chore: add contract test

[cemprolific]

What's in this commit

Lightweight contract test (contract_test/)

Adds a test suite that validates the CLI client against the Prolific OpenAPI spec openapi.yaml. It has two test cases:

• TestAPICoverage: walks every operationId in the spec and asserts it appears in the operations table. An operation must either have a concrete client call exercised against the spec, or an explicit skip reason:
• OUTOFSCOPE: no CLI command exists or is planned
• SPECMISMATCH: client request diverges from the spec (tracked tech-debt)

This makes gaps visible: any new spec endpoint with no entry will fail the test, and SPECMISMATCH entries are a living list of known mismatches to fix.

• TestClientMatchesAPISpec: for each covered operation, fires the client method against a test server, captures the outgoing HTTP request, and validates it against the spec schema using kin-openapi (method,
  path, query params, body shape/types).

Claude Review Command

/audit-command skill (.claude/skills/audit-command/SKILL.md)

A Claude Code slash command (/audit-command [resource] [command]) that reviews an existing CLI command against project conventions. It checks: output flags, dependency injection, rendering strategy, help text, error formatting, and web flag usage, then reports findings grouped by severity (must fix / should fix / ok) and offers to fix flagged issues

See the review output on ./command-audit.md

[prolific-snyk]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[Copilot]

Pull request overview

Adds a new contract test suite to validate the CLI’s generated HTTP requests against the published Prolific OpenAPI spec, and introduces supporting documentation for a command-audit workflow.

Changes:

• Add contract_test/ suite that (1) checks operationId coverage and (2) validates outbound requests against the OpenAPI schema via kin-openapi.
• Add a Claude slash-command skill doc and a generated command audit report markdown.
• Update Go dependencies and linter configuration to support the new tests.

Reviewed changes

Copilot reviewed 6 out of 8 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
contract_test/contract_test.go	New contract tests: spec coverage + request-schema validation via a stub server.
go.mod	Adds direct deps for OpenAPI parsing/validation and YAML parsing.
go.sum	Locks new dependency versions and transitive additions.
.golangci.yml	Excludes errcheck warnings for contract_test/ (intentional ignored returns).
.gitignore	Attempts to ignore downloaded spec artifacts.
.claude/skills/audit-command/SKILL.md	Adds documentation for a /review-command skill to audit commands against conventions.
command-audit.md	Adds a command-audit report documenting convention deviations across commands.
mock_client/mock_client.go	Regenerated/mock recorder ordering adjustment around CreateSurveyResponse.