Build a fast, runnable simulation of a system's safety rules and attack it with hostile inputs to find where it fails BEFORE production — without starting any service. Use this whenever the user wants to "simulate the system", "verify without running it", stress-test invariants, find edge cases / outliers, prove a pipeline or workflow is safe, model a system's rules, or harden code against weird/malicious input. Also use proactively after building any system with safety or correctness invariants (auth, redaction, access control, validation, state machines, data pipelines, payment/ledger logic, agent tool contracts) — the happy-path tests almost never cover the hostile path, and this finds the gap cheaply. Triggers on: "simulate", "model the rules", "edge cases", "stress test", "what could break", "is this safe", "adversarial test", "find outliers".