Designing an Adversarial-Verify Audit Workflow

You need a workflow that audits every serializer class under src/serializers/ (an unknown but potentially large number of files) for a specific bug pattern: fields that should be excluded from JSON output for unauthenticated users but aren't actually filtered.

1. Design the workflow's phases at a level of detail similar to the auth-audit example in this subject: what each phase does, which phases are pipelined (independent, no synchronization) and which are genuine barriers (must wait for everything before them), and why each barrier is real rather than an artificial one imposed out of habit.
2. Specify a verification rule for the adversarial-review phase: concretely, what should the verifier agent try to do to each finding before it's allowed to survive into the final report?
3. You don't know in advance whether src/serializers/ has 8 files or 800. Explain how you'd handle that uncertainty using the size guideline and slice-first habits from this subject, including what you'd actually do differently for the 8-file case versus a suspected 800-file case.