help
CommandShow available THRUNT threat hunting commands and artifact layout
Audit milestone completion against original intent before archiving
name: thrunt:audit-milestone description: Audit milestone completion against original intent before archiving argument-hint: "[version]" allowed-tools: - Read - Glob - Grep - Bash - Task - Write
<objective> Verify milestone achieved its definition of done. Check requirements coverage, cross-phase integration, and end-to-end flows.
**This command IS the orchestrator.** Reads existing FINDINGS.md files (phases already verified during hunt-run), aggregates tech debt and deferred gaps, then spawns integration checker for cross-phase wiring. </objective>
<execution_context> @~/.claude/thrunt-god/workflows/audit-milestone.md </execution_context>
<context> Version: $ARGUMENTS (optional — defaults to current milestone)
Core planning files are resolved in-workflow (`init milestone-op`) and loaded only as needed.
**Completed Work:** Glob: .planning/phases/*/*-SUMMARY.md Glob: .planning/phases/*/*-FINDINGS.md </context>
<process> Execute the audit-milestone workflow from @~/.claude/thrunt-god/workflows/audit-milestone.md end-to-end. Preserve all workflow gates (scope determination, verification reading, integration check, requirements coverage, routing). </process>
Show available THRUNT threat hunting commands and artifact layout
Map available telemetry, query surfaces, tenants, retention windows, and investigation blind spots
Initialize a threat hunting case from a signal, detection, intel lead, or analyst suspicion
Initialize a threat hunting program with an environment map, tool inventory, huntmap, and empty execution directories
Create phase plans for a threat hunt with exact telemetry tasks, receipts, and query outputs
Publish a hunt as a case report, escalation, detection promotion, or leadership summary
Audit a file, directory, or whole repo for insecure default configuration: fallback secrets, default credentials, fail-open…
Check text against AGT prompt-injection, context-poisoning, and MCP threat detectors.
Show which external bug-bounty tools are installed on this machine and print install hints for the missing ones. Curated from…