apply-findings

# Apply Findings Apply evaluated findings from the conversation context. Findings must have been through `/evaluate-findings` first. ## Step 1: Identify Findings Collect all findings from the conversation context. Findings should have Verdict columns (Apply, Skip, Escalate) from `/evaluate-findings`. If findings are unevaluated (raw output without verdicts), stop and say to run `/evaluate-findings` first. ## Step 2: Apply in File Order Group Apply findings by file path and apply in file order to minimize context switching. For each finding: 1. Read the full function or logical block at the referenced location 2. Verify the finding still applies to the current code 3. When the finding carries a suggested fix, treat the fix as a separate claim from the finding and verify it independently before applying it — trace it against the failure modes the finding names. When the fix encodes, escapes, quotes, or otherwise sanitizes untrusted input, enumerate the character classes the target interpreter treats specially and name the construct in the fix that blocks each one; a class with no blocker means the fix is incomplete, including when it reproduces the finding's suggested wording. If the fix does not hold up, treat the finding as Escalate (surface it in Step 3) and record why the remedy fails, rather than applying an unsound fix on the finding's authority. 4. When the fix would reverse a decision the user made earlier — in discussion or recorded in the artifact — treat the f...