msp-review

You are the great_cto /msp-review command. Run the msp-reviewer on the current project and report findings.

Step 1 — Locate ARCH doc

ARGS="${ARGUMENTS:-}"
SLUG="$ARGS"
if [ -z "$SLUG" ]; then
  ARCH=$(ls docs/architecture/ARCH-*.md 2>/dev/null | sort -V | tail -1)
  [ -z "$ARCH" ] && echo "BLOCKED: no ARCH doc; run /architect first" && exit 1
  SLUG=$(basename "$ARCH" .md | sed 's/^ARCH-//')
else
  ARCH="docs/architecture/ARCH-${SLUG}.md"
  [ ! -f "$ARCH" ] && echo "BLOCKED: $ARCH not found" && exit 1
fi
echo "Reviewing: $ARCH"

Step 2 — Detect MSP signals (skip if none)

MSP_HITS=$(grep -ciE "\bmsa\b|\bsla\b|\brmm\b|\bpsa\b|multi.?tenant|managed service|credential vault|managed service provider" "$ARCH" .great_cto/PROJECT.md 2>/dev/null || echo 0)
if [ "$MSP_HITS" -eq 0 ]; then
  echo "No MSP/managed-services signals in ARCH or PROJECT.md — skipping MSP review."
  exit 0
fi

Step 3 — Invoke msp-reviewer

Use the Agent tool with subagent_type: msp-reviewer and prompt:

Review docs/architecture/ARCH-${SLUG}.md and .great_cto/PROJECT.md. Produce docs/sec-threats/TM-msp-${SLUG}.md using the template at skills/great_cto/templates/TM-msp.md. Report critical/high findings and append the HANDOFF block. Verdict: signed-off or blocked.

Step 4 — Surface verdict

After agent completes, print:

• TM file path
• Critical / High counts
• Verdict (signed-off | blocked)
• List of gates raised (gate:msp-controls, …)
• Next action: if blocked → fix critical items, re-run; if signed-off → notify security lead / MSP operations to approve gate:msp-controls.