Use evidence-driven security audits with deterministic adversarial tests

When reviewing security-sensitive code, inspect the exact implementation and existing tests, then verify suspected defects with reproducible probes rather than relying on passing suites or assumptions. Record exact outputs, exceptions, limits, paths, and line references. Add deterministic fail-first regressions for malformed JSON, frozen-input integrity, archive handling, filesystem aliases/races, resource bounds, and fail-closed publication before changing production code. Preserve the frozen scope and avoid duplicating or overlapping active work. After fixes, run focused and full test suites, confirm repository artifacts were not unintentionally modified, and obtain fresh independent correctness and security reviews against the exact final tree.