2154e6bb07
Adds /gsd:secure-phase command and gsd-security-auditor agent as a threat-model-anchored security gate parallel to Nyquist validation. New files: - agents/gsd-security-auditor.md — verifies PLAN.md threat mitigations exist in implemented code; SECURED/OPEN_THREATS/ESCALATE returns - commands/gsd/secure-phase.md — retroactive command, mirrors validate-phase - get-shit-done/workflows/secure-phase.md — enforcing gate: threats_open > 0 blocks phase advancement; accepted risks log prevents resurface - get-shit-done/templates/SECURITY.md — per-phase threat register artifact Modified: - config.json — security_enforcement (absent=enabled), security_asvs_level, security_block_on parallel to nyquist_validation pattern - VALIDATION.md — Threat Ref + Secure Behavior columns in verification map - gsd-planner.md — <threat_model> block in PLAN.md format + quality gate - gsd-executor.md — Rule 2 threat model reference + ## Threat Flags scan - gsd-phase-researcher.md — ## Security Domain mandatory research section - plan-phase.md — step 5.55 Security Threat Model Gate - execute-phase.md — security gate announcement in aggregate step - verify-work.md — /gsd:secure-phase surfaced in completion routing Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
77 lines
2.1 KiB
Markdown
77 lines
2.1 KiB
Markdown
---
|
|
phase: {N}
|
|
slug: {phase-slug}
|
|
status: draft
|
|
nyquist_compliant: false
|
|
wave_0_complete: false
|
|
created: {date}
|
|
---
|
|
|
|
# Phase {N} — Validation Strategy
|
|
|
|
> Per-phase validation contract for feedback sampling during execution.
|
|
|
|
---
|
|
|
|
## Test Infrastructure
|
|
|
|
| Property | Value |
|
|
|----------|-------|
|
|
| **Framework** | {pytest 7.x / jest 29.x / vitest / go test / other} |
|
|
| **Config file** | {path or "none — Wave 0 installs"} |
|
|
| **Quick run command** | `{quick command}` |
|
|
| **Full suite command** | `{full command}` |
|
|
| **Estimated runtime** | ~{N} seconds |
|
|
|
|
---
|
|
|
|
## Sampling Rate
|
|
|
|
- **After every task commit:** Run `{quick run command}`
|
|
- **After every plan wave:** Run `{full suite command}`
|
|
- **Before `/gsd:verify-work`:** Full suite must be green
|
|
- **Max feedback latency:** {N} seconds
|
|
|
|
---
|
|
|
|
## Per-Task Verification Map
|
|
|
|
| Task ID | Plan | Wave | Requirement | Threat Ref | Secure Behavior | Test Type | Automated Command | File Exists | Status |
|
|
|---------|------|------|-------------|------------|-----------------|-----------|-------------------|-------------|--------|
|
|
| {N}-01-01 | 01 | 1 | REQ-{XX} | T-{N}-01 / — | {expected secure behavior or "N/A"} | unit | `{command}` | ✅ / ❌ W0 | ⬜ pending |
|
|
|
|
*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*
|
|
|
|
---
|
|
|
|
## Wave 0 Requirements
|
|
|
|
- [ ] `{tests/test_file.py}` — stubs for REQ-{XX}
|
|
- [ ] `{tests/conftest.py}` — shared fixtures
|
|
- [ ] `{framework install}` — if no framework detected
|
|
|
|
*If none: "Existing infrastructure covers all phase requirements."*
|
|
|
|
---
|
|
|
|
## Manual-Only Verifications
|
|
|
|
| Behavior | Requirement | Why Manual | Test Instructions |
|
|
|----------|-------------|------------|-------------------|
|
|
| {behavior} | REQ-{XX} | {reason} | {steps} |
|
|
|
|
*If none: "All phase behaviors have automated verification."*
|
|
|
|
---
|
|
|
|
## Validation Sign-Off
|
|
|
|
- [ ] All tasks have `<automated>` verify or Wave 0 dependencies
|
|
- [ ] Sampling continuity: no 3 consecutive tasks without automated verify
|
|
- [ ] Wave 0 covers all MISSING references
|
|
- [ ] No watch-mode flags
|
|
- [ ] Feedback latency < {N}s
|
|
- [ ] `nyquist_compliant: true` set in frontmatter
|
|
|
|
**Approval:** {pending / approved YYYY-MM-DD}
|