Phase 2: Schema-aware checks (OpenAPI/JSON-Schema + GraphQL error shape)

[ToryMic]

Goal

Extend SchemaLock beyond envelope-only checks to full response-body schema validation.

Scope

• Validate full JSON response bodies against an OpenAPI/JSON-Schema fragment declared per-endpoint in schemalock.yaml (not just the error envelope).
• GraphQL-aware error shape validation: parse errors[] array shape (message/extensions/path) instead of treating GraphQL responses as opaque JSON.
• Response header contract checks (e.g. Content-Type, Cache-Control, rate-limit headers present).
• Optional: import an existing OpenAPI spec file and auto-generate a baseline schemalock.yaml skeleton from it.

Why

Phase 1 only checks the error envelope shape and status codes. Real contract drift also happens in success-path response bodies and GraphQL error arrays specifically (Wave backends increasingly use GraphQL, per stellarmarket-labs and Talenttrust patterns).

Acceptance criteria

• A response body schema mismatch on a 200 response fails the check with a clear diff.
• GraphQL errors[] shape is validated per-field, not just as opaque JSON.