Flip Monorepo Command Semantics
The scan detects root-level commands (`pnpm run build`, `pnpm run test`) but only surfaces primary-package-scoped commands to ana.json. When pipeline work targets a non-primary package, the worktree builds the wrong package, baseline tests run in the wrong place, and the proof chain records misleading results.
verdict PASSscore 23 / 23findings 6 (1 risk · 1 debt · 4 obs)duration 1h 8mrejection cycles 0shipped May 18, 2026
Pipeline timeline
Intent to proven code in 1h 8m across Think, Plan, Build, and Verify.
Think20m
Plan7m
Build18m
Verify5m
Assertion ledger
23 claims, each independently verified. Showing 8 — show all →
| ID | Says | Matcher | |
|---|---|---|---|
| A001 | Monorepo build command is project-wide, not scoped to primary package | verified | ok |
| A002 | Monorepo buildPackage contains the scoped command for primary package | verified | ok |
| A003 | Monorepo test command is project-wide non-interactive | verified | ok |
| A004 | Monorepo testPackage contains the scoped test command | verified | ok |
| A005 | Single-package projects have no buildPackage or testPackage fields | verified | ok |
| A006 | buildPackage is omitted when its value would be identical to build | verified | ok |
| A007 | testPackage is omitted when its value would be identical to test | verified | ok |
| A008 | Build command stays root when primary package has no build script | verified | ok |
Findings 6 total
debtpackages/cli/src/commands/config.ts→ scope
No dedicated test for empty-string buildPackage/testPackage rejection — verified by source inspection only
obspackages/cli/tests/commands/init/monorepoCommandScoping.test.ts→ accept
A007 tests null equality, not string equality — doesn't exercise the string-comparison branch
obspackages/cli/tests/commands/init/makeTestCommand.test.ts→ closed
makeTestCommand.test.ts modified but not listed in contract file_changes — necessary to avoid regressions
riskpackages/cli/src/commands/init/state.ts→ closed
pkg.path injected without sanitization in new buildPackageCmd and testPackageCmd — same known risk as monorepo-build-scoping-C5
obs→ closed
Contract A005 matcher/value encoding semantically confusing — says 'no buildPackage' but uses 'not_equals'/'undefined'
+1more findings
Integrity seal
scopesha256:f9c2a2ab4ff33...
contractsha256:91bdf99d8722e...
plansha256:c9200cd3bad4b...
specsha256:82a104fc0fa66...
build-reportsha256:8f0f32ab262b9...
build-datasha256:904fb4c2da49f...
verify-reportsha256:4ff4815e0092a...
verify-datasha256:616858bf547b3...
audit cmd$ ana proof audit flip-monorepo-commands → all hashes match