Fix deploy platform detection for monorepos
The scan shows the wrong deploy platform for monorepos where a secondary service's config file sorts alphabetically before the primary app's. inbox-zero deploys to Vercel but the scan says "Cloudflare Workers" because `apps/image-proxy/wrangler.jsonc` is discovered before `apps/web/vercel.json`. The wrong platform cascades into AGENTS.md (no Vercel serverless warnings), gotcha matching (Prisma + Vercel safety gotcha silently suppressed), deployment skill context, service dedup, and scaffold generators. The fix makes `detectDeployment` primary-aware so it prefers the primary package's deploy config.
verdict PASSscore 8 / 8findings 5 (0 risk · 1 debt · 4 obs)duration 49mrejection cycles 0shipped May 26, 2026surface cli
Pipeline timeline
Intent to proven code in 49m across Think, Plan, Build, and Verify.
Think1m
Plan23m
Build3m
Verify5m
Assertion ledger
8 claims, each independently verified.
| ID | Says | Matcher | |
|---|---|---|---|
| A001 | Monorepo scan picks the primary package's deploy platform over alphabetically-first | verified | ok |
| A002 | Monorepo scan returns the primary package's config file path | verified | ok |
| A003 | When the primary package has no deploy config, the first available platform is used | verified | ok |
| A004 | Single-repo projects still detect their deploy platform correctly | verified | ok |
| A005 | Calling without a primary path preserves the original first-match behavior | verified | ok |
| A006 | Empty deployment list still returns null platform | verified | ok |
| A007 | Empty deployment list with a primary path still returns null | verified | ok |
| A008 | The scan engine passes the primary source root to deployment detection | verified | ok |
Findings 5 total
obs→ closed
AC5 wording says AGENTS.md contains Vercel guidance — guidance actually lands in deployment skill
obs→ closed
Contract A006 matcher is 'exists' but says field says 'returns null' — test correctly asserts null, matcher is imprecise
obspackages/cli/src/engine/scan-engine.ts→ closed
No @ana tag for A008 — assertion verified by source inspection only
debtpackages/cli/src/engine/census.ts→ closed
census.ts comment claims V8 string-key insertion order — correct per ES2015+ spec, not V8-specific
obspackages/cli/tests/engine/detectors/ci-detection.test.ts→ monitor
No negative test for primaryPath matching wrong sourceRootPath substring (e.g., 'apps/we' partial match)
Integrity seal
scopesha256:03b29fa1df674...
contractsha256:8f4602c851082...
plansha256:7c1dabafbfbce...
specsha256:78623483604d9...
build-reportsha256:8ecb7905454d7...
build-datasha256:3ca3c45219427...
verify-reportsha256:f79d660d914f1...
verify-datasha256:c62bbe7099bc0...
audit cmd$ ana proof audit fix-deploy-platform-detection → all hashes match