Keep reviews strictly within the user-defined scope and threat model

Follow the user’s explicit review boundaries rather than applying generic security or hardening requirements. Audit only the named files, risks, and correctness dimensions; do not inspect excluded areas, duplicate another reviewer’s scope, or continue obsolete follow-ups. If the user states that adversarial replacement, malformed archives, or similar threats are irrelevant in a private repository, remove those gates and retain only practical checks such as reproducibility, artifact hashes, required-file equality, adjudication correctness, and research validity. Keep requested audits read-only, evidence-based, and substantive, with precise findings and deterministic regressions when required.