Bantuson 2154e6bb07 feat: add security-first enforcement layer with threat-model-anchored verification ...

Adds /gsd:secure-phase command and gsd-security-auditor agent as a
threat-model-anchored security gate parallel to Nyquist validation.

New files:
- agents/gsd-security-auditor.md — verifies PLAN.md threat mitigations
  exist in implemented code; SECURED/OPEN_THREATS/ESCALATE returns
- commands/gsd/secure-phase.md — retroactive command, mirrors validate-phase
- get-shit-done/workflows/secure-phase.md — enforcing gate: threats_open > 0
  blocks phase advancement; accepted risks log prevents resurface
- get-shit-done/templates/SECURITY.md — per-phase threat register artifact

Modified:
- config.json — security_enforcement (absent=enabled), security_asvs_level,
  security_block_on parallel to nyquist_validation pattern
- VALIDATION.md — Threat Ref + Secure Behavior columns in verification map
- gsd-planner.md — <threat_model> block in PLAN.md format + quality gate
- gsd-executor.md — Rule 2 threat model reference + ## Threat Flags scan
- gsd-phase-researcher.md — ## Security Domain mandatory research section
- plan-phase.md — step 5.55 Security Threat Model Gate
- execute-phase.md — security gate announcement in aggregate step
- verify-work.md — /gsd:secure-phase surfaced in completion routing

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-03-25 11:18:30 +02:00

..

add-phase.md

fix: resolve @file: protocol in all INIT consumers for Windows compatibility (#841)

2026-03-03 12:19:12 -06:00

add-tests.md

fix: Windows shell robustness, project_root detection, and hook stdin safety (#1343)

2026-03-23 20:20:15 -04:00

add-todo.md

fix: Windows shell robustness, project_root detection, and hook stdin safety (#1343)

2026-03-23 20:20:15 -04:00

audit-milestone.md

feat: agent skill injection via config (#1355)

2026-03-24 16:47:40 -04:00

audit-uat.md

feat: add verification debt tracking and /gsd:audit-uat command

2026-03-19 00:05:05 -05:00

autonomous.md

fix: Windows shell robustness, project_root detection, and hook stdin safety (#1343)

2026-03-23 20:20:15 -04:00

check-todos.md

fix: resolve @file: protocol in all INIT consumers for Windows compatibility (#841)

2026-03-03 12:19:12 -06:00

cleanup.md

fix: Windows shell robustness, project_root detection, and hook stdin safety (#1343)

2026-03-23 20:20:15 -04:00

complete-milestone.md

fix: Windows shell robustness, project_root detection, and hook stdin safety (#1343)

2026-03-23 20:20:15 -04:00

diagnose-issues.md

feat: agent skill injection via config (#1355)

2026-03-24 16:47:40 -04:00

discovery-phase.md

fix(workflow): enforce 12-char AskUserQuestion header limit (#559)

2026-02-15 09:22:07 -06:00

discuss-phase-assumptions.md

feat: agent skill injection via config (#1355)

2026-03-24 16:47:40 -04:00

discuss-phase.md

feat: agent skill injection via config (#1355)

2026-03-24 16:47:40 -04:00

do.md

fix: use $HOME instead of ~ in installed shell command paths (#1284)

2026-03-21 09:24:31 -04:00

execute-phase.md

feat: add security-first enforcement layer with threat-model-anchored verification

2026-03-25 11:18:30 +02:00

execute-plan.md

fix: add <available_agent_types> to all workflows spawning named agents

2026-03-24 13:17:18 -04:00

fast.md

feat: /gsd:fast command for trivial inline tasks (#609)

2026-03-18 17:17:28 -04:00

forensics.md

fix: address review findings on forensics PR #1305

2026-03-21 18:21:41 -04:00

health.md

fix: Windows shell robustness, project_root detection, and hook stdin safety (#1343)

2026-03-23 20:20:15 -04:00

help.md

Merge branch 'main' into Solvely/execute-phase-active-flags

2026-03-20 13:52:26 -04:00

insert-phase.md

fix: resolve @file: protocol in all INIT consumers for Windows compatibility (#841)

2026-03-03 12:19:12 -06:00

list-phase-assumptions.md

refactor: condense verbose explanations in templates and workflows

2026-01-22 11:11:16 -06:00

list-workspaces.md

feat: add multi-project workspace commands (#1241)

2026-03-20 17:02:48 -04:00

manager.md

fix: Windows shell robustness, project_root detection, and hook stdin safety (#1343)

2026-03-23 20:20:15 -04:00

map-codebase.md

feat: agent skill injection via config (#1355)

2026-03-24 16:47:40 -04:00

milestone-summary.md

fix: address all review findings on PR #1299

2026-03-21 16:38:34 -04:00

new-milestone.md

feat: agent skill injection via config (#1355)

2026-03-24 16:47:40 -04:00

new-project.md

feat: agent skill injection via config (#1355)

2026-03-24 16:47:40 -04:00

new-workspace.md

feat: add multi-project workspace commands (#1241)

2026-03-20 17:02:48 -04:00

next.md

feat: add /gsd:next command for automatic workflow advancement (#927) (#1167)

2026-03-18 09:56:35 -06:00

node-repair.md

feat: add node repair operator for autonomous task failure recovery (#1016)

2026-03-12 11:35:45 -06:00

note.md

feat(note): add zero-friction note capture command (#1080)

2026-03-16 08:50:19 -06:00

pause-work.md

fix: Windows shell robustness, project_root detection, and hook stdin safety (#1343)

2026-03-23 20:20:15 -04:00

plan-milestone-gaps.md

fix: Windows shell robustness, project_root detection, and hook stdin safety (#1343)

2026-03-23 20:20:15 -04:00

plan-phase.md

feat: add security-first enforcement layer with threat-model-anchored verification

2026-03-25 11:18:30 +02:00

plant-seed.md

fix: Windows shell robustness, project_root detection, and hook stdin safety (#1343)

2026-03-23 20:20:15 -04:00

pr-branch.md

feat: community-requested commands — /gsd:review, /gsd:plant-seed, /gsd:pr-branch

2026-03-18 23:53:13 -04:00

profile-user.md

feat: add developer profiling pipeline (#1084)

2026-03-16 09:46:00 -06:00

progress.md

fix: Windows shell robustness, project_root detection, and hook stdin safety (#1343)

2026-03-23 20:20:15 -04:00

quick.md

feat: agent skill injection via config (#1355)

2026-03-24 16:47:40 -04:00

remove-phase.md

fix: resolve @file: protocol in all INIT consumers for Windows compatibility (#841)

2026-03-03 12:19:12 -06:00

remove-workspace.md

feat: add multi-project workspace commands (#1241)

2026-03-20 17:02:48 -04:00

research-phase.md

feat: agent skill injection via config (#1355)

2026-03-24 16:47:40 -04:00

resume-project.md

fix: Windows shell robustness, project_root detection, and hook stdin safety (#1343)

2026-03-23 20:20:15 -04:00

review.md

Modify codex command in review.md

2026-03-23 14:05:33 -04:00

secure-phase.md

feat: add security-first enforcement layer with threat-model-anchored verification

2026-03-25 11:18:30 +02:00

session-report.md

fix: hook version tracking, stale hook detection, stdin timeout, and session-report command (#1153, #1157, #1161, #1162) (#1163)

2026-03-18 09:57:20 -06:00

settings.md

feat: add workflow.skip_discuss setting to bypass discuss-phase in autonomous mode

2026-03-21 18:13:31 -04:00

ship.md

feat: /gsd:ship command for PR creation from verified phase work (#829) (#1123)

2026-03-18 10:01:08 -06:00

stats.md

fix(stats): replace undefined $GSD_TOOLS with standard gsd-tools path (#1236)

2026-03-19 23:23:13 -06:00

transition.md

fix: Windows shell robustness, project_root detection, and hook stdin safety (#1343)

2026-03-23 20:20:15 -04:00

ui-phase.md

feat: agent skill injection via config (#1355)

2026-03-24 16:47:40 -04:00

ui-review.md

feat: agent skill injection via config (#1355)

2026-03-24 16:47:40 -04:00

update.md

docs: update repository references from glittercowboy to gsd-build

2026-03-24 16:57:15 -06:00

validate-phase.md

feat: agent skill injection via config (#1355)

2026-03-24 16:47:40 -04:00

verify-phase.md

fix: Windows shell robustness, project_root detection, and hook stdin safety (#1343)

2026-03-23 20:20:15 -04:00

verify-work.md

feat: add security-first enforcement layer with threat-model-anchored verification

2026-03-25 11:18:30 +02:00