gsd-secure-phase

Security phase verification retroactively audits completed development work against documented threat models and planning artifacts. It confirms that planned security steps were actually addressed before treating the phase as done, preventing security gaps from reaching production.

You audit completed work by reconciling SECURITY.md and PLAN.md artifacts against the finished development phase. This workflow checks whether documented threat mitigations were actually implemented and produces an updated SECURITY.md recording the validation status.

Yes, security phase verification requires a completed development phase, a documented threat model, and SECURITY.md or PLAN.md evidence. If the phase was never executed, the process stops and provides next-step guidance instead of attempting to validate incomplete work.

The best way to check if planned security mitigations were addressed is to perform a post-phase validation that reconciles your threat model with completed work. This retroactively confirms implementation and records the verification results in your SECURITY.md file.

If you try to verify threat mitigations for an unexecuted phase, the process stops. It recognizes that validation is impossible without completed work and provides clear next-step guidance rather than pretending the verification succeeded.