# Tasks: gemma-deployment-security

**Input**: `specs/gemma-deployment-security/plan.md`, `plugins/gemma-deployment-security/docs/spec.md`
**Prerequisites**: Constitution ratified, design spec approved

## Phase 1: Setup (Shared Infrastructure)

**Purpose**: Plugin scaffold and toolkit registration

- [x] T001 Create `plugins/gemma-deployment-security/.claude-plugin/plugin.json` with name, description, version 1.0.0, keywords
- [x] T002 Create `plugins/gemma-deployment-security/CHANGELOG.md` (empty initial)
- [x] T003 Register plugin in `release-please-config.json` under `packages`
- [x] T004 Register plugin in `.release-please-manifest.json` with version `1.0.0`
- [x] T005 Create directory structure for all 7 skills (empty SKILL.md placeholders)

**Checkpoint**: Plugin scaffold complete, `plugin-dev:plugin-validator` passes on structure

---

## Phase 2: Checklist Extraction (Blocking — content for all skills)

**Purpose**: Extract check content from the security research report into checklist files

- [x] T006 [P] Extract Docker Compose checks from security report §05 → `audit-docker-compose/references/checklist.md` (12 checks)
- [x] T007 [P] Create Dockerfile checks from real findings + report → `audit-dockerfile/references/checklist.md` (9 checks)
- [x] T008 [P] Extract CI/CD checks from security report §07 → `audit-cicd-workflows/references/checklist.md` (8 checks)
- [x] T009 [P] Extract server checks from security report §03, §04, §08 → `audit-server-config/references/checklist.md` (12 checks)
- [x] T010 [P] Create server guided-checklist fallback → `audit-server-config/references/guided-checklist.md`
- [x] T011 [P] Create IaC checks from saxonia patterns → `audit-infrastructure-as-code/references/checklist.md` (13 checks)
- [x] T012 [P] Create Airflow-specific checks from report + real findings → `audit-airflow-config/references/checklist.md` (10 checks)
- [x] T013 Create report template → `generate-security-report/assets/report-template.md`

**Checkpoint**: All 7 checklist files complete with proper format (priority, what to look for, pass condition, fail example, remediation, source)

---

## Phase 3: Skill Implementation (can proceed in parallel after Phase 2)

**Purpose**: Write SKILL.md for each audit skill using `skill-creator:skill-creator`

### Skill 1: audit-docker-compose
- [x] T014 Write `audit-docker-compose/SKILL.md` — instructions to read docker-compose.yml, apply each check from checklist, report findings with severity and remediation

### Skill 2: audit-dockerfile
- [x] T015 [P] Write `audit-dockerfile/SKILL.md` — instructions to find and read Dockerfile(s), check for secrets in layers, credential patterns, pinning, USER directive

### Skill 3: audit-cicd-workflows
- [x] T016 [P] Write `audit-cicd-workflows/SKILL.md` — instructions to scan .github/workflows/, check action pinning, environment protection, secrets handling

### Skill 4: audit-server-config
- [x] T017 [P] Write `audit-server-config/SKILL.md` — instructions for SSH-based checks with fallback to guided checklist when SSH unavailable

### Skill 5: audit-infrastructure-as-code
- [x] T018 [P] Write `audit-infrastructure-as-code/SKILL.md` — instructions to scan for *.tf, ansible roles, check OpenTofu + Ansible patterns

### Skill 6: audit-airflow-config
- [x] T019 [P] Write `audit-airflow-config/SKILL.md` — instructions to check Airflow-specific security (fernet key, webserver auth, executor, DAG permissions)

### Skill 7: generate-security-report
- [x] T020 Write `generate-security-report/SKILL.md` — orchestrates all skills, merges findings into report template, writes output file

**Checkpoint**: All 7 SKILL.md files complete, each under 500 lines, proper YAML frontmatter with `disable-model-invocation: true`

---

## Phase 4: Validation & Testing

**Purpose**: Verify plugin works end-to-end

- [x] T021 Run `plugin-dev:plugin-validator` against `plugins/gemma-deployment-security/`
- [x] T022 Run `skill-creator:skill-creator` eval on each skill's description for trigger accuracy
- [x] T023 Test `audit-docker-compose` against `airflow3-demo/docker-compose.yaml` — verify expected findings
- [x] T024 Test `audit-dockerfile` against `gemma-airflow/Dockerfile` — verify secret detection
- [ ] T025 Test `generate-security-report` against `airflow3-demo/` — verify complete report output
- [x] T026 Constitution compliance review: verify all principles are met across all skills

**Checkpoint**: Plugin validated, all functional tests pass, ready for PR

---

## Phase 5: Polish & Release Prep

- [x] T027 Commit all files with conventional commits: `feat(gemma-deployment-security): add initial 7-skill security audit plugin`
- [x] T028 Create PR to main with summary of all skills and test results

---

## Dependencies & Execution Order

### Phase Dependencies
- **Phase 1 (Setup)**: No dependencies — start immediately
- **Phase 2 (Checklists)**: Depends on Phase 1 for directory structure
- **Phase 3 (Skills)**: Depends on Phase 2 for checklist content — skill SKILL.md references checklist.md
- **Phase 4 (Validation)**: Depends on Phase 3 completion
- **Phase 5 (Release)**: Depends on Phase 4 passing

### Parallel Opportunities
- T006–T013 (all checklists): fully parallel — different files, no dependencies
- T014–T019 (all audit skills): fully parallel — different directories, no cross-references
- T020 (report generator): depends on T014–T019 being defined (references their names)
- T023–T025 (functional tests): sequential (each needs the skill to exist)

### Recommended Execution with Subagents
- **Agent pool 1** (Phase 2): 3 agents in parallel
  - Agent A: T006 + T007 (Docker Compose + Dockerfile checklists)
  - Agent B: T008 + T009 + T010 (CI/CD + Server checklists)
  - Agent C: T011 + T012 + T013 (IaC + Airflow checklists + report template)
- **Agent pool 2** (Phase 3): 3 agents in parallel
  - Agent A: T014 + T015 (Docker Compose + Dockerfile skills)
  - Agent B: T016 + T017 + T018 (CI/CD + Server + IaC skills)
  - Agent C: T019 + T020 (Airflow + Report generator skills)
- **Sequential** (Phase 4): Main agent runs validation and tests