Fix False Rejection Archives on Same-Session Re-Saves

When an agent saves an artifact, notices a validation warning or content issue, edits, and re-saves within the same session, the system creates false `_r` archive files and false `.saves.json` history entries — signals that mean "rejection cycle happened" when no rejection occurred. Today this produces noise (false `_r1` files in git, misleading history arrays) but no data corruption, because the timing consumer (`hasRejectionHistory`) checks only `build-report` and `verify-report` history, and the observed trigger was on `verify-data` only. But if the verify report content itself changes on a same-session re-save, the false history entry on `verify-report` activates the rejection-cycle timing reconstruction path, producing phantom build/verify segments from timestamps seconds apart — corrupting the proof chain entry's timing data.

verdict PASSscore 18 / 18findings 5 (0 risk · 2 debt · 3 obs)duration 9h 45mrejection cycles 0shipped May 22, 2026surface cli

Pipeline timeline

Intent to proven code in 9h 45m across Think, Plan, Build, and Verify.

Think
20m
Plan
7m
Build
543m
Verify
6m

Assertion ledger

18 claims, each independently verified. Showing 8 — show all →

IDSaysMatcher
A001Re-saving a verify report without a new build does not create archive filesverifiedok
A002Re-saving a verify report without a new build does not archive companion dataverifiedok
A003Re-saving a verify report without a new build does not add a history entryverifiedok
A004Re-saving a build report without a new verification does not create archive filesverifiedok
A005Re-saving a build report without a new verification does not add a history entryverifiedok
A006A real rejection cycle still creates archive filesverifiedok
A007A real rejection cycle still records history in the saves fileverifiedok
A008Phase-numbered verify report checks the matching phase build reportverifiedok

Findings 5 total

debtpackages/cli/src/commands/artifact.tsclosed
writeSaveMetadata companion gate is a no-op — isArchivableType regex doesn't match data keys
obspackages/cli/src/commands/artifact.tsclosed
hasOpposingStageAdvanced exported but not imported outside artifact.ts — wider public surface than needed
debtpackages/cli/src/commands/artifact.tsmonitor
hasOpposingStageAdvanced reads .saves.json on every call — four calls per save mean four file reads of the same file
obsclosed
proofSummary.ts now ~2370 lines — continues growing past comfort threshold
obspackages/cli/tests/utils/proofSummary.test.tsclosed
A012 and A018 use toBeDefined() — contract-aligned (matcher: exists) but weaker than asserting specific fallback value

Integrity seal

scopesha256:3ff5e6f9f0ea8...
contractsha256:e33b83a2e8729...
plansha256:ad928fab69eff...
specsha256:3d1314822f83a...
build-reportsha256:ca5e2b1419094...
build-datasha256:b975546174afd...
verify-reportsha256:93f0b866f310a...
verify-datasha256:e1e7ddfee3062...
audit cmd$ ana proof audit fix-false-rejection-archive   → all hashes match