Adding Context-based files to GitHub Spec Kit

[debay1010]

I want to ask how one can effectively add a context-based file to the project being handled with Spec Kit. Take for example, I have some design specifications that are outside the default provided by Spec Kit, that I want to include in the project. Where and how to go about this Also what stage in the project timeline (specify, plan or tasks) is best to reference this file for best result, for this particular scenario?

[Prageethcs]

Shouldn't you keep these in the Constitution?

[massimogentilini]

I've added in the constitution something like this:

Principle 0: Regulatory Compliance

MANDATORY AND NON-NEGOTIABLE

This software operates within the European regulated finance industry. ALL code, architecture,
and operational decisions MUST comply with the following regulatory frameworks without exception:

• GDPR (General Data Protection Regulation): Data minimization, right to erasure, consent
  management, encryption of PII, logging restrictions on personal data
• ISO 27001 (Information Security Management): CIA Triad (Confidentiality, Integrity,
  Availability), access controls, cryptographic standards, incident response
• NIS2 (Network and Information Systems Directive 2): Supply chain security, 24-hour
  incident reporting, vulnerability disclosure, MFA enforcement
• DORA (Digital Operational Resilience Act): Circuit breakers, retry logic with exponential
  backoff, correlation IDs, graceful degradation, idempotent operations

Rationale: Regulatory non-compliance exposes the organization to severe financial penalties,
legal liability, and reputational damage. These requirements are legally binding and cannot be
compromised for convenience or velocity.

Implementation: Reference detailed guidance in .specify/regulations/ directory for each
regulation. Every code review, specification, and implementation plan MUST explicitly verify
compliance with all four frameworks.

And then created (not really, I asked Gemini to create them) a GDPR.regulation.md (and also the other 3) that contains the most relevant topics of each regulation.

Following SpecKit command followed the instructions and were able to detect specs that were in contrast with some of the regulations (I did it on purpose and so the test is not really deep, don't know if they would have been able to detect subtle contrasts).