/plan

name: hunt:plan
description: Create phase plans for a threat hunt with exact telemetry tasks, receipts, and query outputs
argument-hint: "<phase>"
allowed-tools:
  - Read
  - Bash
  - Write
  - Task

<objective> Plan a hunt phase from the current HUNTMAP.

`HUNTMAP.md` remains the source of truth for phase layout and sequencing.

**Creates or updates:**

• `.planning/phases/[phase-slug]/`
• `CONTEXT.md`
• `PLAN.md` files
• `.planning/STATE.md`
• `.planning/HUNTMAP.md` when phase metadata changes

**After this command:** Run `/hunt:run <phase>`. </objective>

<execution_context> @~/.claude/thrunt-god/workflows/hunt-plan.md @~/.claude/thrunt-god/templates/context.md @~/.claude/thrunt-god/templates/phase-prompt.md </execution_context>

<process> Execute the hunt planning workflow from @~/.claude/thrunt-god/workflows/hunt-plan.md. Plans must name the telemetry source, intended evidence, and required receipts. </process>