Rust/Go Polyglot Detection
`detectProjectType` only checks for `pyproject.toml` as a competing manifest when `package.json` exists. It never checks for `Cargo.toml` (Rust) or `go.mod` (Go). Result: tabby (92.9% Rust, 20-crate Cargo workspace, 37k stars) is classified as TypeScript because it has a thin `package.json` for turborepo orchestration. This is the same disease class as the Python polyglot fix — a non-Node project with a secondary package.json for frontend/build tooling gets misclassified as Node.
verdict PASSscore 18 / 18findings 6 (1 risk · 2 debt · 3 obs)duration 9h 7mrejection cycles 0shipped May 17, 2026surface cli
Pipeline timeline
Intent to proven code in 9h 7m across Think, Plan, Build, and Verify.
Think2m
Plan9m
Build5m
Verify4m
Assertion ledger
18 claims, each independently verified. Showing 8 — show all →
| ID | Says | Matcher | |
|---|---|---|---|
| A001 | A Rust workspace project with a secondary package.json is detected as Rust | verified | ok |
| A002 | A Rust workspace project gets high detection confidence | verified | ok |
| A003 | Cargo.toml appears in the detection indicators for Rust projects | verified | ok |
| A004 | A WASM binding crate without a workspace stays detected as Node | verified | ok |
| A005 | A Go project with a secondary package.json is detected as Go | verified | ok |
| A006 | A Go project gets high detection confidence | verified | ok |
| A007 | go.mod appears in the detection indicators for Go projects | verified | ok |
| A008 | Projects with only package.json and lockfile still detect as Node | verified | ok |
Findings 6 total
riskpackages/cli/src/commands/init/preflight.ts→ closed
Preflight .git detection regression — fileExists returns false for directories
debtpackages/cli/src/commands/scan.ts→ closed
Over-building — init/state.ts, init/index.ts, scan.ts changes unrelated to polyglot detection
debtpackages/cli/tests/engine/detectors/polyglot.test.ts→ closed
A017 frameworkDeps test uses toBeDefined — passes even if framework is null
obspackages/cli/src/engine/detectors/projectType.ts→ closed
hasRustWorkspace catch block unreachable — regex cannot throw
obspackages/cli/src/engine/detectors/projectType.ts→ closed
Priority ordering Python > Rust > Go in Tier 3 is implicit and untested
+1more findings
Integrity seal
scopesha256:85ce719a170fd...
contractsha256:5be120e2d7446...
plansha256:eed85030e96bd...
specsha256:52d5a8662b376...
build-reportsha256:66519e0d07b20...
build-datasha256:d2d57712949ae...
verify-reportsha256:ebac47ea6d2c8...
verify-datasha256:6bac0f659016e...
audit cmd$ ana proof audit rust-go-polyglot-detection → all hashes match