED,
+            output={
+                "condition": condition,
+                "max_iterations": max_iterations,
+                "loop_type": "do-while",
+            },
+            next_steps=nested_steps,
+        )
+
+    def validate(self, config: dict[str, Any]) -> list[str]:
+        errors = super().validate(config)
+        if "condition" not in config:
+            errors.append(
+                f"Do-while step {config.get('id', '?')!r} is missing "
+                f"'condition' field."
+            )
+        max_iter = config.get("max_iterations")
+        if max_iter is not None:
+            if not isinstance(max_iter, int) or max_iter < 1:
+                errors.append(
+                    f"Do-while step {config.get('id', '?')!r}: "
+                    f"'max_iterations' must be an integer >= 1."
+                )
+        nested = config.get("steps", [])
+        if not isinstance(nested, list):
+            errors.append(
+                f"Do-while step {config.get('id', '?')!r}: 'steps' must be a list."
+            )
+        return errors

src/specify_cli/workflows/steps/fan_in/__init__.py

@@ -0,0 +1,61 @@
+"""Fan-in step — join point for parallel steps."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from specify_cli.workflows.base import StepBase, StepContext, StepResult, StepStatus
+from specify_cli.workflows.expressions import evaluate_expression
+
+
+class FanInStep(StepBase):
+    """Join point that aggregates results from ``wait_for:`` steps.
+
+    Reads completed step outputs from ``context.steps`` and collects
+    them into ``output.results``.  Does not block; relies on the
+    engine executing steps sequentially.
+    """
+
+    type_key = "fan-in"
+
+    def execute(self, config: dict[str, Any], context: StepContext) -> StepResult:
+        wait_for = config.get("wait_for", [])
+        output_config = config.get("output") or {}
+        if not isinstance(output_config, dict):
+            output_config = {}
+
+        # Collect results from referenced steps
+        results = []
+        for step_id in wait_for:
+            step_data = context.steps.get(step_id, {})
+            results.append(step_data.get("output", {}))
+
+        # Resolve output expressions with fan_in in context
+        prev_fan_in = getattr(context, "fan_in", None)
+        context.fan_in = {"results": results}
+        resolved_output: dict[str, Any] = {"results": results}
+
+        try:
+            for key, expr in output_config.items():
+                if isinstance(expr, str) and "{{" in expr:
+                    resolved_output[key] = evaluate_expression(expr, context)
+                else:
+                    resolved_output[key] = expr
+        finally:
+            # Restore previous fan_in state even if evaluation fails
+            context.fan_in = prev_fan_in
+
+        return StepResult(
+            status=StepStatus.COMPLETED,
+            output=resolved_output,
+        )
+
+    def validate(self, config: dict[str, Any]) -> list[str]:
+        errors = super().validate(config)
+        wait_for = config.get("wait_for", [])
+        if not isinstance(wait_for, list) or not wait_for:
+            errors.append(
+                f"Fan-in step {config.get('id', '?')!r}: "
+                f"'wait_for' must be a non-empty list of step IDs."
+            )
+        return errors

src/specify_cli/workflows/steps/fan_out/__init__.py

@@ -0,0 +1,58 @@
+"""Fan-out step — dispatch a step template over a collection."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from specify_cli.workflows.base import StepBase, StepContext, StepResult, StepStatus
+from specify_cli.workflows.expressions import evaluate_expression
+
+
+class FanOutStep(StepBase):
+    """Dispatch a step template for each item in a collection.
+
+    The engine executes the nested ``step:`` template once per item,
+    setting ``context.item`` for each iteration.  Execution is
+    currently sequential; ``max_concurrency`` is accepted but not
+    enforced.
+    """
+
+    type_key = "fan-out"
+
+    def execute(self, config: dict[str, Any], context: StepContext) -> StepResult:
+        items_expr = config.get("items", "[]")
+        items = evaluate_expression(items_expr, context)
+        if not isinstance(items, list):
+            items = []
+
+        max_concurrency = config.get("max_concurrency", 1)
+        step_template = config.get("step", {})
+
+        return StepResult(
+            status=StepStatus.COMPLETED,
+            output={
+                "items": items,
+                "max_concurrency": max_concurrency,
+                "step_template": step_template,
+                "item_count": len(items),
+            },
+        )
+
+    def validate(self, config: dict[str, Any]) -> list[str]:
+        errors = super().validate(config)
+        if "items" not in config:
+            errors.append(
+                f"Fan-out step {config.get('id', '?')!r} is missing "
+                f"'items' field."
+            )
+        if "step" not in config:
+            errors.append(
+                f"Fan-out step {config.get('id', '?')!r} is missing "
+                f"'step' field (nested step template)."
+            )
+        step = config.get("step")
+        if step is not None and not isinstance(step, dict):
+            errors.append(
+                f"Fan-out step {config.get('id', '?')!r}: 'step' must be a mapping."
+            )
+        return errors

src/specify_cli/workflows/steps/gate/__init__.py

@@ -0,0 +1,121 @@
+"""Gate step — human review gate."""
+
+from __future__ import annotations
+
+import sys
+from typing import Any
+
+from specify_cli.workflows.base import StepBase, StepContext, StepResult, StepStatus
+from specify_cli.workflows.expressions import evaluate_expression
+
+
+class GateStep(StepBase):
+    """Interactive review gate.
+
+    When running in an interactive terminal, prompts the user to choose
+    an option (e.g. approve / reject).  Falls back to ``PAUSED`` when
+    stdin is not a TTY (CI, piped input) so the run can be resumed
+    later with ``specify workflow resume``.
+
+    The user's choice is stored in ``output.choice``.  ``on_reject``
+    controls abort / skip behaviour.
+    """
+
+    type_key = "gate"
+
+    def execute(self, config: dict[str, Any], context: StepContext) -> StepResult:
+        message = config.get("message", "Review required.")
+        if isinstance(message, str) and "{{" in message:
+            message = evaluate_expression(message, context)
+
+        options = config.get("options", ["approve", "reject"])
+        on_reject = config.get("on_reject", "abort")
+
+        show_file = config.get("show_file")
+        if show_file and isinstance(show_file, str) and "{{" in show_file:
+            show_file = evaluate_expression(show_file, context)
+
+        output = {
+            "message": message,
+            "options": options,
+            "on_reject": on_reject,
+            "show_file": show_file,
+            "choice": None,
+        }
+
+        # Non-interactive: pause for later resume
+        if not sys.stdin.isatty():
+            return StepResult(status=StepStatus.PAUSED, output=output)
+
+        # Interactive: prompt the user
+        choice = self._prompt(message, options)
+        output["choice"] = choice
+
+        if choice in ("reject", "abort"):
+            if on_reject == "abort":
+                output["aborted"] = True
+                return StepResult(
+                    status=StepStatus.FAILED,
+                    output=output,
+                    error=f"Gate rejected by user at step {config.get('id', '?')!r}",
+                )
+            if on_reject == "retry":
+                # Pause so the next resume re-executes this gate
+                return StepResult(status=StepStatus.PAUSED, output=output)
+            # on_reject == "skip" → completed, downstream steps decide
+            return StepResult(status=StepStatus.COMPLETED, output=output)
+
+        return StepResult(status=StepStatus.COMPLETED, output=output)
+
+    @staticmethod
+    def _prompt(message: str, options: list[str]) -> str:
+        """Display gate message and prompt for a choice."""
+        print("\n  ┌─ Gate ─────────────────────────────────────")
+        print(f"  │ {message}")
+        print("  │")
+        for i, opt in enumerate(options, 1):
+            print(f"  │  [{i}] {opt}")
+        print("  └────────────────────────────────────────────")
+
+        while True:
+            try:
+                raw = input(f"  Choose [1-{len(options)}]: ").strip()
+            except (EOFError, KeyboardInterrupt):
+                print()
+                return options[-1]  # default to last (usually reject)
+            if raw.isdigit() and 1 <= int(raw) <= len(options):
+                return options[int(raw) - 1]
+            # Also accept the option name directly
+            if raw.lower() in [o.lower() for o in options]:
+                return next(o for o in options if o.lower() == raw.lower())
+            print(f"  Invalid choice. Enter 1-{len(options)} or an option name.")
+
+    def validate(self, config: dict[str, Any]) -> list[str]:
+        errors = super().validate(config)
+        if "message" not in config:
+            errors.append(
+                f"Gate step {config.get('id', '?')!r} is missing 'message' field."
+            )
+        options = config.get("options", ["approve", "reject"])
+        if not isinstance(options, list) or not options:
+            errors.append(
+                f"Gate step {config.get('id', '?')!r}: 'options' must be a non-empty list."
+            )
+        elif not all(isinstance(o, str) for o in options):
+            errors.append(
+                f"Gate step {config.get('id', '?')!r}: all options must be strings."
+            )
+        on_reject = config.get("on_reject", "abort")
+        if on_reject not in ("abort", "skip", "retry"):
+            errors.append(
+                f"Gate step {config.get('id', '?')!r}: 'on_reject' must be "
+                f"'abort', 'skip', or 'retry'."
+            )
+        if on_reject in ("abort", "retry") and isinstance(options, list):
+            reject_choices = {"reject", "abort"}
+            if not any(o.lower() in reject_choices for o in options):
+                errors.append(
+                    f"Gate step {config.get('id', '?')!r}: on_reject={on_reject!r} "
+                    f"but options has no 'reject' or 'abort' choice."
+                )
+        return errors

src/specify_cli/workflows/steps/if_then/__init__.py

@@ -0,0 +1,55 @@
+"""If/Then/Else step — conditional branching."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from specify_cli.workflows.base import StepBase, StepContext, StepResult, StepStatus
+from specify_cli.workflows.expressions import evaluate_condition
+
+
+class IfThenStep(StepBase):
+    """Branch based on a boolean condition expression.
+
+    Both ``then:`` and ``else:`` contain inline step arrays — full step
+    definitions, not ID references.
+    """
+
+    type_key = "if"
+
+    def execute(self, config: dict[str, Any], context: StepContext) -> StepResult:
+        condition = config.get("condition", False)
+        result = evaluate_condition(condition, context)
+
+        if result:
+            branch = config.get("then", [])
+        else:
+            branch = config.get("else", [])
+
+        return StepResult(
+            status=StepStatus.COMPLETED,
+            output={"condition_result": result},
+            next_steps=branch,
+        )
+
+    def validate(self, config: dict[str, Any]) -> list[str]:
+        errors = super().validate(config)
+        if "condition" not in config:
+            errors.append(
+                f"If step {config.get('id', '?')!r} is missing 'condition' field."
+            )
+        if "then" not in config:
+            errors.append(
+                f"If step {config.get('id', '?')!r} is missing 'then' field."
+            )
+        then_branch = config.get("then", [])
+        if not isinstance(then_branch, list):
+            errors.append(
+                f"If step {config.get('id', '?')!r}: 'then' must be a list of steps."
+            )
+        else_branch = config.get("else", [])
+        if else_branch and not isinstance(else_branch, list):
+            errors.append(
+                f"If step {config.get('id', '?')!r}: 'else' must be a list of steps."
+            )
+        return errors

src/specify_cli/workflows/steps/prompt/__init__.py

@@ -0,0 +1,156 @@
+"""Prompt step — sends an arbitrary prompt to an integration CLI."""
+
+from __future__ import annotations
+
+import shutil
+from pathlib import Path
+from typing import Any
+
+from specify_cli.workflows.base import StepBase, StepContext, StepResult, StepStatus
+from specify_cli.workflows.expressions import evaluate_expression
+
+
+class PromptStep(StepBase):
+    """Send a free-form prompt to an integration CLI.
+
+    Unlike ``CommandStep`` which invokes an installed Spec Kit command
+    by name (e.g. ``/speckit.specify`` or ``/speckit-specify``),
+    ``PromptStep`` sends an arbitrary inline ``prompt:`` string
+    directly to the CLI.  This is useful for ad-hoc instructions
+    that don't map to a registered command.
+
+    .. note::
+
+        CLI output is streamed to the terminal for live progress.
+        ``output.exit_code`` is always captured and can be referenced
+        by later steps.  Full response text capture is a planned
+        enhancement.
+
+    Example YAML::
+
+        - id: review-security
+          type: prompt
+          prompt: "Review {{ inputs.file }} for security vulnerabilities"
+          integration: claude
+    """
+
+    type_key = "prompt"
+
+    def execute(self, config: dict[str, Any], context: StepContext) -> StepResult:
+        prompt_template = config.get("prompt", "")
+        prompt = evaluate_expression(prompt_template, context)
+        if not isinstance(prompt, str):
+            prompt = str(prompt)
+
+        # Resolve integration (step → workflow default)
+        integration = config.get("integration") or context.default_integration
+        if integration and isinstance(integration, str) and "{{" in integration:
+            integration = evaluate_expression(integration, context)
+
+        # Resolve model
+        model = config.get("model") or context.default_model
+        if model and isinstance(model, str) and "{{" in model:
+            model = evaluate_expression(model, context)
+
+        # Attempt CLI dispatch
+        dispatch_result = self._try_dispatch(
+            prompt, integration, model, context
+        )
+
+        output: dict[str, Any] = {
+            "prompt": prompt,
+            "integration": integration,
+            "model": model,
+        }
+
+        if dispatch_result is not None:
+            output["exit_code"] = dispatch_result["exit_code"]
+            output["stdout"] = dispatch_result["stdout"]
+            output["stderr"] = dispatch_result["stderr"]
+            output["dispatched"] = True
+            if dispatch_result["exit_code"] != 0:
+                return StepResult(
+                    status=StepStatus.FAILED,
+                    output=output,
+                    error=(
+                        dispatch_result["stderr"]
+                        or f"Prompt exited with code {dispatch_result['exit_code']}"
+                    ),
+                )
+            return StepResult(
+                status=StepStatus.COMPLETED,
+                output=output,
+            )
+        else:
+            output["exit_code"] = 1
+            output["dispatched"] = False
+            return StepResult(
+                status=StepStatus.FAILED,
+                output=output,
+                error=(
+                    f"Cannot dispatch prompt: "
+                    f"integration {integration!r} "
+                    f"CLI not found or not installed."
+                ),
+            )
+
+    @staticmethod
+    def _try_dispatch(
+        prompt: str,
+        integration_key: str | None,
+        model: str | None,
+        context: StepContext,
+    ) -> dict[str, Any] | None:
+        """Dispatch *prompt* directly through the integration CLI."""
+        if not integration_key or not prompt:
+            return None
+
+        try:
+            from specify_cli.integrations import get_integration
+        except ImportError:
+            return None
+
+        impl = get_integration(integration_key)
+        if impl is None:
+            return None
+
+        exec_args = impl.build_exec_args(prompt, model=model, output_json=False)
+        if exec_args is None:
+            return None
+
+        if not shutil.which(impl.key):
+            return None
+
+        import subprocess
+
+        project_root = (
+            Path(context.project_root) if context.project_root else Path.cwd()
+        )
+
+        try:
+            result = subprocess.run(
+                exec_args,
+                text=True,
+                cwd=str(project_root),
+            )
+            return {
+                "exit_code": result.returncode,
+                "stdout": "",
+                "stderr": "",
+            }
+        except KeyboardInterrupt:
+            return {
+                "exit_code": 130,
+                "stdout": "",
+                "stderr": "Interrupted by user",
+            }
+        except OSError:
+            return None
+
+    def validate(self, config: dict[str, Any]) -> list[str]:
+        errors = super().validate(config)
+        if "prompt" not in config:
+            errors.append(
+                f"Prompt step {config.get('id', '?')!r} is missing 'prompt' field."
+            )
+        return errors

src/specify_cli/workflows/steps/shell/__init__.py

@@ -0,0 +1,75 @@
+"""Shell step — run a local shell command."""
+
+from __future__ import annotations
+
+import subprocess
+from typing import Any
+
+from specify_cli.workflows.base import StepBase, StepContext, StepResult, StepStatus
+from specify_cli.workflows.expressions import evaluate_expression
+
+
+class ShellStep(StepBase):
+    """Run a local shell command (non-agent).
+
+    Captures exit code and stdout/stderr.
+    """
+
+    type_key = "shell"
+
+    def execute(self, config: dict[str, Any], context: StepContext) -> StepResult:
+        run_cmd = config.get("run", "")
+        if isinstance(run_cmd, str) and "{{" in run_cmd:
+            run_cmd = evaluate_expression(run_cmd, context)
+        run_cmd = str(run_cmd)
+
+        cwd = context.project_root or "."
+
+        # NOTE: shell=True is required to support pipes, redirects, and
+        # multi-command expressions in workflow YAML.  Workflow authors
+        # control commands; catalog-installed workflows should be reviewed
+        # before use (see PUBLISHING.md for security guidance).
+        try:
+            proc = subprocess.run(
+                run_cmd,
+                shell=True,
+                capture_output=True,
+                text=True,
+                cwd=cwd,
+                timeout=300,
+            )
+            output = {
+                "exit_code": proc.returncode,
+                "stdout": proc.stdout,
+                "stderr": proc.stderr,
+            }
+            if proc.returncode != 0:
+                return StepResult(
+                    status=StepStatus.FAILED,
+                    error=f"Shell command exited with code {proc.returncode}.",
+                    output=output,
+                )
+            return StepResult(
+                status=StepStatus.COMPLETED,
+                output=output,
+            )
+        except subprocess.TimeoutExpired:
+            return StepResult(
+                status=StepStatus.FAILED,
+                error="Shell command timed out after 300 seconds.",
+                output={"exit_code": -1, "stdout": "", "stderr": "timeout"},
+            )
+        except OSError as exc:
+            return StepResult(
+                status=StepStatus.FAILED,
+                error=f"Shell command failed: {exc}",
+                output={"exit_code": -1, "stdout": "", "stderr": str(exc)},
+            )
+
+    def validate(self, config: dict[str, Any]) -> list[str]:
+        errors = super().validate(config)
+        if "run" not in config:
+            errors.append(
+                f"Shell step {config.get('id', '?')!r} is missing 'run' field."
+            )
+        return errors

src/specify_cli/workflows/steps/switch/__init__.py

@@ -0,0 +1,70 @@
+"""Switch step — multi-branch dispatch."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from specify_cli.workflows.base import StepBase, StepContext, StepResult, StepStatus
+from specify_cli.workflows.expressions import evaluate_expression
+
+
+class SwitchStep(StepBase):
+    """Multi-branch dispatch on an expression.
+
+    Evaluates ``expression:`` once, matches against ``cases:`` keys
+    (exact match, string-coerced).  Falls through to ``default:`` if
+    no case matches.
+    """
+
+    type_key = "switch"
+
+    def execute(self, config: dict[str, Any], context: StepContext) -> StepResult:
+        expression = config.get("expression", "")
+        value = evaluate_expression(expression, context)
+
+        # String-coerce for matching
+        str_value = str(value) if value is not None else ""
+
+        cases = config.get("cases", {})
+        for case_key, case_steps in cases.items():
+            if str(case_key) == str_value:
+                return StepResult(
+                    status=StepStatus.COMPLETED,
+                    output={"matched_case": str(case_key), "expression_value": value},
+                    next_steps=case_steps,
+                )
+
+        # Default fallback
+        default_steps = config.get("default", [])
+        return StepResult(
+            status=StepStatus.COMPLETED,
+            output={"matched_case": "__default__", "expression_value": value},
+            next_steps=default_steps,
+        )
+
+    def validate(self, config: dict[str, Any]) -> list[str]:
+        errors = super().validate(config)
+        if "expression" not in config:
+            errors.append(
+                f"Switch step {config.get('id', '?')!r} is missing "
+                f"'expression' field."
+            )
+        cases = config.get("cases", {})
+        if not isinstance(cases, dict):
+            errors.append(
+                f"Switch step {config.get('id', '?')!r}: 'cases' must be a mapping."
+            )
+        else:
+            for key, val in cases.items():
+                if not isinstance(val, list):
+                    errors.append(
+                        f"Switch step {config.get('id', '?')!r}: "
+                        f"case {key!r} must be a list of steps."
+                    )
+        default = config.get("default")
+        if default is not None and not isinstance(default, list):
+            errors.append(
+                f"Switch step {config.get('id', '?')!r}: "
+                f"'default' must be a list of steps."
+            )
+        return errors

src/specify_cli/workflows/steps/while_loop/__init__.py

@@ -0,0 +1,68 @@
+"""While loop step — repeat while condition is truthy."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from specify_cli.workflows.base import StepBase, StepContext, StepResult, StepStatus
+from specify_cli.workflows.expressions import evaluate_condition
+
+
+class WhileStep(StepBase):
+    """Repeat nested steps while condition is truthy.
+
+    Evaluates condition *before* each iteration.  If falsy on first
+    check, the body never runs.  ``max_iterations`` is an optional
+    safety cap (defaults to 10 if omitted).
+    """
+
+    type_key = "while"
+
+    def execute(self, config: dict[str, Any], context: StepContext) -> StepResult:
+        condition = config.get("condition", False)
+        max_iterations = config.get("max_iterations")
+        if max_iterations is None:
+            max_iterations = 10
+        nested_steps = config.get("steps", [])
+
+        result = evaluate_condition(condition, context)
+        if result:
+            return StepResult(
+                status=StepStatus.COMPLETED,
+                output={
+                    "condition_result": True,
+                    "max_iterations": max_iterations,
+                    "loop_type": "while",
+                },
+                next_steps=nested_steps,
+            )
+
+        return StepResult(
+            status=StepStatus.COMPLETED,
+            output={
+                "condition_result": False,
+                "max_iterations": max_iterations,
+                "loop_type": "while",
+            },
+        )
+
+    def validate(self, config: dict[str, Any]) -> list[str]:
+        errors = super().validate(config)
+        if "condition" not in config:
+            errors.append(
+                f"While step {config.get('id', '?')!r} is missing "
+                f"'condition' field."
+            )
+        max_iter = config.get("max_iterations")
+        if max_iter is not None:
+            if not isinstance(max_iter, int) or max_iter < 1:
+                errors.append(
+                    f"While step {config.get('id', '?')!r}: "
+                    f"'max_iterations' must be an integer >= 1."
+                )
+        nested = config.get("steps", [])
+        if not isinstance(nested, list):
+            errors.append(
+                f"While step {config.get('id', '?')!r}: 'steps' must be a list."
+            )
+        return errors

tests/integrations/test_integration_base_markdown.py

@@ -245,6 +245,9 @@ class MarkdownIntegrationTests:
             files.append(f".specify/templates/{name}")
 
         files.append(".specify/memory/constitution.md")
+        # Bundled workflow
+        files.append(".specify/workflows/speckit/workflow.yml")
+        files.append(".specify/workflows/workflow-registry.json")
         return sorted(files)
 
     def test_complete_file_inventory_sh(self, tmp_path):

tests/integrations/test_integration_base_skills.py

@@ -347,6 +347,11 @@ class SkillsIntegrationTests:
             ".specify/templates/spec-template.md",
             ".specify/templates/tasks-template.md",
         ]
+        # Bundled workflow
+        files += [
+            ".specify/workflows/speckit/workflow.yml",
+            ".specify/workflows/workflow-registry.json",
+        ]
         return sorted(files)
 
     def test_complete_file_inventory_sh(self, tmp_path):

tests/integrations/test_integration_base_toml.py

@@ -505,6 +505,9 @@ class TomlIntegrationTests:
             files.append(f".specify/templates/{name}")
 
         files.append(".specify/memory/constitution.md")
+        # Bundled workflow
+        files.append(".specify/workflows/speckit/workflow.yml")
+        files.append(".specify/workflows/workflow-registry.json")
         return sorted(files)
 
     def test_complete_file_inventory_sh(self, tmp_path):

tests/integrations/test_integration_base_yaml.py

@@ -384,6 +384,9 @@ class YamlIntegrationTests:
             files.append(f".specify/templates/{name}")
 
         files.append(".specify/memory/constitution.md")
+        # Bundled workflow
+        files.append(".specify/workflows/speckit/workflow.yml")
+        files.append(".specify/workflows/workflow-registry.json")
         return sorted(files)
 
     def test_complete_file_inventory_sh(self, tmp_path):

tests/integrations/test_integration_copilot.py

@@ -199,6 +199,8 @@ class TestCopilotIntegration:
             ".specify/templates/spec-template.md",
             ".specify/templates/tasks-template.md",
             ".specify/memory/constitution.md",
+            ".specify/workflows/speckit/workflow.yml",
+            ".specify/workflows/workflow-registry.json",
         ])
         assert actual == expected, (
             f"Missing: {sorted(set(expected) - set(actual))}\n"
@@ -259,6 +261,8 @@ class TestCopilotIntegration:
             ".specify/templates/spec-template.md",
             ".specify/templates/tasks-template.md",
             ".specify/memory/constitution.md",
+            ".specify/workflows/speckit/workflow.yml",
+            ".specify/workflows/workflow-registry.json",
         ])
         assert actual == expected, (
             f"Missing: {sorted(set(expected) - set(actual))}\n"

tests/integrations/test_integration_generic.py

@@ -248,6 +248,8 @@ class TestGenericIntegration:
             ".specify/templates/plan-template.md",
             ".specify/templates/spec-template.md",
             ".specify/templates/tasks-template.md",
+            ".specify/workflows/speckit/workflow.yml",
+            ".specify/workflows/workflow-registry.json",
         ])
         assert actual == expected, (
             f"Missing: {sorted(set(expected) - set(actual))}\n"
@@ -304,6 +306,8 @@ class TestGenericIntegration:
             ".specify/templates/plan-template.md",
             ".specify/templates/spec-template.md",
             ".specify/templates/tasks-template.md",
+            ".specify/workflows/speckit/workflow.yml",
+            ".specify/workflows/workflow-registry.json",
         ])
         assert actual == expected, (
             f"Missing: {sorted(set(expected) - set(actual))}\n"

workflows/ARCHITECTURE.md

@@ -0,0 +1,211 @@
+# Workflow System Architecture
+
+This document describes the internal architecture of the workflow engine — how definitions are parsed, steps are dispatched, state is persisted, and catalogs are resolved.
+
+For usage instructions, see [README.md](README.md).
+
+## Execution Model
+
+When `specify workflow run` is invoked, the engine loads a YAML definition, resolves inputs, and dispatches steps sequentially through the step registry:
+
+```mermaid
+flowchart TD
+    A["specify workflow run my-workflow"] --> B["WorkflowEngine.load_workflow()"]
+    B --> C["WorkflowDefinition.from_yaml()"]
+    C --> D["_resolve_inputs()"]
+    D --> E["validate_workflow()"]
+    E --> F["RunState.create()"]
+    F --> G["_execute_steps()"]
+    G --> H{Step type?}
+    H -- command --> I["CommandStep.execute()"]
+    H -- shell --> J["ShellStep.execute()"]
+    H -- gate --> K["GateStep.execute()"]
+    H -- "if" --> L["IfThenStep.execute()"]
+    H -- switch --> M["SwitchStep.execute()"]
+    H -- "while/do-while" --> N["Loop steps"]
+    H -- "fan-out/fan-in" --> O["Fan-out/fan-in"]
+
+    I --> P{Result status?}
+    J --> P
+    K --> P
+    L --> P
+    M --> P
+    N --> P
+    O --> P
+    P -- COMPLETED --> Q{Has next_steps?}
+    P -- PAUSED --> R["Save state → exit"]
+    P -- FAILED --> S["Log error → exit"]
+    Q -- Yes --> G
+    Q -- No --> T{More steps?}
+    T -- Yes --> G
+    T -- No --> U["Status = COMPLETED"]
+
+    style R fill:#ff9800,color:#fff
+    style S fill:#f44336,color:#fff
+    style U fill:#4caf50,color:#fff
+```
+
+### Sequential Execution
+
+Steps execute sequentially. Each step receives a `StepContext` containing resolved inputs, accumulated step results, and workflow-level defaults. After execution, the step's output is stored in `context.steps[step_id]` and made available to subsequent steps via expressions like `{{ steps.specify.output.file }}`.
+
+### Nested Steps (Control Flow)
+
+Steps like `if`, `switch`, `while`, and `do-while` return `next_steps` — inline step definitions that the engine executes recursively via `_execute_steps()`. Nested steps share the same `StepContext` and `RunState`, so their outputs are visible to later top-level steps.
+
+### State Persistence and Resume
+
+The engine saves `RunState` to disk after each step, enabling resume from the exact point of interruption:
+
+```mermaid
+flowchart LR
+    A["CREATED"] --> B["RUNNING"]
+    B --> C["COMPLETED"]
+    B --> D["PAUSED"]
+    B --> E["FAILED"]
+    B --> F["ABORTED"]
+    D -- "resume()" --> B
+    E -- "resume()" --> B
+```
+
+When a `gate` step pauses execution, the engine persists `current_step_index` and all accumulated `step_results`. On `specify workflow resume <run_id>`, the engine restores the context and continues from the paused step.
+
+> **Note:** Resume tracking is at the top-level step index only. If a
+> nested step (inside `if`/`switch`/`while`) pauses, resume re-runs
+> the parent control-flow step and its nested body. A nested step-path
+> stack for exact resume is a planned enhancement.
+
+## Step Types
+
+The engine ships with 10 built-in step types, each in its own subpackage under `src/specify_cli/workflows/steps/`:
+
+| Type Key | Class | Purpose | Returns `next_steps`? |
+|----------|-------|---------|-----------------------|
+| `command` | `CommandStep` | Invoke an installed Spec Kit command via integration CLI | No |
+| `prompt` | `PromptStep` | Send an arbitrary inline prompt to integration CLI | No |
+| `shell` | `ShellStep` | Run a shell command, capture output | No |
+| `gate` | `GateStep` | Interactive human review/approval | No (pauses in CI) |
+| `if` | `IfThenStep` | Conditional branching (then/else) | Yes |
+| `switch` | `SwitchStep` | Multi-branch dispatch on expression | Yes |
+| `while` | `WhileStep` | Loop while condition is truthy | Yes (if true) |
+| `do-while` | `DoWhileStep` | Loop, always runs body at least once | Yes (always) |
+| `fan-out` | `FanOutStep` | Dispatch per item over a collection | No (engine expands) |
+| `fan-in` | `FanInStep` | Aggregate results from fan-out | No |
+
+## Step Registry
+
+All step types register into `STEP_REGISTRY` via `_register_builtin_steps()` in `src/specify_cli/workflows/__init__.py`. The registry maps `type_key` strings to step instances:
+
+```python
+STEP_REGISTRY: dict[str, StepBase]  # e.g., {"command": CommandStep(), "gate": GateStep(), ...}
+```
+
+Registration is explicit — each step class is imported and instantiated. New step types follow the same pattern: subclass `StepBase`, set `type_key`, implement `execute()` and optionally `validate()`.
+
+## Expression Engine
+
+Workflow definitions use Jinja2-like `{{ expression }}` syntax for dynamic values. The expression engine in `src/specify_cli/workflows/expressions.py` supports:
+
+| Feature | Syntax | Example |
+|---------|--------|---------|
+| Variable access | `{{ inputs.name }}` | Dot-path traversal into context |
+| Step outputs | `{{ steps.plan.output.file }}` | Access previous step results |
+| Comparisons | `==`, `!=`, `>`, `<`, `>=`, `<=` | `{{ count > 5 }}` |
+| Boolean logic | `and`, `or`, `not` | `{{ items and status == 'ok' }}` |
+| Membership | `in`, `not in` | `{{ 'error' not in status }}` |
+| Literals | strings, numbers, booleans, lists | `{{ true }}`, `{{ [1, 2] }}` |
+| Filter: `default` | `{{ val \| default('fallback') }}` | Fallback for None/empty |
+| Filter: `join` | `{{ list \| join(', ') }}` | Join list elements |
+| Filter: `contains` | `{{ text \| contains('sub') }}` | Substring/membership check |
+| Filter: `map` | `{{ list \| map('attr') }}` | Extract attribute from each item |
+
+**Single expressions** (`{{ expr }}` only) return typed values. **Mixed templates** (`"text {{ expr }} more"`) return interpolated strings.
+
+### Namespace
+
+The expression evaluator builds a namespace from the `StepContext`:
+
+| Key | Source | Available when |
+|-----|--------|----------------|
+| `inputs` | Resolved workflow inputs | Always |
+| `steps` | Accumulated step results | After first step |
+| `item` | Current iteration item | Inside fan-out |
+| `fan_in` | Aggregated results | Inside fan-in |
+
+## Input Resolution
+
+When a workflow is executed, `_resolve_inputs()` validates and coerces provided values against the `inputs:` schema:
+
+| Declared Type | Coercion | Example |
+|---------------|----------|---------|
+| `string` | None (pass-through) | `"my-feature"` |
+| `number` | `float()` → `int()` if whole | `"42"` → `42` |
+| `boolean` | `"true"/"1"/"yes"` → `True` | `"false"` → `False` |
+| `enum` | Validates against allowed values | `["full", "backend-only"]` |
+
+Missing required inputs raise `ValueError`. Inputs with `default` values use the default when not provided.
+
+## Catalog System
+
+```mermaid
+flowchart TD
+    A["specify workflow search"] --> B["WorkflowCatalog.get_active_catalogs()"]
+    B --> C{SPECKIT_WORKFLOW_CATALOG_URL set?}
+    C -- Yes --> D["Single custom catalog"]
+    C -- No --> E{.specify/workflow-catalogs.yml exists?}
+    E -- Yes --> F["Project-level catalog stack"]
+    E -- No --> G{"~/.specify/workflow-catalogs.yml exists?"}
+    G -- Yes --> H["User-level catalog stack"]
+    G -- No --> I["Built-in defaults"]
+    I --> J["default (install allowed)"]
+    I --> K["community (discovery only)"]
+
+    style D fill:#ff9800,color:#fff
+    style F fill:#2196f3,color:#fff
+    style H fill:#2196f3,color:#fff
+    style J fill:#4caf50,color:#fff
+    style K fill:#9e9e9e,color:#fff
+```
+
+Catalogs are fetched with a 1-hour cache (per-URL, SHA256-hashed cache files in `.specify/workflows/.cache/`). Each catalog entry has a `priority` (for merge ordering) and `install_allowed` flag.
+
+When `specify workflow add <id>` installs from catalog, it downloads the workflow YAML from the catalog entry's `url` field into `.specify/workflows/<id>/workflow.yml`.
+
+## State and Configuration Locations
+
+| Component | Location | Format | Purpose |
+|-----------|----------|--------|---------|
+| Workflow definitions | `.specify/workflows/{id}/workflow.yml` | YAML | Installed workflow definitions |
+| Workflow registry | `.specify/workflows/workflow-registry.json` | JSON | Installed workflows metadata |
+| Run state | `.specify/workflows/runs/{run_id}/state.json` | JSON | Persisted execution state |
+| Run inputs | `.specify/workflows/runs/{run_id}/inputs.json` | JSON | Resolved input values |
+| Run log | `.specify/workflows/runs/{run_id}/log.jsonl` | JSONL | Append-only event log |
+| Catalog cache | `.specify/workflows/.cache/*.json` | JSON | Cached catalog entries (1hr TTL) |
+| Project catalogs | `.specify/workflow-catalogs.yml` | YAML | Project-level catalog sources |
+| User catalogs | `~/.specify/workflow-catalogs.yml` | YAML | User-level catalog sources |
+
+## Module Structure
+
+```
+src/specify_cli/
+├── workflows/
+│   ├── __init__.py          # STEP_REGISTRY + _register_builtin_steps()
+│   ├── base.py              # StepBase, StepContext, StepResult, StepStatus, RunStatus
+│   ├── catalog.py           # WorkflowCatalog, WorkflowCatalogEntry, WorkflowRegistry
+│   ├── engine.py            # WorkflowDefinition, WorkflowEngine, RunState, validate_workflow()
+│   ├── expressions.py       # evaluate_expression(), evaluate_condition(), filters
+│   └── steps/
+│       ├── command/         # Dispatch command to AI integration
+│       ├── shell/           # Run shell command
+│       ├── gate/            # Human review checkpoint
+│       ├── if_then/         # Conditional branching
+│       ├── prompt/          # Arbitrary inline prompts
+│       ├── switch/          # Multi-branch dispatch
+│       ├── while_loop/      # While loop
+│       ├── do_while/        # Do-while loop
+│       ├── fan_out/         # Sequential per-item dispatch
+│       └── fan_in/          # Result aggregation
+└── __init__.py              # CLI commands: specify workflow run/resume/status/
+                             #   list/add/remove/search/info,
+                             #   specify workflow catalog list/add/remove
+```

workflows/PUBLISHING.md

@@ -0,0 +1,285 @@
+# Workflow Publishing Guide
+
+This guide explains how to publish your workflow to the Spec Kit workflow catalog, making it discoverable by `specify workflow search`.
+
+## Table of Contents
+
+1. [Prerequisites](#prerequisites)
+2. [Prepare Your Workflow](#prepare-your-workflow)
+3. [Submit to Catalog](#submit-to-catalog)
+4. [Verification Process](#verification-process)
+5. [Release Workflow](#release-workflow)
+6. [Best Practices](#best-practices)
+
+---
+
+## Prerequisites
+
+Before publishing a workflow, ensure you have:
+
+1. **Valid Workflow**: A working `workflow.yml` that passes `specify workflow run` validation
+2. **Git Repository**: Workflow hosted on GitHub (or other public git hosting)
+3. **Documentation**: README.md with description, inputs, and step graph
+4. **License**: Open source license file (MIT, Apache 2.0, etc.)
+5. **Versioning**: Semantic versioning in the `workflow.version` field
+6. **Testing**: Workflow tested on real projects
+
+---
+
+## Prepare Your Workflow
+
+### 1. Workflow Structure
+
+Host your workflow in a repository with this structure:
+
+```text
+your-workflow/
+├── workflow.yml               # Required: Workflow definition
+├── README.md                  # Required: Documentation
+├── LICENSE                    # Required: License file
+└── CHANGELOG.md               # Recommended: Version history
+```
+
+### 2. workflow.yml Validation
+
+Verify your definition is valid:
+
+```yaml
+schema_version: "1.0"
+
+workflow:
+  id: "your-workflow"              # Unique lowercase-hyphenated ID
+  name: "Your Workflow Name"       # Human-readable name
+  version: "1.0.0"                 # Semantic version
+  author: "Your Name or Organization"
+  description: "Brief description (one sentence)"
+  integration: claude              # Default integration (optional)
+  model: "claude-sonnet-4-20250514"         # Default model (optional)
+
+requires:
+  speckit_version: ">=0.6.1"
+  integrations:
+    any: ["claude", "gemini"]      # At least one required
+
+inputs:
+  feature_name:
+    type: string
+    required: true
+    prompt: "Feature name"
+  scope:
+    type: string
+    default: "full"
+    enum: ["full", "backend-only", "frontend-only"]
+
+steps:
+  - id: specify
+    command: speckit.specify
+    input:
+      args: "{{ inputs.feature_name }}"
+
+  - id: review
+    type: gate
+    message: "Review the output."
+    options: [approve, reject]
+    on_reject: abort
+```
+
+**Validation Checklist**:
+
+- ✅ `id` is lowercase alphanumeric with hyphens (single-character IDs are allowed)
+- ✅ `version` follows semantic versioning (X.Y.Z)
+- ✅ `description` is concise
+- ✅ All step IDs are unique
+- ✅ Step types are valid: `command`, `prompt`, `shell`, `gate`, `if`, `switch`, `while`, `do-while`, `fan-out`, `fan-in`
+- ✅ Required fields present per step type (e.g., `condition` for `if`, `expression` for `switch`)
+- ✅ Input types are valid: `string`, `number`, `boolean`
+- ✅ Step IDs do not contain `:` (reserved for engine-generated nested IDs like `parentId:childId`)
+
+### 3. Test Locally
+
+```bash
+# Run with required inputs
+specify workflow run ./workflow.yml --input feature_name="user-auth"
+
+# Check validation
+specify workflow info ./workflow.yml
+
+# Resume after a gate pause
+specify workflow resume <run_id>
+
+# Check run status
+specify workflow status <run_id>
+```
+
+### 4. Create GitHub Release
+
+Create a GitHub release for your workflow version:
+
+```bash
+git tag v1.0.0
+git push origin v1.0.0
+```
+
+The raw YAML URL will be:
+
+```text
+https://raw.githubusercontent.com/your-org/spec-kit-workflow-your-workflow/v1.0.0/workflow.yml
+```
+
+### 5. Test Installation from URL
+
+```bash
+specify workflow add your-workflow
+# (once published to catalog)
+```
+
+---
+
+## Submit to Catalog
+
+### Understanding the Catalogs
+
+Spec Kit uses a dual-catalog system:
+
+- **`catalog.json`** — Official, verified workflows (install allowed by default)
+- **`catalog.community.json`** — Community-contributed workflows (discovery only by default)
+
+All community workflows should be submitted to `catalog.community.json`.
+
+### 1. Fork the spec-kit Repository
+
+```bash
+git clone https://github.com/YOUR-USERNAME/spec-kit.git
+cd spec-kit
+```
+
+### 2. Add Workflow to Community Catalog
+
+Edit `workflows/catalog.community.json` and add your workflow.
+
+> **⚠️ Entries must be sorted alphabetically by workflow ID.** Insert your workflow in the correct position within the `"workflows"` object.
+
+```json
+{
+  "schema_version": "1.0",
+  "updated_at": "2026-04-10T00:00:00Z",
+  "catalog_url": "https://raw.githubusercontent.com/github/spec-kit/main/workflows/catalog.community.json",
+  "workflows": {
+    "your-workflow": {
+      "id": "your-workflow",
+      "name": "Your Workflow Name",
+      "description": "Brief description of what your workflow automates",
+      "author": "Your Name",
+      "version": "1.0.0",
+      "url": "https://raw.githubusercontent.com/your-org/spec-kit-workflow-your-workflow/v1.0.0/workflow.yml",
+      "repository": "https://github.com/your-org/spec-kit-workflow-your-workflow",
+      "license": "MIT",
+      "requires": {
+        "speckit_version": ">=0.15.0"
+      },
+      "tags": [
+        "category",
+        "automation"
+      ],
+      "created_at": "2026-04-10T00:00:00Z",
+      "updated_at": "2026-04-10T00:00:00Z"
+    }
+  }
+}
+```
+
+### 3. Submit Pull Request
+
+```bash
+git checkout -b add-your-workflow
+git add workflows/catalog.community.json
+git commit -m "Add your-workflow to community catalog
+
+- Workflow ID: your-workflow
+- Version: 1.0.0
+- Author: Your Name
+- Description: Brief description
+"
+git push origin add-your-workflow
+```
+
+**Pull Request Checklist**:
+
+```markdown
+## Workflow Submission
+
+**Workflow Name**: Your Workflow Name
+**Workflow ID**: your-workflow
+**Version**: 1.0.0
+**Repository**: https://github.com/your-org/spec-kit-workflow-your-workflow
+
+### Checklist
+- [ ] Valid workflow.yml (passes `specify workflow info`)
+- [ ] README.md with description, inputs, and step graph
+- [ ] LICENSE file included
+- [ ] GitHub release created with raw YAML URL
+- [ ] Workflow tested end-to-end with `specify workflow run`
+- [ ] All gate steps have clear review messages
+- [ ] Input prompts are descriptive
+- [ ] Added to workflows/catalog.community.json (alphabetical order)
+```
+
+---
+
+## Verification Process
+
+After submission, maintainers will review:
+
+1. **Definition validation** — valid `workflow.yml`, correct schema
+2. **Step correctness** — all step types used correctly, no dangling references
+3. **Input design** — clear prompts, sensible defaults and enums
+4. **Security** — no malicious shell commands, safe operations
+5. **Documentation** — clear README explaining what the workflow does and when to use it
+
+Once verified, the workflow appears in `specify workflow search`.
+
+---
+
+## Release Workflow
+
+When releasing a new version:
+
+1. Update `version` in `workflow.yml`
+2. Update CHANGELOG.md
+3. Tag and push: `git tag v1.1.0 && git push origin v1.1.0`
+4. Submit PR to update `version` and `url` in `workflows/catalog.community.json`
+
+---
+
+## Best Practices
+
+### Step Design
+
+- **Use gates at decision points** — place `gate` steps after each major output so users can review before proceeding
+- **Keep steps focused** — each step should do one thing; prefer more steps over complex single steps
+- **Provide clear gate messages** — explain what to review and what approve/reject means
+
+### Inputs
+
+- **Use descriptive prompts** — the `prompt` field is shown to users when running the workflow
+- **Set sensible defaults** — optional inputs should have defaults that work for the common case
+- **Constrain with enums** — when there's a fixed set of valid values, use `enum` for validation
+- **Type appropriately** — use `number` for counts, `boolean` for flags, `string` for names
+
+### Shell Steps
+
+- **Avoid destructive commands** — don't delete files or directories without explicit confirmation via a gate
+- **Quote variables** — use proper quoting in shell commands to handle spaces
+- **Check exit codes** — shell step failures stop the workflow; make sure commands are robust
+
+### Integration Flexibility
+
+- **Set `integration` at workflow level** — use the `workflow.integration` field as the default
+- **Allow per-step overrides** — let individual steps specify a different integration if needed
+- **Document required integrations** — list which integrations must be installed in `requires.integrations`
+
+### Expression References
+
+- **Only reference prior steps** — expressions like `{{ steps.plan.output.file }}` only work if `plan` ran before the current step
+- **Use `default` filter** — `{{ val | default('fallback') }}` prevents failures from missing values
+- **Keep expressions simple** — complex logic should be in shell steps, not expressions

workflows/README.md

@@ -0,0 +1,339 @@
+# Workflows
+
+Workflows are multi-step, resumable automation pipelines defined in YAML. They orchestrate Spec Kit commands across integrations, evaluate control flow, and pause at human review gates — enabling end-to-end Spec-Driven Development cycles without manual step-by-step invocation.
+
+## How It Works
+
+A workflow definition declares a sequence of steps. The engine executes them in order, dispatching commands to AI integrations, running shell commands, evaluating conditions for branching, and pausing at gates for human review. State is persisted after each step, so workflows can be resumed after interruption.
+
+```yaml
+steps:
+  - id: specify
+    command: speckit.specify
+    input:
+      args: "{{ inputs.feature_name }}"
+
+  - id: review
+    type: gate
+    message: "Review the spec before planning."
+    options: [approve, reject]
+    on_reject: abort
+
+  - id: plan
+    command: speckit.plan
+```
+
+For detailed architecture and internals, see [ARCHITECTURE.md](ARCHITECTURE.md).
+
+## Quick Start
+
+```bash
+# Search available workflows
+specify workflow search
+
+# Install the built-in SDD workflow
+specify workflow add speckit
+
+# Or run directly from a local YAML file
+specify workflow run ./workflow.yml --input feature_name="user-auth"
+
+# Run an installed workflow with inputs
+specify workflow run speckit --input feature_name="user-auth"
+
+# Check run status
+specify workflow status
+
+# Resume after a gate pause
+specify workflow resume <run_id>
+
+# Get detailed workflow info
+specify workflow info speckit
+
+# Remove a workflow
+specify workflow remove speckit
+```
+
+## Running Workflows
+
+### From an Installed Workflow
+
+```bash
+specify workflow add speckit
+specify workflow run speckit --input feature_name="user-auth"
+```
+
+### From a Local YAML File
+
+```bash
+specify workflow run ./my-workflow.yml --input feature_name="user-auth"
+```
+
+### Multiple Inputs
+
+```bash
+specify workflow run speckit \
+  --input feature_name="user-auth" \
+  --input scope="backend-only"
+```
+
+## Step Types
+
+Workflows support 10 built-in step types:
+
+### Command Steps (default)
+
+Invoke an installed Spec Kit command by name via the integration CLI:
+
+```yaml
+- id: specify
+  command: speckit.specify
+  input:
+    args: "{{ inputs.feature_name }}"
+  integration: claude        # Optional: override workflow default
+  model: "claude-sonnet-4-20250514"   # Optional: override model
+```
+
+### Prompt Steps
+
+Send an arbitrary inline prompt to an integration CLI (no command file needed):
+
+```yaml
+- id: security-review
+  type: prompt
+  prompt: "Review {{ inputs.file }} for security vulnerabilities"
+  integration: claude
+```
+
+### Shell Steps
+
+Run a shell command and capture output:
+
+```yaml
+- id: run-tests
+  type: shell
+  run: "cd {{ inputs.project_dir }} && npm test"
+```
+
+### Gate Steps
+
+Pause for human review. The workflow resumes when `specify workflow resume` is called:
+
+```yaml
+- id: review-spec
+  type: gate
+  message: "Review the generated spec before planning."
+  options: [approve, edit, reject]
+  on_reject: abort
+```
+
+### If/Then/Else Steps
+
+Conditional branching based on an expression:
+
+```yaml
+- id: check-scope
+  type: if
+  condition: "{{ inputs.scope == 'full' }}"
+  then:
+    - id: full-plan
+      command: speckit.plan
+  else:
+    - id: quick-plan
+      command: speckit.plan
+      options:
+        quick: true
+```
+
+### Switch Steps
+
+Multi-branch dispatch on an expression value:
+
+```yaml
+- id: route
+  type: switch
+  expression: "{{ steps.review.output.choice }}"
+  cases:
+    approve:
+      - id: plan
+        command: speckit.plan
+    reject:
+      - id: log
+        type: shell
+        run: "echo 'Rejected'"
+  default:
+    - id: fallback
+      type: gate
+      message: "Unexpected choice"
+```
+
+### While Loop Steps
+
+Repeat steps while a condition is truthy:
+
+```yaml
+- id: retry
+  type: while
+  condition: "{{ steps.run-tests.output.exit_code != 0 }}"
+  max_iterations: 5
+  steps:
+    - id: fix
+      command: speckit.implement
+```
+
+### Do-While Loop Steps
+
+Execute steps at least once, then repeat while condition holds:
+
+```yaml
+- id: refine
+  type: do-while
+  condition: "{{ steps.review.output.choice == 'edit' }}"
+  max_iterations: 3
+  steps:
+    - id: revise
+      command: speckit.specify
+```
+
+### Fan-Out Steps
+
+Dispatch a step template for each item in a collection (sequential):
+
+```yaml
+- id: parallel-impl
+  type: fan-out
+  items: "{{ steps.tasks.output.task_list }}"
+  max_concurrency: 3
+  step:
+    id: impl
+    command: speckit.implement
+```
+
+### Fan-In Steps
+
+Aggregate results from fan-out steps:
+
+```yaml
+- id: collect
+  type: fan-in
+  wait_for: [parallel-impl]
+  output: {}
+```
+
+## Expressions
+
+Workflow definitions use `{{ expression }}` syntax for dynamic values:
+
+```yaml
+# Access inputs
+args: "{{ inputs.feature_name }}"
+
+# Access previous step outputs
+args: "{{ steps.specify.output.file }}"
+
+# Comparisons
+condition: "{{ steps.run-tests.output.exit_code != 0 }}"
+
+# Filters
+message: "{{ status | default('pending') }}"
+```
+
+Supported filters: `default`, `join`, `contains`, `map`.
+
+## Input Types
+
+Workflow inputs are type-checked and coerced from CLI string values:
+
+```yaml
+inputs:
+  feature_name:
+    type: string
+    required: true
+    prompt: "Feature name"
+  task_count:
+    type: number
+    default: 5
+  dry_run:
+    type: boolean
+    default: false
+  scope:
+    type: string
+    default: "full"
+    enum: ["full", "backend-only", "frontend-only"]
+```
+
+| Type | Accepts | Example |
+|------|---------|---------|
+| `string` | Any string | `"user-auth"` |
+| `number` | Numeric strings → int/float | `"42"` → `42` |
+| `boolean` | `true`/`1`/`yes` → `True`, `false`/`0`/`no` → `False` | `"true"` → `True` |
+
+## State and Resume
+
+Every workflow run persists state to `.specify/workflows/runs/<run_id>/`:
+
+```bash
+# List all runs with status
+specify workflow status
+
+# Check a specific run
+specify workflow status <run_id>
+
+# Resume a paused run (after approving a gate)
+specify workflow resume <run_id>
+
+# Resume a failed run (retries from the failed step)
+specify workflow resume <run_id>
+```
+
+Run states: `created` → `running` → `completed` | `paused` | `failed` | `aborted`
+
+## Catalog Management
+
+Workflows are discovered through catalogs. By default, Spec Kit uses the official and community catalogs:
+
+> [!NOTE]
+> Community workflows are independently created and maintained by their respective authors. GitHub and the Spec Kit maintainers may review pull requests that add entries to the community catalog for formatting and structure, but they do **not review, audit, endorse, or support the workflow definitions themselves**. Review workflow source before installation and use at your own discretion.
+
+```bash
+# List active catalogs
+specify workflow catalog list
+
+# Add a custom catalog
+specify workflow catalog add https://example.com/catalog.json --name my-org
+
+# Remove a catalog
+specify workflow catalog remove <index>
+```
+
+## Creating a Workflow
+
+1. Create a `workflow.yml` following the schema above
+2. Test locally with `specify workflow run ./workflow.yml --input key=value`
+3. Verify with `specify workflow info ./workflow.yml`
+4. See [PUBLISHING.md](PUBLISHING.md) to submit to the catalog
+
+## Environment Variables
+
+| Variable | Description |
+|----------|-------------|
+| `SPECKIT_WORKFLOW_CATALOG_URL` | Override the catalog URL (replaces all defaults) |
+
+## Configuration Files
+
+| File | Scope | Description |
+|------|-------|-------------|
+| `.specify/workflow-catalogs.yml` | Project | Custom catalog stack for this project |
+| `~/.specify/workflow-catalogs.yml` | User | Custom catalog stack for all projects |
+
+## Repository Layout
+
+```
+workflows/
+├── ARCHITECTURE.md                         # Internal architecture documentation
+├── PUBLISHING.md                           # Guide for submitting workflows to the catalog
+├── README.md                               # This file
+├── catalog.json                            # Official workflow catalog
+├── catalog.community.json                  # Community workflow catalog
+└── speckit/                                # Built-in SDD cycle workflow
+    └── workflow.yml
+```

workflows/catalog.community.json

@@ -0,0 +1,6 @@
+{
+  "schema_version": "1.0",
+  "updated_at": "2026-04-10T00:00:00Z",
+  "catalog_url": "https://raw.githubusercontent.com/github/spec-kit/main/workflows/catalog.community.json",
+  "workflows": {}
+}

workflows/catalog.json

@@ -0,0 +1,16 @@
+{
+  "schema_version": "1.0",
+  "updated_at": "2026-04-13T00:00:00Z",
+  "catalog_url": "https://raw.githubusercontent.com/github/spec-kit/main/workflows/catalog.json",
+  "workflows": {
+    "speckit": {
+      "id": "speckit",
+      "name": "Full SDD Cycle",
+      "description": "Runs specify \u2192 plan \u2192 tasks \u2192 implement with review gates",
+      "author": "GitHub",
+      "version": "1.0.0",
+      "url": "https://raw.githubusercontent.com/github/spec-kit/main/workflows/speckit/workflow.yml",
+      "tags": ["sdd", "full-cycle"]
+    }
+  }
+}

workflows/speckit/workflow.yml

@@ -0,0 +1,63 @@
+schema_version: "1.0"
+workflow:
+  id: "speckit"
+  name: "Full SDD Cycle"
+  version: "1.0.0"
+  author: "GitHub"
+  description: "Runs specify → plan → tasks → implement with review gates"
+
+requires:
+  speckit_version: ">=0.6.1"
+  integrations:
+    any: ["copilot", "claude", "gemini"]
+
+inputs:
+  feature_name:
+    type: string
+    required: true
+    prompt: "Feature name"
+  integration:
+    type: string
+    default: "copilot"
+    prompt: "Integration to use (e.g. claude, copilot, gemini)"
+  scope:
+    type: string
+    default: "full"
+    enum: ["full", "backend-only", "frontend-only"]
+
+steps:
+  - id: specify
+    command: speckit.specify
+    integration: "{{ inputs.integration }}"
+    input:
+      args: "{{ inputs.feature_name }}"
+
+  - id: review-spec
+    type: gate
+    message: "Review the generated spec before planning."
+    options: [approve, reject]
+    on_reject: abort
+
+  - id: plan
+    command: speckit.plan
+    integration: "{{ inputs.integration }}"
+    input:
+      args: "{{ inputs.feature_name }}"
+
+  - id: review-plan
+    type: gate
+    message: "Review the plan before generating tasks."
+    options: [approve, reject]
+    on_reject: abort
+
+  - id: tasks
+    command: speckit.tasks
+    integration: "{{ inputs.integration }}"
+    input:
+      args: "{{ inputs.feature_name }}"
+
+  - id: implement
+    command: speckit.implement
+    integration: "{{ inputs.integration }}"
+    input:
+      args: "{{ inputs.feature_name }}"