audit-contracts
audit-contracts is the audit that targets contract drift
between layers in a multi-stack repo. The dominant failure mode
in monorepos with a frontend and a backend is that one side adds
a new field or changes a status code and the other side doesn’t
notice — the breakage shows up later, usually in production,
sometimes in a different team’s PR.
The six axes
- Endpoints. New backend route → check there’s a frontend client that calls it. Removed backend route → check no frontend client still calls it.
- DTOs. Backend request/response DTO changes (added / removed / renamed field) → check the corresponding frontend type matches. Optional fields on one side must be optional on the other.
- Enums. Enum value added on the backend → check the frontend enum lists it. Enum value removed → check the frontend doesn’t still send it.
- Status codes. Backend handler that returns a new status
code (
429,409, etc.) → check the frontend error-handling path covers it. - Auth rules. Endpoint that was public is now protected (or vice versa) → check the frontend’s auth-aware code matches.
- Params. New required query parameter on backend → check the frontend passes it.
Why these six and not “any drift”
A broad “find any difference” check produces too many false
positives — backend and frontend types have legitimate divergence
(e.g., the backend stores Decimal, the frontend uses number).
The six axes target the specific contract surface where divergence
breaks runtime behaviour, while ignoring divergence that’s by
design.
Static analysis, not runtime
The audit reads the code on both sides — it doesn’t run requests or compare to a live API. That means:
- It catches drift that’s in the diff. If the divergence existed before the diff started, it’s not flagged.
- It depends on conventions (where DTOs live, how routes are declared) to find the surfaces to compare. Projects that put their backend types in unconventional places get less coverage.
Pairing with audit-all
audit-contracts is one of the four audits audit-all composes
in parallel. The standalone invocation makes sense when you want
to scope to contracts specifically (e.g., a frontend team’s PR
that only touches the API client; running the full audit suite is
overkill).
Stack support
Today the skill understands TypeScript on the frontend and C# (EF Core / ASP.NET) on the backend — Octopus’s reference stack. Other backend stacks need a SKILL.md update to recognise their route-declaration syntax and DTO conventions.