test-red-team — Adversarial Full-App Defect Sweep

Degree of freedom: MIXED — matrix and severity [HIGH freedom]; ROE, harness, and benign-payload confirmation [LOW freedom — run exactly]. Web driver is playwright-cli. Do not write exploit PoCs into the repo.

A hostile, skeptical pass across UI/UX, data pipeline, security, and performance. Default output is a severity-ranked defect list, not inline fixes (test-playwright is the fix-as-you-go PDCA). Offer to fix after the report; ask which defects to prioritize.

Read protocol-browser-anti-stall before any browser action (Rule 0: manual & headed) and references/playwright-session-coordination.md.

Attack through the visible UI, by hand. One real action at a time. eval / CDP / WebView attach may set a condition (throttle, kill a request, emulate) or inspect — never perform the click/type/submit under test. The defect must be reachable the way a real attacker reaches it.