Perform a complete security analysis of this codebase.

EXECUTION MODE CHECK:
- First read the <scan_execution_mode> block in this prompt.
- Treat these fields as authoritative for this run: run_only_subagent, resume_from_subagent, skip_subagents, dast_enabled, fix_remediation_enabled.
- Ignore conflicting OS environment variables.
- Legacy fallback only if <scan_execution_mode> is missing:
  - RUN_ONLY_SUBAGENT
  - SKIP_SUBAGENTS
  - DAST_ENABLED

Execute these phases SEQUENTIALLY, ONE AT A TIME:

PHASE 1: ASSESSMENT
- Skip if: skip_subagents contains "assessment" OR (run_only_subagent != "none" AND run_only_subagent != "assessment")
- Announce: "Starting Phase 1: Assessment"
- Use the Task tool to invoke the 'assessment' agent to analyze architecture
- Creates .promptheus/SECURITY.md
- Report: "Assessment complete" when done
- WAIT for completion before proceeding

PHASE 2: THREAT MODELING
- Skip if: skip_subagents contains "threat-modeling" OR (run_only_subagent != "none" AND run_only_subagent != "threat-modeling")
- Announce: "Starting Phase 2: Threat Modeling"
- Use the Task tool to invoke the 'threat-modeling' agent to search for threat patterns using STRIDE
- Reads .promptheus/SECURITY.md
- Creates .promptheus/THREAT_MODEL.json
- Report: "Threat modeling complete" when done (do NOT include threat counts - counts will be calculated from the file)
- WAIT for completion before proceeding

PHASE 3: CODE REVIEW
- Skip if: skip_subagents contains "code-review" OR (run_only_subagent != "none" AND run_only_subagent != "code-review")
- Announce: "Starting Phase 3: Code Review"
- Use the Task tool to invoke the 'code-review' agent to validate threats with evidence
- Reads .promptheus/THREAT_MODEL.json
- Creates .promptheus/VULNERABILITIES.json
- Report: "Code review complete" when done
- WAIT for completion before proceeding

PHASE 4: REPORT GENERATION
- Skip if: skip_subagents contains "report-generator" OR (run_only_subagent != "none" AND run_only_subagent != "report-generator")
- When skip_subagents contains both "report-generator" and "dast", the scanner runs Phase 4 and Phase 5 in parallel after this orchestration; you will only run Phases 1–3.
- Otherwise: Announce "Starting Phase 4: Report Generation", use the Task tool to invoke the 'report-generator' agent, wait for completion.
- Report-generator reads SECURITY.md, THREAT_MODEL.json, VULNERABILITIES.json and creates .promptheus/scan_results.json with ALL vulnerabilities.

PHASE 5: DAST VALIDATION (CONDITIONAL)
- Skip if: dast_enabled != "true" OR skip_subagents contains "dast" OR (run_only_subagent != "none" AND run_only_subagent != "dast")
- Check scan_execution_mode.dast_enabled
- If dast_enabled != "true", SKIP this phase entirely
- If dast_enabled == "true":
  - Announce: "Starting Phase 5: DAST Validation"
  - Use the Task tool to invoke the 'dast' agent to validate vulnerabilities via HTTP-based dynamic testing
  - Reads .promptheus/VULNERABILITIES.json
  - Creates .promptheus/DAST_VALIDATION.json
  - Agent may use skills discovered in .claude/skills/dast/
  - Report: "DAST validation complete" when done

PHASE 6: FIX SUGGESTIONS (CONDITIONAL)
- Skip if: fix_remediation_enabled != "true" OR skip_subagents contains "fix-remediation" OR (run_only_subagent != "none" AND run_only_subagent != "fix-remediation")
- Check scan_execution_mode.fix_remediation_enabled
- If fix_remediation_enabled != "true", SKIP this phase entirely
- If fix_remediation_enabled == "true":
  - Announce: "Starting Phase 6: Fix Suggestions"
  - Use the Task tool to invoke the 'fix-remediation' agent to suggest fixes for vulnerabilities
  - Reads .promptheus/VULNERABILITIES.json
  - Creates .promptheus/FIX_SUGGESTIONS.json (advisory only; agent must NOT modify repo files)
  - Report: "Fix suggestions complete" when done

CRITICAL RULES:
- Execute agents ONE AT A TIME in strict sequential order
- Explicitly announce each phase before starting
- WAIT for each phase to complete before starting the next
- VERIFY the required artifact exists after each phase. If missing, STOP IMMEDIATELY.
- Use the Task tool to invoke each agent. Do NOT create agents manually or write agent code.
- Each agent uses ONLY its assigned tools
- Phase 5 is OPTIONAL - only run if dast_enabled=true
- Phase 6 is OPTIONAL - only run if fix_remediation_enabled=true

Keep responses brief - focus on announcing phases, invoking agents, and reporting completion.
