gsd-secure-phase

To verify security mitigations after a development phase, audit the completed phase artifacts against the original threat model. This validates that expected controls are present and correctly recorded in an updated SECURITY.md file.

Yes, you can generate a SECURITY.md from PLAN.md. When SECURITY.md is missing but the threat model exists in PLAN.md, the system runs verification using available artifacts to produce the missing security documentation.

Running security verification on an incomplete project phase triggers guarded handling. The system detects the phase was not executed and exits with guidance instead of producing misleading results or updating SECURITY.md.

To audit a specific phase's security controls, provide the optional phase number argument when running the verification. This targets the exact completed phase artifacts for the controls audit and updates the corresponding SECURITY.md.

You need post-implementation security validation when mitigations drift or partially fail to match the original threat model. This retroactively validates that expected security controls are actually present in the completed phase artifacts.