API & Contracts
API governance and shared contract policy.
Contract Source of Truth
All typed contracts must live in shared packages and be imported by all clients and services.
API Governance
- Version APIs deliberately
- Validate all external input
- Require auth for protected mutations
- Log security-relevant failures
Parity Requirement
Web, native, desktop, and TUI clients consume the same contract models.