---
description: >-
  Start supply chain security planning from PRD artifacts using the
  SSSC Planner agent in from-prd mode
agent: SSSC Planner
---

# SSSC from PRD

## Startup

Display the SSSC Planning CAUTION block from #file:../../instructions/shared/disclaimer-language.instructions.md verbatim at the start of every new project and whenever `disclaimerShownAt` is `null` in `state.json`, before any questions or analysis. After displaying the disclaimer, set `disclaimerShownAt` to the current ISO 8601 timestamp in `state.json`.

After the disclaimer, display the framework attribution `OpenSSF Scorecard • SLSA Build Levels • OpenSSF Best Practices Badge • Sigstore • SBOM`. Display both the disclaimer and the attribution before any questions or analysis.

Activate the SSSC Planner in **from-prd mode** for project slug `${input:project-slug}` to bootstrap a supply chain security assessment from existing product definition artifacts.

The SSSC Planner consults the `supply-chain-security` skill for framework and capabilities-inventory reference content (OpenSSF Scorecard, SLSA, Best Practices Badge, Sigstore, SBOM); do not restate those tables in this prompt.

## Inputs

* `${input:project-slug}`: (Optional) Project slug for the SSSC plan directory. When omitted, derive from the discovered PRD project name.

## Requirements

### Pre-Scan

Scan the workspace for PRD artifacts and supporting context:

**Primary paths:**

* `.copilot-tracking/prd-sessions/` for product requirements documents

**Secondary scan:**

* `.copilot-tracking/` for files matching `prd-*.md`, `*-prd.md`, or `product-definition*.md`. Exclude generic matches like `requirements.txt` or files outside product-scoping contexts.

Also scan the shared supporting context sources defined in `sssc-planner.instructions.md`.

Present pre-scan results as a checklist:

* ✅ Discovered PRD artifacts and supporting context with file paths and brief descriptions
* ❌ Expected sources that were not found

If zero PRD artifacts are found, fall back to capture mode and explain the switch.

### Scope Extraction

Extract from the discovered PRD artifacts:

1. Project name and supply chain security purpose
2. Technology stack and package managers
3. CI/CD platform and release strategy
4. Deployment targets and registry destinations
5. Compliance requirements and integration points

### Initialization

Create the project directory at `.copilot-tracking/sssc-plans/${input:project-slug}/`.

Write `state.json` with `entryMode` set to `"from-prd"`, `currentPhase` set to `1`, preserving `disclaimerShownAt` if already set, and remaining fields populated from the extracted PRD context.

### Phase 1 Entry

Present the extracted scope as a checklist with markers:

* ✅ Items confirmed from the PRD
* ❓ Items that need clarification or are missing

Then invite the user into a Phase 1 conversation with 3 to 5 facilitative clarifying questions targeting supply chain gaps not covered by the PRD, such as runner topology, signing strategy, SBOM tooling, and Best Practices Badge readiness. Use confirmation-and-refinement phrasing rather than directives.
