Verify API release commit in gateway gate

services/nginx/app/classes/release_manager.php

@@ -1434,6 +1434,7 @@ class release_manager
             ];
         }
 
+        $expectedCommit = self::normalizeCommitSha((string)($gateInput['expected_commit'] ?? ''));
         $checked = [];
         try {
             foreach ($gateInput['api_ping_paths'] as $path) {
@@ -1442,9 +1443,19 @@ class release_manager
                 if (array_key_exists('success', $payload) && $payload['success'] !== true) {
                     throw new RuntimeException(sprintf('%s returned success=false.', $path));
                 }
+                $actualCommit = $this->releaseGateApiPayloadCommitSha($payload);
+                if ($expectedCommit !== '' && !$this->releaseGateCommitMatches($actualCommit, $expectedCommit)) {
+                    throw new RuntimeException(sprintf(
+                        '%s returned commit %s, expected %s.',
+                        $path,
+                        $actualCommit !== '' ? $actualCommit : 'unknown',
+                        $expectedCommit
+                    ));
+                }
                 $checked[] = [
                     'path' => $path,
                     'status' => $json['status'],
+                    'commit_sha' => $actualCommit !== '' ? $actualCommit : null,
                 ];
             }
         } catch (Throwable $throwable) {
@@ -1471,10 +1482,24 @@ class release_manager
             'context' => [
                 'api_base_url' => $apiBaseUrl,
                 'checked' => $checked,
+                'expected_commit' => $expectedCommit !== '' ? $expectedCommit : null,
             ],
         ];
     }
 
+    private function releaseGateApiPayloadCommitSha(array $payload): string
+    {
+        $data = is_array($payload['data'] ?? null) ? $payload['data'] : $payload;
+        foreach (['api_commit_sha', 'backend_version', 'commit_sha', 'version'] as $key) {
+            $commit = self::normalizeCommitSha((string)($data[$key] ?? ''));
+            if ($commit !== '') {
+                return $commit;
+            }
+        }
+
+        return '';
+    }
+
     private function releaseGateFetchJson(string $baseUrl, string $path): array
     {
         $result = $this->releaseGateFetch($this->releaseGateJoinUrl($baseUrl, $path));

services/nginx/app/tests/Unit/ReleaseManager/ReleaseManagerTest.php

@@ -140,6 +140,26 @@ it('requires non-empty release gate checks before auto-sync can proceed', functi
         ]);
 });
 
+it('extracts API ping commit metadata for release gate verification', function (): void {
+    $manager = new release_manager();
+    $method = new ReflectionMethod(release_manager::class, 'releaseGateApiPayloadCommitSha');
+    $method->setAccessible(true);
+
+    expect($method->invoke($manager, [
+        'success' => true,
+        'data' => [
+            'message' => 'pong',
+            'api_commit_sha' => '327a77edf48069c14cb592f298924b0ea1aaf208',
+        ],
+    ]))->toBe('327a77edf48069c14cb592f298924b0ea1aaf208')
+        ->and($method->invoke($manager, [
+            'success' => true,
+            'data' => [
+                'backend_version' => '75c19bcce44fe3f0657d84b45dbc1c89f29332b4',
+            ],
+        ]))->toBe('75c19bcce44fe3f0657d84b45dbc1c89f29332b4');
+});
+
 it('normalizes GitHub repository identifiers for private repository access checks', function (): void {
     expect(release_manager::normalizeGithubRepositoryName('truckwash/backend-php'))->toBe('truckwash/backend-php');
     expect(release_manager::normalizeGithubRepositoryName('https://github.com/truckwash/front-end-vue.git'))->toBe('truckwash/front-end-vue');