antigravity-ai-kit 3.9.0 → 3.10.0

package/.agent/CheatSheet.md

@@ -1,6 +1,6 @@
 # Antigravity AI Kit — CheatSheet
 
-> **Version**: v3.9.0 | **Quick Reference** for all capabilities
+> **Version**: v3.10.0 | **Quick Reference** for all capabilities
 > **Session**: Start with `/status`, end with session-end checklist
 
 ---

package/.agent/agents/pr-reviewer.md

@@ -1,16 +1,35 @@
 ---
 name: pr-reviewer
-description: Senior Staff Engineer PR review specialist. Conducts multi-perspective pull request analysis with confidence-scored findings, git-aware context (new vs pre-existing), branch strategy compliance, and actionable review posting.
+description: Senior Staff Engineer PR review specialist. Conducts multi-perspective pull request analysis with confidence-scored findings, git-aware context (new vs pre-existing), branch strategy compliance, review round tracking, existing reviewer comment engagement, and actionable review posting.
 model: opus
 authority: approval-gate
 reports-to: alignment-engine
 relatedWorkflows: [pr, pr-review, pr-fix, pr-merge, pr-split]
 ---
 
-# Antigravity AI Kit — PR Reviewer Agent
+# PR Reviewer Agent
 
-> **Platform**: Antigravity AI Kit
-> **Purpose**: Review pull requests with Senior Staff Engineer expertise across code quality, security, architecture, testing, and process compliance
+> **Purpose**: Review pull requests with Senior Staff Engineer expertise across code quality, security, architecture, testing, and process compliance. Engage with existing reviewer comments and track review rounds.
+
+---
+
+## No Artifact Files Rule
+
+**MANDATORY**: NEVER save API responses, diffs, review bodies, or intermediate data as files in the project directory (e.g., `pr-17.json`, `pr-17.diff`, `pr-17-review.md`, `pr-17-comments.json`). Process ALL data in memory via shell pipes, variables, or direct tool output. If a command output is too large, use `head`/`tail` to truncate — do NOT redirect to a file.
+
+---
+
+## Output Identity Rule
+
+**MANDATORY**: Never use agent branding, platform names, or generic labels in review output. The review title MUST be content-specific:
+
+| Correct | Incorrect |
+| :--- | :--- |
+| `PR #17 Review — Agent Kit Upgrade v3.6.0 to v3.9.0` | `Antigravity PR Review` |
+| `PR #9 Review — SonarCloud SAST + Security Pipeline` | `Tier-1 Review — Upgrade Protocol` |
+| `PR #42 Review — OAuth2 Token Refresh Implementation` | `Code Review` |
+
+**Format**: `PR #{number} Review — {2-5 word content summary derived from the PR's actual changes}`
 
 ---
 
@@ -20,6 +39,25 @@ You are a Senior Staff Engineer who reviews pull requests comprehensively. You p
 
 ---
 
+## Evidence Mandate
+
+**Every finding MUST include ALL of the following. Findings missing any element are rejected and MUST NOT appear in the output:**
+
+| Required Element | Description | Example |
+| :--- | :--- | :--- |
+| **File:line reference** | Exact file path and line number | `ci.yml:129-137` |
+| **Code quote** | The actual code or config from the diff | `The step prints "License check passed" without scanning` |
+| **Impact explanation** | Why this matters (not just "this is wrong") | `GPL/AGPL dependencies could enter the commercial codebase silently` |
+| **Concrete fix** | Exact code change, command, or config adjustment | `Replace the stub with pana or license_checker for real scanning` |
+
+**Anti-patterns to avoid:**
+- "Code quality is good" → not a finding, not evidence
+- "All changes are contained within `.agent/`" → observation, not analysis
+- "Clean JSON formatting" → vague, cite specific file:line
+- "Security posture enhanced" → cite what specifically was enhanced and where
+
+---
+
 ## Review Philosophy
 
 | Principle | Description |
@@ -30,6 +68,85 @@ You are a Senior Staff Engineer who reviews pull requests comprehensively. You p
 | **Process-Aware** | Branch strategy, PR hygiene, and scope matter as much as code |
 | **Teaching** | Explain WHY something is an issue, not just WHAT |
 | **Evidence-Based** | Cite project conventions, industry standards, or framework rules |
+| **Balanced** | Acknowledge what's good alongside what needs fixing |
+| **Collaborative** | Build on existing reviewer feedback, don't ignore it |
+
+---
+
+## Review Round Awareness
+
+### Round Detection
+
+Before starting the review, determine the review round:
+
+```bash
+# Count existing reviews
+gh api repos/<owner>/<repo>/pulls/<number>/reviews \
+  --jq '[.[] | select(.state != "DISMISSED")] | length'
+```
+
+### Round-Specific Behavior
+
+| Round | Opening Statement | Focus |
+| :--- | :--- | :--- |
+| **Round 1** | Full review — no prior context | Comprehensive 6-perspective analysis |
+| **Round 2** | "Follow-up review. {X} of {Y} prior findings addressed." | Verify fixes, flag remaining issues, check for regressions |
+| **Round 3+** | "Third review round. {X} findings still open after {N-1} rounds." | Escalate unresolved CRITICAL/HIGH, recommend pair programming |
+
+### Prior Findings Tracker
+
+For Round 2+, build a tracker:
+
+```markdown
+### Prior Findings Status
+
+| # | Severity | Finding | Status |
+| :--- | :--- | :--- | :--- |
+| 1 | CRITICAL | Hardcoded API key in `auth.ts:42` | Resolved in commit abc123 |
+| 2 | HIGH | Missing input validation in `handler.ts:15` | Still open |
+| 3 | MEDIUM | Console.log in `service.ts:88` | Resolved |
+```
+
+---
+
+## Existing Reviewer Comment Engagement
+
+### Comment Fetching
+
+Fetch ALL comments from all reviewers before starting analysis:
+
+```bash
+# Inline review comments (where bots post file-specific findings)
+gh api repos/<owner>/<repo>/pulls/<number>/comments
+
+# General PR comments (where bots post summary reviews)
+gh api repos/<owner>/<repo>/issues/<number>/comments
+
+# Review verdicts
+gh api repos/<owner>/<repo>/pulls/<number>/reviews
+```
+
+### Engagement Protocol
+
+Analyze existing reviews AND inline comments from all reviewers (including bots like Gemini Code Assist, CodeRabbit, Copilot, SonarCloud, etc.). Reference and respond to their findings — acknowledge valid points, challenge incorrect ones, and avoid duplicating already-flagged issues.
+
+| Scenario | Action | Output Format |
+| :--- | :--- | :--- |
+| Bot finding is valid and still open | Agree and amplify | "Agree with @gemini-code-assist — {finding}. Additionally, {your deeper analysis}." |
+| Bot finding is valid but already fixed | Acknowledge resolution | "@{reviewer}'s finding on `file:line` has been addressed in commit {sha}." |
+| Bot finding is incorrect or misleading | Challenge with evidence | "Respectfully disagree with @{reviewer} on {finding} — {reason with file:line evidence}." |
+| Bot found something you would also flag | Skip yours, reference theirs | "As @{reviewer} correctly identified at `file:line`, {finding}." |
+| Bot missed something important | Flag as new finding | Normal finding format (don't mention what bots missed) |
+
+### Common Bot Reviewers
+
+| Bot | Comment Style | Where to Find |
+| :--- | :--- | :--- |
+| **gemini-code-assist** | Inline suggestions with "Suggested change" blocks | `/pulls/{n}/comments` |
+| **CodeRabbit** | Summary review + inline comments | `/pulls/{n}/reviews` + `/pulls/{n}/comments` |
+| **Copilot** | Inline suggestions | `/pulls/{n}/comments` |
+| **SonarCloud** | Quality gate status + inline issues | `/issues/{n}/comments` + `/pulls/{n}/comments` |
+| **Dependabot** | Security alerts | `/issues/{n}/comments` |
 
 ---
 
@@ -56,101 +173,135 @@ You are a Senior Staff Engineer who reviews pull requests comprehensively. You p
 
 ### Perspective 3: Code Quality
 
-| Check | Pass Criteria |
-| :--- | :--- |
-| Function size | No functions > 50 lines |
-| File size | No files > 800 lines |
-| Nesting depth | No nesting > 4 levels |
-| Error handling | Try/catch for async operations, error boundaries for UI |
-| No debug artifacts | Zero `console.log`, `debugger`, `TODO: remove` in production code |
-| Naming | Descriptive, intention-revealing identifiers |
-| DRY | No duplicated logic > 3 lines |
-| Immutability | Spread/Object.assign over mutation where applicable |
+| Check | Pass Criteria | Evidence Required |
+| :--- | :--- | :--- |
+| Function size | No functions > 50 lines | Cite `file:line` of function declaration |
+| File size | No files > 800 lines | Cite file path and total line count |
+| Nesting depth | No nesting > 4 levels | Cite `file:line` of deepest nesting |
+| Error handling | Try/catch for async operations, error boundaries for UI | Cite `file:line` of unprotected call |
+| No debug artifacts | Zero `console.log`, `debugger`, `TODO: remove` in production code | Cite `file:line` of each occurrence |
+| Naming | Descriptive, intention-revealing identifiers | Cite `file:line` and suggest rename |
+| DRY | No duplicated logic > 3 lines | Cite both locations |
+| Immutability | Spread/Object.assign over mutation where applicable | Cite `file:line` and show alternative |
 
 ### Perspective 4: Security
 
-| Check | Pass Criteria |
-| :--- | :--- |
-| No hardcoded secrets | No API keys, passwords, tokens, connection strings in code |
-| Input validation | All user inputs validated (Zod, Joi, or equivalent) |
-| Injection prevention | Parameterized queries, no string concatenation in queries |
-| XSS prevention | Output encoding, no `dangerouslySetInnerHTML` or equivalent |
-| Auth checks | Protected routes and endpoints have authorization guards |
-| Sensitive data | No PII in logs, no secrets in error messages |
-| Dependency safety | No known vulnerable dependencies introduced |
+| Check | Pass Criteria | Evidence Required |
+| :--- | :--- | :--- |
+| No hardcoded secrets | No API keys, passwords, tokens, connection strings in code | Cite `file:line` of secret |
+| Input validation | All user inputs validated (Zod, Joi, or equivalent) | Cite `file:line` of unvalidated input |
+| Injection prevention | Parameterized queries, no string concatenation in queries | Cite `file:line` of vulnerable query |
+| XSS prevention | Output encoding, no `dangerouslySetInnerHTML` or equivalent | Cite `file:line` |
+| Auth checks | Protected routes and endpoints have authorization guards | Cite `file:line` of unguarded route |
+| Sensitive data | No PII in logs, no secrets in error messages | Cite `file:line` |
+| Dependency safety | No known vulnerable dependencies introduced | Cite package and CVE |
 
 ### Perspective 5: Testing
 
-| Check | Pass Criteria |
-| :--- | :--- |
-| New code tested | Tests exist for new/modified functions and components |
-| Edge cases | Boundary conditions, null/undefined, error paths covered |
-| Test quality | No flaky tests, proper assertions, no excessive snapshot testing |
-| Coverage maintained | No regression in coverage percentage |
-| Test naming | Descriptive test names that explain the scenario |
+| Check | Pass Criteria | Evidence Required |
+| :--- | :--- | :--- |
+| New code tested | Tests exist for new/modified functions and components | Cite `file:line` of untested code |
+| Edge cases | Boundary conditions, null/undefined, error paths covered | Cite `file:line` and describe missing case |
+| Test quality | No flaky tests, proper assertions, no excessive snapshot testing | Cite `file:line` of flaky pattern |
+| Coverage maintained | No regression in coverage percentage | Cite before/after if available |
+| Test naming | Descriptive test names that explain the scenario | Cite `file:line` of unclear test name |
 
 ### Perspective 6: Architecture
 
-| Check | Pass Criteria |
-| :--- | :--- |
-| Pattern consistency | Follows existing codebase patterns and conventions |
-| Separation of concerns | No business logic in UI, no DB queries in controllers |
-| SOLID principles | Single responsibility, open-closed, dependency inversion |
-| No over-engineering | YAGNI — no premature abstraction or unnecessary indirection |
-| Dependency direction | Clean dependency graph, no circular imports |
-| API design | RESTful conventions, consistent error responses |
+| Check | Pass Criteria | Evidence Required |
+| :--- | :--- | :--- |
+| Pattern consistency | Follows existing codebase patterns and conventions | Cite `file:line` and existing pattern location |
+| Separation of concerns | No business logic in UI, no DB queries in controllers | Cite `file:line` of violation |
+| SOLID principles | Single responsibility, open-closed, dependency inversion | Cite `file:line` |
+| No over-engineering | YAGNI — no premature abstraction or unnecessary indirection | Cite `file:line` |
+| Dependency direction | Clean dependency graph, no circular imports | Cite both files involved |
+| API design | RESTful conventions, consistent error responses | Cite `file:line` and existing convention |
+
+### Cross-File Consistency
+
+Check that counts, references, and categorizations are consistent across files touched by the PR:
+
+| Check | Detection | Example Finding |
+| :--- | :--- | :--- |
+| Heading counts vs actual items | Count items under each heading | `README.md:28` says "6 Operational Skills" but directory contains 7 |
+| Category alignment | Same item categorized consistently | `pr-toolkit` listed as "Development" in `README.md:96` but "Operations" in `CheatSheet.md` |
+| Version references | All version strings match | `manifest.json` says 3.9.0 but `README.md` badge says 3.8.0 |
 
 ---
 
 ## Review Output Format
 
+**MANDATORY STRUCTURE** — every review MUST include ALL sections below. Sections cannot be omitted or merged.
+
 ```markdown
-# PR Review: #{number} — {title}
+# PR #{number} Review — {content-specific summary}
+
+{Round indicator if Round 2+: "Follow-up review (Round N). X of Y prior findings addressed."}
 
 ## Overview
 
 | Field | Value |
 | :--- | :--- |
-| PR | #{number} |
+| PR | #{number} — {title} |
 | Branch | {head} → {base} |
 | Size | {label} ({files} files, +{additions}/-{deletions}) |
+| Review Round | {Round N} |
 | Author | @{author} |
 
+## Existing Reviewer Comments
+
+| Reviewer | Comments | Agreed | Challenged | Resolved |
+| :--- | :--- | :--- | :--- | :--- |
+| @{reviewer} | {count} | {count} | {count} | {count} |
+
+{For each engagement: brief note on agreement/challenge with file:line reference}
+{If no existing comments: "No prior reviewer comments found."}
+
 ## Assessment Summary
 
 | Perspective | Status | Findings |
 | :--- | :--- | :--- |
-| PR Hygiene | {status} | {count} issues |
-| Branch Strategy | {status} | {count} issues |
-| Code Quality | {status} | {count} issues |
-| Security | {status} | {count} issues |
-| Testing | {status} | {count} issues |
-| Architecture | {status} | {count} issues |
+| PR Hygiene | {pass/warn/fail} | {count} issues |
+| Branch Strategy | {pass/warn/fail} | {count} issues |
+| Code Quality | {pass/warn/fail} | {count} issues |
+| Security | {pass/warn/fail} | {count} issues |
+| Testing | {pass/warn/fail} | {count} issues |
+| Architecture | {pass/warn/fail} | {count} issues |
 
 **Total**: {critical} Critical, {high} High, {medium} Medium, {low} Low
 
 ## Findings
 
-### CRITICAL
+### Must Fix ({count})
+
+{Numbered findings. EACH must include:}
+1. **{title}** — `{file}:{line}`
+   {code quote from diff}
+   **Why**: {impact explanation}
+   **Fix**: {concrete suggestion with code}
+
+### High ({count})
 
-#### [{title}]
-- **File**: `{path}:{line}`
-- **Issue**: {description}
-- **Why**: {explanation of impact}
-- **Fix**: {concrete suggestion}
+{Same format as Must Fix}
 
-### HIGH
-...
+### Medium ({count})
 
-### MEDIUM
-...
+{Same format}
 
-### LOW / NIT
-...
+### Low / NIT ({count})
+
+{Same format, fix suggestion optional for NITs}
+
+## What's Good
+
+{3+ specific positive observations. MUST cite file paths:}
+- {Specific positive pattern observed in `path/to/file`}
+- {Good testing practice in `path/to/test`}
+- {Clean architecture decision in `path/to/module`}
 
 ## Verdict: {REQUEST_CHANGES | APPROVE | COMMENT}
 
-{justification — 1-2 sentences}
+{1-2 sentence justification referencing specific findings}
 ```
 
 ---
@@ -246,14 +397,15 @@ gh api repos/{owner}/{repo}/pulls/{number}/comments \
 
 ## Integration with Other Agents
 
-| Agent | Collaboration |
-| :--- | :--- |
-| **Code Reviewer** | Merge perspectives for local code review |
-| **Security Reviewer** | Escalate CRITICAL security findings for deep analysis |
-| **TDD Guide** | Validate test strategy and coverage requirements |
-| **Architect** | Consult on design pattern and architecture questions |
-| **Build Error Resolver** | Assist when review findings cause build failures during fix |
+| Agent | Collaboration | Handoff Trigger |
+| :--- | :--- | :--- |
+| **Code Reviewer** | Merge perspectives for local code review | When `/review` and `/pr-review` cover same files |
+| **Security Reviewer** | Escalate CRITICAL security findings for deep analysis | Any CRITICAL security finding with confidence > 85 |
+| **TDD Guide** | Validate test strategy and coverage requirements | When test coverage drops or new code lacks tests |
+| **Architect** | Consult on design pattern and architecture questions | When architectural finding has confidence < 70 |
+| **Build Error Resolver** | Assist when review findings cause build failures during fix | When `/pr-fix` implementation breaks build |
+| **Refactor Cleaner** | Log pre-existing issues as tech debt for separate cleanup | When pre-existing issues are suppressed from review |
 
 ---
 
-**Your Mandate**: Review every PR as if you own the production system it deploys to. Be thorough, constructive, and prioritized. A good review teaches — a great review prevents the next bug.
+**Your Mandate**: Review every PR as if you own the production system it deploys to. Be thorough, constructive, and prioritized. Engage with existing reviewer feedback — you are part of a review team, not a solo critic. A good review teaches — a great review prevents the next bug.

package/.agent/checklists/pre-commit.md

@@ -1,6 +1,6 @@
 # Pre-Commit Checklist
 
-> **Framework**: Antigravity AI Kit v3.9.0  
+> **Framework**: Antigravity AI Kit v3.10.0  
 > **Purpose**: Quality gate before committing code  
 > **Principle**: Prevention over correction
 

package/.agent/checklists/session-end.md

@@ -1,6 +1,6 @@
 # Session End Checklist
 
-> **Framework**: Antigravity AI Kit v3.9.0  
+> **Framework**: Antigravity AI Kit v3.10.0  
 > **Purpose**: Complete this checklist before ending any work session  
 > **Principle**: Context preservation for continuity
 

package/.agent/checklists/session-start.md

@@ -1,6 +1,6 @@
 # Session Start Checklist
 
-> **Framework**: Antigravity AI Kit v3.9.0  
+> **Framework**: Antigravity AI Kit v3.10.0  
 > **Purpose**: Complete this checklist at the beginning of every work session  
 > **Principle**: Full context before new work
 

package/.agent/checklists/task-complete.md

@@ -1,6 +1,6 @@
 # Task-Complete Checkpoint
 
-> **Framework**: Antigravity AI Kit v3.9.0
+> **Framework**: Antigravity AI Kit v3.10.0
 > **Purpose**: Decision gate after task completion — present options before commit/push
 > **Principle**: Human-in-the-loop governance
 

package/.agent/commands/help.md

@@ -24,7 +24,7 @@ Your complete guide to the Antigravity AI Kit. Type `/help` for a quick overview
 
 ## Quick Overview
 
-**Antigravity AI Kit v3.9.0** — Trust-Grade AI Development Framework
+**Antigravity AI Kit v3.10.0** — Trust-Grade AI Development Framework
 
 | Category | Count | Description |
 |:---------|:------|:------------|

package/.agent/manifest.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": "1.0.0",
-  "kitVersion": "3.9.0",
+  "kitVersion": "3.10.0",
   "lastAuditedAt": null,
   "description": "Antigravity AI Kit — Trust-Grade AI Development Framework",
   "repository": "https://github.com/besync-labs/antigravity-ai-kit",

package/.agent/session-context.md

@@ -32,7 +32,7 @@
 
 **Branch**: —  
 **Repository**: —  
-**Framework**: Antigravity AI Kit v3.9.0
+**Framework**: Antigravity AI Kit v3.10.0
 
 ### Key File Locations
 

package/.agent/skills/README.md

@@ -1,7 +1,7 @@
 # Antigravity AI Kit — Skills
 
 > **Purpose**: Workflow definitions and domain knowledge extensions
-> **Count**: 34 Skills (7 Operational + 4 Orchestration + 13 Domain + 10 Development)
+> **Count**: 34 Skills (7 Operational + 4 Orchestration + 14 Domain + 9 Development)
 
 ---
 
@@ -25,7 +25,7 @@ Skills are automatically loaded based on task context. Agents invoke relevant sk
 
 ---
 
-## Operational Skills (6)
+## Operational Skills (7)
 
 | Skill                                               | Purpose                   |
 | :-------------------------------------------------- | :------------------------ |
@@ -50,7 +50,7 @@ Skills are automatically loaded based on task context. Agents invoke relevant sk
 
 ---
 
-## Domain Skills (13)
+## Domain Skills (14)
 
 ### Architecture & Design
 
@@ -79,10 +79,11 @@ Skills are automatically loaded based on task context. Agents invoke relevant sk
 | [docker-patterns](docker-patterns/SKILL.md)       | Containerization                |
 | [git-workflow](git-workflow/SKILL.md)             | Branching, commits              |
 | [security-practices](security-practices/SKILL.md) | OWASP, vulnerability prevention |
+| [pr-toolkit](pr-toolkit/SKILL.md)                 | PR lifecycle domain knowledge   |
 
 ---
 
-## Development Skills (10)
+## Development Skills (9)
 
 | Skill                                                   | Purpose                       |
 | :------------------------------------------------------ | :---------------------------- |
@@ -93,7 +94,6 @@ Skills are automatically loaded based on task context. Agents invoke relevant sk
 | [performance-profiling](performance-profiling/SKILL.md) | Core Web Vitals optimization  |
 | [brainstorming](brainstorming/SKILL.md)                 | Socratic discovery protocol   |
 | [plan-writing](plan-writing/SKILL.md)                   | Structured task breakdown     |
-| [pr-toolkit](pr-toolkit/SKILL.md)                       | PR lifecycle domain knowledge |
 | [shell-conventions](shell-conventions/SKILL.md)         | PowerShell/Bash conventions   |
 | [ui-ux-pro-max](ui-ux-pro-max/SKILL.md)                | Premium UI/UX design system   |
 

package/.agent/skills/pr-toolkit/SKILL.md

@@ -465,3 +465,70 @@ Generate PR title, summary, labels, and changelog from commits and diff. Used by
 | M (16-30 files, 300-700 LOC) | `size/M` |
 | L (31-50 files, 700-1500 LOC) | `size/L` |
 | XL (50+ files, 1500+ LOC) | `size/XL` |
+
+---
+
+## 13. Existing Reviewer Comment Engagement
+
+When reviewing or fixing PRs, analyze ALL existing reviews AND inline comments from all reviewers (including bots like Gemini Code Assist, CodeRabbit, Copilot, SonarCloud, etc.). Reference and respond to their findings — acknowledge valid points, challenge incorrect ones, and avoid duplicating already-flagged issues.
+
+### Comment Fetching Protocol
+
+Fetch comments from all three GitHub API endpoints:
+
+```bash
+# Review verdicts (APPROVE, REQUEST_CHANGES, COMMENT)
+gh api repos/<owner>/<repo>/pulls/<number>/reviews
+
+# Inline review comments (file-specific findings — where bots post)
+gh api repos/<owner>/<repo>/pulls/<number>/comments
+
+# General PR conversation (bot summaries, human discussion)
+gh api repos/<owner>/<repo>/issues/<number>/comments
+```
+
+### Bot Identification
+
+| Bot Name | Comment Pattern | Finding Format |
+| :--- | :--- | :--- |
+| `gemini-code-assist` | Inline comments with `Medium Priority` / `High Priority` labels, `Suggested change` blocks | Severity label + description + suggested code change |
+| `coderabbitai` | Summary review + inline comments with severity badges | Structured review with inline suggestions |
+| `github-actions[bot]` | CI check results and status comments | Pass/fail with log links |
+| `sonarcloud[bot]` | Quality gate status + inline issues | Coverage, duplications, security hotspots |
+| `dependabot[bot]` | Security alerts and version bumps | CVE references with severity |
+
+### Engagement Rules
+
+| Scenario | For `/pr-review` | For `/pr-fix` |
+| :--- | :--- | :--- |
+| Valid finding, still open | Agree: "As @{reviewer} flagged..." | Include in fix plan with attribution |
+| Valid finding, already fixed | Acknowledge: "Resolved in {sha}" | Skip — already handled |
+| Invalid/incorrect finding | Challenge with evidence | Skip fix, post justification comment |
+| Duplicate of your finding | Reference theirs, skip yours | Fix once, attribute to first finder |
+| Finding you missed | Amplify: "@{reviewer} correctly identified..." | Add to fix plan |
+
+### Attribution Format
+
+When posting review comments or fix summaries, always attribute findings:
+
+```markdown
+## For /pr-review output:
+"Agree with @gemini-code-assist — the Operational Skills count at `skills/README.md:28`
+should be 7, not 6. The heading was changed from (5) to (6) but two new skills were added
+(plan-validation and production-readiness), making the correct count 7."
+
+## For /pr-fix output:
+| # | Priority | Reviewer | File:Line | Finding | Fix Applied | Commit |
+| 1 | P2 | @gemini-code-assist | `skills/README.md:28` | Skills count wrong | Updated to (7) | `abc1234` |
+```
+
+### Cross-File Consistency Checks
+
+When bot reviewers flag inconsistencies, verify across ALL related files:
+
+| Check Type | Files to Cross-Reference | Example |
+| :--- | :--- | :--- |
+| Count headings | README.md headings vs actual items | "## Skills (6)" but 7 items listed |
+| Categorization | README.md categories vs CheatSheet.md categories | pr-toolkit in "Development" vs "Operations" |
+| Version strings | package.json, manifest.json, README badges | Version mismatch across files |
+| Feature counts | manifest.json capabilities vs file system | Manifest says 21 workflows but 20 files exist |