gsd-secure-phase

To verify threat mitigations for a completed phase, audit the phase artifacts against your security requirements. This checks if threat-model artifacts are present and correct, then updates SECURITY.md to reflect compliance.

If SECURITY.md is absent, the security audit runs from artifacts by checking for a PLAN.md containing a threat model. If neither exists, it exits with guided remediation steps.

You cannot audit threat mitigations for an unexecuted phase. The process exits with guidance to prevent unresolved risks, ensuring you only verify phases with actual artifacts.

A phase review updates security compliance documentation by preserving all workflow gates and writing the verification results directly into SECURITY.md as part of the audit process.

You need to audit threat mitigations from PLAN.md artifacts when SECURITY.md is missing but a threat model exists in PLAN.md, allowing you to validate security controls retroactively.