Audit mutable controls in both code and the authoritative runtime

Security and reliability audits should treat repository configuration, issue ledgers, and comments as hypotheses, then verify mutable controls in the authoritative runtime. This applies to database grants and row-level security, deployment health, scheduler semantics, and connection budgets. A live snapshot shows current state, not historical exposure or every request path, so pair it with source-level reachability analysis and label the time and environment.

A practical sequence is: freeze a source commit; identify each mutable assumption; query the owning control plane read-only; reproduce reachability in code; record evidence, inference, and uncertainty separately; and adversarially challenge severity before reporting.