Version Awareness Notifications
Users have zero visibility into version drift. Two silent failures happen today:
verdict PASSscore 25 / 25findings 6 (0 risk · 0 debt · 6 obs)duration 1h 18mrejection cycles 0shipped May 10, 2026surface cli
Pipeline timeline
Intent to proven code in 1h 18m across Think, Plan, Build, and Verify.
Think17m
Plan13m
Build12m
Verify9m
Assertion ledger
25 claims, each independently verified. Showing 8 — show all →
| ID | Says | Matcher | |
|---|---|---|---|
| A001 | Users see when a newer CLI version is available on npm | verified | ok |
| A002 | The update notification tells users the exact command to upgrade | verified | ok |
| A003 | Users see when their project was initialized with a different CLI version | verified | ok |
| A004 | The mismatch notification tells users to re-initialize | verified | ok |
| A005 | No notifications appear when all versions are current | verified | ok |
| A006 | No mismatch notification appears when project version matches CLI | verified | ok |
| A007 | Network failures never show errors to the user | verified | ok |
| A008 | A fresh cache is not re-fetched within 24 hours | verified | ok |
Findings 6 total
obspackages/cli/src/utils/update-check.ts→ closed
packageName interpolated via template literal without JSON.stringify in spawn script URL
obspackages/cli/src/utils/update-check.ts→ closed
Four of five exports from update-check.ts are unused in production code — only checkForUpdates is imported
obspackages/cli/tests/utils/update-check.test.ts→ closed
A007 tagged test checks return values not output — contract target is 'output' with not_contains 'Error'
obspackages/cli/tests/utils/update-check.test.ts→ closed
A010 tagged test checks spawn not called — contract target is updateAvailable equals null, which is tested in untagged CI test
obspackages/cli/src/utils/update-check.ts→ closed
Spawn script uses require() (CommonJS) inside node -e — works but inconsistent with ESM codebase
+1more findings
Integrity seal
scopesha256:58190b59c07de...
contractsha256:9a72139a73b01...
plansha256:31c1dac815901...
specsha256:f202f2d1fd1b9...
build-reportsha256:12a8303dc5dcb...
build-datasha256:2833dfeaf1efd...
verify-reportsha256:5ae699b3d0957...
verify-datasha256:daae46f961e7a...
audit cmd$ ana proof audit version-awareness → all hashes match