Deploy-preflight contract checks — production misconfiguration, fail loud.
These complement the existing safety rules (secret_key, allowed_hosts) with the production-posture mistakes that otherwise surface only after deploy:
deploy_debug:debug=Truewhileenv="production"deploy_metrics:metrics_pathcollides with an application routedeploy_health:health_path/ready_pathcollides with an app routedeploy_sentry: a Sentry DSN is set but traces are silently disabled
Scope is strictly check rules — no deploy automation, no Procfile/Dockerfile generation, no in-core APM. Prometheus/Sentry/OTel stay config-surface integrations; these rules only catch their silent misconfiguration.
contracts.rules_deploy
| Name | Type | Default | Description |
|---|---|---|---|
type
|
|
— | |
qualified_name
|
|
— | |
element_type
|
|
— | |
description
|
|
— | |
source_file
|
|
— | |
line_number
|
|
— | |
is_autodoc
|
|
— | |
autodoc_element
|
|
— | |
_autodoc_template
|
|
— | |
_autodoc_url_path
|
|
— | |
_autodoc_page_type
|
|
— | |
title
|
|
— | |
doc_content_hash
|
|
— |
Symbols on this page
ERROR whendebug=Truein a production environment.
Debug mode enables verbose error pages (information disclosure), hot reload, and dev tooling — never appropriate in…
ERROR when the Prometheusmetrics_pathcollides with an app route.
When metrics are enabled, the metrics endpoint and an application route sharing a path…
ERROR when an auto-mounted probe path collides with an app route.
Chirp auto-mounts/health (liveness) and /ready(readiness) at
health_path / ready_path. These…
WARN when a Sentry DSN is configured but tracing is disabled.
A DSN withsentry_traces_sample_rate == 0captures errors but no performance traces —…
check_debug_in_production
function
def check_debug_in_production(config: Any) -> list[ContractIssue]ERROR whendebug=Truein a production environment.
Debug mode enables verbose error pages (information disclosure), hot reload, and dev tooling — never appropriate in production.
Parameters
| Name | Type | Default | Description |
|---|---|---|---|
config
|
Any
|
— |
check_metrics_path_collision
function
def check_metrics_path_collision(config: Any, router: Router) -> list[ContractIssue]ERROR when the Prometheusmetrics_pathcollides with an app route.
When metrics are enabled, the metrics endpoint and an application route sharing a path silently shadow each other — one of them never serves.
Scope: this sees metrics configured viaAppConfig.metrics_enabled/
metrics_pathonly. Metrics enabled solely through
run_production_server(metrics_enabled=...)arguments are not visible at
app.check()time and are not covered here.
Parameters
| Name | Type | Default | Description |
|---|---|---|---|
config
|
Any
|
— | |
router
|
Router
|
— |
check_health_path_collision
function
def check_health_path_collision(config: Any, router: Router) -> list[ContractIssue]ERROR when an auto-mounted probe path collides with an app route.
Chirp auto-mounts/health (liveness) and /ready(readiness) at
health_path / ready_path. These are always mounted (no enable gate),
so an application route sharing a probe path shadows the probe: the route
serves and the probe silently steps aside, so K8s liveness/readiness checks
hit the app handler (secure stack, CSRF, return-type negotiation) instead of
the plain 200/503 probe. Fix: rename the route or changehealth_path/
ready_path.
Parameters
| Name | Type | Default | Description |
|---|---|---|---|
config
|
Any
|
— | |
router
|
Router
|
— |
check_sentry_sample_rate
function
def check_sentry_sample_rate(config: Any) -> list[ContractIssue]WARN when a Sentry DSN is configured but tracing is disabled.
A DSN withsentry_traces_sample_rate == 0captures errors but no
performance traces — usually an oversight when observability is wanted.
Parameters
| Name | Type | Default | Description |
|---|---|---|---|
config
|
Any
|
— |
View source · /home/runner/work/chirp/chirp/site/../src/chirp/contracts/rules_deploy.py:1