@kensaurus/skills 0.0.0-stage → 2.1.0

package/skills/audit-agent-speed/scripts/stop-typecheck.mjs

@@ -0,0 +1,151 @@
+#!/usr/bin/env node
+/**
+ * Claude Code Stop hook, registered with `asyncRewake: true`: typecheck in the
+ * background after a turn, and wake Claude only when there is something new to fix.
+ *
+ *   {
+ *     "hooks": { "Stop": [{ "hooks": [{
+ *       "type": "command",
+ *       "command": "node \"$CLAUDE_PROJECT_DIR/.claude/hooks/stop-typecheck.mjs\" typecheck",
+ *       "asyncRewake": true,
+ *       "timeout": 600
+ *     }] }] }
+ *   }
+ *
+ * - Skips in ~0.3 s when no TypeScript input changed since the last check.
+ * - Exit 2 wakes Claude with the errors (stderr becomes a system reminder).
+ *   Exit 0 stays silent. A plain synchronous Stop hook can't do this: its
+ *   stdout only reaches the debug log, so Claude never sees the errors.
+ * - Re-wakes only when the error set changes, so a pre-existing error can't loop.
+ * - Summarizes large error sets (often one missing codegen step) instead of
+ *   dumping hundreds of lines.
+ * - State, lock and tsbuildinfo live in this worktree's git dir, never in a
+ *   node_modules shared across worktrees.
+ *
+ * Assumes the script (default `typecheck`) runs plain `tsc --noEmit` and accepts
+ * `--incremental --tsBuildInfoFile <path>`. Not for `tsc -b` or wrappers that
+ * reject extra flags. Package manager is picked from the lockfile.
+ *
+ * Usage: node stop-typecheck.mjs [script-name]
+ */
+import { execFileSync, spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+
+const script = process.argv[2] || "typecheck";
+const cwd = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+const git = (...args) => execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+const sha = (s) => createHash("sha1").update(s).digest("hex");
+const STALE_LOCK_MS = 15 * 60 * 1000;
+
+let gitDir;
+try {
+  gitDir = git("rev-parse", "--path-format=absolute", "--git-dir");
+} catch {
+  process.exit(0);
+}
+// Stay silent in a repo without the script rather than waking the agent with
+// the package manager's "missing script" error.
+try {
+  const scripts = JSON.parse(fs.readFileSync(path.join(cwd, "package.json"), "utf8")).scripts ?? {};
+  if (!(script in scripts)) process.exit(0);
+} catch {
+  process.exit(0);
+}
+
+const stateFile = path.join(gitDir, "claude-stop-typecheck.json");
+const lockFile = path.join(gitDir, "claude-stop-typecheck.lock");
+const buildInfo = path.join(gitDir, "claude-stop-typecheck.tsbuildinfo");
+
+// HEAD plus size and mtime of every changed or untracked TypeScript input.
+const status = git("status", "--porcelain", "--untracked-files=all", "--", "*.ts", "*.tsx", "*.mts", "*.cts", "tsconfig*.json", "package.json");
+const stamps = status
+  .split("\n")
+  .filter(Boolean)
+  .map((line) => {
+    const file = line.slice(3).split(" -> ").pop().replace(/^"|"$/g, "");
+    try {
+      const st = fs.statSync(path.join(cwd, file));
+      return `${line}|${st.size}|${st.mtimeMs}`;
+    } catch {
+      return line;
+    }
+  });
+const fingerprint = sha([git("rev-parse", "HEAD"), ...stamps].join("\n"));
+
+let state = {};
+try {
+  state = JSON.parse(fs.readFileSync(stateFile, "utf8"));
+} catch {}
+if (state.fingerprint === fingerprint) process.exit(0);
+
+// One run per worktree at a time; a later turn re-checks anyway.
+let lock;
+try {
+  lock = fs.openSync(lockFile, "wx");
+} catch {
+  try {
+    if (Date.now() - fs.statSync(lockFile).mtimeMs < STALE_LOCK_MS) process.exit(0);
+    fs.rmSync(lockFile, { force: true });
+    lock = fs.openSync(lockFile, "wx");
+  } catch {
+    process.exit(0);
+  }
+}
+
+const runner = fs.existsSync(path.join(cwd, "pnpm-lock.yaml"))
+  ? "pnpm run --silent"
+  : fs.existsSync(path.join(cwd, "yarn.lock"))
+    ? "yarn run --silent"
+    : fs.existsSync(path.join(cwd, "bun.lock")) || fs.existsSync(path.join(cwd, "bun.lockb"))
+      ? "bun run"
+      : "npm run --silent";
+const extraArgs = `--incremental --tsBuildInfoFile "${buildInfo}"`;
+// npm needs `--` before script args; pnpm, yarn and bun forward them as-is.
+const command = runner.startsWith("npm") ? `${runner} ${script} -- ${extraArgs}` : `${runner} ${script} ${extraArgs}`;
+
+let exitCode = 0;
+try {
+  const run = spawnSync(command, { cwd, shell: true, encoding: "utf8", maxBuffer: 64 << 20 });
+  const output = `${run.stdout || ""}${run.stderr || ""}`;
+  if (run.status === 0) {
+    state = { fingerprint, errorsHash: "" };
+  } else {
+    const errors = [...new Set(output.split(/\r?\n/).filter((l) => /error TS\d+/.test(l)))];
+    const report = errors.length ? errors : output.trim().split(/\r?\n/).slice(-30);
+    const errorsHash = sha(report.slice().sort().join("\n"));
+    if (errorsHash !== state.errorsHash) {
+      process.stderr.write(
+        `Background \`${script}\` failed after your last turn (${errors.length || "unknown number of"} error(s)). Fix these before finishing:\n` +
+          (errors.length > 50 ? summarize(errors) : report.slice(0, 40).join("\n")) +
+          "\n",
+      );
+      exitCode = 2;
+    }
+    state = { fingerprint, errorsHash };
+  }
+  fs.writeFileSync(stateFile, JSON.stringify(state));
+} finally {
+  fs.closeSync(lock);
+  fs.rmSync(lockFile, { force: true });
+}
+process.exit(exitCode);
+
+// Hundreds of errors usually cascade from one cause, such as missing generated code.
+// Summarize so Claude fixes the root cause instead of chasing symptoms.
+function summarize(errors) {
+  const count = (list, key) => list.reduce((m, l) => ((k) => (k ? m.set(k, (m.get(k) || 0) + 1) : m))(key(l)), new Map());
+  const top = (m, n) => [...m].sort((a, b) => b[1] - a[1]).slice(0, n);
+  const codes = top(count(errors, (l) => l.match(/error (TS\d+)/)?.[1]), 6).map(([c, n]) => `${c} x${n}`).join(", ");
+  const missing = top(count(errors.filter((l) => /TS2307/.test(l)), (l) => l.match(/module '([^']+)'/)?.[1]), 5);
+  const lines = [`By code: ${codes}`];
+  if (missing.length) {
+    lines.push("Most-missing modules:", ...missing.map(([mod, n]) => `  ${mod} (${n} imports)`));
+    if (missing.some(([mod]) => /generated|prisma|\.gen\b|codegen/i.test(mod))) {
+      lines.push("Generated code is missing in this checkout. Run the repo's codegen first (e.g. `npx prisma generate`), then re-check. Most other errors likely cascade from it.");
+    }
+  }
+  lines.push("First errors:", ...errors.slice(0, 10));
+  return lines.join("\n");
+}

package/skills/audit-analytics/SKILL.md

@@ -0,0 +1,138 @@
+---
+name: audit-analytics
+description: >
+  Read-only audit of product-analytics events (PostHog, Amplitude, Mixpanel,
+  GA4): taxonomy, funnels, consent-gated firing, dead or duplicate events. Use
+  when "audit our analytics", "are we tracking the right events", or "funnel
+  instrumentation".
+license: MIT
+effort: high
+---
+
+# audit-analytics — Product-event instrumentation
+
+**Degree of freedom: HIGH** — judgment on taxonomy and funnel coverage.
+Consent-gate proof is `[LOW freedom]` when you confirm the SDK does not
+init on boot (quote the init site; do not invent a legal opinion).
+
+Read-only. You verify the app measures what the business needs to decide, with
+one taxonomy, without leaking PII or firing before consent.
+
+**The failure mode is silent:** the dashboard looks populated, but the key
+funnel step was never instrumented, so every decision on it is guesswork.
+
+> **Present findings. Propose a canonical taxonomy. Do not rewrite events
+> until approved.**
+
+## This skill vs neighbors
+
+| Skill | Owns |
+|---|---|
+| **audit-analytics** (this) | Event coverage, naming, consent-gated *firing* |
+| `plan-privacy-compliance` | Legal data-flow + store labels; **run both** when consent is in play |
+| `data-visualization` | Charts/dashboards as UI — not whether events exist |
+| `iterate-post-launch` | What to fix next from *existing* prod signals |
+| `audit-ux-journeys` | Task completion / IA; may recommend this skill when funnels are blind |
+| `workflow-feature-flag` | Flag rollout; not event taxonomy |
+
+Do **not** fire for "build me a chart" → `data-visualization`.
+Do **not** fire for "GDPR / privacy labels" alone → `plan-privacy-compliance`
+(then come back here for the event matrix).
+
+## How to reason
+
+1. **Observe** — quote the `track()` / schema name and where it fires
+2. **Interpret** — can the business answer the funnel question this event claims to answer?
+3. **Classify** — missing / dead / duplicate / phantom / PII / consent-before-init / correct
+4. **Severity** — key-funnel step never fired, or analytics before consent = P0
+
+## Worked example
+
+> **Observe:** signup success fires `signup_completed` on web and
+> `Signup Success` on iOS; PostHog inits in `layout.tsx` before the consent banner.
+> **Interpret:** the funnel splits across two names; EU visitors are tracked
+> before consent.
+> **Classify:** taxonomy split + consent-before-init.
+> **Severity:** P0 for consent; major for the name split.
+> **Finding:** `Signup Success` | duplicate name | unify to `signup_completed`;
+> init → `plan-privacy-compliance` + gate behind consent.
+
+---
+
+## Phase 0 — Detect the analytics stack  [HIGH freedom]
+
+- Provider: PostHog / Amplitude / Mixpanel / GA4 / Segment / custom table
+- Where events are defined: central taxonomy vs scattered `track()` (scattered
+  is itself a finding)
+- Typed schema vs free-form string names
+- Web vs iOS vs Android vs server
+
+---
+
+## Phase 1 — Reconstruct the intended funnel  [HIGH freedom]
+
+From the product's core loop, list critical journeys as ordered steps
+(e.g. install → signup → activation → first value → habit → conversion).
+For each step, name the event(s) that *must* fire. This is the yardstick.
+
+---
+
+## Phase 2 — Coverage and correctness  [HIGH freedom; consent init = LOW]
+
+**Funnel completeness** — Each intended step has an event in code. Missing Y
+means you cannot answer "why drop between X and Y".
+
+**Taxonomy** — One convention (`object_action`, case, tense). Mixed names
+(`signup_completed` vs `Signup Success`) fragment analysis. Properties
+consistent (`user_id` vs `userId`).
+
+**Dead / duplicate / phantom** — Defined never fired; same action twice under
+different names; fired on render instead of on action.
+
+**Property hygiene** — Plan tier, platform, source present so cohorts work later.
+
+**PII & consent** — No raw email/name/address in properties. Analytics SDK
+gated behind consent — **not** initialized on boot. Cross-check
+`plan-privacy-compliance` for the legal inventory; this skill owns the
+event-level gate.
+
+**Cross-platform parity** — Same action → same event name on each client.
+
+**Identity** — Anonymous → identified stitch after signup. Broken stitch
+double-counts users.
+
+---
+
+## Definition of Done
+
+- [ ] Intended funnel(s) written with required event per step
+- [ ] Each step instrumented or gap logged
+- [ ] Naming checked against one convention
+- [ ] Dead, duplicate, phantom fires listed
+- [ ] PII in properties + consent-gating verified; privacy handoff written
+- [ ] Cross-platform parity checked if multi-platform
+- [ ] Anonymous→identified stitching verified
+- [ ] Nothing rewritten without approval
+
+## Self-critique before reporting  [LOW freedom — do not skip]
+
+1. **Evidenced** — event name + file:line, not "we probably track signup"
+2. **Funnel first** — every finding maps to a step that must fire
+3. **No PII values** — report property *names*, never emails or user ids
+4. **Right owner** — legal inventory → `plan-privacy-compliance`
+5. **Nothing rewritten** — taxonomy proposed, not applied
+
+## Output format
+
+1. **Funnel coverage** — step | required event | present? | notes
+2. **Taxonomy findings** — inconsistent/dead/duplicate/phantom | severity | fix
+3. **PII/consent** — event | problem | handoff to `plan-privacy-compliance`
+4. **Fix plan** — taxonomy → missing events → consent gate, severity-ordered
+
+## Related
+
+- `plan-privacy-compliance` — consent, deletion, store labels (run both)
+- `iterate-post-launch` — consume a trustworthy data layer
+- `audit-ux-journeys` — journeys that need funnel evidence
+- `data-visualization` — rendering metrics, not collecting them
+- `workflow-feature-flag` — flag exposure events

package/skills/audit-auth-flows/SKILL.md

@@ -0,0 +1,267 @@
+---
+name: audit-auth-flows
+description: >
+  Read-only audit of app-layer auth: route×gate matrix, session lifecycle,
+  OAuth, provider traps (getSession vs getUser, middleware-only gates,
+  CVE-2025-29927). Use when "audit our auth" or "check middleware protection".
+  RLS → plan-rls-audit.
+license: MIT
+effort: high
+---
+
+# audit-auth-flows — Middleware is edge routing, not a security boundary
+
+**Degree of freedom: MIXED — declared per phase**
+
+- Phases 0–4 (discovery, judgment): **[HIGH freedom]** — reason about what
+  you find; checklists prompt investigation, they are not tick-scripts.
+- Phase 5 (live probes) and the getSession grep: **[LOW freedom — run
+  exactly]** — a skipped probe is an unproven claim, not a saved step.
+
+Read-only. Map the auth surface and prove, route by route, that identity is
+verified where it matters. Then stop. Hand fixes to a follow-up session.
+
+**2026 consensus (official, post CVE-2025-29927):** Next.js middleware
+runs before cache and routing. Vercel: *"We do not recommend Middleware
+to be the sole method of protecting routes in your application."* An
+audit that only reads `middleware.ts` and declares the app safe has
+missed the point. Defense in depth: edge + route handler / server action
++ data layer. Each layer covers a different part of the request path.
+
+## How to reason in this audit
+
+Every finding is recorded in this shape, in this order:
+
+1. **Observe** — what does the code/probe actually show? (quote the line or the response)
+2. **Interpret** — what does that mean for who can reach what? (don't assume intent)
+3. **Classify** — real exposure / defense-in-depth-gap / correct-as-is / needs-a-probe
+4. **Severity** — by blast radius: unauth data access & auth bypass = critical;
+   everything else justified against what an attacker actually gains.
+
+If you cannot complete Interpret from static code, it is a **needs-a-probe**
+item for Phase 5, not a conclusion.
+
+## Worked example
+
+> **Observe:** `middleware.ts` matcher is `['/dashboard/:path*']`. The route
+> `/api/orders/[id]` has no check in the handler.
+> **Interpret:** API routes are not under the matcher, so middleware never
+> runs on them; the order endpoint is reachable without auth. Layout-level
+> checks don't cover direct API calls.
+> **Classify:** real exposure (not merely a defense-in-depth gap — data is
+> actually reachable).
+> **Severity:** critical — unauthenticated data access.
+> **Finding row:** `/api/orders/[id]` | edge+route | critical | matcher
+> excludes /api; handler has no `getUser()` check | probe P5-a confirmed
+> 200 while logged out.
+
+## This skill vs neighbors
+
+| Skill | Owns |
+|---|---|
+| **audit-auth-flows** (this) | Session lifecycle, route×gate matrix, OAuth, provider traps |
+| `audit-security` | OWASP checklist (injection, headers, deps) — may fix inline |
+| `plan-security-audit` | Plan-only hardening burndown |
+| `plan-rls-audit` | Data-layer who-can-read-which-rows |
+| `plan-secrets-audit` | Where `service_role` / keys live |
+| `plan-privacy-compliance` | Consent / policy vs collection — not session gates |
+| `backend-patterns` | Building the middleware / guard fixes after this audit |
+| `test-exploratory` | Live guest vs logged-in probe (runtime complement to this static matrix) |
+
+---
+
+## Phase 0 — Detect the auth stack  [HIGH freedom]
+
+Identify: provider (Supabase Auth / NextAuth / Clerk / Auth0 / custom),
+framework protection (Next.js middleware + `matcher`, route guards,
+server-action checks), session transport (cookie vs `localStorage` vs
+`Authorization` header), token model (JWT vs server session). Enumerate
+pages, API routes, server actions, edge functions, admin areas. Record
+the pinned framework version — auth CVEs are version-gated.
+
+---
+
+## Phase 1 — Route × gate coverage matrix  [HIGH freedom — the centerpiece]
+
+Every protected route / action, one row. Apply the reasoning chain per row.
+
+| route/action | intended access | gate that protects it | verified server-side? | data-layer backstop? |
+
+Hunt the gaps this exposes:
+
+- **Matcher holes** — `config.matcher` misses a protected path. API
+  routes and server actions often bypass page middleware — each needs
+  its own check.
+- **Layout-only protection** — a layout/wrapper is a client-side
+  illusion. It does not gate data fetches or direct API/action calls.
+- **Middleware-as-only-gate** — the CVE-2025-29927 class. Any route
+  where middleware is the *sole* authorization layer is a finding
+  **regardless of framework version or host**. Patching the CVE is not
+  defense in depth.
+- **Server action exposure** — Next.js server actions are POST
+  endpoints callable directly. Each mutating action must check identity
+  itself.
+- **Unlisted routes** — grep the router; do not trust the matcher list.
+
+---
+
+## Phase 2 — Provider and framework traps  [HIGH freedom, except the grep = LOW]
+
+**Supabase (check first on this stack):**
+
+- **[LOW freedom — run exactly]** `grep -rn "getSession(" <server-code-paths>`.
+  Treat every server-side hit as a finding until proven client-side-only.
+  Official JS docs: cookie/storage values *may not be authentic*;
+  `getSession()` is strongly advised against for authorization.
+  `getUser()` performs a network request to the Auth server and *can* be
+  used to base authorization rules. Newer SSR guides also use
+  `getClaims()` to *refresh* cookies — that is not a substitute for
+  verifying identity at the handler.
+- Service-role key on any client-exposed path → `plan-secrets-audit`.
+  RLS assumed but not enforcing → `plan-rls-audit` (data-layer
+  backstop; this skill is the app layer above it).
+- `autoRefreshToken` disabled without manual refresh; JWT expiry
+  absurdly short (<300s) hammering refresh.
+
+**Next.js CVE-2025-29927** (GHSA-f82v-jwr5-mffw, critical): bypass
+authorization if the check occurs only in middleware, via the internal
+`x-middleware-subrequest` header. **Patched:** 12.3.5 / 13.5.9 /
+14.2.25 / 15.2.3. **Impacted:** self-hosted `next start` and
+`output: 'standalone'`. Vercel-hosted apps were incidentally
+protected; Netlify and Cloudflare Workers were not affected. Workaround
+if unpatched: drop `x-middleware-subrequest` before it hits Next.
+If below the fix → P0 *and* a defense-in-depth finding. Also sweep
+later Next.js auth CVEs against the pinned version — query the GitHub
+advisory database rather than listing CVEs from memory; 29927 is not the
+only one.
+
+**General rule:** any "the framework enforces auth at the edge"
+assumption is a finding, whatever the framework.
+
+**NextAuth / Clerk / Auth0** — session strategy (JWT vs database),
+callback / redirect validation, and whether `auth()` / session checks
+actually run server-side per protected operation.
+
+---
+
+## Phase 3 — Session lifecycle  [HIGH freedom]
+
+**Cookies** — `HttpOnly`, `Secure`, `SameSite` (Lax min, Strict for
+sensitive); scoped path/domain; not readable by JS. Token in
+`localStorage` is XSS-exfiltratable — flag it; CSRF-vs-XSS must be a
+deliberate choice.
+
+**Logout that actually logs out** — a stateless JWT stays valid until
+expiry if logout only clears the client. Confirm server-side
+invalidation (Supabase `signOut` revokes the refresh token). Probe it
+(Phase 5). Official sessions FAQ: access tokens can still be presented
+after sign-out unless the app also checks revocation / uses
+`getUser()`.
+
+**Rotation & timeouts** — rotate on privilege change (login, role
+elevation) to kill fixation; idle timeout and absolute-max lifetime
+both present. Current norm: short access tokens, longer **rotated**
+refresh tokens with reuse detection, capped absolute session.
+
+**Refresh-token rotation + reuse detection** — official Supabase
+sessions docs: a refresh token is single-use, with two exceptions
+(default **10s reuse interval** — do not widen; parent-token retry for
+lost responses). Outside those exceptions the **whole session family
+is revoked**. Disabling that in Advanced Settings is "generally not
+recommended" — flag if widened or disabled.
+
+---
+
+## Phase 4 — Credentials, OAuth, authorization  [HIGH freedom]
+
+**OAuth / OIDC** — `state` (CSRF on the callback), PKCE for public
+clients, redirect-URI allowlist exact-match, provider `email_verified`
+checked before trust, account-linking collisions handled.
+
+**Credential flows** — reset tokens single-use + expiring + not leaked
+in URL/referrer; **user enumeration** via differing error text or
+timing on login/reset/signup; rate limiting on auth endpoints
+specifically; MFA state cannot be skipped mid-flow.
+
+**Authorization above the data layer** — not just "is logged in" but
+"is allowed"; IDOR on API params (`/api/orders/:id` scoped to caller?);
+admin routes gated by role server-side. Name which layer each control
+lives in. `plan-rls-audit` owns the data-layer half.
+
+---
+
+## Phase 5 — Live probes  [LOW freedom — run each, in order, non-prod]
+
+Force the failures rather than only reading code. Log each as
+`P5-x | expected | actual | evidence`:
+
+- **P5-a** Hit each protected route / API / action **unauthenticated** →
+  expect deny (not a redirect that still returns data).
+- **P5-b** Replay a **logged-out** session token → expect reject.
+- **P5-c** Tamper the session cookie / swap another user's identifier →
+  reject.
+- **P5-d** IDOR: as user A, request user B's object by id → deny.
+- **P5-e** If Next.js is version-vulnerable or self-hosted: send
+  `x-middleware-subrequest` and confirm WAF/edge *and* a route-handler
+  check still stop it.
+- **P5-f** User-enumeration: compare wrong-password vs nonexistent-user
+  (text + timing).
+
+Do not run these against production. Do not write exploit PoCs into
+the repo.
+
+---
+
+## Self-critique before reporting  [LOW freedom — do not skip]
+
+Challenge every finding against this rubric; drop or downgrade any that fail:
+
+1. **Evidenced, not assumed** — quoted line or probe result? If it rests on
+   "the code probably…", mark unconfirmed or run the probe.
+2. **Reproducible** — did the probe succeed twice, or once? Flaky ≠ finding.
+3. **Severity justified** — "critical" requires actual unauth access or
+   bypass, not theoretical risk.
+4. **Right layer** — app-layer (yours) or data-layer (→ `plan-rls-audit`)?
+5. **No false safety** — did you confirm a gate *works*, or only that it
+   *exists*? A check a probe bypassed is critical, not a pass.
+
+---
+
+## Definition of Done
+
+- [ ] Auth stack + framework version recorded
+- [ ] Degree-of-freedom respected: Phase 5 probes and the getSession grep
+      run exactly, in order
+- [ ] Route×gate matrix complete; every row reasoned
+      Observe→Interpret→Classify→Severity
+- [ ] Matcher holes, layout-only, middleware-as-sole-gate, unprotected
+      server actions surfaced
+- [ ] `getSession()`-for-authz grepped; `getUser()` confirmed on every
+      server gate
+- [ ] CVE-2025-29927 (and later auth CVEs) checked against the pinned version
+- [ ] Cookie flags, localStorage exposure, CSRF pairing assessed
+- [ ] Server-side logout invalidation confirmed by probe; rotation +
+      idle/absolute timeouts present
+- [ ] Refresh reuse interval not widened; family revocation not disabled
+- [ ] OAuth state / PKCE / redirect-allowlist / email_verified checked
+- [ ] User-enumeration, reset tokens, auth-endpoint rate limits, MFA-skip
+      checked
+- [ ] App-layer authorization (roles, IDOR, admin) split from the RLS half
+- [ ] Live probes run non-prod; each logged pass/fail
+- [ ] Self-critique rubric applied; unevidenced/flaky findings dropped or
+      downgraded
+- [ ] Read-only — findings presented, not patched
+
+## Output format
+
+1. **Route × gate matrix** — the table, gaps highlighted
+2. **Findings** — issue | layer (edge/route/data) | severity (critical =
+   unauth access / auth bypass) | file:line or probe | fix shape — each
+   finding in the worked-example shape
+3. **Provider-trap list** — exact call to change (`getSession` →
+   `getUser`, etc.)
+4. **Probe log** — P5-x | expected | actual | evidence
+5. **Fix plan** — auth-bypass and getSession-authz first, then session
+   lifecycle, then enumeration/OAuth. Handoffs: `plan-rls-audit`,
+   `plan-secrets-audit`, `plan-security-audit`, `backend-patterns`.
+   Present and stop.