API contract fixtures

The shared package owns these fixtures in nmr-provider-tools. NMRNet's installed consumer tests reuse selected fake peers from the released source archive; generic contract tests run in the shared repository.

The nmr_api_v1 fixture is the complete public release: its manifest and 17 inventoried artifacts (16 schemas and OpenAPI), preserved byte for byte. No signing private keys are included. It was copied on 22 October 2026.

Release reference

sha256:719055db7751605c0e5325ca23bcbe66cde631376d4b2b99523c8e4db75f0d01

Manifest SHA-256

dda8dc36db963f85ec9105567342dae4ba680476c7ab1114bd1e33acba65474b

OpenAPI SHA-256

0d8939625504e5fd1706e9e9325a2abbc9684087678e6c2b8daca5cb36fa46cc

Declared source revision

12a53e720fc87e1a4144c76203f8853d5afaf753

Source and provenance limits

The copy came from NMRPeak's pinned contract bundle. It matches the API's archived release byte for byte. The archive commit records this existing source provenance.

Content identity does not authenticate the publisher. The declared source_revision is excluded from the release-reference digest and is not cryptographically attested. These snapshots do not establish a live server's supported baseline: contract_releases/checks.py, inspected at API revision e7790cf6a922c39261fe736d5a23d17a9a5ea322, explicitly selected no supported historical baseline.

What the tests consume

Tests adapt tests/unit/test_provider_signing.py and the artifact/hash rules in nmrpeak_provider/provider_http_contract.py at the pinned NMRPeak revision above. The complete bundle keeps signing vectors, schemas, route facts and their original inventory together.

This is test data, excluded from the runtime wheel. Contract tests check specific consumed rules; they are not a general JSON Schema validator or exhaustive OpenAPI qualification. No sibling source is imported at runtime and no schema-engine dependency is added.

For package usage and runtime requirements, see the provider-core package reference.