donny-audit-phase

name	donny-audit-phase
description	Retroactively audits a completed phase for security (threat mitigations from the PLAN.md threat model are implemented) and validation (Nyquist test coverage of the phase's requirements). Use after a phase is executed to confirm threats are closed and requirements are tested; runs both audits by default. --security or --validate narrows to one. Open threats block phase advancement.
argument-hint	[phase] [--security|--validate]
allowed-tools	["Read","Write","Edit","Bash","Glob","Grep","Task","AskUserQuestion"]

Audit a completed phase across two dimensions, updating SECURITY.md and/or VALIDATION.md:

• Security - verify every threat in the PLAN.md threat model is mitigated (or accepted/transferred and documented). Open threats block advancement.
• Validation - audit Nyquist coverage: map requirements to tests, fill gaps, mark manual-only what can't be automated.

Default runs BOTH. --security / --validate narrows to one. Each dimension has its own config gate (workflow.security_enforcement, workflow.nyquist_validation).

Output: updated {phase}-SECURITY.md and/or {phase}-VALIDATION.md (plus generated tests).

<execution_context> @~/.claude/donny/workflows/audit-phase.md </execution_context>

Phase: $ARGUMENTS - optional phase number, defaults to last completed phase. Optional scope flag: - `--security` - security audit only - `--validate` - validation audit only - (none) or `--all` - both Execute @~/.claude/donny/workflows/audit-phase.md end-to-end. Preserve all workflow gates: scope resolution, per-dimension config gates, the shared phase-executed gate, both auditor spawns, the SECURITY.md filename guard, and the open-threats advancement block.