DE//AGENT
Explore
Runbook community intermediate severity: high

Data contract broken

A producer violated its contract and a consumer broke in production — bound the impact before fixing.

At a glance

When A consumer broke right after a producer deploy; A promised column or semantic changed, or an SLA was breached
Where Data Contracts
Why A broken contract is a negotiation as much as a bug — bound the blast radius from lineage before deciding who reverts and who adapts.

Security scan

Last sweep 2026-10-24: 0 finding(s), 0 marked as examples.

Symptoms

  1. A consumer's pipeline fails after a producer deploy
  2. A promised column or semantic changed
  3. An SLA (freshness/completeness) is breached

Incident notebook

Impact

A consumer is down or wrong in production; trust in the contract process itself takes the bigger hit.

Escalation

Put the producer and consumer owners on the same call — revert-vs-adapt is a joint decision; escalate to the data platform lead if no agreement within the hour.

Evidence to collect first

  • The broken clause (schema, semantics, or SLA) and its version history
  • The lineage-derived impact set for the affected asset
  • The producer deploy that coincides with the break

Rollback

Producer reverts or adds a shim; SLA breaches get a dated temporary relaxation, never an indefinite one.

Follow-up

  • Add the consumer-driven contract test to the producer's pipeline
  • Record the negotiated semantics as a new contract version

Diagnosis

  • Identify which contract clause broke (schema, semantics, or SLA).
  • Establish the impact set from lineage before anything else.
  • Determine if the fix is on the producer (revert) or consumer (adapt).

Possible causes

  • Producer shipped a breaking change without the notice period
  • A "safe" rename that changed semantics
  • SLA breach from an unrelated upstream outage

Commands

# impact set from lineage
SELECT * FROM lineage WHERE upstream = 'prod.orders' AND direction = 'downstream';

Fix

  • Schema breach → producer reverts or adds a compatibility shim.
  • SLA breach → negotiate a temporary relaxation and a root-cause fix.

Prevention

  • Contracts with CI enforcement and a dated deprecation path.
  • Consumer-driven contract tests in the producer's pipeline.

Monitoring

  • contract-violation events, SLA breach count per asset

Common gotchas

  • A 'safe' rename that changed semantics is still a breach.
  • SLA misses can come from unrelated outages — root-cause before pointing at the producer.
  • Whatever the fix, the consumer impact set comes first, from lineage.

Production considerations

  • Contracts get CI enforcement and a dated deprecation path.
  • Run consumer-driven contract tests in the producer's pipeline.

Tradeoffs

Choose this when Costs & caveats
consumer-driven tests catch breakage before deploy contract overhead slows fast-moving producers

Diagram

contract broken
   |
   |- schema breach --> producer reverts or adds a compatibility shim
   |
   |- semantic change --> agree semantics --> version the contract
   |
   |- SLA breach --> negotiate temporary relaxation --> root-cause fix

Registry stats

Verification community · Sep 21, 2026
Completeness 75
Trust multiplier ×0.75
Composite 32.75 · adequate
Freshness 33 days since last source check
Difficulty intermediate
Severity high
Version 1.1.0
License CC-BY-4.0
Security flags 2