dsiddharth2 · May 23, 2026 · May 22, 2026 · May 22, 2026 · May 22, 2026 · May 22, 2026
diff --git a/PLAN.md b/PLAN.md
diff --git a/commands/findings-schema.json b/commands/findings-schema.json
@@ -36,6 +36,11 @@
         "$ref": "#/$defs/Finding"
       }
     },
+    "files_clean": {
+      "type": "array",
+      "items": { "type": "string" },
+      "description": "Files reviewed with no findings — every code file must appear in either findings[].file or files_clean[]"
+    },
     "fix_verifications": {
       "type": "array",
       "description": "Fix verification results from a re-push (optional)",
@@ -85,7 +90,7 @@
         },
         "category": {
           "type": "string",
-          "enum": ["security", "performance", "best_practices", "code_style", "documentation"],
+          "enum": ["security", "performance", "best_practices", "architecture", "correctness", "error_handling", "code_style", "documentation", "testing"],
           "description": "Finding category"
         },
         "title": {

diff --git a/commands/lang-rules/android.md b/commands/lang-rules/android.md
@@ -0,0 +1,43 @@
+# Android Review Rules
+
+## All Versions
+
+- [ ] No `Context` stored in static fields or singletons (memory leak)
+- [ ] `AsyncTask` not used — deprecated; use Kotlin coroutines or `WorkManager`
+- [ ] `SharedPreferences` not used for sensitive data — use `EncryptedSharedPreferences` or Keystore
+- [ ] `WebView` does not enable `setJavaScriptEnabled(true)` unless explicitly required and documented
+- [ ] `android:debuggable="true"` not set in production manifests
+- [ ] Permissions declared in the manifest are the minimum required — no over-broad permissions
+- [ ] `BroadcastReceiver` unregistered in `onStop` / `onDestroy` if registered in `onStart` / `onCreate`
+- [ ] `Cursor` objects closed after use to avoid resource leaks
+- [ ] No network calls on the main thread (causes `NetworkOnMainThreadException`)
+- [ ] `Activity` / `Fragment` references not held in long-lived objects (memory leak)
+- [ ] `Intent` extras validated before use — `getStringExtra()` returns null if the key is absent
+- [ ] `PendingIntent` flags include `FLAG_IMMUTABLE` (required on API 31+)
+
+## API 26+
+
+- [ ] `NotificationChannel` created before posting notifications (required API 26+)
+- [ ] Background service uses `JobIntentService` or `WorkManager`, not a plain `Service`
+- [ ] `JobScheduler` / `WorkManager` used for deferred background work instead of AlarmManager
+- [ ] Auto-fill hints (`android:autofillHints`) set on form fields for password managers
+
+## Jetpack Compose
+
+- [ ] Composable functions are stateless where possible — state hoisted to parent
+- [ ] `remember` / `rememberSaveable` used to survive recompositions and process death respectively
+- [ ] `LaunchedEffect` dependencies are correct — all values read inside must be in the key list
+- [ ] `SideEffect` / `DisposableEffect` used for non-Compose side effects with cleanup
+- [ ] `derivedStateOf` used when derived state computation is expensive and inputs change frequently
+- [ ] `Modifier` parameter present and used as the first modifier in composable public APIs
+- [ ] `CompositionLocal` not used for data that could be passed explicitly through parameters
+
+## Kotlin-first
+
+- [ ] Kotlin coroutines use structured concurrency — no `GlobalScope.launch`
+- [ ] `viewModelScope` used inside `ViewModel`, `lifecycleScope` inside `Activity`/`Fragment`
+- [ ] Flow collected with `repeatOnLifecycle(Lifecycle.State.STARTED)` to avoid collecting in background
+- [ ] `StateFlow` / `SharedFlow` used instead of `LiveData` in new Kotlin-first code
+- [ ] `hiltViewModel()` used for Hilt-injected ViewModels in Compose — not manual `ViewModelProvider`
+- [ ] `NavController` navigation not called from inside `LaunchedEffect` with a key that re-fires on recomposition
+- [ ] Room database accessed only on background threads — not on `Dispatchers.Main`
diff --git a/commands/lang-rules/cpp.md b/commands/lang-rules/cpp.md
@@ -0,0 +1,46 @@
+# C++ Review Rules
+
+## All Versions
+
+- [ ] No raw `new` / `delete` — use `std::unique_ptr`, `std::shared_ptr`, or stack allocation
+- [ ] No manual memory management in code that can throw — RAII wrappers used throughout
+- [ ] `std::string` not constructed from `nullptr` (undefined behavior)
+- [ ] Integer overflow on signed integers considered — use `unsigned` or checked arithmetic for external input
+- [ ] Array bounds not accessed out-of-range — prefer iterators or range-based for loops
+- [ ] `reinterpret_cast` usage documented with proof that the aliasing is defined behavior
+- [ ] No `const_cast` removing constness on values actually declared `const`
+- [ ] Virtual destructors on all base classes with virtual methods
+- [ ] Rule of Five: if one of destructor, copy ctor, copy assignment, move ctor, move assignment is defined, all five are defined or `= delete`d
+- [ ] No `using namespace std;` in header files (pollutes consumer namespaces)
+- [ ] Thread-shared mutable data protected with `std::mutex` or `std::atomic`
+- [ ] `[[nodiscard]]` on functions whose return value must be checked
+
+## C++14
+
+- [ ] `auto` used for iterator types and complex template types, not for obscuring simple types
+- [ ] Generic lambdas used instead of boilerplate `struct` with templated `operator()`
+- [ ] `std::make_unique` used instead of `new` with `unique_ptr` constructor
+
+## C++17
+
+- [ ] Structured bindings (`auto [a, b] = pair`) used for multi-value returns
+- [ ] `if constexpr` used for compile-time branching in templates instead of specialization
+- [ ] `std::optional` used for nullable return values instead of sentinel values or output parameters
+- [ ] `std::variant` / `std::visit` used for type-safe unions instead of tagged unions with `void*`
+- [ ] Parallel algorithms (`std::sort(std::execution::par, ...)`) used only where thread safety of data is guaranteed
+- [ ] `std::string_view` used for read-only string parameters to avoid copies
+
+## C++20
+
+- [ ] Concepts used to constrain template type parameters instead of SFINAE
+- [ ] Ranges (`std::ranges::sort`, `std::views::filter`) used for composable sequence operations
+- [ ] Coroutines (`co_await`, `co_yield`) require an appropriate promise type — not used ad-hoc
+- [ ] `std::span` used instead of pointer + length pairs for buffer parameters
+
+## C++23
+
+- [ ] `std::expected<T, E>` used for error-returning functions instead of exceptions or output parameters
+- [ ] `std::mdspan` used for multidimensional array views instead of manual pointer arithmetic
+- [ ] `std::print` / `std::println` used in new code instead of `printf`
+- [ ] `std::stacktrace` used for capturing call stack in error reporting where diagnostics are needed
+- [ ] `if consteval` used to branch compile-time vs runtime evaluation in constexpr functions
diff --git a/commands/lang-rules/csharp.md b/commands/lang-rules/csharp.md
@@ -0,0 +1,109 @@
+# C# Review Rules
+
+## All Versions
+
+- [ ] No hardcoded credentials, connection strings, or secrets in source code
+- [ ] Exceptions are not swallowed silently (`catch (Exception) {}`)
+- [ ] `IDisposable` types used in `using` statements or disposed explicitly
+- [ ] `async void` methods only used for event handlers — never for fire-and-forget without error handling
+- [ ] Nullable reference type annotations (`?`) present where nulls are valid inputs
+- [ ] No use of `Thread.Sleep` on async code paths — use `Task.Delay`
+- [ ] `ConfigureAwait(false)` used in library code to avoid deadlocks
+- [ ] `string` concatenation inside loops uses `StringBuilder`, not `+`
+- [ ] `==` not used to compare strings where culture-sensitive comparison is needed
+- [ ] Static mutable state (static fields/properties) is thread-safe
+- [ ] LINQ queries do not evaluate multiple times (materialize with `.ToList()` before re-use)
+- [ ] No `dynamic` type used in performance-critical paths
+- [ ] `public` API surfaces have XML documentation on all members
+- [ ] Interfaces used for dependencies rather than concrete types (DI-friendly)
+- [ ] No reflection over private members of external types
+- [ ] Enum flags decorated with `[Flags]` attribute when bit-masking is intended
+
+## .NET Framework 4.x
+
+- [ ] C# version limited to 7.3 — no `record` types, `init` properties, `required` keyword, file-scoped namespaces, global usings, switch expressions, pattern matching `is not null`, top-level statements, raw string literals
+- [ ] `using` declarations without braces (C# 8) have limited support — prefer explicit `using` blocks
+- [ ] `string.Contains(char)` overload not available — use `string.Contains(string)` or `IndexOf`
+- [ ] `string.Contains(value, StringComparison)` not available — use `IndexOf(value, comparison) >= 0`
+- [ ] `ArgumentNullException.ThrowIfNull()` not available — use manual `if (x == null) throw new ArgumentNullException()`
+- [ ] `Span<T>`, `Memory<T>`, `ValueTask` not available or limited — use `byte[]` and `Task`
+- [ ] `System.Text.Json` not available — use `Newtonsoft.Json` / `JsonConvert`
+- [ ] `IAsyncEnumerable<T>` not available — use `Task<List<T>>` or `Task<IEnumerable<T>>`
+- [ ] `ILogger<T>` / `Microsoft.Extensions.Logging` not standard — check if project uses it before suggesting
+- [ ] `HttpClientFactory` not available — use `new HttpClient()` with proper disposal or a static instance
+- [ ] Null-conditional assignment (`x ??= y`) not available (C# 8+) — use explicit null check
+- [ ] `Index` and `Range` types (`^1`, `..`) not available (C# 8+) — use `Length - 1` and `Substring`
+- [ ] `IHttpActionResult` is the return type for Web API controllers — not `IActionResult` or `ActionResult<T>`
+
+## EF 6.x
+
+- [ ] No `ExecuteUpdateAsync()` / `ExecuteDeleteAsync()` — use loop + `SaveChanges()` or raw SQL
+- [ ] No compiled queries — use parameterized raw SQL for performance-critical paths
+- [ ] No `IAsyncEnumerable` query streaming — use `ToListAsync()`
+- [ ] No bulk insert/update operations built-in — use `AddOrUpdate()` for seeds, raw SQL for bulk ops
+- [ ] Migrations use `DbMigration` base class, not `Migration`
+- [ ] `DbContext` uses `DbSet<T>` with `DbModelBuilder` configuration, not `OnModelCreating` fluent API style
+- [ ] Connection strings in `Web.config`, not `appsettings.json`
+- [ ] `SqlQuery<T>()` for raw SQL queries, not `FromSqlRaw()`
+- [ ] No `.AsNoTracking()` on `DbSet` — use `AsNoTracking()` via extension or manual detach
+- [ ] `Include()` for eager loading uses string paths (`Include("Orders.Items")`) or lambda — verify overload exists
+
+## ASP.NET Web API 5.x
+
+- [ ] No `[ApiController]` attribute — validation is manual, not automatic
+- [ ] No `ActionResult<T>` — use `IHttpActionResult` (`Ok()`, `NotFound()`, `BadRequest()`)
+- [ ] No minimal APIs — all endpoints are controller actions
+- [ ] No `[FromBody]` auto-binding on complex types — may need explicit `[FromBody]` attribute
+- [ ] No built-in model validation auto-response — check `ModelState.IsValid` manually
+- [ ] Route templates use `[Route("api/controller/{id}/{action}")]` convention
+- [ ] No `ProblemDetails` — return custom error objects or use `BadRequest(ModelState)`
+- [ ] `GlobalConfiguration.Configuration.DependencyResolver` for DI — not `IServiceProvider`
+- [ ] CORS configured via `EnableCorsAttribute` or `Web.config`, not middleware pipeline
+- [ ] No `IOptions<T>` pattern — configuration via `ConfigurationManager` or custom settings classes
+
+## LINQ (All .NET Versions)
+
+- [ ] `IQueryable` queries not materialized prematurely — `.ToList()` only when results are needed
+- [ ] `IEnumerable` results not iterated multiple times — materialize with `.ToList()` before re-use
+- [ ] `.FirstOrDefault()` / `.SingleOrDefault()` results null-checked before property access
+- [ ] `.Where().First()` replaced with `.First(predicate)` for clarity
+- [ ] `.Any()` used instead of `.Count() > 0` for existence checks (short-circuits)
+- [ ] `.Select()` projections do not include side effects — LINQ should be pure
+- [ ] `.OrderBy()` not called multiple times — use `.ThenBy()` for secondary sort
+- [ ] `.GroupBy()` results not re-enumerated inside the loop — materialize or use lookup
+
+## .NET 6+
+
+- [ ] `DateOnly` and `TimeOnly` used instead of `DateTime` for date-only or time-only values
+- [ ] `ArgumentNullException.ThrowIfNull()` used instead of manual null guard code
+- [ ] Minimal API endpoints validate inputs before processing
+- [ ] `ILogger<T>` injected via DI, not instantiated directly
+- [ ] Hot reload–incompatible patterns (source generators, static constructors with side effects) documented
+- [ ] `CancellationToken` threaded through async call chains from entry points
+- [ ] Record types used for immutable data transfer objects where appropriate
+
+## .NET 8+
+
+- [ ] `FrozenDictionary` / `FrozenSet` used for large, read-only lookup tables
+- [ ] Primary constructors used consistently for simple classes/structs without extra initialization
+- [ ] `TimeProvider` abstracted for testable time-dependent logic
+- [ ] Keyed services used where multiple implementations of the same interface are registered
+- [ ] `SearchValues<T>` used for high-frequency char/byte search patterns in hot paths
+
+## EF Core 6+
+
+- [ ] No N+1 queries — related data loaded with `.Include()` or projection
+- [ ] Read-only queries use `.AsNoTracking()`
+- [ ] Bulk deletes/updates use `ExecuteDeleteAsync()` / `ExecuteUpdateAsync()` not loop + SaveChanges
+- [ ] Migrations do not drop columns that are still referenced in code
+- [ ] `DbContext` not shared across async paths (not thread-safe)
+- [ ] Raw SQL (`FromSqlRaw`) uses parameterized queries — no string interpolation
+
+## ASP.NET Core
+
+- [ ] `[Authorize]` or `[AllowAnonymous]` explicitly on all controller actions — no implicit open endpoints
+- [ ] `ModelState.IsValid` checked before processing in controller actions
+- [ ] CORS policy explicitly defined — no wildcard `*` origin in production config
+- [ ] Response caching headers set appropriately on read endpoints
+- [ ] File uploads validate extension, MIME type, and maximum size
+- [ ] Anti-forgery tokens validated on state-changing form actions
diff --git a/commands/lang-rules/css.md b/commands/lang-rules/css.md
@@ -0,0 +1,76 @@
+# CSS / SCSS Review Rules
+
+## All Versions
+
+### Layout & Box Model
+- [ ] No `!important` unless overriding third-party styles — document reason in a comment
+- [ ] `box-sizing: border-box` applied globally or per component — not mixed models
+- [ ] `z-index` values use a defined scale (10, 20, 30...) — no arbitrary large numbers (99999)
+- [ ] Flexbox or Grid used for layout — no `float`-based layouts in new code
+- [ ] No negative margins for layout — use gap, padding, or flexbox alignment
+- [ ] Fixed dimensions (`width: 300px`) not used on containers that hold dynamic content — use `min-width`/`max-width`
+- [ ] `overflow: hidden` not used to hide layout bugs — fix the underlying overflow cause
+
+### Naming & Organization
+- [ ] Class names use project convention (camelCase for CSS Modules, BEM for global CSS) — consistent within file
+- [ ] No element selectors (`div`, `span`, `p`) for styling — use class selectors for specificity control
+- [ ] No ID selectors (`#header`) for styling — IDs are for anchors and JS hooks only
+- [ ] Selectors max 3 levels deep — avoid `.parent .child .grandchild .great-grandchild` specificity chains
+- [ ] No inline styles in markup for static styling — use classes; inline only for truly dynamic values (JS-computed)
+- [ ] Color values use project design tokens / CSS custom properties — not hardcoded hex/rgb in component styles
+- [ ] Repeated values (colors, spacing, fonts, shadows) extracted to CSS custom properties or SCSS variables
+
+### Typography & Spacing
+- [ ] Font sizes use relative units (`rem`, `em`) or project scale — not arbitrary `px` values
+- [ ] Line height uses unitless values (`1.5`) — not pixel values that break on font-size changes
+- [ ] Spacing uses consistent scale (multiples of 4px or 8px) — not arbitrary values
+- [ ] `text-overflow: ellipsis` paired with `overflow: hidden` and `white-space: nowrap` (all three required)
+
+### Responsive & Cross-Browser
+- [ ] Media queries use the project's defined breakpoints — no arbitrary pixel values
+- [ ] Mobile-first (`min-width`) or desktop-first (`max-width`) approach consistent within project — not mixed
+- [ ] No vendor prefixes in source CSS when autoprefixer is configured — let the tool handle it
+- [ ] `touch-action` set on interactive elements for mobile — prevents 300ms tap delay
+- [ ] Minimum touch target size 44x44px on interactive elements
+
+### Performance
+- [ ] No `*` universal selector in component styles — acceptable only in reset/normalize
+- [ ] `will-change` used sparingly and only on elements that actually animate — not as a blanket optimization
+- [ ] Animations use `transform` and `opacity` — not `top`/`left`/`width`/`height` (triggers layout)
+- [ ] Transitions under 300ms for UI feedback; `prefers-reduced-motion` media query respected
+- [ ] Large background images use `image-set()` or responsive `srcset` — not desktop-size images on mobile
+- [ ] `contain: layout` or `contain: content` used on independently-rendered components to limit paint scope
+
+### Accessibility
+- [ ] Color contrast meets WCAG AA (4.5:1 for text, 3:1 for large text / UI components)
+- [ ] Focus styles visible and not removed (`outline: none` only when replaced with equivalent visible indicator)
+- [ ] `:focus-visible` used instead of `:focus` to avoid focus rings on mouse click
+- [ ] Content not hidden with `display: none` when it should be screen-reader accessible — use `.sr-only` pattern
+- [ ] No `user-select: none` on text content users might need to copy
+- [ ] Decorative elements use `aria-hidden="true"` — no alt text on decorative images
+
+### Common Bugs
+- [ ] `position: sticky` has a scrollable ancestor — fails silently if any ancestor has `overflow: hidden`
+- [ ] `gap` property supported by target browsers when used with flexbox (not supported in older Safari)
+- [ ] Percentage heights have an explicit height on the parent — percentage height on `auto`-height parent is 0
+- [ ] `calc()` expressions have spaces around operators — `calc(100%-20px)` silently fails
+- [ ] `transition: all` not used — specify exact properties to avoid animating unintended changes
+
+## CSS Modules
+
+- [ ] File naming follows convention: `ComponentName.module.css` (or `.module.scss`)
+- [ ] Import as `styles` object: `import styles from './Component.module.css'`
+- [ ] Class access uses dot notation (`styles.container`) — not bracket notation (`styles['container']`)
+- [ ] `:global(.class)` used sparingly — only for third-party overrides, documented with comment
+- [ ] `composes` used for style composition — not `@extend` or class concatenation in markup
+
+## SCSS
+
+- [ ] Nesting max 3 levels deep — deeper nesting produces overly specific selectors
+- [ ] `@use` and `@forward` used instead of `@import` (deprecated in Dart Sass)
+- [ ] Mixins used for repeated patterns with parameters — not for single-use style blocks
+- [ ] `@each` / `@for` loops used for generating utility classes — not copy-pasted variants
+- [ ] Placeholder selectors (`%placeholder`) used with `@extend` — not class-based `@extend` (avoids unintended selector bloat)
+- [ ] Variables use meaningful names (`$color-primary`, `$spacing-md`) — not generic (`$a`, `$temp`)
+- [ ] Maps used for structured data (breakpoints, colors, z-index scale) — accessed with `map.get()`
+- [ ] Partials prefixed with underscore (`_variables.scss`) and loaded via `@use`