iep-challenge

Audit every user-facing legal citation in apps/web against the canonical OBL register at docs/case-management-research/enforcement-map.md. Enforces the three-tier legal-leakage taxonomy from CLAUDE.md — verbatim regulation text lives only in `DisclosureCard.citation`; eyebrows, headings, button labels, and form copy stay plain-language; acronyms expand on first use on family surfaces. Flags fabricated cites (a §-reference that doesn't resolve to a real OBL entry), Tier-2 leakage (legal jargon in chrome), and Tier-3 leakage (raw acronyms in family chrome). Runs inline. Use when the user says "audit citations", "check grounding", "legal-leakage check", or after lifting a prototype page that mentions any of `§ / OBL- / CFR / IDEA / PWN / ARD / IAES / REED / manifestation`.

Adversarial review of design-system fidelity in the plugin/ subtree (plugins/*/src/pages, plugins/*/src/components, packages/ui). Hunts editorial drift (facts surfaced twice, sections that dump tables instead of answering questions, lists that should be summary stats), atomic-unit drift (the same person row / item row / section header rendered with different markup), and proportional drift (arbitrary spacing values, ad-hoc letter-spacing, hand-rolled cards next to the Card primitive). Pairs with packages/ui/src/boundary.test.ts which enforces the deterministic patterns. Runs inline in the current chat (no subagent fork). Use when the user says "design review", "design audit", "consistency check", "is the design system holding", or after adding any UI surface.

Drive one or more control-room workflows end-to-end and diff the capture against the prior run for the same workflow. Surfaces which (persona, step) cells changed and why, so a cascade regression caused by a recent change becomes a structured finding instead of an after-the-fact "I think something broke." Runs inline in the current chat (no subagent fork). Use when the user says "run the harness", "drive a workflow", "verify the cascade", "check for regressions across personas", "run the journey loop", or after a non-trivial change to rights derivation / state-machine guards / Drizzle queries / persona shells.

Inline mutation testing for the apps/ monorepo — inject targeted regressions into @iep/domain (machine guards, rights derivation), @iep/data (Drizzle queries, schema), @iep/services (mutation contracts, composition), or apps/web (server actions), then run `pnpm -w typecheck` + `pnpm -w test` and report which mutations SURVIVED. Surviving mutations are direct evidence of validation gaps. Runs inline in the current chat (no subagent fork). Use when the user says "trickster", "mutation test", "break the code", "can the tests catch regressions", "grade the validation", or after adding code whose coverage is uncertain.

Adversarial bug-hunting code review of the plugin-first framework in plugin/ — @plugin/{core,runtime,ui}, the host app, and plugin packages. Hunts real bugs in manifest validation, merger floor enforcement, mutator atomicity, registry collision detection, auditor declared-emitter discipline, state-machine actor lifecycle, realtime subscriber isolation, and the plugin-scoped service injection seam. Not style nits. Runs inline in the current chat. Use after non-trivial framework changes or before a phase commit.

Adversarial bug-hunting code review of the apps/ monorepo — apps/web, @iep/domain, @iep/data, @iep/services, @iep/auth. Hunts real bugs in state-machine guards, rights derivation, Drizzle queries, server actions, persona/audit emission, and idempotent seed/migration code. Not style nits. Runs inline in the current chat (no subagent fork). Use when the user asks for a "red team", "bug hunt", "adversarial review", or at checkpoints during long lifts.

Adversarial review of the TEST AND VALIDATION SURFACE of the apps/ monorepo — vitest unit suites in @iep/domain + @iep/data + @iep/services + @iep/ui + apps/web, the Drizzle integration tests under @iep/data/queries, the boundary.test.ts pattern enforcers in @iep/ui and @iep/data, and the OBL enforcement-map. Hunts tautological assertions, integration tests that don't reach the DB, missing regression coverage for known-deferred obligations, and surfaces that document an invariant without enforcing it. Runs inline in the current chat (no subagent fork). Use when the user says "red team the tests", "audit the tests", "are our tests any good", or after adding tests/validation that needs scrutiny.