gsd-secure-phase

Security phase verification checks the presence and effectiveness of threat mitigations for completed phases by analyzing SECURITY.md and PLAN.md existence within a GSD-namespace workflow, ensuring compliance without merging into broader AppSec capabilities.

Post-completion threat mitigation analysis works by checking for the existence of SECURITY.md and PLAN.md files containing a threat model, or by analyzing the phase execution status to determine the security posture of a completed workflow phase.

Yes, gsd-pipeline-orchestrator and gsd-execute-phase are required external dependencies for secure phase verification, providing the necessary workflow integration and execution status data to analyze completed phases within the GSD-namespace.

The best way to check security compliance after a phase execution is to run a retroactive verification command like `gsd-secure-phase 4` to validate threat mitigations by analyzing phase execution status and SECURITY.md presence.

Yes, you can verify threat models for completed phases without merging into broader AppSec capabilities by using a dedicated secure phase verification tool that applies retroactive post-completion analysis specifically within the GSD-namespace workflow.

You should run secure phase verification immediately after a development phase is complete, ensuring all necessary security measures and threat mitigations are in place before moving to the next phase in your pipeline.