kiosk-redteam drives hostile HTTP scenarios against any Kiosk provider and asserts each attack is correctly blocked — a deliberate refusal, never a crash and never a toll the harness could not settle. A scenario that finds a real breach fails loudly. Ships a Scenario/Verdict/Runner framework and a library of generic attack scenarios parameterised by a per-provider Profile. It attacks through the assistant client kiosk-test-support ships. No dependency on Rails.

kiosk-rls-minitest wires the framework-agnostic Kiosk journey-test DSL (kiosk-test-support) into Minitest. `include Kiosk::TestHelpers` inside any `Minitest::Test` subclass mixes in the journey helpers (`as_agent_of`, `as_user`, `as_agent`, `as_anonymous`, `query`, `run_query`, `run_action`, `pay_action`, `kiosk_seed`). Ships the assertions `assert_rls_denied` and `assert_quota_exceeded` for asserting the structured error classes — both also exposed as the Minitest `must_raise_*` / `wont_raise_*` spec-DSL forms.

kiosk-rls-rspec wires the framework-agnostic Kiosk journey-test DSL (kiosk-test-support) into RSpec. Automatically mixes the journey helpers (`as_agent_of`, `as_user`, `as_agent`, `as_anonymous`, `query`, `run_query`, `run_action`, `pay_action`, `kiosk_seed`) into any example group tagged `type: :kiosk_journey` (or `type: :kiosk_agent`, the same DSL under a second tag). Ships the matchers `be_rls_denied` and `be_quota_exceeded` for asserting the structured error classes.