code-review hunts bugs, ponytail-audit hunts bloat, medusa hunts secrets. Nothing asked the structural question: where does this codebase hold one truth in two places, mix two reasons to change in one unit, or trust an input it never validated. Those defects pass every test and every linter.
Six lenses, each with a falsification test rather than a feeling: DRY demands the proven shared reason to change, so two blocks that merely look alike stay separate; SRP demands two nameable stakeholders; security stays at the trust boundaries and stays defensive. The silent-defaults lens routes to no-defaults instead of restating it.
The rules exist to keep the report worth reading. A finding carries file:line the agent actually read, one hit is not a pattern, and a finding whose worst case is "feels wrong" is deleted rather than softened - the expensive ones go through dialectic first. A deliberate ponytail: marker is a known ceiling, not a finding.
Read-only by construction, so auto-feature can run it as a first pass without side effects.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
