Adversarial review

Try to disprove the system's important invariants with concrete inputs and state. Findings need a reachable path or an explicit evidence gap; a clean report is allowed.

Phase 1: Bound the target

Review the named target (diff, change request, branch or paths); a fresh reviewer context may lack the conversation. If none is given, state the target inferred from the working tree, or ask when inference is unsafe.

• Read scope, repository instructions, architecture and diff; inspect committed, staged, unstaged and relevant untracked changes separately. Record revision, test environment and intended invariants.
• Map the attack surface: entry points, untrusted data, transformations, authorization decisions, sinks, persistence, and who controls each input.
• Reproduce only in local fixtures or an authorized environment, never with destructive traffic against a live system.