Git-aware contract lockfile

Did we change something other teams depend on?

Boundver records the contracts shared across components, checks them against an exact Git snapshot, and names the consumers that may need to re-test.

Run the one-minute demo Read how it works

One lockfile. Four useful signals.

Declare each component, the artifacts it publishes, and its downstream consumers. Commit the generated boundary.lock.json. Later checks tell you which identities moved.

exact

Tracked component content, path, or file identity changed. Text CRLF and LF are equivalent under the hashing contract.

behavior

A declared runtime-relevant input changed.

boundary

A declared published artifact changed.

compat

The configured compatibility family changed.

Several facets can change at once. You choose which ones fail CI. Boundary and compatibility drift can also identify direct or transitive consumers.

From Git change to the right check

1. Declarecomponents, published artifacts, and consumer edges
2. Comparethe committed lock with HEAD, the index, a working tree, or a branch range
3. Routeformat-specific checks and consumer suites using bounded text or JSON output

python -m pip install "boundver[schema,yaml]"
boundver init
boundver generate --source working-tree
boundver verify --source working-tree

That scaffold expects tracked code under src/. For another layout, run boundver init --discover and review its proposal, or edit the generated component path before validation.

Use it with what you already trust

Boundver does not replace compilers, build graphs, compatibility tools, or consumer tests. It adds a repository-level contract signal between them.

Git snapshot -> contract drift -> compatibility check -> affected consumer tests

For example, an OpenAPI boundary change can trigger oasdiff and the suites reachable from that API, while an internal refactor remains visible without being mislabeled as a public-contract change.

• First evaluation

  Follow Getting started or run the reproducible demo.

• Existing monorepo

  Adopt one component at a time with Gradual adoption.

• Pull-request routing

  Use Historical range review and the CI cookbook.

• Need exact semantics

  Read the reference, glossary, and normative specification.

Know the boundary of the answer

Boundver reports drift in what you declared. It does not decide whether a change is backward compatible, run consumer tests, or discover dependencies. Files omitted from a selector remain outside that identity.

A clean result means no unacknowledged gated drift remains. With a verification baseline, acknowledged lock drift can still be present. It does not prove that every consumer is safe. Start with What boundver does and does not do, or compare it with build graphs and schema-specific tools.

Local by design

The built-in boundver CLI is telemetry-free. It analyzes local Git state and does not collect or transmit source, usage, analytics, update checks, or crash reports. Read the privacy policy and security model.

Using or evaluating boundver? You can identify yourself voluntarily in the adopter discussion.