Keep app-facing API contracts deployable and verifiable - #308
Merged
Conversation
Constraint: Shopify compatibility remains query-only and existing app routes stay backward-compatible. Rejected: Raw payload logging | Protected customer data must not enter retained runtime evidence. Confidence: high Scope-risk: moderate Directive: Keep OpenAPI parity, Shopify API defaults, and disposable DB guards synchronized with runtime changes. Tested: prisma validate/generate; lint; typecheck; build; 1,881 default tests; 59 disposable DB tests; OpenAPI parse/parity checks. Not-tested: Production cross-service smoke pending after both PRs merge.
Constraint: Production monitoring treats the repository migration tail as an exact deployment contract. Confidence: high Scope-risk: narrow Directive: Update the monitor migration count and latest-name assertion whenever a checked-in migration is added. Tested: tests/deploy/monitor-route-ops-production.test.sh
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
2026-07shopify_admin_api_surface_requestcorrelation recordsWhy
The full API audit found documented/runtime route drift, duplicated Shopify API defaults, incomplete cross-service request evidence, and DB integration suites that were safe but difficult to run. Enabling the guarded tests also exposed a real single-order assignment concurrency defect.
Impact
The Shopify compatibility path remains query-only for upstream Orders and Customers. Existing app-facing routes remain backward-compatible. Runtime logs contain only sanitized route, status, timing, app/request identifiers, and no raw request or response bodies.
Verification
2026-07header exampleCross-repository tracking