round-based-code-auditlisted

# Round-Based Code Audit Audit one stable target through distinct engineering lenses. Discovery is read-only. Do not fix code, edit project files, or publish issues unless the requester separately authorizes that action. ## Configure The Audit Resolve the following from the request and repository. Use the defaults when the choice does not materially change scope; ask only when it does. - **Target:** repository, commit/ref, and included paths. Default to the current checkout and exclude generated, vendored, dependency, fixture, and build-output paths unless they are relevant to a finding. - **Lenses:** requested concern groups. Default to all lenses in [references/audit-lenses.md](references/audit-lenses.md). - **Depth:** `survey`, `standard`, or `deep`. Default to `standard`. Depth changes evidence breadth, not the validation threshold. - **Finding floor:** default to every validated, issue-worthy P0-P3 finding; exclude subjective nits and unsupported suspicions. - **Evidence budget:** applicable tests, static tools, history, and runtime checks that are safe and proportionate. Never claim an unexecuted check passed. - **Output:** report only, issue drafts, or approved GitHub publication. Default to drafts when publication intent is unclear. - **GitHub destination:** repository plus allowed existing labels. Do not infer authority to create labels, assign people, add milestones/projects, or disclose sensitive vulnerabilities. State the resolved configuration and exclusions