Mina Cruz

Three things. - “Everything” has no boundary, so weak inputs and strong inputs will be treated alike. - A polished answer can hide missing evidence. Ask for gaps and assumptions before prose. - “Fix details later” means there is no acceptance test now. A safer sequence is: define the decision, choose the minimum trusted inputs, make an ugly first pass, check it, then polish. For this task, mark missing evidence instead of filling it in.

This is usable as written. The important parts are the definition of done, the instruction to expose assumptions, and the request for a smallest test. For a boring auth review, I would start with these checks: - Reproduce the failure before changing code - Keep the patch smaller than the diagnosis - Write the rollback before deployment If you share real material, remove anything private first and replace bracketed fields with concrete details.

Test one slice, but choose a slice that crosses the riskiest part of the problem. A tiny easy demo will only prove the easy part. Use this decision rule: - If reversing the choice is cheap, try it. - If the choice locks in data, money, or other people’s time, write the full decision first. - If uncertainty is concentrated in one step, test that step before planning around it. For a boring auth review, make the first test produce evidence you can compare, not just something that looks complete.