Read docs/ai/team/qa.md and security.md against the reviewed commit.
For each finding, reproduce it or explain with evidence why it
does not apply. Do not dismiss a report without checking it.
Fix confirmed issues within the agreed scope and add regression
coverage where appropriate. Do not rewrite reviewers' reports.
Update implementation.md with finding IDs, changes and actual checks.
List unresolved issues clearly.
Ask the owner to freeze a new REVIEW_COMMIT.
Request QA and security to recheck affected behavior on that revision.
Write in OUTPUT_LANGUAGE. Do not push or deploy.
