audit-auth-flows — Middleware is edge routing, not a security boundary

Degree of freedom: MIXED — declared per phase

• Phases 0–4 (discovery, judgment): [HIGH freedom] — reason about what you find; checklists prompt investigation, they are not tick-scripts.
• Phase 5 (live probes) and the getSession grep: [LOW freedom — run exactly] — a skipped probe is an unproven claim, not a saved step.

Read-only. Map the auth surface and prove, route by route, that identity is verified where it matters. Then stop. Hand fixes to a follow-up session.

2026 consensus (official, post CVE-2025-29927): Next.js middleware runs before cache and routing. Vercel: "We do not recommend Middleware to be the sole method of protecting routes in your application." An audit that only reads middleware.ts and declares the app safe has missed the point. Defense in depth: edge + route handler / server action

• data layer. Each layer covers a different part of the request path.