audit-payment-system — Money-Movement Correctness & Compliance Audit

Degree of freedom: MIXED — Scope, matrix, and severity [HIGH freedom]; Phase 0 detection searches [LOW freedom — run exactly]. Do not write exploit or payment-fraud PoCs — quote the missing control, never a replay or spoof recipe.

Read-only. Assess and prioritize; do not change code. Payment code is a STOP-and-confirm surface — findings feed a human-reviewed remediation, ideally with a stronger model. Delegations: per-call resilience → audit-resilience; PCI/secrets/authz → audit-security; ledger schema → audit-db-schema; outbox/saga structure → audit-backend-architecture; append-only integrity → plan-data-integrity; Stripe integration → the Stripe plugin skills. This skill owns payment-domain correctness.