v0.3: docs — CROSS-REPO-CONTRACTS.md (canonical reference for the contract layer)

[Daren9m]

Goal

Write docs/CROSS-REPO-CONTRACTS.md as the canonical reference for the v0.2 cross-repo contract layer. Index page that ties together the contract version, bump rules, breaking-change detection, consumer pin-gate, upstream-request action, and migration bot.

Depends on

All other v0.2 issues (this is the wrap-up doc).

Structure

# Cross-Repo Contracts (v0.2)

## What is a "contract" here

Brief: CheckID is the upstream registry; consumers (M365-Assess, Az-Assess, EZ-CMMC, M365-Remediate) consume `data/registry.json`. The contract is the shape and content of that file.

## The contract version

Field: `contractVersion` on registry.json. SemVer. Bump rules: ...

## Breaking changes (major)

Enumerated taxonomy: removed CheckID, removed mapping, removed required field, removed enum value.

## Additive changes (minor) / patch

Enumerated taxonomy.

## How CheckID detects bump-vs-classification mismatch

The contract-bump-check.yml workflow runs on every PR. ...

## How consumers pin and gate

`.github/checkid-contract.yml` schema. The consumer-contract-gate reusable workflow. ...

## How CheckID notifies consumers when a major lands

The dispatch-contract-bump workflow + the receive-contract-bump action. ...

## Migration bot

Per-CheckID migration summary as a follow-up comment.

## End-to-end timeline of a breaking change

Step-by-step walk-through using a hypothetical CheckID rename.

## See also

- v0.1 (#40) — foundation
- v3.0.0 — schema baseline
- The cross-cutting v3.5 themes (#386–#389) that intersect with contract changes

Acceptance criteria

• docs/CROSS-REPO-CONTRACTS.md published
• Each subsection accurate against the shipped components from the other v0.2 issues
• Cross-linked from README.md (Cross-repo section) and docs/SCHEMA-MIGRATION-3.x.md
• CHANGELOG documents the doc
• Linked from each consumer-side integration PR