Audit a whole codebase rather than a single diff — establish the boundary and baseline, sweep layer by layer (entry points, domain, data, integrations, auth, tests, ops), check every stated invariant for a real enforcement point, a failing-on-violation test, and a production signal, rank findings by blast radius, and emit each as a ticket with a Verification-command.
