@vibe-agent-toolkit/cli 0.2.0-rc.10 → 0.2.0-rc.12

package/dist/commands/verify.js

@@ -9,30 +9,35 @@
  *   5. packaged-content  (in-process; built bundles carry nothing that must not ship)
  *   6. consistency check  (in-process; skill distribution integrity — package.json, plugin assignment)
  *
- * 1–3 delegate to a whole `vat` command and nest that command's own report under
- * `report`; they are chosen by {@link selectVerifyPhases}. 4–6 exist only here and
- * are chosen by `selectInProcessVerifyPhases`. Every phase runs in this process.
+ * 1–3 delegate to a whole `vat` command, whose report is held to that command's
+ * registered schema and folded into `data.phases`; they are chosen by
+ * {@link selectVerifyPhases}. 4–6 exist only here, hold their reports to their own
+ * schemas, and are chosen by `selectInProcessVerifyPhases`. Every phase runs in
+ * this process.
  * Both sets are config-gated, and both are announced on startup.
  */
-import { existsSync, statSync } from 'node:fs';
 import { detectPackagedAgentInstructionFiles, explicitFilesConfigDests, indexPluginLocalSkills, } from '@vibe-agent-toolkit/agent-skills';
-import { calculateValidationStatus, countBySeverity, } from '@vibe-agent-toolkit/schema';
-import { isPathAbsentError, safePath, toForwardSlash } from '@vibe-agent-toolkit/utils';
+import { buildReport, toFindings, } from '@vibe-agent-toolkit/schema';
+import { everywhere, followedKindSync, forEachInOrder, isPathAbsentError, pathPresent, safePath, toForwardSlash } from '@vibe-agent-toolkit/utils';
 import { Command } from 'commander';
-import { handleCommandError } from '../utils/command-error.js';
+import { marksOperandRefusalByHand } from '../command-tree.js';
 import { loadConfig } from '../utils/config-loader.js';
+import { endWithReport } from '../utils/document-writer.js';
 import { formatIssueLines } from '../utils/issue-rendering.js';
 import { resolveIssueSeverity } from '../utils/issue-severity.js';
-import { writeYamlOutput } from '../utils/output.js';
 import { requireProjectRoot } from '../utils/project-root-policy.js';
-import { nothingCheckedFinding, runIntegrityFinding } from '../utils/run-integrity.js';
+import { runIntegrityFinding } from '../utils/run-integrity.js';
 import { isSkillPublished, mergeSkillPackagingConfig, pluginLocalSkillConfigEntry, publishScope } from '../utils/skill-packaging-config.js';
+import { MARKETPLACE_VALIDATE_EXAMINED, MARKETPLACE_VALIDATE_REPORT_SCHEMA } from './claude/marketplace/validate-schema.js';
 import { runMarketplaceValidatePhase } from './claude/marketplace/validate.js';
 import { runConsistencyChecks, } from './consistency-check.js';
-import { addRetiredOnlyOption, aggregatePhaseStatus, applyPhaseSelection, createPhaseContext, decidePhaseSelection, exitCodeForPhases, rejectRetiredOnly, runPhase, } from './phase-utils.js';
+import { PACKAGED_CONTENT_EXAMINED, PACKAGED_CONTENT_REPORT_SCHEMA } from './orchestrator-schema.js';
+import { addRetiredOnlyOption, applyPhaseSelection, createPhaseContext, DATALESS_PHASE_REPORT_SCHEMA, decidePhaseSelection, orchestrate, ORCHESTRATOR_FORMAT, ORCHESTRATOR_GATE, rejectRetiredOnly, runPhase, shipsPluginLocalSkills, skillsPhaseExamined, } from './phase-utils.js';
 import { rejectPositionalArguments } from './positional-args.js';
+import { RESOURCES_VALIDATE_EXAMINED, RESOURCES_VALIDATE_REPORT_SCHEMA } from './resources/validate-schema.js';
 import { runResourcesValidatePhase } from './resources/validate.js';
 import { discoverSkillsFromConfig, readPluginLocalSkillNames } from './skills/skill-discovery.js';
+import { SKILLS_VALIDATE_EXAMINED, SKILLS_VALIDATE_REPORT_SCHEMA } from './skills/validate-schema.js';
 import { runSkillsValidatePhase } from './skills/validate.js';
 /**
  * Measured full-run duration on the 90-skill / 1,041-document adopter, cited by
@@ -43,7 +48,8 @@ const VERIFY_FULL_RUN_SECONDS = 32;
 /** How this command names itself in every user-facing diagnostic. */
 const COMMAND_NAME = 'vat verify';
 export function createVerifyTopLevelCommand() {
-    const command = new Command('verify');
+    // Refuses operands in its action, with a better message than commander's.
+    const command = marksOperandRefusalByHand(new Command('verify'));
     addRetiredOnlyOption(command)
         .description('Verify built artifacts (resources + skills + marketplace + consistency); marketplace/consistency read dist/ — run after vat build')
         .option('-v, --verbose', 'Show all inspected resources, including those without issues')
@@ -54,8 +60,10 @@ Description:
   Verifies all project artifacts. The marketplace and consistency phases
   read the built dist/ tree, so run this after 'vat build'.
 
-  For source-only validation that needs no build (resources + skills,
-  suitable for pre-commit and CI-before-build), use 'vat validate'.
+  For source-only validation that needs no build (resources, their checks,
+  skills — the CI-before-build gate), use 'vat validate'.
+  This command does not run resources.checks; 'vat validate' and
+  'vat resources check' do.
 
   Config-driven, exactly like 'vat validate': a phase runs only when its
   config block is present. There is no phase filter — the whole run takes
@@ -68,8 +76,8 @@ Description:
     marketplace  → strict marketplace validation (when 'claude.marketplaces:' configured)
 
   Phases (verify's own, run after the above, when 'skills:' is configured):
-    files-config-dests → every 'files:' dest exists in the built output. Appears
-                         in the document only when a dest is missing.
+    files-config-dests → every 'files:' dest exists in the built output; one
+                         FILES_CONFIG_DEST_MISSING error per missing dest.
     packaged-content   → built skill bundles carry no repo-internal agent-instruction
                          file (CLAUDE.md, AGENTS.md, GEMINI.md). A dest an explicit
                          'files:' entry names is honoured, not reported.
@@ -84,32 +92,25 @@ Description:
   inspect its inputs is listed even when it finds nothing to report.
 
 Output:
-  ONE YAML document → stdout
-    per phase: status (success | warning | error | system-error). A delegated
-    phase's own report is captured and nested under 'report', so the whole run
-    is a single parseable document (a phase's stdout is never streamed
-    through). A phase's status comes from its own REPORTED status, not from its
-    exit code — an exit code cannot express 'warning'. Verify's own phases also
-    publish issueCounts {errors, warnings, info}; 'consistency' and
-    'packaged-content' carry their findings into the document too, while
-    'files-config-dests' publishes counts only and lists the missing dests on
-    stderr. 'packaged-content' also publishes bundlesInspected — the built
-    bundles it crawled — beside bundlesExpected (the bundles 'vat build'
-    produces for the skills this run discovered) and bundlesMissing (expected
-    bundles absent from dist/, by path). Zero inspected, or any missing, is
-    refused as RESOURCE_CHECK_BROKEN at error (exit 1) rather than reported as
-    a pass: a run that found none of the build (dist/ not built, or a
-    skills.include glob that matched nothing) or only part of it (a bundle
-    deleted, a skill added since the last build) is not a verdict on what ships.
-    A skill whose merged config says publish: false is IN-PLACE — never
-    bundled by 'vat build', so no pool bundle is expected for it (a stale one
-    in dist/skills is still inspected); bundlesInPlace counts them, and a run
-    whose every discovered skill is in place passes with nothing to inspect. A
-    plugin-local skill (a git-tracked skill dir under a plugin's skills/) is
-    never in place: it is expected in its plugin tree whatever publish says,
-    and never counted in bundlesInPlace. Declare
-    skills.defaults.publish: false for a project that builds with --only claude
-    and uses its other skills from the repo.
+  ONE report envelope (YAML) → stdout: status (ok | findings | error),
+  examined (the sum over every phase), summary {errors, warnings, info},
+  findings (every phase's, flat), and data.phases — one entry per phase with
+  its own status, examined, summary, error (when it did not finish) and the
+  phase's own data. Schema: packages/cli/schemas/orchestrator.json.
+    'packaged-content': examined is the built bundles it crawled; its data is
+    bundlesExpected (the bundles 'vat build' produces for the skills this run
+    discovered), bundlesInPlace, and bundlesMissing (expected bundles absent
+    from dist/, by path). Zero inspected, or any missing, is refused as
+    RESOURCE_CHECK_BROKEN at error (exit 1): a run that found none of the build
+    (dist/ not built, or a skills.include glob that matched nothing) or only
+    part of it is not a verdict on what ships. A skill whose merged config says
+    publish: false is IN-PLACE — never bundled by 'vat build', so no pool bundle
+    is expected for it; a run whose every discovered skill is in place passes
+    with nothing to inspect. A plugin-local skill (a git-tracked skill dir under
+    a plugin's skills/) is never in place: it is expected in its plugin tree.
+    'marketplace:<name>': a plugin.json, a skills/ directory or a SKILL.md the
+    OS will not read is refused as RESOURCE_CHECK_BROKEN at error (exit 1),
+    naming it — a file this run could not read is not a verdict on what ships.
   Progress and validation errors → stderr (streamed live)
 
   By default each delegated phase reports a per-asset summary plus the assets
@@ -117,11 +118,13 @@ Output:
   then also lists the assets it inspected and found nothing to report.
 
 Exit Codes:
-  0 - All phases passed (a warning does not fail the run — read status/issueCounts)
-  1 - Validation errors found
-  2 - System error (this command's own, or propagated from a phase that could
-      not run: it exited 2, or reported 'system-error' for itself), or a usage
-      error such as passing a path
+  0 - Every phase finished and no finding is an error (warnings never fail)
+  1 - An error finding, or a configured phase examined nothing — an include
+      that matches no file, say (RESOURCE_CHECK_BROKEN, naming the phase's unit)
+  2 - The run could not do its job: a phase did not finish (RUN_INCOMPLETE,
+      the finished phases still in data.phases), a path argument or the
+      retired '--only' (USAGE_INVALID), no project root, a population it
+      could not see
 
 Arguments:
   None. Scope comes from vibe-agent-toolkit.config.yaml, never from the command
@@ -162,9 +165,10 @@ function filesOf(entry) {
  * refused `dist/skills/x` as missing would name it under `missing` with a
  * remedy ("run vat build") that cannot help.
  */
-function isDirectory(dir) {
+function isDirectory(dir, within) {
     try {
-        return statSync(dir).isDirectory();
+        // Beneath the project root: every link on the way is read before the kernel follows it.
+        return followedKindSync(dir, within) === 'directory';
     }
     catch (error) {
         if (isPathAbsentError(error))
@@ -180,7 +184,7 @@ function isDirectory(dir) {
  * that is not a directory is named in `missing` — that absence is the finding,
  * not a skip (see {@link isDirectory} for why "exists" is not enough).
  *
- * An EMPTY `files:` block is registered, not skipped: {@link checkFilesConfigDests}
+ * An EMPTY `files:` block is registered, not skipped: {@link runFilesConfigDestsPhase}
  * has nothing to verify for such a skill and filters it out itself, but
  * {@link checkPackagedAgentInstructionFiles} must still crawl that bundle — a skill
  * with no `files:` block is exactly the one whose agent-instruction file arrived by
@@ -191,7 +195,7 @@ function addCheckCandidate(outputs, seen, cwd, candidate, expected) {
     if (seen.has(key))
         return;
     seen.add(key);
-    const exists = isDirectory(candidate.outputDir);
+    const exists = isDirectory(candidate.outputDir, cwd);
     if (exists)
         outputs.built.push(candidate);
     if (!expected)
@@ -254,7 +258,7 @@ function collectBuiltSkillOutputs(cwd, discovered, pluginLocal, pluginLocalNames
     // used to wrap this whole body could only ever absorb a DEFECT — and it
     // absorbed it into an empty candidate list, which every phase below then
     // verified against: zero bundles, zero findings, exit 0.
-    const config = loadConfig(cwd);
+    const config = loadConfig(cwd, 'source');
     if (!config)
         return outputs;
     const skillsConfig = config.skills;
@@ -297,28 +301,27 @@ function collectBuiltSkillOutputs(cwd, discovered, pluginLocal, pluginLocalNames
     return outputs;
 }
 /**
- * Check that all dest paths from the merged files config exist in the built output.
+ * The `files:` dests of every built bundle that declares some: how many bundles
+ * were checked, and which dests are absent.
  *
- * A dest is "missing" ONLY when absent from a candidate dir that exists. If a skill
- * has no existing candidate dir, it is not reported (build didn't run for that mode).
- *
- * @param discovered - The skills this run discovered from `skills.include`. See
- *   {@link collectBuiltSkillOutputs} for why it is required rather than optional.
- * @param pluginLocal - The run's plugin-local index — required for the same reason.
- * @param pluginLocalNames - The declared name of every location in `pluginLocal` — required for the same reason.
- * @returns One result per (skill, outputDir) pair where dests are absent.
+ * A dest is "missing" ONLY when absent from a candidate dir that exists. A skill
+ * with no existing candidate dir is not reported (the build did not run for that
+ * mode) — the packaged-content phase names the unbuilt bundles.
  */
-export function checkFilesConfigDests(cwd, discovered, pluginLocal, pluginLocalNames) {
+function checkFilesConfigDestsOf(built, projectRoot) {
     const results = [];
-    for (const check of collectBuiltSkillOutputs(cwd, discovered, pluginLocal, pluginLocalNames).built) {
+    let checked = 0;
+    for (const check of built) {
         const { skillName, outputDir } = check;
         const mergedFiles = filesOf(check);
         if (mergedFiles.length === 0)
             continue;
+        checked += 1;
         const missing = [];
         for (const entry of mergedFiles) {
             const destPath = safePath.resolve(outputDir, entry.dest);
-            if (!existsSync(destPath)) {
+            // A probe the OS refuses is the bundle's source fault, never "missing" (a remedy that cannot help).
+            if (!pathPresent(destPath, { follow: projectRoot }, everywhere('source'), 'probe')) {
                 missing.push(entry.dest);
             }
         }
@@ -326,7 +329,7 @@ export function checkFilesConfigDests(cwd, discovered, pluginLocal, pluginLocalN
             results.push({ skillName, outputDir, missing });
         }
     }
-    return results;
+    return { checked, missing: results };
 }
 /**
  * Crawl every built skill bundle for repo-internal agent-instruction files.
@@ -378,7 +381,9 @@ export function checkPackagedAgentInstructionFiles(cwd, discovered, pluginLocal,
     const issues = [];
     const outputs = collectBuiltSkillOutputs(cwd, discovered, pluginLocal, pluginLocalNames);
     for (const check of outputs.built) {
-        const raw = detectPackagedAgentInstructionFiles(check.outputDir, cwd, explicitFilesConfigDests(filesOf(check)));
+        const raw = detectPackagedAgentInstructionFiles(check.outputDir, cwd, explicitFilesConfigDests(filesOf(check)), 
+        // `vat verify` examines what an earlier build wrote; it writes nothing.
+        []);
         issues.push(...resolveIssueSeverity(raw, check.packaging.validation));
     }
     return {
@@ -398,7 +403,7 @@ export function checkPackagedAgentInstructionFiles(cwd, discovered, pluginLocal,
  */
 function loadConfigTolerant(cwd) {
     try {
-        return { config: loadConfig(cwd) };
+        return { config: loadConfig(cwd, 'source') };
     }
     catch (error) {
         return { config: undefined, error: error instanceof Error ? error.message : String(error) };
@@ -419,21 +424,17 @@ function reportFilesDestErrors(results, logger) {
     }
 }
 /**
- * Log packaged-content findings to stderr.
- *
- * A companion to the document entry, never a substitute for it: this phase's
- * findings are published into the YAML too (see {@link FindingsPhaseResult}).
+ * Log packaged-content findings to stderr — a companion to the report, never a
+ * substitute for it.
  *
  * Rendered through the SHARED {@link formatIssueLines}, which `vat skills build`
- * and `vat skills validate` already use. The hand-rolled renderer this replaces
- * printed severity, code, location and fix — and dropped `message`, the only part
- * of a finding that says what is wrong. A second renderer for the same shape is
+ * and `vat skills validate` already use: a second renderer for the same shape is
  * how one command's findings end up spelled differently from every other's.
  */
-function reportPackagedContentIssues(issues, logger) {
+function reportPackagedContentIssues(findings, logger) {
     logger.error(`\n▶ Phase: ${PACKAGED_CONTENT}`);
-    for (const issue of issues) {
-        for (const line of formatIssueLines(issue, '  '))
+    for (const finding of findings) {
+        for (const line of formatIssueLines(finding, '  '))
             logger.error(line);
     }
 }
@@ -471,7 +472,6 @@ const VERIFY_VOCABULARY = {
     validNames: VALID_PHASES,
     noop: {
         warning: 'No resources:, skills: or claude.marketplaces: block found in vibe-agent-toolkit.config.yaml — nothing to verify. If this is unexpected, check your config.',
-        note: 'No configured phases (no resources, skills or claude.marketplaces block in vibe-agent-toolkit.config.yaml).',
     },
 };
 /**
@@ -503,12 +503,17 @@ export function selectVerifyPhases(config, configError, verbose) {
     if (unreadable || config?.resources) {
         phases.push({
             name: 'resources',
+            schema: RESOURCES_VALIDATE_REPORT_SCHEMA,
+            examined: RESOURCES_VALIDATE_EXAMINED,
             run: () => runResourcesValidatePhase(undefined, { verbose: detail }),
         });
     }
     if (unreadable || config?.skills) {
         phases.push({
             name: 'skills',
+            schema: SKILLS_VALIDATE_REPORT_SCHEMA,
+            // As `vat validate`: the phase validates the pool, and a plugin-local project has none.
+            examined: skillsPhaseExamined(SKILLS_VALIDATE_EXAMINED, () => shipsPluginLocalSkills(config, process.cwd())),
             run: () => runSkillsValidatePhase(undefined, { verbose: detail }),
         });
     }
@@ -519,6 +524,10 @@ export function selectVerifyPhases(config, configError, verbose) {
         const marketplacePath = `dist/.claude/plugins/marketplaces/${name}`;
         phases.push({
             name: `marketplace:${name}`,
+            schema: MARKETPLACE_VALIDATE_REPORT_SCHEMA,
+            // The verb's declaration, its unit naming WHICH marketplace: this phase runs once per marketplace,
+            // and two that examined nothing would otherwise publish one location-less finding twice.
+            examined: { ...MARKETPLACE_VALIDATE_EXAMINED, unit: `${MARKETPLACE_VALIDATE_EXAMINED.unit} of marketplace ${name}` },
             run: () => runMarketplaceValidatePhase(marketplacePath, { verbose: detail }),
         });
     }
@@ -546,7 +555,7 @@ const PACKAGED_CONTENT = 'packaged-content';
  * announced 'resources → files-config-dests → consistency' and emitted a
  * document holding `resources` and nothing else, so an operator read a claim
  * that distribution consistency had been checked. Both in-process phases read
- * the same input, the `skills:` block — without it {@link checkFilesConfigDests}
+ * the same input, the `skills:` block — without it {@link runFilesConfigDestsPhase}
  * has no `files:` entry to resolve (both `defaults.files` and
  * `config.<skill>.files` live under `skills:`, so every merge is empty) and
  * {@link runConsistencyPhase} returns before its first lookup. Neither can
@@ -571,32 +580,6 @@ export function formatVerifyAnnouncement(delegatedPhaseNames, config) {
     const all = [...delegatedPhaseNames, ...selectInProcessVerifyPhases(config)];
     return `🔍 vat verify (phases: ${all.join(' → ')})`;
 }
-/**
- * Project ONE finding into the archived YAML.
- *
- * The whole anchor rides along. This shape used to be `{severity, code, message,
- * fix}` and the projection destructured exactly those four, so every
- * `packaged-content` finding reached the document with no `location` — the same
- * defect this PR fixed one command over in `vat skills build`, where a published
- * count carried "no `code`, no location and no fix string at ANY verbosity". It
- * looked survivable only because `materializeIssue` happens to interpolate the
- * detail into `message` for this one code; that is a coincidence, not a contract,
- * and stderr is not the document a CI consumer parses.
- */
-export function toPublishedIssue(issue) {
-    return {
-        severity: issue.severity,
-        code: issue.code,
-        message: issue.message,
-        fix: issue.fix ?? '',
-        // Conditional rather than `location: issue.location`: `exactOptionalPropertyTypes`
-        // distinguishes an absent key from an explicit `undefined`, and a YAML document
-        // carrying `location: null` claims something the finding never said.
-        ...(issue.location === undefined ? {} : { location: issue.location }),
-        ...(issue.line === undefined ? {} : { line: issue.line }),
-        ...(issue.reference === undefined ? {} : { reference: issue.reference }),
-    };
-}
 /**
  * The refusal for a crawl that found only PART of the build.
  *
@@ -620,95 +603,53 @@ function missingBundlesFinding(crawl) {
             + ' Run `vat build` first, then re-run `vat verify`.')];
 }
 /**
- * Build the `packaged-content` phase result from what the crawl found.
+ * What a zero means for the `packaged-content` phase, read from its own `data`: nothing expected
+ * because every discovered skill is in place (`bundlesInPlace > 0`) IS a verdict; anything else
+ * is the zero every phase refuses, by {@link PACKAGED_CONTENT_EXAMINED}.
  *
- * 🚨 **Zero bundles is an ERROR, not a clean phase — and so is a MISSING one.**
- * The phase is pushed unconditionally whenever `skills:` exists and it feeds the
- * real exit code; `discoverSkillsFromConfig` returning `[]` on a typo'd glob —
- * or `dist/` not having been built at all, or built somewhere else — gave the
- * crawl nothing to walk, and nothing walked was zero findings was `success`,
- * with no count in the document to say the phase had looked at nothing. `vat
- * verify` exists to check the BUILT tree; a run that found none of it is not a
- * verdict on it. Nor is a run that found half of it: with `bundlesInspected` as
- * the only denominator, two discovered skills and one deleted bundle published
- * `success` beside `bundlesInspected: 1`. The crawl now also carries what it
- * should have found, and the document publishes both counts.
- *
- * One zero IS a verdict: nothing expected because every discovered skill is in
- * place (`bundlesInPlace > 0`). Zero discovered skills stays refused.
- *
- * Derived here, in the one function that produces this phase's document, and
- * not in the command body, so no path through the orchestrator can publish
- * `status: success` beside `bundlesInspected: 0` or beside a non-empty
- * `bundlesMissing`. Through the shared mechanism in `run-integrity.ts`: one
- * non-overridable `RESOURCE_CHECK_BROKEN` at `error`, which
- * {@link exitCodeForPhases} then turns into exit 1. ONE, not two, when both
- * apply: the missing-bundle refusal is derived first because it names paths,
- * and {@link nothingCheckedFinding} stands down behind an existing
- * run-integrity finding.
+ * The phase's `examined` declaration (`Phase.examined`): `runPhase` judges the phase with it
+ * through the one zero-examined helper, so this phase holds no refusal of its own for "crawled
+ * nothing" — only the one for "crawled part" ({@link missingBundlesFinding}).
  *
  * Pure, and exported so the refusal is pinned without a project on disk.
  */
+function packagedContentExamined(report) {
+    const data = report.data;
+    if (data !== null && data.bundlesExpected === 0 && data.bundlesInPlace > 0) {
+        return { zeroIsAnAnswer: 'every discovered skill is in place (publish: false), so no built bundle is expected' };
+    }
+    return PACKAGED_CONTENT_EXAMINED;
+}
+/**
+ * Build the `packaged-content` phase from what the crawl found.
+ *
+ * 🚨 **Zero bundles is an ERROR, not a clean phase — and so is a MISSING one.**
+ * `vat verify` exists to check the BUILT tree; a run that found none of it is
+ * not a verdict on it, and neither is a run that found half of it. A crawl that
+ * found PART is refused here, naming the missing paths; one that found NONE is
+ * refused by `runPhase`, through the declaration {@link packagedContentExamined}
+ * answers — the same helper every phase's zero goes through. One
+ * `RESOURCE_CHECK_BROKEN` at `error`, never two: the helper stands down when the
+ * missing-bundle refusal is already there.
+ *
+ * Pure, and exported so the phase is pinned without a project on disk.
+ */
 export function buildPackagedContentPhase(crawl) {
-    const { bundlesInspected, bundlesExpected, bundlesInPlace, bundlesMissing, issues: found } = crawl;
-    const missing = missingBundlesFinding(crawl);
-    const accountedFor = bundlesExpected === 0 ? bundlesInspected + bundlesInPlace : bundlesInspected;
-    const issues = [
-        ...missing,
-        ...nothingCheckedFinding(accountedFor, [...missing, ...found], () => 'The packaged-content phase inspected 0 built skill bundles, so this phase is not a'
-            + ' verdict: nothing was crawled for files that must not ship, and the document reads'
-            + ' the same as a run over clean bundles. Either `vat build` has not run (or wrote'
-            + ' somewhere other than dist/), or `skills.include` in vibe-agent-toolkit.config.yaml'
-            + ' matched no SKILL.md — usually a typo in the glob. Run `vat build` first; `vat skills'
-            + ' validate` lists what the globs discover.'),
-        ...found,
-    ];
+    const { issues: found, bundlesInspected, ...data } = crawl;
     return {
         name: PACKAGED_CONTENT,
-        status: calculateValidationStatus(issues),
-        // The denominator, beside the counts it qualifies — and what it should have been.
-        bundlesInspected,
-        bundlesExpected,
-        bundlesInPlace,
-        bundlesMissing,
-        issueCounts: countBySeverity(issues),
-        issues: issues.map(toPublishedIssue),
+        report: buildReport({
+            examined: bundlesInspected,
+            findings: toFindings([...missingBundlesFinding(crawl), ...found]),
+            data,
+            gate: ORCHESTRATOR_GATE,
+        }),
     };
 }
 /**
- * `ConsistencyIssue` speaks the same severity vocabulary as `ValidationIssue`
- * but carries a free-form `code`, so it is counted through this projection —
- * there must be exactly ONE issues→status/counts collapse in the codebase, and
- * it lives in `@vibe-agent-toolkit/schema`.
- */
-function asValidationIssues(issues) {
-    return issues.map((issue) => ({
-        code: issue.code,
-        severity: issue.severity,
-        message: issue.message,
-        fix: issue.fix,
-        ...(issue.location === undefined ? {} : { location: issue.location }),
-        ...(issue.line === undefined ? {} : { line: issue.line }),
-    }));
-}
-/**
- * Run the `packaged-content` phase: crawl, derive the phase document, and
- * report THAT document's issues on stderr.
- *
- * 🚨 **The stderr report used to be gated on the crawl, one line before the
- * refusal was derived.** `if (crawl.issues.length > 0) report(crawl.issues)`
- * ran ahead of {@link buildPackagedContentPhase}, which is where the
- * zero-bundle refusal is added — so on an unbuilt project the crawl found
- * nothing, nothing was logged, the skills phase's `✅ All validations passed`
- * stayed the last line on stderr, and the process exited 1 on a refusal that
- * existed only in the YAML. Reporting from the phase result makes what stderr
- * says and what the exit code is computed from one list, which is
- * `run-integrity.ts` invariant 6.
- *
- * The round trip through `asValidationIssues` is deliberate rather than
- * reporting the crawl's list plus a second derivation of the refusal: the
- * document is the artifact of record, and stderr should render exactly what it
- * carries, not a parallel computation that can drift from it.
+ * Run the `packaged-content` phase: crawl, derive the phase, and report THAT
+ * phase's findings on stderr — so what stderr says and what the exit code is
+ * computed from are one list (`run-integrity.ts` invariant 6).
  */
 export function runPackagedContentPhase(projectRoot, discoveredSkills, pluginLocal, pluginLocalNames, logger) {
     const phase = buildPackagedContentPhase(checkPackagedAgentInstructionFiles(projectRoot, discoveredSkills, pluginLocal, pluginLocalNames));
@@ -716,150 +657,145 @@ export function runPackagedContentPhase(projectRoot, discoveredSkills, pluginLoc
     return phase;
 }
 export function reportPackagedContentPhase(phase, logger) {
-    if (phase.issues.length > 0) {
-        reportPackagedContentIssues(asValidationIssues(phase.issues), logger);
+    const { findings, data, examined } = phase.report;
+    if (findings.length > 0) {
+        reportPackagedContentIssues(findings, logger);
     }
-    else if (phase.bundlesExpected === 0 && phase.bundlesInspected === 0) {
-        logger.info(`\n▶ Phase: ${PACKAGED_CONTENT} — nothing to inspect: all ${phase.bundlesInPlace} discovered skill(s) are in place (publish: false)`);
+    else if (data !== null && data.bundlesExpected === 0 && examined === 0) {
+        logger.info(`\n▶ Phase: ${PACKAGED_CONTENT} — nothing to inspect: all ${data.bundlesInPlace} discovered skill(s) are in place (publish: false)`);
     }
 }
+/** One finding per `files:` dest absent from the built output, located at the path it should be. */
+function filesDestFindings(projectRoot, missing) {
+    return missing.flatMap(({ skillName, outputDir, missing: dests }) => dests.map((dest) => ({
+        code: 'FILES_CONFIG_DEST_MISSING',
+        severity: 'error',
+        message: `Skill '${skillName}' declares the files: dest '${dest}', and the built output does not hold it.`,
+        location: toForwardSlash(safePath.relative(projectRoot, safePath.resolve(outputDir, dest))),
+        fix: 'Run `vat build` so the files: entry is applied, or correct the entry\'s dest in vibe-agent-toolkit.config.yaml.',
+    })));
+}
 /**
- * Run the in-process consistency check phase and record its outcome.
+ * The `files-config-dests` phase: every built bundle declaring `files:` dests,
+ * checked. `examined` is the bundles checked — those that exist and declare at
+ * least one dest — and each missing dest is one `FILES_CONFIG_DEST_MISSING`
+ * error at the path it should be, relative to `projectRoot`. Always `error`: the
+ * code is a `NonOverridableCode`, so no `validation.severity` is read for it.
  *
- * The findings are published INTO the phase result, not merely logged: they used
- * to go to stderr only, so the archived YAML — the artifact of record — said
- * nothing happened. And a warning-only run reported `passed`, which is the
- * reassuring answer to a question it could not represent.
+ * @param discovered - The skills this run discovered from `skills.include`. See
+ *   {@link collectBuiltSkillOutputs} for why it is required rather than optional.
+ * @param pluginLocal - The run's plugin-local index — required for the same reason.
+ * @param pluginLocalNames - The declared name of every location in `pluginLocal` — required for the same reason.
+ */
+export function runFilesConfigDestsPhase(projectRoot, discovered, pluginLocal, pluginLocalNames, logger) {
+    const built = collectBuiltSkillOutputs(projectRoot, discovered, pluginLocal, pluginLocalNames).built;
+    const { checked, missing } = checkFilesConfigDestsOf(built, projectRoot);
+    if (missing.length > 0)
+        reportFilesDestErrors(missing, logger);
+    return {
+        name: FILES_CONFIG_DESTS,
+        report: buildReport({ examined: checked, findings: filesDestFindings(projectRoot, missing), data: null, gate: ORCHESTRATOR_GATE }),
+    };
+}
+/**
+ * The in-process consistency check phase, its findings published into the
+ * report, not merely logged: they used to go to stderr only, so the archived
+ * YAML — the artifact of record — said nothing happened.
  *
  * Discovery is handed in rather than performed here: it crawls the whole project,
  * and the packaged-content and files-config-dests phases need the same list. One
  * crawl per run, one answer to "which skills does this project have".
  */
-function runConsistencyPhase(logger, phaseResults, config, projectRoot, discoveredSkills, pluginLocal) {
-    if (!config?.skills) {
-        // Nothing to cross-reference, so nothing to report: a run without a
-        // `skills:` block is a genuine no-op, and {@link selectInProcessVerifyPhases}
-        // has already decided not to name this phase. There used to be a second arm
-        // here that pushed an ERROR result instead — because `--only consistency`
-        // had asked for THIS phase specifically, and answering an explicit request
-        // with an empty phase list and `success` is the same silent pass
-        // `vat validate --only <unconfigured surface>` refuses to give. With
-        // `--only` retired from `vat verify` there is no way to ask for this phase
-        // specifically, so that arm went with it. This guard remains reachable only
-        // defensively (and narrows `config.skills` for the call below).
-        return;
-    }
-    const consistencyResult = runConsistencyChecks([...discoveredSkills], config, projectRoot, pluginLocal);
-    const issues = consistencyResult.issues;
-    if (issues.length > 0) {
+function runConsistencyPhase(logger, config, projectRoot, discoveredSkills, pluginLocal) {
+    const { issues } = runConsistencyChecks([...discoveredSkills], config, projectRoot, pluginLocal);
+    if (issues.length > 0)
         reportConsistencyIssues(issues, logger);
-    }
-    const asValidation = asValidationIssues(issues);
-    const result = {
+    return {
         name: 'consistency',
-        status: calculateValidationStatus(asValidation),
-        issueCounts: countBySeverity(asValidation),
-        issues: asValidation.map(toPublishedIssue),
+        report: buildReport({ examined: discoveredSkills.length, findings: issues, data: null, gate: ORCHESTRATOR_GATE }),
     };
-    phaseResults.push(result);
 }
+/**
+ * Run one in-process phase as a {@link Phase}, so a throw inside it — a
+ * `package.json` the OS will not read, coded `INPUT_UNREADABLE` — becomes THAT
+ * phase's refusal with its own code, and the phases that finished still publish.
+ */
+function inProcess(phase, run) {
+    return runPhase({ ...phase, run: () => Promise.resolve({ report: run().report }) });
+}
+/**
+ * The three in-process phases, each with the schema its report is held to and what a zero means
+ * for it. Two check what the `skills` phase beside them discovered — it is that phase that refuses
+ * a discovery of none — and for them a zero of their own is an answer.
+ */
+export const IN_PROCESS_PHASES = {
+    [FILES_CONFIG_DESTS]: {
+        name: FILES_CONFIG_DESTS,
+        schema: DATALESS_PHASE_REPORT_SCHEMA,
+        examined: { zeroIsAnAnswer: 'it checks the built bundles that declare a files: dest, and a project that declares none has nothing for it to check' },
+    },
+    [PACKAGED_CONTENT]: { name: PACKAGED_CONTENT, schema: PACKAGED_CONTENT_REPORT_SCHEMA, examined: packagedContentExamined },
+    consistency: {
+        name: 'consistency',
+        schema: DATALESS_PHASE_REPORT_SCHEMA,
+        examined: { zeroIsAnAnswer: 'it checks the skills the `skills` phase discovered, and that phase refuses a discovery of none' },
+    },
+};
 /**
  * The in-process half of `vat verify`: `files-config-dests`, `packaged-content` and
- * `consistency`, each where `inProcess` names it.
+ * `consistency`, each where `inProcess` names it, each recorded as it finishes.
  */
 async function runInProcessPhases(run) {
-    const { inProcess, config, projectRoot, logger, phaseResults } = run;
-    // ONE discovery for the whole in-process half of the run. Every phase below
-    // asks the same question — "which skills does this project have" — and each
-    // answer used to be a different one: `consistency` crawled, while
-    // `files-config-dests` and `packaged-content` read `skills.config` keys and
-    // were therefore blind to every skill discovered by a glob.
-    // `'refuse'`: a verify over a population it could not see is the
-    // green-without-checking shape this command exists to refuse. The throw
-    // lands in the command's catch → `handleCommandError`, exit 2, with the
-    // crawl's own root-relative sentence.
+    const { phases, config, projectRoot, logger, results } = run;
+    // ONE discovery for the whole in-process half of the run: every phase below
+    // asks "which skills does this project have", and each used to answer it
+    // differently. `'refuse'`: a verify over a population it could not see is the
+    // green-without-checking shape this command exists to refuse — the throw is
+    // the run's refusal, published with the phases that already finished.
     const discoveredSkills = await discoverSkillsFromConfig(run.skills, projectRoot, 'refuse');
-    // ONE plugin-local index likewise: listing it crawls every plugin, and every phase
-    // below asks it (in-place vs plugin-only, plugin-tree bundles, plugin assignment).
+    // ONE plugin-local index likewise, and the declared name of each plugin-local
+    // skill, which keys its config exactly as the plugin build keyed it.
     const pluginLocal = indexPluginLocalSkills(config, projectRoot);
-    // …and the declared name of each plugin-local skill, which keys its config exactly as
-    // the plugin build keyed it.
     const pluginLocalNames = await readPluginLocalSkillNames(pluginLocal);
-    // Post-build files config check: verify all dest paths exist in built output
-    if (inProcess.includes(FILES_CONFIG_DESTS)) {
-        const filesDestResults = checkFilesConfigDests(projectRoot, discoveredSkills, pluginLocal, pluginLocalNames);
-        if (filesDestResults.length > 0) {
-            reportFilesDestErrors(filesDestResults, logger);
-            phaseResults.push({
-                name: FILES_CONFIG_DESTS,
-                status: 'error',
-                issueCounts: { errors: filesDestResults.length, warnings: 0, info: 0 },
-            });
-        }
+    if (phases.includes(FILES_CONFIG_DESTS)) {
+        results.push(await inProcess(IN_PROCESS_PHASES[FILES_CONFIG_DESTS], () => runFilesConfigDestsPhase(projectRoot, discoveredSkills, pluginLocal, pluginLocalNames, logger)));
     }
-    // Packaged-content check: crawl each built skill bundle for repo-internal
-    // agent-instruction files. Publishes its findings INTO the document rather
-    // than only logging them — a file that must not ship has to be visible in
-    // `issueCounts`, or a CI consumer reads a clean report for a bundle carrying
-    // one. Warnings do not fail the run; the exit code still comes from errors.
-    // The zero-bundle refusal is derived inside the builder and logged from the
-    // built phase, so stderr, the document and the exit code carry one list.
-    if (inProcess.includes(PACKAGED_CONTENT)) {
-        phaseResults.push(runPackagedContentPhase(projectRoot, discoveredSkills, pluginLocal, pluginLocalNames, logger));
+    if (phases.includes(PACKAGED_CONTENT)) {
+        results.push(await inProcess(IN_PROCESS_PHASES[PACKAGED_CONTENT], () => runPackagedContentPhase(projectRoot, discoveredSkills, pluginLocal, pluginLocalNames, logger)));
     }
-    // Consistency check: cross-reference discovered skills vs package.json and plugin assignments
-    if (inProcess.includes('consistency')) {
-        runConsistencyPhase(logger, phaseResults, config, projectRoot, discoveredSkills, pluginLocal);
+    if (phases.includes('consistency')) {
+        results.push(await inProcess(IN_PROCESS_PHASES.consistency, () => runConsistencyPhase(logger, config, projectRoot, discoveredSkills, pluginLocal)));
     }
 }
 async function verifyTopLevelCommand(options, command) {
-    // First, and before requireProjectRoot: `vat verify dist/skills/demo` used to
-    // be accepted, have its path discarded, run wide over the whole project and
-    // report success. Nothing below can un-tell that lie, so the run ends here.
-    rejectPositionalArguments(command.args, COMMAND_NAME, 'verifies every phase vibe-agent-toolkit.config.yaml declares, against the built dist/ tree');
-    // Before requireProjectRoot: a retired flag is a usage error, and answering it
-    // with "no vibe-agent-toolkit.config.yaml found" would diagnose the wrong
-    // problem for anyone running the old invocation outside a project.
-    rejectRetiredOnly(options.only, COMMAND_NAME, VERIFY_FULL_RUN_SECONDS);
-    const { logger, startTime } = createPhaseContext(options.debug);
-    try {
-        // Inside the try, deliberately: phase selection used to throw from out here
-        // (on an unroutable `--only`), so the user got a raw Node stack trace and
-        // zero bytes of the structured document a scripted caller parses — and so
-        // did "no project here", at Node's default exit 1, which the contract reads
-        // as FINDINGS.
+    const { logger } = createPhaseContext(options.debug);
+    const report = await orchestrate(async (results) => {
+        // First, and before requireProjectRoot: `vat verify dist/skills/demo` used to
+        // be accepted, have its path discarded, run wide over the whole project and
+        // report success.
+        rejectPositionalArguments(command.args, COMMAND_NAME, 'verifies every phase vibe-agent-toolkit.config.yaml declares, against the built dist/ tree');
+        // Before requireProjectRoot: a retired flag is a usage error, and answering it
+        // with "no vibe-agent-toolkit.config.yaml found" would diagnose the wrong problem.
+        rejectRetiredOnly(options.only, COMMAND_NAME, VERIFY_FULL_RUN_SECONDS);
         // Spec §7: `vat verify` requires a projectRoot.
         const projectRoot = requireProjectRoot(process.cwd(), COMMAND_NAME);
         const { config, error: configError } = loadConfigTolerant(projectRoot);
-        const phases = applyPhaseSelection(selectVerifyPhases(config, configError, options.verbose), logger, startTime);
+        const phases = applyPhaseSelection(selectVerifyPhases(config, configError, options.verbose), logger);
         // Announced from the same list the in-process gates below read, so the
         // printed phases and the executed phases cannot disagree.
-        const inProcess = selectInProcessVerifyPhases(config);
+        const inProcessPhases = selectInProcessVerifyPhases(config);
         logger.info(formatVerifyAnnouncement(phases.map((p) => p.name), config));
-        const phaseResults = [];
-        for (const phase of phases) {
+        // In order, deliberately: phases are announced in a fixed order and their
+        // stderr streams live, so overlapping them would interleave two running
+        // reports into one unreadable channel.
+        await forEachInOrder(phases, async (phase) => {
             logger.info(`\n▶ Phase: ${phase.name}`);
-            // Awaited in the loop, deliberately: phases are announced in a fixed order
-            // and their stderr streams live, so overlapping them would interleave two
-            // running reports into one unreadable channel.
-            phaseResults.push(await runPhase(phase));
-        }
-        if (inProcess.length > 0 && config?.skills) {
-            await runInProcessPhases({ inProcess, config, skills: config.skills, projectRoot, logger, phaseResults });
-        }
-        const duration = Date.now() - startTime;
-        // Worst-wins across phases, with `system-error` outranking `error`: a phase
-        // that could not run exits 2, so a CI script can tell a broken config from
-        // a broken artifact.
-        writeYamlOutput({
-            status: aggregatePhaseStatus(phaseResults),
-            phases: phaseResults,
-            duration: `${duration}ms`,
+            results.push(await runPhase(phase));
         });
-        process.exit(exitCodeForPhases(phaseResults));
-    }
-    catch (error) {
-        handleCommandError(error, logger, startTime, 'Verify');
-    }
+        if (inProcessPhases.length > 0 && config?.skills) {
+            await runInProcessPhases({ phases: inProcessPhases, config, skills: config.skills, projectRoot, logger, results });
+        }
+    });
+    endWithReport('verify', report, ORCHESTRATOR_FORMAT);
 }
 //# sourceMappingURL=verify.js.map