test(contracts): verify published registry drift

Aitomates · Aitomates · commit 4dc270ef86fc · 2026-07-04T22:09:21.000+03:00
diff --git a/.github/workflows/contract-registry-live.yml b/.github/workflows/contract-registry-live.yml
@@ -0,0 +1,41 @@
+name: Contract registry live drift
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "17 5 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  verify-v1-1:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - name: Compare published v1.1.0 release with vendored contracts
+        env:
+          REGISTRY_BASE: https://coding-autopilot-system.github.io/cas-contracts/registry
+          PINNED_VERSION: 1.1.0
+          VENDORED_ROOT: tests/contracts/cas-contracts/v1.1.0
+        shell: python
+        run: |
+          import hashlib, json, os, pathlib, urllib.request
+          base = os.environ["REGISTRY_BASE"]
+          version = os.environ["PINNED_VERSION"]
+          root = pathlib.Path(os.environ["VENDORED_ROOT"])
+          with urllib.request.urlopen(f"{base}/index.json", timeout=20) as response:
+              index = json.load(response)
+          if version not in index.get("releases", []):
+              raise SystemExit(f"published registry is missing release {version}")
+          with urllib.request.urlopen(f"{base}/releases/v{version}/manifest.json", timeout=20) as response:
+              manifest = json.load(response)
+          for entry in manifest["schemas"]:
+              local = (root / entry["path"]).read_bytes()
+              if hashlib.sha256(local).hexdigest() != entry["sha256"]:
+                  raise SystemExit(f"vendored digest drift: {entry['path']}")
+              with urllib.request.urlopen(f"{base}/releases/v{version}/{entry['path']}", timeout=20) as response:
+                  published = response.read()
+              if published != local:
+                  raise SystemExit(f"published content drift: {entry['path']}")
diff --git a/tests/contracts/cas-contracts/v1.1.0/common.schema.json b/tests/contracts/cas-contracts/v1.1.0/common.schema.json
@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://schemas.coding-autopilot.dev/v1.1/common.schema.json",
+  "$id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.1/common.schema.json",
   "title": "CAS Common Definitions v1.1",
   "$defs": {
     "actor": {
diff --git a/tests/contracts/cas-contracts/v1.1.0/manifest.json b/tests/contracts/cas-contracts/v1.1.0/manifest.json
@@ -2,34 +2,34 @@
   "version": "1.1.0",
   "schemas": [
     {
-      "id": "https://schemas.coding-autopilot.dev/v1.1/common.schema.json",
+      "id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.1/common.schema.json",
       "path": "common.schema.json",
-      "sha256": "078026d60c219658fe0fc5cf7c4f786acdcf0c492121f7d688d5078b33ca25af"
+      "sha256": "111ea168b873aa99a5f2d731f1295320c83c8424156546be9dbdc5624c597562"
     },
     {
-      "id": "https://schemas.coding-autopilot.dev/v1.1/phase-execution-request.schema.json",
+      "id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.1/phase-execution-request.schema.json",
       "path": "phase-execution-request.schema.json",
-      "sha256": "927ffda5ba809e58627ba25b3275355644b510b0ae1c76f446aa7b7f291f08fd"
+      "sha256": "a9dd60ade628f98cdc97fec9900f4b429f81e0fe07413a2ff21cd42188f85fb6"
     },
     {
-      "id": "https://schemas.coding-autopilot.dev/v1.1/phase-execution-result.schema.json",
+      "id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.1/phase-execution-result.schema.json",
       "path": "phase-execution-result.schema.json",
-      "sha256": "1d353e20cf6338c2de4a9bec0bad83ca0dec6c9feb5434c5e6264fdc075e7c25"
+      "sha256": "7c56cc51aa0f8ae878a4f8219a4b1bedc20697f57d557797a0907a7163df1f7e"
     },
     {
-      "id": "https://schemas.coding-autopilot.dev/v1.1/phase-verification-result.schema.json",
+      "id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.1/phase-verification-result.schema.json",
       "path": "phase-verification-result.schema.json",
-      "sha256": "ec5b97a2bf75892530442f666d23a8b6dbb8f13bda0efe49553d3f64cd41b995"
+      "sha256": "800cfceecd61a16883a5be67f0da9ff9fa8865450c62e92676a878189c12b6cc"
     },
     {
-      "id": "https://schemas.coding-autopilot.dev/v1.1/sdlc-lifecycle-event.schema.json",
+      "id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.1/sdlc-lifecycle-event.schema.json",
       "path": "sdlc-lifecycle-event.schema.json",
-      "sha256": "bd955637761679d3b6e8ee09fb7b693b1d0362615b0865204c5ae3bacb3809dc"
+      "sha256": "f746915fc3687496be216d0b8bcfec0398a8c5eebb765ff8c63e7c9ee88b174f"
     },
     {
-      "id": "https://schemas.coding-autopilot.dev/v1.1/sdlc-profile.schema.json",
+      "id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.1/sdlc-profile.schema.json",
       "path": "sdlc-profile.schema.json",
-      "sha256": "f4974e911e7cb88191c1a331470c8cd7a79d1c7311c963dd70cd9c8f524ebe45"
+      "sha256": "80e75549b7ef49182aba640576228db6bed674f15847b154bbf83d7953e23334"
     }
   ]
 }
diff --git a/tests/contracts/cas-contracts/v1.1.0/phase-execution-request.schema.json b/tests/contracts/cas-contracts/v1.1.0/phase-execution-request.schema.json
@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://schemas.coding-autopilot.dev/v1.1/phase-execution-request.schema.json",
+  "$id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.1/phase-execution-request.schema.json",
   "title": "PhaseExecutionRequest",
   "type": "object",
   "allOf": [
diff --git a/tests/contracts/cas-contracts/v1.1.0/phase-execution-result.schema.json b/tests/contracts/cas-contracts/v1.1.0/phase-execution-result.schema.json
@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://schemas.coding-autopilot.dev/v1.1/phase-execution-result.schema.json",
+  "$id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.1/phase-execution-result.schema.json",
   "title": "PhaseExecutionResult",
   "type": "object",
   "allOf": [
diff --git a/tests/contracts/cas-contracts/v1.1.0/phase-verification-result.schema.json b/tests/contracts/cas-contracts/v1.1.0/phase-verification-result.schema.json
@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://schemas.coding-autopilot.dev/v1.1/phase-verification-result.schema.json",
+  "$id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.1/phase-verification-result.schema.json",
   "title": "PhaseVerificationResult",
   "type": "object",
   "allOf": [
diff --git a/tests/contracts/cas-contracts/v1.1.0/sdlc-lifecycle-event.schema.json b/tests/contracts/cas-contracts/v1.1.0/sdlc-lifecycle-event.schema.json
@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://schemas.coding-autopilot.dev/v1.1/sdlc-lifecycle-event.schema.json",
+  "$id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.1/sdlc-lifecycle-event.schema.json",
   "title": "SdlcLifecycleEvent",
   "type": "object",
   "allOf": [
diff --git a/tests/contracts/cas-contracts/v1.1.0/sdlc-profile.schema.json b/tests/contracts/cas-contracts/v1.1.0/sdlc-profile.schema.json
@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://schemas.coding-autopilot.dev/v1.1/sdlc-profile.schema.json",
+  "$id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.1/sdlc-profile.schema.json",
   "title": "SdlcProfile",
   "type": "object",
   "allOf": [

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"$schema": "https://json-schema.org/draft/2020-12/schema",`
`3`		`- "$id": "https://schemas.coding-autopilot.dev/v1.1/common.schema.json",`
	`3`	`+ "$id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.1/common.schema.json",`
`4`	`4`	`"title": "CAS Common Definitions v1.1",`
`5`	`5`	`"$defs": {`
`6`	`6`	`"actor": {`
Original file line number	Diff line number	Diff line change
`@@ -2,34 +2,34 @@`
`2`	`2`	`"version": "1.1.0",`
`3`	`3`	`"schemas": [`
`4`	`4`	`{`
`5`		`- "id": "https://schemas.coding-autopilot.dev/v1.1/common.schema.json",`
	`5`	`+ "id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.1/common.schema.json",`
`6`	`6`	`"path": "common.schema.json",`
`7`		`- "sha256": "078026d60c219658fe0fc5cf7c4f786acdcf0c492121f7d688d5078b33ca25af"`
	`7`	`+ "sha256": "111ea168b873aa99a5f2d731f1295320c83c8424156546be9dbdc5624c597562"`
`8`	`8`	`},`
`9`	`9`	`{`
`10`		`- "id": "https://schemas.coding-autopilot.dev/v1.1/phase-execution-request.schema.json",`
	`10`	`+ "id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.1/phase-execution-request.schema.json",`
`11`	`11`	`"path": "phase-execution-request.schema.json",`
`12`		`- "sha256": "927ffda5ba809e58627ba25b3275355644b510b0ae1c76f446aa7b7f291f08fd"`
	`12`	`+ "sha256": "a9dd60ade628f98cdc97fec9900f4b429f81e0fe07413a2ff21cd42188f85fb6"`
`13`	`13`	`},`
`14`	`14`	`{`
`15`		`- "id": "https://schemas.coding-autopilot.dev/v1.1/phase-execution-result.schema.json",`
	`15`	`+ "id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.1/phase-execution-result.schema.json",`
`16`	`16`	`"path": "phase-execution-result.schema.json",`
`17`		`- "sha256": "1d353e20cf6338c2de4a9bec0bad83ca0dec6c9feb5434c5e6264fdc075e7c25"`
	`17`	`+ "sha256": "7c56cc51aa0f8ae878a4f8219a4b1bedc20697f57d557797a0907a7163df1f7e"`
`18`	`18`	`},`
`19`	`19`	`{`
`20`		`- "id": "https://schemas.coding-autopilot.dev/v1.1/phase-verification-result.schema.json",`
	`20`	`+ "id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.1/phase-verification-result.schema.json",`
`21`	`21`	`"path": "phase-verification-result.schema.json",`
`22`		`- "sha256": "ec5b97a2bf75892530442f666d23a8b6dbb8f13bda0efe49553d3f64cd41b995"`
	`22`	`+ "sha256": "800cfceecd61a16883a5be67f0da9ff9fa8865450c62e92676a878189c12b6cc"`
`23`	`23`	`},`
`24`	`24`	`{`
`25`		`- "id": "https://schemas.coding-autopilot.dev/v1.1/sdlc-lifecycle-event.schema.json",`
	`25`	`+ "id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.1/sdlc-lifecycle-event.schema.json",`
`26`	`26`	`"path": "sdlc-lifecycle-event.schema.json",`
`27`		`- "sha256": "bd955637761679d3b6e8ee09fb7b693b1d0362615b0865204c5ae3bacb3809dc"`
	`27`	`+ "sha256": "f746915fc3687496be216d0b8bcfec0398a8c5eebb765ff8c63e7c9ee88b174f"`
`28`	`28`	`},`
`29`	`29`	`{`
`30`		`- "id": "https://schemas.coding-autopilot.dev/v1.1/sdlc-profile.schema.json",`
	`30`	`+ "id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.1/sdlc-profile.schema.json",`
`31`	`31`	`"path": "sdlc-profile.schema.json",`
`32`		`- "sha256": "f4974e911e7cb88191c1a331470c8cd7a79d1c7311c963dd70cd9c8f524ebe45"`
	`32`	`+ "sha256": "80e75549b7ef49182aba640576228db6bed674f15847b154bbf83d7953e23334"`
`33`	`33`	`}`
`34`	`34`	`]`
`35`	`35`	`}`