Verified reproductions / contract drift / local-first

Failures shrink.
Evidence stays.

Evidrift turns noisy failing JSON requests into replay-verified reductions, then guards the TypeScript and OpenAPI assumptions your code relies on.

Evidrift: AI dependency lockfile — code compiles, APIs change
No signup. No target setup. No remote request.

Shrink a verified failure in one command.

npx --yes evidrift@latest repro-demo

The demo starts a disposable loopback server, verifies an HTTP 500 plus INVALID_FILTER, replays every candidate, verifies the minimized result, and closes the server.

MINIMIZED sha256:...
Body: 217 bytes -> 46 bytes
Minimal JSON: {"filters":{"unsupported":{"mode":"explode"}}}
Evidence: 1-minimal under the selected JSON reducers and failure predicate
Real package / exact versions / documented breaking change

Catch the React 19 useRef type break.

React's official upgrade guide says useRef now requires an argument. This source-repository lab records the no-argument overload in @types/react@18.3.12, installs @types/react@19.0.1, and requires Evidrift to report that the recorded overload disappeared.

git clone https://github.com/bm1016bm-svg/evidrift.git
cd evidrift
npm ci --ignore-scripts
npm run demo:react-19
FAIL contract_mismatch
Expected signature: useRef<T = undefined>():MutableRefObject<T|undefined>
Current overloads: useRef<T>(initialValue:T):RefObject<T> | ...
Action: Review the dependency change and affected code.

The lab pins and verifies both installed versions, disables dependency lifecycle scripts, and runs no React application code.

Two isolated workflows

One failure reduced. One assumption recomputed.

HTTP replay never runs from contract checks or MCP. Receipts remain repository files, not trusted verdicts.

repro.minimize

Minimal HTTP reproduction

Remove JSON structure and accept a candidate only after status plus explicit error identity still match on a literal loopback target.

typescript.symbol

TypeScript API drift

Lock the overload selected at a real call site, its parameter, normalized signature, installed version, resolved declaration path, and hash.

json.pointer

OpenAPI contract drift

Lock one canonical value in repository-local OpenAPI JSON or JSON Schema through RFC 6901 JSON Pointer.

Contract drift / no package execution

See deterministic drift in one command.

npx --yes evidrift@latest demo
Real Evidrift CLI demo: a TypeScript contract passes, the dependency signature changes, and Evidrift reports deterministic contract drift

Rendered from a real local CLI transcript. No dependency-under-test code, cloud service, or LLM verdict is involved.

FAIL contract_mismatch sha256:...
Claim: parseConfig accepts an optional options parameter used by the demo.
Expected signature: parseConfig(input:string,options?:ParseOptions):ParseResult
Current signature: parseConfig(input:string,options:ParseOptions):ParseResult
Affected code location: app/src/index.ts:3
Receipt ID: sha256:...
Action: Review the dependency change, then intentionally record new evidence.
Not another AI reviewer

Deterministic or it does not block.

Evidrift does

  • replay every accepted JSON reduction against an explicit loopback failure;
  • record why a code location depends on a static contract;
  • revalidate the exact evidence through CLI, MCP, or GitHub Actions;
  • fail on deterministic contract mismatch or evidence-integrity failure;
  • warn when a source changed but the selected contract still matches.

Evidrift does not

  • claim a global minimum, root cause, or broad runtime correctness;
  • replay remote URLs or resolve remote OpenAPI references;
  • execute package code or Receipt-supplied commands;
  • use an LLM judge as a CI gate.
Straight answers

FAQ

What does “minimal” mean?

When the probe budget completes, no selected single JSON reduction still matches the chosen failure predicate. It is not a claim of the globally smallest possible request.

What is API drift?

API drift is a change to a dependency or contract after code was written against it. Evidrift checks the selected TypeScript call signature or repository-local JSON value.

Is this contract testing?

It is narrower. Contract tests exercise provider and consumer behavior. Evidrift locks one explicit static assumption and checks it without running dependency code or services.

Does it work with Codex, Claude Code, and Cursor?

Yes. Any MCP client that launches a local STDIO server can call Evidrift. All integrations use the same core as the CLI.

Does it prove AI-generated code is correct?

No. ReproMin verifies only that one reduced request currently matches one explicit failure predicate during replay. Contract Receipts establish only that selected deterministic evidence still matches and passes integrity checks.