<![CDATA[Enterprise microservice architectures pose simultaneous quality-assurance challenges across delivery velocity, functional contract integrity, security, resilience, and regulatory compliance. Existing DevSecOps practices commonly address these concerns through separate pipeline stages, which can fragment findings and limit the traceability, consistency, and completeness of compliance evidence. This study introduces CONTESSA (Continuous Testing and Security Assurance), an integrated framework that coordinates contract enforcement, static security analysis, dynamic security analysis, resilience and chaos testing, and compliance evidence generation within a unified CI/CD pipeline. The framework employs a domain profile system in which a single YAML configuration parameterizes the five testing and assurance layers for enterprise and regulated healthcare deployment contexts. A Compliance Evidence Ledger generates structured evidence records linked to applicable control identifiers and protected through SHA-256 chaining to support evidence integrity, traceability, and auditability. Prototype evaluation was conducted using an 11-service microservice application to assess the framework's ability to identify defects and to produce traceable evidence of compliance during automated pipeline execution. The evaluation identified 13 HIGH and CRITICAL vulnerabilities across the five testing layers, including four authorization-related defects detected by contract enforcement before service deployment to the test environment. The resulting compliance report contained 42 evidence records covering eight SOX ITGCs and PCI DSS controls, providing complete control coverage for the ENTERPRISE profile. These results demonstrate that CONTESSA can coordinate functional contract verification, security testing, resilience assessment, and compliance evidence generation within a single pipeline architecture. The framework establishes compliance evidence as a first-class pipeline output while enabling security contract requirements to be verified alongside functional contract requirements. This integration provides a structured approach for improving security assurance, evidence traceability, and compliance readiness in enterprise microservice environments]]>
