Module contract_identity 

Available on crate feature deployment only.

Contract Identity Annotation Scheme v1.

Stamps every deployment artefact (OCI image, Helm chart, ArgoCD Application) with three uniform, greppable identity annotations:

Key	Meaning	Format
io.hyperi.contract.version	Contract schema version	Literal string v1
io.hyperi.contract.source-commit	Git SHA of the consumer app’s HEAD	40-char lowercase hex
io.hyperi.contract.image-ref	Intended pull reference for the image	<reg>/<repo>:<tag> or @<digest>

Same key string on every surface. The grep payoff: grep -r 'io.hyperi.contract' . finds every contract-emitted artefact.

Pre-push vs post-push image_ref

At Dockerfile-emit time the image isn’t built, so its digest is unknown: the image label carries the TAG form (<reg>/<repo>:<tag>). The push step re-renders Chart.yaml and the ArgoCD Application with the DIGEST form returned by the registry, for digest-pinned reproducibility.

Rollout phase

Phase 1 (this commit): generators accept Option<&ContractIdentity> – Some emits the annotations, None is silent (backwards-compat for consumers not yet migrated). Phase 2 makes it required once all six DFE consumers pass identity. Phase 3 drops the Option wrapper.

Structs

ContractIdentity

Three-key identity stamped on every deployment artefact.

Enums

IdentityError

Errors from constructing or detecting a ContractIdentity.

Constants

KEY_PREFIX

Annotation key prefix shared across all three keys.

VERSION

Schema version literal. Bumps only when the contract format itself breaks, NOT when the consumer’s app version moves.