…rkflow

A second skill alongside security-audit, built for the Builders engineering
family. It keeps the upstream verification spine (three-verdict model,
adversarial independence, severity-requires-impact, sandboxed source-and-local
evidence, hardened validators and schema) and adds what the family does better:

- Plain-language consequence framing: every confirmed finding states what
  happens to a real person or the business, not just the technical boundary.
- Risk tiers (0-3) aligned with production-readiness.
- An explicit handoff graph so the review plugs into software-design-principles,
  regression-protection, production-readiness, database-rls, testing-verification,
  and ci-cd-delivery-governance, with a verdict-to-gate vocabulary mapping.
- A founder-facing report shape and scaffolder.
- A schema-conforming findings.example.json (upstream shipped none).

The hardened validators, schema, and their tests are carried over from
Cloudflare's security-audit-skill (MIT) and credited in NOTICE.md. All 65
validator tests pass; the example validates clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012eNWPncGRMnzwT359xvyXY