Run independent adversarial security and external-effects review

Outcome

An independent model attempts to bypass authority, expose sensitive data, or duplicate money/supplier effects before the deployed demo is trusted.

Scope

• Attack OAuth audience/tenancy, RBAC, local/broker revocation, non-authorizing handoffs, browser sessions, CSRF, and approval/review TOCTOU.
• Attack Stripe and supplier idempotency, webhook/browser ordering, crash reconciliation, refund-target overcommitment, service refunds, and inactive-run callbacks.
• Inspect vault, redaction, erasure, logs, URLs, receipts, effects/attempts/jobs, errors, and console/MCP projections.
• Attack fixture materialization privilege and active-run switching with unresolved work.

Acceptance

• Reviewer did not author the reviewed code or its fixes.
• Severity-ranked findings include reproducible evidence or concrete arguments.
• Locator-only browser use, wrong user, replay, stale reprice, revoked authority, callback inversion, overlapping refund obligations, and racing effect observations are attempted.
• All blocking findings are fixed and re-reviewed or explicitly accepted by the product owner.
• The review states which deeper production-hardening items remain post-demo.

Dependencies

• #19, #20, #21, #14, and #15.

Review

This issue is the mandatory stage 4 security/effects gate artifact.

Start by reading the implementations and review artifacts from dependencies #19, #20, #21, #14, and #15, then map the listed OAuth, authorization, browser, payment, callback, logging, and fixture scenarios to the deployed demo. Attempt each acceptance-case attack with reproducible evidence, rank findings by severity, and document fixes, explicit product-owner acceptance, and remaining post-demo hardening work.