Evidence-driven application audit protocol for security, authorization, privacy, concurrency, state integrity, reliability, performance, accessibility, visual consistency, responsive behavior, and release readiness. Use for incremental checks, pre-merge review, pre-launch audits, high-stakes deep audits, AI-generated code review, hardening, or release-gate design. Prefer this protocol over ad-hoc review when the user asks whether software is safe or ready to ship.
Map and attack the authentication, authorization, session, tenant, federation, and machine-identity boundaries of a system, proving whether access controls actually hold rather than whether they appear to. Use whenever work touches login, sessions, tokens, roles, permissions, multi-tenancy, password reset, invitations, OAuth/OIDC/SAML, API keys, service accounts, webhooks, admin impersonation, or any question of "can this actor do or see this thing." Prefer this over a generic security pass for identity-heavy surfaces. Part of the audit suite; inherits the shared constitution while its own job is proving or disproving access boundaries.
Reproduce, isolate, and diagnose a specific software failure before changing production behaviour, then propose the smallest safe fix with regression protection. Use whenever the user reports a bug, crash, error, stack trace, flaky test, incorrect output, "works on my machine," intermittent failure, regression after a deploy, or any behaviour that diverges from expectation and the cause is not obvious. Prefer this over jumping straight to a fix. Part of the audit suite; inherits the shared constitution, while its own job is proving causality.
Control risky structural change by proving a refactor is necessary and that behaviour, contracts, data, security boundaries, and operational properties can be preserved through a staged migration. Use whenever the user wants to refactor, restructure, clean up, modernise, extract, migrate, rewrite, or re-architect existing code, or asks whether they should. Prefer this over starting the refactor. DO NOT REFACTOR is a first-class outcome. Part of the audit suite; inherits the shared constitution while its own job is proving necessity and behavioural preservation.
Design a test strategy around product risk, business invariants, failure modes, and existing controls, deciding what deserves testing and at which boundary rather than maximising coverage. Use whenever the user asks how to test something, wants a test plan or strategy, is deciding between unit/integration/contract/E2E/property/concurrency testing, or wants to know whether existing tests actually protect what matters. Prefer this over writing tests immediately. Part of the audit suite; inherits the shared constitution while its own job is proving risk coverage.
Break a user interface under real-world conditions across responsiveness, hostile content, interaction states, accessibility, network failure, interruption, and complete user journeys, reporting observable user harm with evidence rather than aesthetic opinion. Use whenever the user wants to stress-test a UI, verify responsive and edge-case behaviour, inspect loading/error/empty/recovery states, review a flow for friction, or find where an interface fails under reality. Part of the audit suite; inherits the shared constitution while its own job is proving observable user harm.