Contract-Safe Persona CI

Overview

Keep the required CI gate deterministic and secret-minimal. Offline fixtures validate JSON:API, version, idempotency, webhook HMAC, replay, and unknown additions; an optional protected sandbox job proves connectivity without making production a test dependency.

Prerequisites

• Repository test conventions and required status names
• Redacted signed fixtures for REST and webhook contracts
• Protected sandbox secret scope and synthetic test identities

Instructions

Step 1: Define the offline denominator

List parsers, commands, event transitions, security checks, error envelopes, pagination, and compatible-addition cases that must run on every change.

Step 2: Pin contract provenance