bug-huntlisted

# Bug Hunt — adversarial defect hunt across design, code, docs, verification, and the harness > **Invoke ONLY on explicit request.** Run this skill exclusively when the user asks for a > "bug hunt", "bug sweep", "design bug hunt", "design bug sweep", "extended doc sync", or > "full doc-sync audit" by name. Do NOT infer it from "adversarial review", "security > pass", "review the code/design/docs", plain "doc sync", or any general review phrasing — > those mean a general findings-only review done in plan mode (or the narrow `doc-sync` > skill), not this full-surface BUGS.md-writing sweep. When in doubt, ask before invoking. **This skill orchestrates; it does not read the catalogs itself.** The heavy method detail lives in four sidecar briefs, each read by the subagent that sweeps that layer, never by the orchestrator — that is what keeps the main session's context lean (CLAUDE_CODE_GUIDE §2): - `REFERENCE.md` — the implementation-layer category catalog (§4.4.1–48), the hygiene catalog (§4.4B.1–8), cross-cutting observations, external security calibration lenses, static search recipes, and the testing/CI punch-list detail (§5.1–5.6). - `DESIGN.md` — the design-layer method: requirements-quality checks, the threat model, contract/data/migration/parity sweeps, the scenario tabletop, the design-finding refutation checklist, reviewer personas, and the design bug taxonomy. - `DOCSYNC.md` — the documentation-layer method: the doc universe and ledger, drift classification