Pipeline Stage Contract
What each pipeline stage promises the next — an artifact of a stated shape plus a specific claim about it that has been verified.
A pipeline is not a sequence of scripts; it is a sequence of assertions. Each stage receives an artifact and a set of claims already proved about it, adds one more claim, and hands both on. Written down, a stage contract looks like: given a signed image with unit tests passed, this stage proves the image starts against a real database and satisfies its consumer contracts, and emits the same image digest plus a contract-verification record.
Making this explicit changes two things. First, it exposes stages that prove nothing — the ones that run and pass regardless of what is fed into them, which exist in most mature pipelines and cost time on every change. Second, it forbids rebuilding: if the stage's output is a different artifact from its input, every claim proved upstream is now about something that is not being deployed.
The failure this prevents is subtle and common. A pipeline that builds separately for staging and for production has verified staging's artifact and shipped production's, and the two differ by whatever the build environment happened to contain that day.