Mistral Offline-First CI Contract

Overview

Make deterministic contract and safety tests required while isolating network evidence. Provider outage or missing fork secrets must not block ordinary review, and untrusted changes never receive credentials.

Prerequisites

• A locked dependency graph and application-owned adapter.
• Synthetic fixtures for success, streams, tools, throttling, malformed data, and cancellation.
• A protected CI environment for a separately approved live smoke.

Current Contract

Client and endpoint schemas can drift, but CI can validate the application contract offline. Live checks consume capacity and belong in a trusted branch, schedule, or approved lane with a strict budget.

Authentication

Required jobs run without MISTRAL_API_KEY and deny unexpected network. The live job resolves a protected secret only after trust, branch, and approval guards pass.