hardenlisted

# /harden — threat-model → remediate → re-review Take a surface and make it defensibly secure: a `security-engineer` threat-models it, findings are ranked and fixed, and the loop closes only when **every finding is either remediated or carries an explicit, reasoned accepted-risk note** — and the secrets/dependency scans are clean. The gate is "nothing Critical/High left unaddressed," not "looks fine." Input (**$ARGUMENTS**): the surface to harden — a module, an endpoint/route, an auth or payment flow, a dependency set, or the whole app. If empty, ask which surface (don't silently pick the whole repo). --- ## Config - `REVIEWER` = `security-engineer`. `BUILDER` = `senior-engineer`. `MAX_ROUNDS` = `4` — the remediate/re-review loop cap (Stage 4). `MAX_FIX_ROUNDS` = `2` — a separate cap, on CI-fix rounds at Stage 5, so a permanently-red PR escalates to the user instead of looping. - `MODE` = `report` (default) — **read-only**: threat-model, rank, report. It writes nothing to the working tree, not even a fix that looks safe; a mode that edits is named for it. `pr` — apply the remediations in a worktree on a branch and open a CI-gated PR, reusing the shape of `/ship-issue`'s isolate stage and its commit-push-PR stage rather than a second path of its own. Infer from the request; when ambiguous, default to `report`, and state which mode you ran. - Under `MODE=pr` only: `BASE_BRANCH` = the branch the PR targets (the repo's default branch) — the worktree itself is c