Files

Bantuson 2154e6bb07 feat: add security-first enforcement layer with threat-model-anchored verification

Adds /gsd:secure-phase command and gsd-security-auditor agent as a
threat-model-anchored security gate parallel to Nyquist validation.

New files:
- agents/gsd-security-auditor.md — verifies PLAN.md threat mitigations
  exist in implemented code; SECURED/OPEN_THREATS/ESCALATE returns
- commands/gsd/secure-phase.md — retroactive command, mirrors validate-phase
- get-shit-done/workflows/secure-phase.md — enforcing gate: threats_open > 0
  blocks phase advancement; accepted risks log prevents resurface
- get-shit-done/templates/SECURITY.md — per-phase threat register artifact

Modified:
- config.json — security_enforcement (absent=enabled), security_asvs_level,
  security_block_on parallel to nyquist_validation pattern
- VALIDATION.md — Threat Ref + Secure Behavior columns in verification map
- gsd-planner.md — <threat_model> block in PLAN.md format + quality gate
- gsd-executor.md — Rule 2 threat model reference + ## Threat Flags scan
- gsd-phase-researcher.md — ## Security Domain mandatory research section
- plan-phase.md — step 5.55 Security Threat Model Gate
- execute-phase.md — security gate announcement in aggregate step
- verify-work.md — /gsd:secure-phase surfaced in completion routing

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-03-25 11:18:30 +02:00

2.1 KiB

Raw Blame History

phase, slug, status, nyquist_compliant, wave_0_complete, created

phase

slug

status

nyquist_compliant

wave_0_complete

created

N

phase-slug

draft

false

date

Phase {N} — Validation Strategy

Per-phase validation contract for feedback sampling during execution.

Test Infrastructure

Property	Value
Framework	{pytest 7.x / jest 29.x / vitest / go test / other}
Config file	{path or "none — Wave 0 installs"}
Quick run command	`{quick command}`
Full suite command	`{full command}`
Estimated runtime	~{N} seconds

Sampling Rate

After every task commit: Run {quick run command}
After every plan wave: Run {full suite command}
Before /gsd:verify-work: Full suite must be green
Max feedback latency: {N} seconds

Per-Task Verification Map

Task ID	Plan	Wave	Requirement	Threat Ref	Secure Behavior	Test Type	Automated Command	File Exists	Status
{N}-01-01	01	1	REQ-{XX}	T-{N}-01 / —	{expected secure behavior or "N/A"}	unit	`{command}`	✅ / ❌ W0	⬜ pending

Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky

Wave 0 Requirements

{tests/test_file.py} — stubs for REQ-{XX}
{tests/conftest.py} — shared fixtures
{framework install} — if no framework detected

If none: "Existing infrastructure covers all phase requirements."

Manual-Only Verifications

Behavior	Requirement	Why Manual	Test Instructions
{behavior}	REQ-{XX}	{reason}	{steps}

If none: "All phase behaviors have automated verification."

Validation Sign-Off

All tasks have <automated> verify or Wave 0 dependencies
Sampling continuity: no 3 consecutive tasks without automated verify
Wave 0 covers all MISSING references
No watch-mode flags
Feedback latency < {N}s
nyquist_compliant: true set in frontmatter

Approval: {pending / approved YYYY-MM-DD}

2.1 KiB Raw Blame History