| name | donny-audit-phase |
| description | Retroactively audits a completed phase for security (threat mitigations from the PLAN.md threat model are implemented) and validation (Nyquist test coverage of the phase's requirements). Use after a phase is executed to confirm threats are closed and requirements are tested; runs both audits by default. --security or --validate narrows to one. Open threats block phase advancement. |
| argument-hint | [phase] [--security|--validate] |
| allowed-tools | ["Read","Write","Edit","Bash","Glob","Grep","Task","AskUserQuestion"] |
Audit a completed phase across two dimensions, updating SECURITY.md and/or VALIDATION.md:
- Security - verify every threat in the PLAN.md threat model is mitigated (or accepted/transferred and documented). Open threats block advancement.
- Validation - audit Nyquist coverage: map requirements to tests, fill gaps, mark manual-only what can't be automated.
Default runs BOTH. --security / --validate narrows to one. Each dimension has its own config gate (workflow.security_enforcement, workflow.nyquist_validation).
Output: updated {phase}-SECURITY.md and/or {phase}-VALIDATION.md (plus generated tests).
<execution_context>
@~/.claude/donny/workflows/audit-phase.md
</execution_context>
Phase: $ARGUMENTS - optional phase number, defaults to last completed phase. Optional scope flag:
- `--security` - security audit only
- `--validate` - validation audit only
- (none) or `--all` - both
Execute @~/.claude/donny/workflows/audit-phase.md end-to-end.
Preserve all workflow gates: scope resolution, per-dimension config gates, the shared phase-executed gate, both auditor spawns, the SECURITY.md filename guard, and the open-threats advancement block.
