CLI commits scoped to intended paths
Every `git commit` in the CLI commits the entire staging index, not the specific files it staged. Pre-existing staged changes from other sessions, manual operations, or concurrent pipeline work leak into unrelated commits. Observed: `work complete commit-work-start-timestamps` (commit `bb2ee1f`) swept `polish-scan-copy`'s staged deletions into its commit — files from a different work item deleted by a different terminal session. The user wants every CLI commit to contain exactly what was intended.
verdict PASSscore 14 / 14findings 5 (0 risk · 1 debt · 4 obs)duration 21h 59mrejection cycles 0shipped May 10, 2026
Pipeline timeline
Intent to proven code in 21h 59m across Think, Plan, Build, and Verify.
Think17m
Plan10m
Build7m
Verify4m
Assertion ledger
14 claims, each independently verified. Showing 8 — show all →
| ID | Says | Matcher | |
|---|---|---|---|
| A001 | The work complete commit only contains the files it intended to stage | verified | ok |
| A002 | Pre-existing staged files remain staged after a scoped commit | verified | ok |
| A003 | The work complete commit includes the archived plan directory | verified | ok |
| A004 | The work complete commit includes the proof chain | verified | ok |
| A005 | The single artifact save commit uses scoped pathspecs | verified | ok |
| A006 | The multi artifact save commit uses scoped pathspecs | verified | ok |
| A007 | The single artifact diff check uses scoped pathspecs | verified | ok |
| A008 | The multi artifact diff check uses scoped pathspecs | verified | ok |
Findings 5 total
debtpackages/cli/tests/commands/work.test.ts→ closed
No integration tests for artifact.ts or proof.ts scoped commit sites — 9 of 14 assertions verified by source inspection only
obspackages/cli/src/commands/artifact.ts→ closed
git commit -- uses --only semantics (working tree, not index) — safe because git add and commit are adjacent synchronous calls, but undocumented assumption
obspackages/cli/src/commands/artifact.ts→ closed
Site 2 stages plan.md with absolute path via runGit but tracks relative path in stagedPaths — works correctly but mixed path convention
obspackages/cli/tests/commands/work.test.ts→ closed
Test uses toContain('completed/') for path matching — works in controlled test but would false-positive if any other path contained 'completed/'
obs→ closed
commitSaves silently swallows commit failures — pre-existing, still present (see proof context)
Integrity seal
scopesha256:a7026c5b9f90c...
contractsha256:49b4b2dc0b2e7...
plansha256:71d051f7260e7...
specsha256:f5146bd855dff...
build-reportsha256:bfc54376fe22e...
build-datasha256:64c888b6fb815...
verify-reportsha256:2bf986c9b3811...
verify-datasha256:886bf3ff3884e...
audit cmd$ ana proof audit scoped-cli-commits → all hashes match