# Task
Base SHA: 6382cb8e0473ba9ea5ba7a3f94f34e8ab0d4ec60
Reviewed SHA: 17faecd962c2cf40e0a3f6ec4434811cfffdd312
Scope: Independent read-only audit of R1–R5 acceptance in the specified immutable base..HEAD range. Focus on auth profile/CSRF/Secure strictness, socket-origin and trusted-proxy behavior, deploy network and backup safety, R3 fail-closed/no partial saves, and live smoke truthfulness.
Do not change: Production code/tests, containers, or anything outside this assignment/report and individual memory worklog. No commit/push/delegation. Preserve pre-existing AGENTS.md modification.
Definition of Done: Findings with severity, file/line, impact and reproducible scenario; reviewed SHA; commands and actual results; UNVERIFIED claims and blockers.
Required verification: Static source review and focused, non-conflicting checks only; root owns npm ci/generate/full gates/PostgreSQL/Docker.
Authorization evidence: agents/codex/inbox/2026-10-19-stage1-completion.md and agents/codex/inbox/2026-10-19-seed-owner-authorization.md.