Contracts & Gatekeeper
BoundaryContract (Contract IR)
Versioned producer/consumer boundary:
id,version(semver),mode(declared|inferred|observed|promoted)edge— kind, producer, consumer, channel, operationrequiredShape— format + required/provided fieldscontractHash— content address (sha256:…)- optional
effects— EffectSpec - optional
resilience— ResilienceProfile
Contracts are parse-don’t-validate: invalid shapes never become live values past the boundary.
Compatibility
Compatibility checks compare previous vs next revisions:
| Change | Result |
|---|---|
| Added provided fields | Compatible |
| Removed required/provided field consumers need | Breaking (required-field-removed) |
| Channel change / version regress | Breaking |
| Effect widening when effects declared | Breaking (effect-widened) |
can-deploy
Given deployed contract state + candidate deployment plan → compatibility matrix + gate pass/fail events with agent-actionable reasons.
Gatekeeper
Composes into one decision (allow | allow-degraded | deny | require-approval):
- can-deploy (contracts)
- policy pack — always emits
policy.Decided - obligations
- cost/quota
- optional secretless-config / can-migrate dimensions
Also surfaces effect summaries and optional reasons with gate: "effects" | "resilience".
Describe / export
CLI and MCP can describe a contract as human text or export an effect manifest for policy and SRE tooling.
Testing
See Testing: contracts for harness usage.