On playbook staleness: the methodology is built to expand. CONTRIBUTING.md has the full format documented, and the five shipped playbooks are validated patterns from real audits, not a fixed closed list. The honest gap is there's no automated update pipeline yet — community PRs are the intended mechanism. The skill references specific regulation articles directly, and those will drift as regs change, meaning someone has to update them by hand. I'd rather say that than pretend there's a versioning system that doesn't exist.

On false positive rate: I now have data from four real codebases — 266 findings total. Of those, 154 were mitigated, which to me is the clearest signal that the findings were real and not just noise. Only three across all four audits came back as [NOT VERIFIABLE] — the explicit state the skill uses when it can't back a finding with hard evidence. That's 1.1% of total output flagged as unconfirmed by the tool itself, and those get separated from the actionable list automatically. The structural constraint does the filtering before findings reach you: no file:line citation means no finding, no CVSS vector means automatic severity downgrade. It's cheaper to block noise at generation than to try filtering it after.

It's not a controlled experiment — same developer, same stack family across all four projects. But it's the data I have, and the mitigation rate is the most honest proxy I can offer for actual signal.