http header contract audit derived

{
  "input": {
    "body": {
      "status": 200,
      "headers": {
        "Vary": [
          "Accept-Encoding",
          "Origin"
        ],
        "Server": "example-edge/2.1",
        "Content-Type": "application/json",
        "X-Request-Id": [
          "a1",
          "b2"
        ]
      },
      "contract": {
        "values": {
          "Content-Type": {
            "starts_with": "application/json"
          },
          "X-Frame-Options": "DENY"
        },
        "required": [
          "Cache-Control",
          "Content-Type"
        ],
        "forbidden": [
          "Server",
          "X-Powered-By"
        ],
        "require_cache_directives": true
      }
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "limits": {
        "maxPages": 50,
        "maxListed": 200,
        "maxCookies": 100,
        "maxHeaders": 200,
        "maxFindings": 500,
        "maxHtmlBytes": 262144,
        "maxSitemapUrls": 10000,
        "maxSitemapBytes": 1048576
      },
      "passed": false,
      "status": 200,
      "checked": {
        "values": 2,
        "required": 2,
        "forbidden": 2,
        "cache_directives": true
      },
      "complete": true,
      "findings": [
        {
          "code": "REQUIRED_HEADER_ABSENT",
          "detail": "cache-control is required and absent.",
          "header": "cache-control"
        },
        {
          "code": "FORBIDDEN_HEADER_PRESENT",
          "detail": "server is present and the contract forbids it.",
          "header": "server"
        },
        {
          "code": "REQUIRED_HEADER_ABSENT",
          "detail": "x-frame-options is constrained by a value rule and absent.",
          "header": "x-frame-options"
        }
      ],
      "conformant": false,
      "request_id": "example-request",
      "service_id": "http_header_contract_audit",
      "assumptions": [
        "Header names are compared case-insensitively, as HTTP defines them, and a repeated header is read from an array or a comma-joined string because clients differ.",
        "A header legitimately repeated, such as Set-Cookie, Link or Vary, is not reported as ambiguous.",
        "Every finding describes the headers supplied. This is not a security assessment or a compliance determination."
      ],
      "limitations": [
        "Observable facts about the headers supplied. Whether the origin always sends them, and whether an intermediary alters them, are outside this.",
        "conformant is true only when every declared rule was evaluated and none failed."
      ],
      "observed_at": "2026-10-02T00:00:00.000Z",
      "header_count": 4,
      "header_names": [
        "content-type",
        "server",
        "vary"
      ],
      "not_examined": [],
      "finding_count": 7,
      "service_version": "1.0.0",
      "findings_by_code": {
        "NO_VALIDATOR": 1,
        "CACHE_CONTROL_ABSENT": 1,
        "CHARSET_NOT_DECLARED": 1,
        "REQUIRED_HEADER_ABSENT": 2,
        "FORBIDDEN_HEADER_PRESENT": 1,
        "HEADER_REPEATED_WITH_DIFFERENT_VALUES": 1
      }
    }
  }
}