Step 1: Dedup and Inventory

Run uv run python3 $CLAUDE_PROJECT_DIR/tools/dedup_findings.py --scan-dir scans/ --db findings.json --stats Read findings.md and brain effective techniques. Show the user a numbered list of confirmed findings.

Step 2: For EACH confirmed finding (one at a time):

2a: Check if PoC exists

Look in poc/ directory. If no PoC for this finding, launch poc-builder agent: "Create PoC for: [finding details]. You MUST write files to poc//. Create reproduce.sh and poc.html (if client-side). Do NOT just output to terminal — write the actual files."

2b: Check if evidence exists

Look in evidence/ directory. If no screenshots/recordings exist:

Do NOT claim screenshots exist if they haven't been taken
Do NOT hallucinate file paths — verify files exist with ls before referencing them
Tell the user: "No evidence captured yet. Run /evidence screenshot to capture, or note 'evidence pending' in the report."