env file contract audit derived

{
  "input": {
    "body": {
      "env": "# local development\nDATABASE_URL=postgres://app@localhost:5432/app\nAPI_BASE=https://${API_HOST}/v1\nLOG_LEVEL=debug # verbose for now\nGREETING=hello world\nSESSION_SECRET=\nLOG_LEVEL=info\n",
      "example": "DATABASE_URL=\nAPI_BASE=\nAPI_HOST=\nSESSION_SECRET=\nFEATURE_FLAGS=\n",
      "required": [
        "DATABASE_URL",
        "API_BASE",
        "SESSION_SECRET"
      ]
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "names": [
        "API_BASE",
        "DATABASE_URL",
        "GREETING"
      ],
      "limits": {
        "maxFindings": 500,
        "maxJsonBytes": 1048576,
        "maxResources": 5000,
        "maxTextBytes": 262144,
        "maxEnvEntries": 2000,
        "maxPatchOperations": 1000
      },
      "passed": false,
      "complete": true,
      "findings": [
        {
          "code": "UNQUOTED_VALUE_WITH_TRAILING_COMMENT",
          "line": 4,
          "name": "LOG_LEVEL",
          "detail": "LOG_LEVEL is unquoted and contains a hash, so some loaders keep the comment as part of the value and some drop it."
        },
        {
          "code": "UNQUOTED_VALUE_WITH_SPACE",
          "line": 4,
          "name": "LOG_LEVEL",
          "detail": "LOG_LEVEL is unquoted and contains a space, so a shell sourcing the file would split it."
        },
        {
          "code": "UNQUOTED_VALUE_WITH_SPACE",
          "line": 5,
          "name": "GREETING",
          "detail": "GREETING is unquoted and contains a space, so a shell sourcing the file would split it."
        }
      ],
      "conformant": false,
      "request_id": "example-request",
      "service_id": "env_file_contract_audit",
      "assumptions": [
        "No value from a .env file is ever returned, only names, line numbers and whether a value was quoted. A .env file is a credential store by convention.",
        "The quoting findings are about loader disagreement rather than correctness: an unquoted value with a trailing hash or a trailing space is kept by some loaders and trimmed by others, so the effective c...",
        "An interpolation reference the file does not define is reported because most loaders substitute an empty string, so the result is silently incomplete rather than an error."
      ],
      "entry_count": 5,
      "limitations": [
        "The files supplied. What the process environment already holds, and what a platform injects at run time, are outside this.",
        "conformant is true only when every required name was set, every reference resolved, and the comparison the caller asked for was performed."
      ],
      "observed_at": "2026-10-02T00:00:00.000Z",
      "not_examined": [],
      "quoted_count": 0,
      "finding_count": 10,
      "service_version": "1.0.0",
      "findings_by_code": {
        "DUPLICATE_NAME": 1,
        "NAME_NOT_IN_EXAMPLE": 2,
        "REQUIRED_NAME_EMPTY": 1,
        "REFERENCE_NOT_DEFINED": 1,
        "NAME_IN_EXAMPLE_NOT_SET": 2,
        "UNQUOTED_VALUE_WITH_SPACE": 2,
        "UNQUOTED_VALUE_WITH_TRAILING_COMMENT": 1
      },
      "compared_with_example": true
    }
  }
}