Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@a11y-architect.md`:
- Around line 41-44: The "Optimize Touch/Pointer" bullet point conflates two
different accessibility requirements by presenting the 24x24 CSS-pixel minimum
for web and the 44x44 pixel mobile guidance together without platform
distinction. Separate these into distinct guidance items that clearly specify
which requirement applies to web platforms versus mobile/touch platforms. This
ensures the agent provides the correct target-size requirement based on the
specific platform context rather than creating confusion between web and mobile
accessibility standards.
- Around line 2-3: Register the a11y-architect agent by adding
"agents/a11y-architect.md" to the agents list in .gemini-plugin/plugin.json
alongside the existing architect.md entry. Additionally, in Step 2 of the
a11y-architect.md file, clarify the target-size guidance by explicitly
distinguishing between mobile and web standards rather than conflating them;
specify that mobile platforms require 44x44 points minimum size while web
platforms require 24x24 CSS pixels minimum spacing, and align this early
guidance with the more detailed distinction already present in the ADR section.

In `@build-error-resolver.md`:
- Around line 163-180: The tsconfig paths alias example is incomplete and FIX 3
is incorrect. In the section showing path alias resolution, update FIX 1 to
include the required baseUrl compiler option alongside the paths configuration
(baseUrl should be set to "." or similar), as paths alone cannot resolve aliases
without it. Remove or replace FIX 3 entirely since npm install cannot install
path aliases like `@/lib/utils` - path aliases are configuration-based, not
package-based. Keep only the valid fixes (checking tsconfig configuration with
both baseUrl and paths, or using relative imports as FIX 2).

In `@chief-of-staff.md`:
- Around line 99-110: The relationships log is being read from two different
file paths which creates a split state. In Step 1, the process reads from
`private/relationships.md` to get sender context, but in Step 5 Post-Send
Follow-Through, the interaction is appended to `relationships.md` (without the
private/ prefix). This means newly logged interactions won't be visible to the
reply logic that consumes the private/relationships.md file. Update the Step 5
Relationships follow-through to append interactions to
`private/relationships.md` instead of `relationships.md` so all reads and writes
operate on the same file path.
- Around line 107-117: The `PostToolUse` hook is automatically pushing changes
to relationship notes and pending-response metadata, which risks leaking private
correspondence to the remote repository. Modify the `PostToolUse` hook
implementation to remove automatic pushing behavior - either keep commits local
only by removing the push step from step 7 (Git commit & push), or add an
explicit confirmation/approval requirement before any push operation occurs.
Ensure that sensitive files like relationships.md and pending-response metadata
are never automatically synced to a remote repository without user consent.

In `@comment-analyzer.md`:
- Around line 4-8: The tools list in the comment-analyzer configuration includes
run_shell_command which is unnecessary for the agent's comment analysis
functionality and unnecessarily expands the attack surface when processing
untrusted prompt input. Remove the run_shell_command tool from the tools list
since comment analysis only requires the read_file, search_file_content, and
list_directory capabilities for safely analyzing and providing feedback on code.

In `@cpp-build-resolver.md`:
- Around line 38-43: The issue is that the diagnostic commands truncate output
with head and tail which can hide relevant compiler errors, and the error
handling with || echo "...not available" incorrectly treats tool execution
failures as tool absence rather than distinguishing between tools not being
installed versus tools finding legitimate issues. Remove the head and tail
filters from the cmake and clang-tidy commands to preserve full output, and for
clang-tidy and cppcheck commands, check for tool availability separately before
execution rather than catching non-zero exit codes which occur when the tools
successfully detect problems.

In `@csharp-reviewer.md`:
- Around line 31-35: The insecure-deserialization bullet point incorrectly pairs
TypeNameHandling.All with System.Text.Json.JsonSerializer when it is actually a
Newtonsoft.Json feature. Fix this API mismatch by either clarifying that
TypeNameHandling.All applies to Newtonsoft.Json (not System.Text.Json), or by
replacing the reference with an appropriate System.Text.Json vulnerability
example such as allowing arbitrary type instantiation through the
JsonSerializerOptions.

In `@database-reviewer.md`:
- Around line 4-7: Remove the write_file tool from the tools list in the
database-reviewer configuration. The database reviewer agent should only be able
to read and analyze database changes, not write or mutate files. Keep read_file
and run_shell_command in the tools list, but delete the write_file entry to
ensure the agent remains a read-only reviewer and limits potential blast radius
from unintended mutations.

In `@doc-updater.md`:
- Around line 42-51: The sample commands in the code analysis section hard-code
src/ as the target directory, but the workflow documentation earlier instructs
discovering multiple workspace roots (apps/*, packages/*, services/*) in
monorepos. Update the three commands (npx tsx scripts/codemaps/generate.ts, npx
madge --image graph.svg src/, and npx jsdoc2md src/**/*.ts) to be
workspace-aware by making them discover and process all workspace roots instead
of hard-coding src/. This ensures the generated codemaps and documentation
include all relevant workspace directories in the monorepo structure.

In `@e2e-runner.md`:
- Around line 233-258: There is an inconsistency in the test directory naming
across the documentation. The test file organization tree uses `tests/e2e/` but
other sections reference `tests/egc-e2e/` and the playwright.config.ts testDir
is set to `./tests/egc-e2e`. Choose one canonical folder name for your test
directory and update all three locations to use it consistently: the test file
organization tree structure, any example file paths shown in the documentation,
and the testDir configuration value in playwright.config.ts. Ensure all
references point to the same directory path to avoid test discoverability
issues.
- Around line 666-689: Remove the invalid `snapshots: true` option from the
browser.startTracing() method call, keeping only the valid options of `path` and
`screenshots`. Additionally, replace the deprecated `videosPath` configuration
in the playwright.config.ts with `outputDir` in the main config section to
control artifact location, or remove it entirely to use the default
`test-results` directory that Playwright provides.

In `@gan-evaluator.md`:
- Around line 49-58: The bash commands in the initial section use invalid
Playwright syntax with `playwright navigate` and `playwright screenshot`
commands that do not exist. Replace these invalid commands with either the MCP
tool syntax using the mcp__playwright__navigate and mcp__playwright__screenshot
format with proper parameter objects, or use the standard Playwright CLI syntax
with npx playwright test. Reference the correct syntax examples that are already
documented later in the same file to ensure consistency and validity.

In `@gan-planner.md`:
- Around line 69-83: The Evaluation Criteria section has misaligned weights
where Craft is set to 0.3 and Originality is set to 0.2, which conflicts with
the design-heavy focus in workflows/gan-design.md. Update the weight values for
the Originality and Craft criteria so that Originality (novelty/uniqueness) is
scored higher than Craft (polish/animations). Ensure all weights still sum to
1.0 and reflect that design and originality are the primary evaluation drivers
rather than craft details.

In `@go-build-resolver.md`:
- Around line 42-44: The current Static analysis section for the staticcheck and
golangci-lint commands incorrectly uses the || operator to handle both missing
tools and actual lint findings, causing real diagnostic output to be suppressed
and mislabeled as missing tools. Instead, first check if each tool is available
in the system PATH using a command like which or command -v, and only echo the
"not installed" message if the tool is truly missing. If the tool is available,
run it and allow its exit code and output to display normally so that actual
linting failures are visible to users. This way, tool availability is detected
separately from the tool's exit status.

In `@harness-optimizer.md`:
- Around line 29-40: The workflow step 1 references `/egc-harness-audit` which
is Gemini-shell-specific and incompatible with the other claimed supported
platforms (Gemini CLI, Cursor, OpenCode, and Codex). Replace the
`/egc-harness-audit` command in step 1 with a reference to a repository script
or a portable wrapper function that all client types can invoke uniformly,
ensuring the audit baseline collection works consistently across Gemini CLI,
Cursor, OpenCode, and Codex.

In `@healthcare-reviewer.md`:
- Around line 65-87: The output format template for Healthcare Review only
includes three verdict states (SAFE TO DEPLOY, NEEDS FIXES, and BLOCK) but the
review rules require flagging uncertain clinical logic as NEEDS REVIEW. Add
NEEDS REVIEW as a fourth verdict option to the Verdict line in the Output Format
section so that uncertain cases can be properly classified without forcing
misclassification into existing categories.

In `@java-build-resolver.md`:
- Around line 134-136: The grep command that searches for annotation processor
configuration only checks pom.xml and build.gradle files, but projects using
Kotlin DSL (build.gradle.kts) will be missed. Update the grep command to include
build.gradle.kts in the file list being searched alongside pom.xml and
build.gradle so that all build configuration variants are verified for proper
Lombok and MapStruct annotation processor setup.
- Around line 41-42: The current approach of using logical OR to fall back to
system Maven on any exit code from the wrapper causes genuine compile errors to
be masked by attempting to rerun with different settings. Instead of the pattern
`./mvnw command || mvn command`, first check if the wrapper executable exists
using a conditional test (not a try-catch with OR). Only invoke the system Maven
as a fallback when the wrapper file is actually missing, not when the wrapper
itself reports a failure. Apply this logic to both the compile and test commands
to ensure build failures are reported with their actual context rather than
being retried with potentially different Maven/JDK configurations.

In `@kotlin-build-resolver.md`:
- Around line 94-100: Remove the `allWarningsAsErrors = true` line from the
compilerOptions block in the Kotlin build configuration. This global setting
goes beyond the minimal fix needed and can introduce unintended build failures
in repositories that do not already enforce this warning policy. Keep only the
`-Xjsr305=strict` compiler argument which directly addresses the null safety
issue being diagnosed.

In `@opensource-forker.md`:
- Around line 150-157: The cd command in the staging directory checkout is using
a literal string TARGET_DIR instead of referencing the variable. Replace cd
TARGET_DIR with cd $TARGET_DIR to properly change into the directory stored in
the TARGET_DIR variable, ensuring the subsequent git init, git add -A, and git
commit commands execute in the correct forked repository directory.
- Around line 53-56: The rsync command with `--exclude='.env*'` is too broad and
removes the `.env.example` configuration template file which should be preserved
for the fork. Instead of excluding all `.env*` files, modify the exclude pattern
to be more specific and only exclude actual secret environment files like
`.env`, `.env.local`, and `.env.*.local`, while preserving `.env.example`.
Alternatively, add a specific inclusion rule for `.env.example` before the
broader exclude pattern to ensure it is preserved during the sync.

In `@opensource-packager.md`:
- Around line 176-183: The git clone command in the Quick Start section
hardcodes a GitHub HTTPS URL format (https://github.com/{org}/{repo}.git), which
assumes the project is always hosted on GitHub. To make this host-agnostic,
replace the hardcoded GitHub URL with a variable or placeholder (such as
{repo_url} or similar) that can be substituted with the actual repository URL
regardless of which Git hosting service is used. This ensures the generated
README will work correctly for repositories hosted on GitHub, GitLab, Gitea, or
any other Git service.

In `@opensource-sanitizer.md`:
- Around line 46-48: The regex pattern for "Database URLs with credentials"
currently only matches postgres, mysql, mongodb, and redis schemes in the
alternation group but does not include the postgresql scheme variant, which
causes credentials in postgresql:// URLs to bypass the sanitizer. Add postgresql
to the alternation group within the parentheses so that both postgres:// and
postgresql:// DSNs with embedded credentials are properly detected and matched
by the pattern.
- Around line 28-30: The third bullet point's description of "read-only" is
ambiguous and incorrectly implies that no file writes occur at all, but the
pipeline actually needs the `SANITIZATION_REPORT.md` artifact. Reword the bullet
point to clarify that read-only applies specifically to source code and
configuration files, not to report generation, such as changing it to indicate
that the step generates reports without modifying source files or clarifying
that writes are limited to artifacts only.

In `@performance-optimizer.md`:
- Around line 367-403: The Web Vitals monitoring code uses the deprecated getFID
function which was removed in web-vitals v5.0; it should be replaced with getINP
(Interaction to Next Paint). Update the import statement to include getINP
instead of getFID, replace the getFID(console.log) call with
getINP(console.log), update the comment from "First Input Delay" to "Interaction
to Next Paint", and in the performance report template, replace the FID row in
the Web Vitals table with an INP row, updating the metric name, target value
(typically < 200ms), and description accordingly.
- Around line 37-57: Remove the npx bundle-analyzer and npx source-map-explorer
commands from the bundle analysis section in the performance-optimizer.md file,
keeping only the npx webpack-bundle-analyzer command to avoid confusion since
these tools serve different purposes and webpack-bundle-analyzer is the most
commonly used approach. Additionally, locate line 371 where getFID is imported
or used from the web-vitals package and replace it with getINP (Interaction to
Next Paint), as getFID was deprecated on March 12, 2024 and removed in
web-vitals v5.0.0, ensuring the code uses the current recommended API for
measuring interaction metrics.

---

Outside diff comments:
In `@comment-analyzer.md`:
- Around line 50-58: The Output Format section states that findings should be
grouped by severity, but the listed buckets (Inaccurate, Stale, Incomplete,
Low-value) are categories rather than severity levels. Either rename these
buckets to actual severity levels (such as Critical, High, Medium, Low) if they
are meant to represent severity, or change the instruction text from "grouped by
severity" to "grouped by category" to accurately reflect what the buckets
represent.

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="opensource-forker.md">

<violation number="1" location="opensource-forker.md:151">
P1: `cd TARGET_DIR` is missing `$` variable prefix, causing the clean-history step to fail since it references a literal directory name instead of the `$TARGET_DIR` variable used elsewhere.</violation>
</file>

<file name="build-error-resolver.md">

<violation number="1" location="build-error-resolver.md:179">
P2: Incorrect remediation advice: treats a TypeScript path alias (`@/lib/utils`) as an installable npm package</violation>
</file>

<file name="opensource-sanitizer.md">

<violation number="1" location="opensource-sanitizer.md:36">
P1: Database URL secret pattern causes deterministic false positives on `.env.example` placeholder values, which Step 5 requires to exist.</violation>

<violation number="2" location="opensource-sanitizer.md:100">
P1: Windows home-directory regex only matches single-character usernames, creating false negatives in a CRITICAL scan category</violation>
</file>

<file name="e2e-runner.md">

<violation number="1" location="e2e-runner.md:140">
P2: Inconsistent test directory/file conventions in the same guide can cause generated tests and run commands to target different locations.</violation>

<violation number="2" location="e2e-runner.md:670">
P1: Trace collection example uses `browser.startTracing`/`browser.stopTracing`, a Chromium-only API with non-portable options (`screenshots`, `snapshots`), which will break on Firefox/WebKit projects documented in the same file. Should use the cross-browser `context.tracing.start/stop` API instead.</violation>
</file>

<file name="csharp-reviewer.md">

<violation number="1" location="csharp-reviewer.md:34">
P1: Insecure deserialization guidance conflates serializer APIs: `TypeNameHandling.All` is a Newtonsoft.Json-only setting, but the bullet pairs it with the bare name `JsonSerializer`, which in modern .NET usually means `System.Text.Json.JsonSerializer`. This is ambiguous and can mislead reviewers.</violation>
</file>

<file name="go-reviewer.md">

<violation number="1" location="go-reviewer.md:32">
P1: Path traversal "Good" example is incomplete: it does not reject absolute paths, so `filepath.Join(baseDir, "/etc/passwd")` still resolves outside `baseDir`.</violation>
</file>