fastapi/examples/README.md

Synthetic API contract experiment

BB Skills independently authored the runner, public_contract.py and evidence. Do not deploy these apps. They deliberately include invalid and raw-response counterexamples and do not authenticate users or connect a database.

From the extracted fastapi directory, create a virtual environment, install examples/requirements.txt and run examples/run_contract_fixture.py. On Windows use .venv/Scripts/python; on Unix use .venv/bin/python. Dependency installation uses the public registry separately. The runner forbids external sockets but allows the Windows event loop's loopback socketpair and counts those connections. It writes a new native-api-evidence.json with the current environment/time.

Both runs contain 29 named observations, ten original Python blocks and 27 in-process TestClient requests. The primary run used HTTPX2 2.13.1. The separate HTTPX 0.28.1 file is comparison evidence: plain HTTPX is deprecated by the tested Starlette version, and the requirements install the recommended HTTPX2 transport. Source hashes match the original retained files and independent runner. The database-shaped example gets a synthetic session/query; the function-scope example's print call is captured as a lifecycle event. Original code is not rewritten. ASGI event order is not a real HTTP streaming/transport test.

Input validation, response projection, overrides and cleanup do not verify identity, ownership, authorization, concurrent persistence, cloud SDKs, telemetry export, frontend hosting, production deployment or comprehensive security. No AI client executed the complete skill; runtime_tested is false. Runtime binaries, wheels, user credentials and production data are not bundled. A bounded diagnostic timeout reports hangs; a restricted Windows sandbox may block local socketpair.