API contract enforcement

A public API is a promise. This skill reviews PRs for unannounced changes to that promise — the kind of edit that ships green CI in your repo but breaks every consumer the moment it lands.

What counts as "public API" for this skill

In rough order of consequence:

1. HTTP routes and request/response shapes — REST endpoints, JSON-RPC methods, OpenAPI schemas.
2. gRPC services and message definitions — protobuf field numbers, deprecated tags, oneof variants.
3. GraphQL schemas — types, fields, arguments, directives, enum values.
4. SDK exports — anything a package's index.ts / __init__.py / package's main entry re-exports. Types AND runtime values.
5. CLI flags, subcommands, and exit codes — anything documented in --help or relied on by scripts.
6. Database column names, view definitions, materialized views — when the schema is consumed by readers outside the PR's own service.
7. Event payload shapes — Kafka topics, webhook bodies, queue messages.
8. Configuration file schemas — when a config file is read by code outside the PR's service.

What this skill is not for: internal helper functions, private classes, package-internal modules. Convention says those can change.