Harden — Adversarial Review, Security, Observability, Lean

Make a system production-robust without over-building it. Red-team it, refute each finding before accepting it, then land patches. Composes /review (correctness passes) and /security (auth, encryption, secrets), plus /gate to prove fixes hold.

North star: no security holes · full debuggable observability at every stage · no bottlenecks · no over-engineering AND no shortcuts — never trade away performance, cost, or output quality to simplify.

Step 0 — Detect stack & map the pipeline

Detect language/framework from manifests (package.json, pyproject.toml, go.mod, IaC files). Then map every stage data flows through — this map drives every later pass:

• Entry points — uploads, API routes, webhooks, queue consumers, scheduled jobs.
• Processing — pipeline/graph stages, agent or LLM calls, external service calls.
• Exit — report generation, persistence, notifications.

Output a stage map: entry → … → exit, with the trust boundary and failure surface at each hop.