--- name: speckit-red-team-gate-2cd82b4374e5 description: Principle VIII gate — check whether the current feature spec qualifies for red team, and block /speckit.plan if a qualifying spec has no findings report on record. compatibility: Requires spec-kit project structure with .specify/ directory metadata: author: github-spec-kit source: red-team:commands/red-team-gate.md --- ## User Input ```text $ARGUMENTS ``` ## Purpose This command is a **gate**, not a workflow. It runs automatically as the `before_plan` hook of the `red-team` extension and is invoked by `/speckit.plan` before any planning work begins. The gate enforces the constitutional rule that functional specs matching one or more red team Trigger Criteria MUST have a red team findings report on record before `/speckit.plan` proceeds. See your project's constitution (Principle VIII — Red Team Qualifying Specs Before Plan — if adopted) or the canonical protocol reference at `https://github.com/ashbrener/spec-kit-red-team/blob/main/docs/protocol.md`. ## Outline 1. **Resolve the spec under consideration**. - If `$ARGUMENTS` contains a path to a spec file, use that. - Else, attempt to determine the current feature from the working branch via the `.specify/scripts/bash/check-prerequisites.sh --json --paths-only` helper. Parse `FEATURE_SPEC` from its output. - If neither resolves, print `Red-Team Gate: SKIPPED (no spec in context)` and return `PROCEED`. 2. **Scan the spec for Red Team Trigger Criteria**. Read the spec file. For each of the six categories below, mark it as triggered if ANY listed keyword (case-insensitive, word-boundary) appears in the spec body. Record which categories matched — this becomes part of the gate output for transparency. | Category | Example keyword hits (not exhaustive) | |---|---| | `money_path` | `fee`, `fees`, `amount`, `allocation`, `carry`, `carried interest`, `preferred return`, `management fee`, `waterfall`, `price`, `currency`, `invoice`, `AUM`, `IRR`, `MOIC`, `valuation` | | `regulatory_path` | `KYC`, `AML`, `GDPR`, `SEC`, `FCA`, `AIFMD`, `Reg S-P`, `compliance`, `regulator`, `audit report`, `investor disclosure`, `lawful basis`, `subject rights` | | `ai_llm` | `LLM`, `Claude`, `GPT`, `prompt`, `inference`, `classification`, `extraction`, `summarisation`, `summarization`, `scoring`, `model output`, `AI-generated`, `AI-assisted` | | `immutability_audit` | `immutable`, `append-only`, `permanent`, `never deleted`, `audit log`, `audit trail`, `tamper`, `hash chain`, `version chain`, `previous_.*_id` | | `multi_party` | `approval`, `approve`, `IC`, `Investment Committee`, `two-person`, `partner approval`, `override`, `sign-off`, `sign off`, `role-based`, `permission gate` | | `contracts` | `contract`, `interface`, `handoff`, `hand-off`, `upstream`, `downstream`, `API boundary`, `envelope`, `payload`, `request shape`, `response shape`, `schema` | Keyword matching is intentionally liberal — a false positive on the gate just means a spec that did not need red team is still offered the choice. A false negative silently waives a required gate, which is the failure mode the gate exists to prevent. 3. **Check for a findings report**. - Glob `specs//red-team-findings-*.md` in the repo root. - Also check `99_Archive/red-team//` in case the spec has already graduated and the findings were archived. - If the project uses a different path convention, honour its `extension.yml` `config.findings_glob` override (if set). Otherwise use the default above. 4. **Emit the gate decision**. - **No category matched** → ``` Red-Team Gate: NOT REQUIRED Triggers matched: none Outcome: PROCEED ``` Return `PROCEED`. - **At least one category matched AND a findings report exists** → ``` Red-Team Gate: SATISFIED Triggers matched: Findings report: Outcome: PROCEED ``` Return `PROCEED`. - **At least one category matched AND no findings report exists** → ``` Red-Team Gate: BLOCKED (Constitution Principle VIII — qualifying spec without findings on record) Triggers matched: Expected: specs//red-team-findings-*.md (or 99_Archive/red-team//) Found: (none) Options: 1. Run the red team now: /speckit.red-team.run specs//spec.md Community extension — `specify extension add red-team` if not already installed. 2. Explicit opt-out: re-run /speckit.plan with the argument --skip-red-team-gate: The reason is recorded verbatim in the plan's Constitution Check section as an Accepted Risk tagged [red-team-skipped]. A waived gate is itself an Accepted Risk and will be surfaced to the user in the plan summary. Outcome: HALT ``` Return `HALT`. `/speckit.plan` MUST NOT proceed to its Outline step. 5. **Respect an explicit opt-out**. If `$ARGUMENTS` contains the token `--skip-red-team-gate:` followed by a non-empty reason, emit: ``` Red-Team Gate: WAIVED Triggers matched: Reason: Outcome: PROCEED (record as Accepted Risk in plan Constitution Check, tagged [red-team-skipped]) ``` Return `PROCEED`. The caller is responsible for carrying the `[red-team-skipped]` marker into the plan artefact's Constitution Check section. ## Non-Goals - The gate does NOT run the red team itself. That is `/speckit.red-team.run`. - The gate does NOT modify any file. It emits a decision and returns control. - The gate does NOT interpret `condition` expressions on itself — it is a pass-through gate invoked by the `before_plan` hook mechanism. - The gate is idempotent: running it twice on the same spec produces the same decision. ## Implementation Notes - Keyword scans are **simple substring / word-boundary checks**. Do NOT attempt semantic understanding of the spec — the scan is deliberately over-broad so that the only false outcome is "run a red team you didn't strictly need to," never "skip a red team you did need." - Keyword lists above are starting defaults. Projects customising their `red-team-lenses.yml` MAY add their own trigger keywords via the `trigger_keywords` block in that file (v1.1 feature). For v1.0.2 the gate uses the built-in defaults. - The gate runs against the spec file only. It does NOT walk the full documentation tree. This keeps runtime in the single-digit-milliseconds range — the gate is free, invoked on every `/speckit.plan`. --- Source attribution: eitatech Original project: https://github.com/eitatech/gatomia-vscode/blob/081a9aadc7c7680b5b2b4f728042dc2a9f7e8dcc/.agents/skills/speckit-red-team-gate/SKILL.md License: MIT License information: https://opensource.org/license/mit Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice MIT License Copyright (c) 2025 atman-33 Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. # Mega AI Hub resource metadata Creator / publisher: eitatech Original project: https://github.com/eitatech/gatomia-vscode/blob/081a9aadc7c7680b5b2b4f728042dc2a9f7e8dcc/.agents/skills/speckit-red-team-gate/SKILL.md Attribution basis: Source repository record Fields of work: Product Management, Project & Program Management Roles: Product Manager, Project Manager, Technical Product Manager Specialties: API Tools: Spec Kit Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: d83250784dd04ce78523b9e3c25b31e9abdc23186b04c0e563329d3b468c4aad