helm values contract audit derived

{
  "input": {
    "body": {
      "values": "replicaCount: \"2\"\nimage:\n  repository: ghcr.io/example/web\nenvironment: prod\ningress:\n  enabled: yes\n",
      "contract": {
        "enums": {
          "environment": [
            "development",
            "staging",
            "production"
          ]
        },
        "types": {
          "image.tag": "string",
          "replicaCount": "number",
          "ingress.enabled": "boolean"
        },
        "required": [
          "image.repository",
          "image.tag",
          "replicaCount"
        ],
        "forbid_unknown": false
      },
      "compare_with": "replicaCount: 2\nimage:\n  repository: ghcr.io/example/web\n  tag: 1.4.0\nenvironment: staging\ningress:\n  enabled: false\n  host: staging.example.test\n"
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "limits": {
        "maxFindings": 500,
        "maxYamlBytes": 262144,
        "maxDockerfileBytes": 131072,
        "maxDockerfileLines": 4000
      },
      "passed": false,
      "compared": true,
      "complete": false,
      "findings": [
        {
          "code": "SCALAR_IS_A_YAML_BOOLEAN",
          "line": 6,
          "detail": "values: \"yes\" is an unquoted YAML 1.1 boolean and reads as true, not as the text yes. Quoting it keeps it a string.",
          "location": "ingress.enabled"
        },
        {
          "code": "REQUIRED_VALUE_ABSENT",
          "detail": "image.tag is required and is absent, so the chart renders with whatever its own default is rather than with a stated value.",
          "location": "image.tag"
        },
        {
          "code": "VALUE_TYPE_MISMATCH",
          "detail": "replicaCount is string and number was declared. The chart will receive the wrong kind of value.",
          "location": "replicaCount"
        }
      ],
      "conformant": false,
      "request_id": "example-request",
      "service_id": "helm_values_contract_audit",
      "assumptions": [
        "Values are flattened to dotted paths, which is how a chart references them, so a contract is written in the same notation a template uses.",
        "A type mismatch names the YAML cause where there is one: an unquoted numeric-looking value arrives as a number and an unquoted boolean word as a boolean, and both are the usual reason a chart receives...",
        "A path the contract does not mention is only reported when the caller asks, because Helm ignores a value no template reads and a strict default would be noise for a partial contract."
      ],
      "limitations": [
        "The values files supplied against the contract supplied. No chart is read, so whether a template actually consumes a value is not known here.",
        "conformant is true only when every declared rule was evaluated and none failed."
      ],
      "observed_at": "2026-10-02T00:00:00.000Z",
      "typed_count": 3,
      "value_count": 4,
      "not_examined": [
        "TYPE_NOT_CHECKED: image.tag is absent, so its declared type was not checked."
      ],
      "finding_count": 7,
      "required_count": 3,
      "service_version": "1.0.0",
      "enumerated_count": 1,
      "findings_by_code": {
        "VALUE_NOT_PERMITTED": 1,
        "VALUE_TYPE_MISMATCH": 1,
        "REQUIRED_VALUE_ABSENT": 1,
        "SCALAR_IS_A_YAML_BOOLEAN": 1,
        "VALUE_ABSENT_FROM_COMPARISON": 2,
        "VALUE_TYPE_DIFFERS_BETWEEN_FILES": 1
      },
      "unknown_values_forbidden": false
    }
  }
}