rune-adversary

Run the adversary analysis on the approved plan document. It challenges the plan across five dimensions — edge cases, security, scalability, error propagation, and integration — and returns severity-ranked findings with a REVISE, HARDEN, or PROCEED verdict.

It is a structured review that attacks a plan's assumptions before any code exists, unlike code review which operates after implementation. Each finding must reference a specific plan section or file and include a concrete attack scenario and remediation.

Use plan red-teaming after a plan is approved but before implementation begins, especially for high-risk or critical-path features. Code review, preflight, and security scans operate on existing code and catch a different class of issues later in the pipeline.

Yes. Plans involving auth, crypto, or payment logic trigger a security-focused mode covering only security and integration dimensions, and identified attack vectors are escalated to a dedicated sentinel skill for deep validation before being reported as CRITICAL.

It is read-only and never modifies plans or writes code. It requires an existing plan document to run, caps output at 3 CRITICAL and 5 HIGH findings to avoid analysis paralysis, and skips integration checks when codebase access is unavailable.

Oracle replies are rejected when all claims lack file:line citations, when cited files were not in the dispatched bundle, or when the bundle exceeds the 100k token cap. Rejection emits an oracle.failed signal and the primary agent continues without the second opinion.