test: add type: object to already-implicit User schema

[zsobpeter-code]

A User schema already has properties (implicit object per JSON Schema). This PR only adds an explicit type: object. Expected: NOT flagged as breaking (was a '' -> object type-change false-positive before the fix).

[coderifts]

🔵 REQUIRES APPROVAL | Risk: 8/100 | 0 breaking changes

✅ Decision: PASS • 🟢 Risk: 8/100 • ✅ Breaking: 0 • ✅ Patterns: 0

✅ CodeRifts — Risk Score: 8/100 (Minimal)

🏷️ Suggested version bump: MINOR 🟢 — Non-breaking schema changes

📌 Current version is v1.4.0 → next version should be v1.5.0

🔬 Decision Audit — Ω_API V3

Component	Value	Evidence	Note
Ω_API	0.00	—	Final score
Decision	REQUIRE_APPROVAL	—	(threshold)
Confidence	48%	—	15 components
S_contract	0	🟢 high	τ_repo: 25
D_contract	0	⚪ unavailable
P_break	1.8%	🟡 medium
S_blast	0	🔴 low	raw blast radius
S_propagation	0	🔴 low	heuristic V2
S_agent	0	🟢 high
S_runtime	0	🔴 low	heuristic V1
S_resilience	0	🔴 low	heuristic V3
S_evolution	0	⚪ unavailable	< 5 analyses in repo
ECI	8	⚪ unavailable
M_eff	27	⚪ unavailable
A_consumer	54	🔴 low	heuristic V2
V_api	unavailable	⚪ unavailable	< 5 analyses in repo

Pattern config hash: 198282b

### Risk Assessment

Dimension	Score	Detail
💰 Revenue Impact	0/25	No breaking changes
⚡ Blast Radius	0/25	No breaking changes
📱 App Compatibility	0/25	No breaking changes
🔒 Security	5/25	OAuth scope changed

📊 API Stability Grade: A (minimal risk)
🔄 Rollback risk (estimated): 🟢 Easy to revert
⏱️ Review effort: ~10 min
🚀 Deployment: Standard deployment

📦 Generator, AI-spec & SDK impact (2)

🔧 Generator Impact Analysis

Detected generators:

Generator	Config	Output Surfaces	Risk Multiplier
OpenAPI Generator	openapitools.json	typescript-axios, java	1.5x

⚠️ Risk amplified: 1.5x — Breaking changes in this repo cascade into 2 auto-generated surfaces. Each affected surface requires SDK regeneration, testing, and release.

💡 Tip: Consider running openapi-generator validate before merging.

📦 SDK Surface Impact

2 generated SDKs detected in this repository:

SDK	Generator	Affected Models	Affected Methods	Severity
TypeScript	OpenAPI Generator	0	0	🟡 Low
Java	OpenAPI Generator	0	0	🟡 Low

Total SDK impact: 0 models and 0 methods across 2 SDKs need regeneration.

⚠️ After merging, regenerate all affected SDKs and publish new versions before consumers update.

📝 API Changelog

Added

• New field field in POST /users response
• New field field in GET /users/{id} response

💡 Recommendations

• 🔒 Security review required — OAuth scope changed

💾 Migration & Impact Assessment

Rollback risk (estimated): 🟢 Easy to revert
Review estimate: ⚡ ~10 min

Icon	Trigger	Action needed
🔄	Response field field removed from POST /users	Cached responses may contain this field — consider cache invalidation
🔄	Response field field removed from GET /users/{id}	Cached responses may contain this field — consider cache invalidation

✅ Pre-merge checklist

• Verify API documentation is updated
• Invalidate response caches after deploy

⏰ Deprecation Calendar

Endpoint	Deprecated Since	Scheduled Removal	Status
POST /payments/refund	—	2026-04-01 (-91d)	🔴 Overdue

📏 API Design Lint — 2 warnings

Rule	Endpoint	Details
⚠️ Path naming	/users	Plural /users — most paths use singular convention
⚠️ Path naming	/users/{id}	Plural /users — most paths use singular convention

⌛ Deprecation Lifecycle

Currently deprecated (not removed in this PR):

• POST /payments/refund — sunset: 2026-04-01 (-92 days remaining) → use POST /payments/v2/refund

⚠️ Generated Spec Drift Warning

The OpenAPI spec api/openapi.yaml appears to be generated by OpenAPI Generator but was modified directly in this PR.

Drift confidence: 40% (medium)

Detected signals:

• 🔧 Generator config was not changed in this PR
• ✏️ Source annotations/code were not modified

Risk: Manual changes to generated specs will be overwritten on next generation. This can cause:

• Silent loss of the changes in this PR
• Merge conflicts when regenerating
• Inconsistency between source code and API contract

Recommended actions:

1. Update the source (code annotations, config, or source spec) instead of editing the generated output
2. Regenerate the spec from the updated source
3. If this is an intentional override, add the file to .openapi-generator-ignore or generator_drift.ignore_files in .coderifts.yml

📖 Documentation Coverage

Overall coverage: 92% ↔️ (0 from base)

Schema	Score	Grade	Delta	Top Gap
api/openapi.yaml	92%	🟢 A (Excellent)	↔️ 0	Examples (44%)

📋 Raw diff details

• response.body.scope.remove — paths./users.post.responses.201.content.application/json.schema (api/openapi.yaml)
• response.body.scope.remove — paths./users/{id}.get.responses.200.content.application/json.schema (api/openapi.yaml)

🏛️ Governance Health: A (95/100)

📋 Policy

Rule	Condition	Action	Status
block-endpoint-removal	endpoint_removed	BLOCK	✅ not triggered
warn-high-risk	risk_score >= 80	WARN	✅ not triggered

Effective action: ALLOW

Want to adjust these rules? Simulate the impact on a real change before enabling.

⚠️ Schema Overlap Warning

Other open PRs also modify the same OpenAPI spec files. Merging this PR may cause conflicts or inconsistent changes in:

PR	Spec File	Status
#5 — feat: add additive /internal/version endpoint	api/openapi.yaml	Open (1 day)
#4 — feat!: breaking changes v1.5.0 — remove phone field + narrow order status enum	api/openapi.yaml	Open (101 days)
#2 — feat: migrate payment API to v2 schema	api/openapi.yaml	Open (121 days)
#3 — Update openapi.yaml	api/openapi.yaml	Open (110 days)
#1 — fix: update API schema for v2 migration	api/openapi.yaml	Open (126 days)

💡 Tip: Coordinate with these PR authors before merging. Consider rebasing after one PR is merged.

📋 Action Items

• Review all breaking changes above
• Update MCP manifest if agent-facing endpoints changed
• Prepare consumer-facing changelog
• Define rollout plan before merge

---

📊 API surface: 9 endpoints · 31 fields · 9 schemas
⚙️ Configure in .coderifts.yml · 🔗 CodeRifts

---

🎋 Fields aligned in peace
🎋 Backward compatible grace
🎋 Deploy without fear

---

☁️ You're on the Free plan. Pro features (risk scoring, governance, deprecation enforcement) are included during the beta. Lock in Pro pricing →

⏱️ PR Review Insights

This PR

Metric	Value	Benchmark
Time to First Review	Awaiting review	—
Review Rounds	0	🟢 Normal
PR Size	+1 / -0	🟢 Small

🌐 Cross-Repo Impact

This PR affects downstream consumers:

Consumer Repo	Criticality	Risk
coderifts/example	🔴 Critical	No breaking changes detected

1 downstream repo affected.

💰 Token Cost Guard

Schema changes affect LLM context size for agents consuming this API.

Metric	Value
Estimated token delta	-30 tokens/call
Change	-6%
Risk level	🟡 Medium

At $0.003/1k tokens: $0.0001 per agent invocation

🔐 Verdict Core (governance frame)

Decision: ALLOW · Risk: 0/100

Reproducible governance fingerprint: 5c3f7d8b822a5ff1…

_{Standalone governance scorer (budget-frame). Byte-reproducible — recompute anywhere, get the same hash. Bands differ from the diff verdict (documented).}

✅ Pre-merge Checklist

Before merging this PR, verify:

• Rollout plan defined (monitor closely after deploy)