env contract audit derived

{
  "input": {
    "body": {
      "contract": {
        "optional": [
          "LOG_LEVEL"
        ],
        "patterns": {
          "PORT": "port",
          "LOG_LEVEL": "non-empty",
          "DATABASE_URL": "url"
        },
        "required": [
          "DATABASE_URL",
          "SESSION_SECRET",
          "PORT",
          "FEATURE_FLAGS",
          "SENTRY_DSN"
        ],
        "forbidden": [
          "DEBUG_SQL"
        ]
      },
      "variables": {
        "PORT": "eight-thousand",
        "DEBUG_SQL": "true",
        "LOG_LEVEL": "debug",
        "DATABASE_URL": "postgres://app:not-a-real-password@db.internal:5432/orders",
        "GITHUB_TOKEN": "ghp_000000000000000000000000000000000000",
        "FEATURE_FLAGS": "",
        "SESSION_SECRET": "f0e1d2c3b4a5968778695a4b3c2d1e0ff0e1d2c3b4a5968778695a4b3c2d1e0f"
      }
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "limits": {
        "maxJobs": 200,
        "maxFindings": 500,
        "maxServices": 200,
        "maxResources": 2000,
        "maxVariables": 1000,
        "maxComponents": 5000,
        "maxDependencies": 5000
      },
      "passed": false,
      "complete": true,
      "findings": [
        {
          "code": "REQUIRED_VARIABLE_EMPTY",
          "detail": "FEATURE_FLAGS is required and present but empty, which is usually worse than absent because a default will not apply.",
          "variable": "FEATURE_FLAGS"
        },
        {
          "code": "REQUIRED_VARIABLE_MISSING",
          "detail": "SENTRY_DSN is required and absent.",
          "variable": "SENTRY_DSN"
        },
        {
          "code": "FORBIDDEN_VARIABLE_PRESENT",
          "detail": "DEBUG_SQL must not be set in this environment.",
          "variable": "DEBUG_SQL"
        }
      ],
      "variables": [
        {
          "name": "DATABASE_URL",
          "type": "string",
          "empty": false,
          "length": 58,
          "declared": true,
          "shape_class": "a9.",
          "looks_like_secret": "URL_WITH_INLINE_CREDENTIALS"
        },
        {
          "name": "DEBUG_SQL",
          "type": "string",
          "empty": false,
          "length": 4,
          "declared": false,
          "shape_class": "a",
          "looks_like_secret": null
        },
        {
          "name": "FEATURE_FLAGS",
          "type": "string",
          "empty": true,
          "length": 0,
          "declared": true,
          "shape_class": "empty",
          "looks_like_secret": null
        }
      ],
      "conformant": false,
      "request_id": "example-request",
      "service_id": "env_contract_audit",
      "assumptions": [
        "No value is ever returned. Each variable is described by its type, length, character classes and whether it is shaped like a credential, which is enough to act on without exposing anything.",
        "A required variable that is present but empty is reported separately from one that is absent, because an empty value suppresses a default where an absent one does not.",
        "Credential detection is by name convention and by value shape. It says a value looks like a credential, never that it is one or that it is compromised."
      ],
      "limitations": [
        "Observable facts about the variables supplied. This is not a secret scanner, a compliance determination or a statement that any value is safe.",
        "conformant is true only when every declared rule was evaluated and none failed."
      ],
      "observed_at": "2026-10-02T00:00:00.000Z",
      "not_examined": [],
      "finding_count": 8,
      "declared_count": 6,
      "variable_count": 7,
      "service_version": "1.0.0",
      "findings_by_code": {
        "UNDECLARED_VARIABLE": 1,
        "VALUE_SHAPE_MISMATCH": 1,
        "REQUIRED_VARIABLE_EMPTY": 1,
        "REQUIRED_VARIABLE_MISSING": 1,
        "FORBIDDEN_VARIABLE_PRESENT": 1,
        "VALUE_LOOKS_LIKE_CREDENTIAL": 3
      },
      "undeclared_count": 2
    }
  }
}