OpenAPI change audit with Nano

This client guide is free. The hosted Contract Lens API costs 0.01 XNO per document pair, paid on Nano mainnet. Operator: Roman Vinogradov and his Codex agent. MIT source: https://github.com/sapph1re/contract-lens-nano. The source can also be used locally under its license.

Use this service to flag removed operations, changed required parameters, and schema/security changes needing review before an API release. It performs deterministic structural comparisons, not a full OpenAPI validation or a proof of runtime compatibility. No model subscription or API key is required.

Inputs and limits

Create pair.json containing {"before": <old document>, "after": <new document>}. Both documents must identify OpenAPI 3. Keep the total request at or below 128 KiB and each document at or below 200 operations. Submit documents the user has authorized for this service. The API does not fetch external references, store documents, or store reports. It keeps invoice metadata, request hashes, and payment receipts.

Example pair that removes one operation:

{"before":{"openapi":"3.0.3","info":{"title":"Items","version":"1"},"paths":{"/items":{"get":{"responses":{"200":{"description":"ok"}}}}}},"after":{"openapi":"3.0.3","info":{"title":"Items","version":"2"},"paths":{}}}

Get an invoice

Requires Node.js 22 or later with outbound HTTPS and local file access. In the directory containing pair.json, run:

node --input-type=module <<'JS'
import {readFile,writeFile} from 'node:fs/promises';
const body=await readFile('pair.json');
const r=await fetch('https://contract-lens-nano.dev-romanv.chatgpt.site/v1/audit',{
  method:'POST',redirect:'error',headers:{'Content-Type':'application/json'},
  body,signal:AbortSignal.timeout(30000)
});
const q=await r.json();
if(r.status!==402||q.error!=='payment_required')throw new Error('No invoice: HTTP '+r.status);
await writeFile('contract-lens-quote.json',JSON.stringify(q,null,2),{mode:0o600,flag:'wx'});
console.log(JSON.stringify({amount_nano:q.amount_nano,pay_to:q.pay_to,body_sha256:q.body_sha256}));
JS

Keep the quote token private and preserve pair.json byte for byte. Quotes do not expire. If a quote file already exists, inspect and reuse it instead of overwriting it or requesting more invoices. GET /health and GET /v1/price are free.

Pay and retrieve

The quote uses contract-lens-invoice-v1, not a stock x402 signed-block envelope. Check its amount, network, and destination against the user's payment authorization. Use the user's Nano wallet to send exactly the quoted amount to that quote's pay_to address. Never supply a seed or private key to Contract Lens. An overpayment buys the same report, not extra calls.

Once the wallet reports a confirmed send, save its public 64-character hexadecimal send block hash in payment-hash.txt. Retrieve the report:

node --input-type=module <<'JS'
import {readFile,writeFile} from 'node:fs/promises';
import {createHash} from 'node:crypto';
const body=await readFile('pair.json');
const q=JSON.parse(await readFile('contract-lens-quote.json','utf8'));
const hash=(await readFile('payment-hash.txt','utf8')).trim();
if(!/^[0-9a-f]{64}$/i.test(hash))throw new Error('Invalid send hash');
if(createHash('sha256').update(body).digest('hex')!==q.body_sha256)throw new Error('Request bytes changed');
const r=await fetch('https://contract-lens-nano.dev-romanv.chatgpt.site/v1/audit',{
  method:'POST',redirect:'error',headers:{'Content-Type':'application/json',
    'X-Quote-Id':q.quote_id,'X-Quote-Token':q.quote_token,'X-Nano-Payment':hash},
  body,signal:AbortSignal.timeout(30000)
});
const report=await r.json();
if(r.status!==200)throw new Error('Report not delivered: HTTP '+r.status+' '+String(report.error));
await writeFile('contract-lens-report.json',JSON.stringify(report,null,2),{mode:0o600,flag:'wx'});
console.log('Report saved to contract-lens-report.json');
JS

The same paid quote, body, token, and payment hash retrieve the same report without paying again. A 503 means receipt verification is unavailable; retain the invoice and retry later without another transfer. A 402 after payment needs receipt inspection, not an automatic second payment. A 409 means the request no longer matches the quote. A 403 means the token is wrong. A 429 during quote creation contains no payment destination.

Explain findings with the affected operation and why a client may need to change. Treat schema/security findings as review prompts. Unreferenced components, callbacks, webhooks, and runtime behavior are outside scope; bounded or unresolved references are disclosed in the report.

Validation record

On September 10, 2026, the public health, price, invoice, and source-download checks passed. Local tests cover audit behavior and synthetic receipt rejection, retry, and concurrency cases. A real paid delivery had not yet been verified when this guide was published. These facts describe the release check, not current uptime or a completed payment.