rust-api-contractlisted

# Rust API Contract **Observable contract.** Every distinction a deployed client can detect is a clause: status, body shape or absence, error code and detail, header, default, security requirement, and the outcome of a retry. Follow a change from the annotated handler through the committed document to the client that reads it. Honor supplied requirements and preserve settled choices outside the requested change; resolve only what the task leaves open. The document is derived, not written. Handlers carry utoipa path attributes and request and response types derive ToSchema; service::api::contract merges every OpenApiRouter into one value whose two halves are the served router and the OpenAPI document; the openapi binary renders it into api/openapi/service.yaml, and the service crate's openapi test refuses a committed copy that differs from the generator. A contract change starts in the Rust annotation, continues with make openapi-generate, and is reviewed as the YAML diff. Editing the YAML by hand is the wrong default, and so is a handler doc comment meant for readers of the code, because it becomes the operation description. Every operation declares two things the contract tests enforce: the x-security-decision extension with an exposure of public, protected, or blocked plus a rationale, and its OpenAPI security. An empty security attribute renders the explicit public override; a protected operation names exactly the bearer scheme without scopes and declares the 400, 401,