fix(ci): stop failing the API audit for adding a compliant route

[waleedlatif1]

The next route fails CI regardless of quality

BASELINE.totalRoutes is 1162 and the repo has exactly 1162 routes. The gate is:

if (totalRoutes > BASELINE.totalRoutes) {
  failures.push(`route count increased from ${BASELINE.totalRoutes} to ${totalRoutes}`)
}

Route 1163 turns CI red whether or not it is contract-backed. Reproduced by dropping the baseline by one:

API validation audit failed:
  - route count increased from 1161 to 1162

It gates nothing the other counters miss

Live output: total routes: 1162 / Zod-backed: 1162 / non-Zod: 0.

The invariant worth holding is every route has a contract, and nonZodRoutes states exactly that — it is 0 and rises the moment a route ships without one. With zodRoutes === totalRoutes, the total carries no information the other two counters don't.

What it adds instead is a bad habit

The only way past this failure is editing the number. This file holds seven other baselines — routeZodImports, routeLocalSchemaConstructors, clientHookZodImports and the rest — and every one of them works only while nobody bumps a baseline casually.

A gate you must bump to add a compliant route trains exactly the reflex that erodes the gates that matter.

Change

The total is still printed as a metric. It is no longer a failure condition. Nothing else moves.

Verified both directions

Scenario	Before	After
Compliant new route (total over baseline, nonZod still 0)	❌ red	✅ passes
Route with no contract (nonZod rises)	❌ red	❌ red

The second was checked by lowering nonZodRoutes to -1, which correctly produced non-Zod routes increased from -1 to 0 (1162 Zod-backed routes) and exit 1.

check:api-validation and check:api-validation:strict both exit 0 on the restored file.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 24, 2026 2:17am

[cursor]

PR Summary

Low Risk
CI-only change to an audit script: it loosens a redundant count gate while keeping the contract-coverage check. No runtime or security behavior changes.

Overview
Stops the API validation audit from failing when a new contract-backed route is added.

totalRoutes is still printed, but it is no longer a CI gate. Coverage is still enforced by nonZodRoutes staying at 0, so a route without a contract still fails. This avoids training people to bump baselines just to land a compliant route.

^{Reviewed by Cursor Bugbot for commit 99c1616. Configure here.}

[greptile-apps]

Greptile Summary

Removes the aggregate route-count failure from the API validation audit while retaining route-count reporting and the gate on non-Zod routes.

• Documents why total route count is informational rather than a compliance invariant.
• Allows new contract-backed routes without requiring a baseline increase.
• Continues rejecting discovered routes classified as lacking Zod-backed validation.

Confidence Score: 5/5

The PR appears safe to merge because it removes only the aggregate route-count failure while preserving the audit’s contract-compliance gate.

Discovered routes remain exhaustively divided into Zod-backed and non-Zod counts, and any increase in the latter still fails the audit.

Important Files Changed

Filename	Overview
scripts/check-api-validation-contracts.ts	The audit no longer fails solely because the total number of routes increased; its non-Zod and strict boundary-policy checks remain intact.

_{Reviews (1): Last reviewed commit: "fix(ci): stop failing the API audit for ..." | Re-trigger Greptile}