adversarial-review

# Adversarial review — presume it broken, find where

A normal review reads code and looks for reasons to approve it. An adversarial review starts from the
opposite prior: **this was just built, it is presumed broken, and the job is to find where.** The
builder believes in their work — that belief is exactly the blind spot. So the reviewer must be
incentivized to find failure, not confirm success, and must work *without the builder's context* so it
cannot inherit the builder's assumptions.

This skill is the canonical adversarial-review protocol for ATLAS. Reach for it autonomously after
building anything non-trivial, before shipping, or when handed unfamiliar code to harden.

## When to use it — and which review

- **Use this** when you want the thing *attacked*: a feature you just finished, a build before
  delivery, a flow you suspect is fragile, an unfamiliar codebase you must trust.
- **Use `/code-review` instead** for a fast, conservative pass over a **diff or PR** — it statically
  reads the change for bugs and cleanups, scores confidence, and **never runs the app**. That is the
  right tool for routine change review.
- **The line between them:** `/code-review` reads; adversarial-review *runs*. This skill presumes
  breakage, fans out diverse hostile lenses in clean contexts, and **reproduces findings against the
  live target** before believing them. Heavier, empirical, used deliberately.
- **Scale down, don't skip:** for a small change one hostile reviewer is enough. Don't fan out a fleet
  to attack a typo fix — deliberating everything ships nothing.

## The four invariants (what makes a review adversarial)

1. **Presumed-broken mandate.** Every reviewer gets one instruction: *"this was just built and is
   presumed broken; find where."* Never "check if it looks ok."
2. **Context isolation.** Reviewers run in **clean contexts** (separate subagents) — they get the
   target and the mandate, not the build's rationalizations. A separate context window is the closest
   thing to a genuine second opinion.
3. **Empirical reproduction.** A finding is a hypothesis until reproduced against the real target.
   Run it. A finding that can't be reproduced is an opinion, not a bug.
4. **Senior triage.** Reproduce before fixing, fix what's real, re-verify the fix, and name the false
   alarms. The report is only trustworthy if it admits what wasn't real.

## How to run it

1. **Frame the target and scale.** Name what's under review (a diff, a feature, a running app, a whole
   codebase) and how to exercise it (commands to run, URLs/flows to walk, entry points). Pick reviewer
   count by stakes: 1 for a small change, 3–5 lenses for a feature or build.

2. **Fan out hostile reviewers in clean contexts.** Spawn subagents, each with the presumed-broken
   mandate and **one lens**, blind to each other. Choose lenses that fit the target — typically:
   - **Correctness** — edge cases, off-by-one, race conditions, broken flows, state that lies
   - **Security** — injection, authz/authn holes, secrets in code, unvalidated input, SSRF/path traversal
   - **The empty world** — first run, zero data, no config, expired token: does it still stand up?
   - **Data integrity** — partial writes, lost updates, migrations, constraints that don't hold
   - **Failure & limits** — network/dependency failure, timeouts, huge inputs, concurrent users
   - **UX seams** — error messages, loading/empty states, the run instructions a stranger needs
   (One-shot work dies at the seams and the empty world far more than the happy path — weight those.)

3. **Reproduce every finding.** Before fixing anything, run the target and confirm the failure
   actually happens. Capture the evidence (output, screenshot, failing command). Unreproducible →
   demote to "unconfirmed," don't fix on faith.

4. **Triage like a senior.** Fix what reproduced, re-run to confirm the fix closed it (and opened
   nothing new), and record what looked like a bug but wasn't. If a fix opens a real design fork,
   invoke `free-will`.

## Output — the report

One honest summary:

- **Confirmed & fixed** — what broke, the reproduction, the fix, the re-verification.
- **Confirmed & deferred** — real but consciously not fixed now, and why (goes on the gap list).
- **False alarms** — flagged then disproven. Listing these is what makes the rest credible.
- **Residual risk** — what this pass could not exercise, and what would attack it next.

Never report "no issues found" from a read alone — that claim requires having *run* the lenses and
reproduced nothing. Report what you actually exercised, not what you assume holds.