Fix non-product code pollution in findings, hot files, schema counts, and deploy detection

The scanner already knows which paths are non-product code (`EXCLUDED_SEGMENTS` in surfaces.ts, used by `isNonProductPath()`). Five other systems — findings rules, hot file detection, Supabase schema detection, and deploy discovery — don't use it. Test fixtures, templates, examples, and playground directories are counted as production code, producing visibly wrong results on high-profile repos: 4x model inflation (supabase), 100% false-positive findings (trigger.dev, payload, novu), template Dockerfiles as deploy platform (payload), and template configs dominating hot files (shadcn).

verdict PASSscore 14 / 14findings 6 (0 risk · 1 debt · 5 obs)duration 52mrejection cycles 0shipped Jun 2, 2026surface cli

Pipeline timeline

Intent to proven code in 52m across Think, Plan, Build, and Verify.

Think
4m
Plan
9m
Build
10m
Verify
5m

Assertion ledger

14 claims, each independently verified. Showing 8 — show all →

IDSaysMatcher
A001All non-product path exclusions come from one shared definitionverifiedok
A002The shared ignore list includes every non-product segmentverifiedok
A003The shared ignore list includes build artifact directoriesverifiedok
A004Validation rule excludes template route files from its countverifiedok
A005Error boundary rule excludes template page files from its countverifiedok
A006Secret scanner excludes files under non-product directoriesverifiedok
A007Template config files do not appear in hot file resultsverifiedok
A008Legitimate source files still appear in hot file resultsverifiedok

Findings 6 total

obspackages/cli/tests/engine/non-product-filtering.test.ts→ closed
A004-A006 verify glob array contents and isNonProductPath, not actual glob execution in findings rules
obspackages/cli/tests/engine/non-product-filtering.test.ts→ closed
A007-A008 test isNonProductPath directly, not the git churn detection loop in git.ts
obspackages/cli/tests/engine/non-product-filtering.test.ts→ closed
A011 simulates Supabase filtering inline instead of calling scan-engine detectSchemas
debtpackages/cli/src/engine/findings/rules/errorBoundaries.ts→ monitor
Redundant alias: GLOB_IGNORE = NON_PRODUCT_GLOB_IGNORE adds an unnecessary indirection
obspackages/cli/src/engine/detectors/surfaces.ts→ monitor
NON_PRODUCT_GLOB_IGNORE includes **/build/** which collides with legitimate 'build' directories in some monorepo layouts
+1more findings

Integrity seal

scopesha256:933ba1bd0fe84...
contractsha256:078a984daa896...
plansha256:6feff6edc24d3...
specsha256:321adbf6827bb...
build-reportsha256:cdecc14dff541...
build-datasha256:d395849aaa230...
verify-reportsha256:a7acfeb736078...
verify-datasha256:eb02d46e4667b...
audit cmd$ ana proof audit fix-non-product-code-pollution   → all hashes match