Fix Deep Tier Sampling & Finding Accuracy

The deep tier's proportional sampler produces a depth-biased sample that systematically over-represents shallow files (config, types, barrel exports) and under-represents application code (API routes, services, domain logic). This bias causes the API validation finding to produce misleading results on real customer repos — "1/1 sampled API routes have no input validation" on Dub (which has 139 API routes, 76 with validation imports), "12/12" on Formbricks (which has 96 routes, 30+ with direct validation). The error-boundaries finding has the same sample-dependency problem. And the import convention classifier has a separate bug that misclassifies alias imports, producing wrong results for any project with multiple tsconfig path aliases.

verdict PASSscore 21 / 21findings 6 (0 risk · 1 debt · 5 obs)duration 1h 21mrejection cycles 0shipped May 20, 2026surface cli

Pipeline timeline

Intent to proven code in 1h 21m across Think, Plan, Build, and Verify.

Think
25m
Plan
12m
Build
16m
Verify
5m

Assertion ledger

21 claims, each independently verified. Showing 8 — show all →

IDSaysMatcher
A001The validation rule finds all API routes in a project, not just sampled onesverifiedok
A002Routes with validation library imports are correctly detected as validatedverifiedok
A003Both App Router and Pages Router API routes are discoveredverifiedok
A004Small projects with few API routes get info severity at most, not warnverifiedok
A005Projects with no API routes produce no validation findingverifiedok
A006The validation finding title shows actual counts instead of saying sampledverifiedok
A007Partially validated projects include a limitation note about wrapper-based validationverifiedok
A008Routes importing schema or validate path patterns count as validatedverifiedok

Findings 6 total

obspackages/cli/src/engine/findings/rules/validation.ts→ monitor
VALIDATION_PATH_PATTERNS check can false-positive on non-validation imports containing 'schema' or 'validate'
debtpackages/cli/src/engine/sampling/proportionalSampler.ts→ closed
allocateBudget can return total exceeding budget when budget < non-empty bucket count
obspackages/cli/src/engine/analyzers/conventions/imports.ts→ closed
classifyTSImport line 83 replace('/*', '') is dead code for new alias format
obspackages/cli/tests/engine/findings/rules/validation.test.ts→ monitor
No test exercises VALIDATION_PATH_PATTERNS false positive boundary (e.g., import containing 'schema' in a non-validation context)
obspackages/cli/src/engine/findings/rules/validation.ts→ monitor
Validation rule reads all route files synchronously via readFileSync — established pattern (matches secrets.ts) but could be noticeable at 500+ routes
+1more findings

Integrity seal

scopesha256:8e9fde00b1840...
contractsha256:6b208ad85ce65...
plansha256:2301478e0a2b5...
specsha256:a4b70752b9962...
build-reportsha256:e10288ebf6dbe...
build-datasha256:8a319c3c89d16...
verify-reportsha256:2a3b077acfa5b...
verify-datasha256:90bf37188cc61...
audit cmd$ ana proof audit fix-deep-tier-sampling   → all hashes match