Runtime

CI/CD Contract Gate

Keep the stable apibox-ci.json v1 artifact and prepare a fail-closed ContractRadar configuration for the checked-in private runner source. Manual source review and baseline creation remain required.

Pro PREPARED · HOLD

PREPARED · HOLD

Private source runner preparation

Runtime capability truth

Needs CI

Runtime connection: unknown
Strongest limitation: No valid explicit runtime check proves a live connection (unknown). The self-contained CLI tarball is beta evaluation tooling, not a hosted monitoring service.

The exported runner file is a non-executable preparation receipt. It does not install the legacy fingerprint as a baseline and makes no published package, hosted service, or container-release claim.

Replace the explicit OpenAPI source placeholder, review and copy runnerConfigTemplate to radar.json, then validate it and create a manual baseline before enabling the gate.

Generated pipelines use only the checked-in private runner source and fail closed when the source directory or radar.json is missing.

CI onboarding

Build a reviewed contract gate

SUPPORTEDRepository file + SHA-256

The workflow loads the reviewed baseline from protected main, checks its fingerprint, creates fresh CI state, then evaluates the candidate. The candidate cannot silently reuse the legacy fingerprint. GitHub pull requests use the protected base workflow; GitLab merge requests stay HOLD until a protected external pipeline policy is active.

HOLDOther baseline sources

Protected-branch artifacts, provider artifacts and external agent-state imports are not generated until their authenticated retrieval and provenance checks exist.

1 · Contract filesReviewed baseline fileBaseline SHA-256Candidate OpenAPI file

2 · Release policy

Block whenWarn whenMinimum coverage (%)Minimum confidence (%)

Unknown downstream impact

3 · Evidence and secrets

Published views

Decision JSONJUnitSARIFHTML reportChecksums always included

Required secret environment namesNames only. Secret values never enter this page or the generated files.

Evidence retention (days)Post a redacted PR summaryComments are same-repository only. Every PR run is secretless and fails closed when a configured secret is required.

4 · Validation and files

Setup needs attention

Enter the baseline file's 64-character SHA-256 fingerprint.

Downloads stay locked until every field passes validation.

Runner evidence

Review a completed evidence bundle

Choose the complete JSON bundle produced by the reviewed headless runner. APIMaster checks its governed file list and every SHA-256 checksum before showing a decision.

Local review only · maximum 5 MB · no upload · no raw specification storage · no claim that CI ran

Review evidence JSON

Release assurance V2

One decision, CI-native evidence

source-prepared-private

A reviewed one-shot run projects the same deterministic decision into JSON, JUnit, SARIF, HTML, and checksummed evidence. The legacy browser export alone does not create these V2 results.

json

release-decision.json

Machine-readable release decision

junit

junit.xml

CI test-report ingestion

sarif

results.sarif

Static-analysis finding ingestion

html

executive-report.html

Human-readable decision review

checksums

checksums.sha256

Evidence integrity verification

node contract-radar-runner/dist/cli.js doctor --config radar.json

Validate local configuration and report lifecycle truth without probing the network.

node contract-radar-runner/dist/cli.js watch --once --config radar.json --output contract-radar-evidence

Run exactly one externally scheduled check and write release evidence.

Distribution HOLD: The checked-in private source is prepared for reviewed one-shot execution; no npm package, container image, hosted daemon, or supported registry distribution is published.

Source

API under gate

API

Slug: order-mgmt
Version: 2.4.1
Endpoints: 4
Scenarios: 2
Schemas: 0
Rules: 4

Compatibility

Legacy artifact fingerprint

provenance onlymanual baseline required

2.4.1|4|GET /orders/{id},PATCH /orders/{id},POST /orders,POST /orders/{id}/fulfill

The exported runner file is a non-executable preparation receipt. It does not install the legacy fingerprint as a baseline and makes no published package, hosted service, or container-release claim.

Artefacts

Compatibility and preparation files

Pro

Everything is generated locally — no network calls, no data leaves this browser.

Reviewed setup

Prepare the source-runner gate

The legacy bundle remains portable provenance. The ContractRadar gate becomes executable only after an operator supplies and reviews a complete OpenAPI source and creates a manual baseline.

1
Export the compatibility files
Download apibox-ci.json and the separate prepared runner receipt. The legacy fingerprint is retained as provenance only.
2
Prepare the authoritative source
Replace the OpenAPI placeholder, review the policy, and copy only runnerConfigTemplate into radar.json.
3
Validate and create a baseline
Use the checked-in private runner source to validate radar.json, then run the explicit baseline command outside this browser.
4
Enable the CI gate after review
Add the generated workflow only after the source and baseline are approved. Missing source, config, or state fails closed.

Source-prepared, not published

The workflow uses the checked-in private runner source. It does not claim an npm release, container publication, hosted service, or unattended browser scheduler.

Legacy artifact: apibox-ci.json
Preparation receipt: contract-radar-runner.prepared.json
Reviewed runner config: radar.json
Checked-in runner source: contract-radar-runner/