gsd-secure-phase

To verify threat mitigations for a completed project phase, you can retrospectively validate applied security measures against existing artifacts. This process updates your SECURITY.md to confirm that planned protections were actually executed and recorded.

Updating a missing SECURITY.md is possible by extracting threat-model artifacts from an existing PLAN.md. This reconstructs the required security documentation retrospectively to validate completed phase mitigations.

Running a security audit on a non-executed project phase triggers an early exit with guidance instead of producing misleading results. This safety guardrail prevents validating mitigations for work that was never completed.

Yes, retrospective security verification preserves existing workflow gating and phase exits while updating your security documentation. It ensures that retroactively hardening a completed project phase does not disrupt your established compliance checks.

To reconstruct security documentation using PLAN.md threat models, the system reads existing plan artifacts to identify planned mitigations. It then validates these against execution artifacts to produce an updated SECURITY.md.