ai-maestro 1.0.0

package/src/run-diagnostics.mjs

@@ -0,0 +1,641 @@
+import fs from 'fs/promises';
+import path from 'path';
+import { execFileRaw } from './shell.mjs';
+import { stripAccents } from './smart-planner.mjs';
+import { stripBom } from './files.mjs';
+
+const ANALYSIS_ONLY_ACCEPTANCE_PATTERN = /nao alterar codigo/;
+const ANALYSIS_ONLY_KEYWORD_PATTERN = /\b(mapear|analisar|identificar|localizar|diagnosticar|listar|relatorio)\b|nao alterar|sem alterar/;
+
+export function isAnalysisOnlyTask(task) {
+  if (!task) {
+    return false;
+  }
+  if (task.requestKind === 'analysis-only') {
+    return true;
+  }
+  const acceptanceText = stripAccents((task.acceptance || []).join(' ').toLowerCase());
+  if (ANALYSIS_ONLY_ACCEPTANCE_PATTERN.test(acceptanceText)) {
+    return true;
+  }
+  const text = stripAccents(((task.title || '') + ' ' + (task.description || '')).toLowerCase());
+  return ANALYSIS_ONLY_KEYWORD_PATTERN.test(text);
+}
+
+const UNSUPPORTED_TOOL_PATTERNS = [
+  /unsupported call: apply_patch/i,
+  /cannot update goal because this thread has no goal/i,
+  /error=unsupported call/i,
+  // Codex's internal plan tool rejecting a status Maestro uses internally,
+  // e.g. "unknown variant `blocked`, expected one of `pending`,
+  // `in_progress`, `completed`". Maestro statuses must be mapped at the
+  // boundary (see mapStatusToCodexPlanVariant in task-commands.mjs); when
+  // this error still shows up, it must at least be flagged.
+  /unknown variant/i,
+  /ParserError/,
+  /MissingExpressionAfterOperator/
+];
+
+export function detectUnsupportedToolCall(output) {
+  const text = String(output || '');
+  return UNSUPPORTED_TOOL_PATTERNS.some(pattern => pattern.test(text));
+}
+
+const CLAIM_PATTERN = /\b(updated|created|modified|alterado|atualizado|criado|completed|done)\b/i;
+
+// Phrases where the worker states, in prose, that it did NOT or could NOT
+// complete the task -- independent of exit code. A worker's own CLI process
+// can exit 0 (it didn't crash) while its final answer plainly says it
+// failed; that must never read as `completed`. Kept narrow and anchored to
+// completion/action verbs so we don't flag unrelated uses of "failure",
+// "falha" or "não foi possível" (e.g. "não foi possível reproduzir o bug",
+// "a falha esperada no teste", "corrigi o erro que fazia o processo
+// falhar") -- see tests for the exact false-positive cases this must avoid.
+const EXPLICIT_FAILURE_PATTERNS = [
+  /\bnao consegui\b/i,
+  /\bnao foi possivel (conclu\w*|criar|executar|rodar|completar|finalizar|implementar|acessar|modificar|alterar)\b/i,
+  /\bfalhei ao\b/i,
+  /\ba implementacao nao foi realizada\b/i,
+  /\bunable to complete\b/i,
+  /\bcould not complete\b/i,
+  /\bfailed to implement\b/i,
+  /\bi was unable to\b/i,
+  /\bno changes were made\b/i,
+  /\bcould not access the filesystem\b/i,
+  /\bpermission denied\b/i,
+  /\bsandbox acl\b/i,
+  /\bworker failed\b/i,
+  /\bcould not (run|modify|create)\b/i,
+  // Hotfix A.2: the Windows-sandbox ACL failure and the way workers phrase
+  // it. "I cannot read/write ... files" is anchored to the first person so
+  // prose about a bug ("the parser cannot read files with BOM") does not
+  // trip it.
+  /\bi am blocked\b/i,
+  /\bi cannot (read|write|access|modify|create)\b/i,
+  /\bhelper_unknown_error\b/i,
+  /apply deny-read acls/i
+];
+
+function splitSentences(text) {
+  const parts = String(text || '')
+    .split(/(?<=[.!?\n])\s+|\r?\n+/)
+    .map(part => part.trim())
+    .filter(Boolean);
+  return parts.length ? parts : [String(text || '')];
+}
+
+export function detectExplicitFailure(output) {
+  const evidence = [];
+  for (const sentence of splitSentences(output)) {
+    const normalized = stripAccents(sentence.toLowerCase());
+    if (EXPLICIT_FAILURE_PATTERNS.some(pattern => pattern.test(normalized))) {
+      evidence.push(sentence);
+    }
+  }
+  return { explicitWorkerFailure: evidence.length > 0, explicitFailureEvidence: evidence };
+}
+
+export function buildRunDiagnostics({ output, unsupportedToolCall, workspaceChanged, noChangeExpected = false }) {
+  const text = String(output || '');
+  const warnings = [];
+  if (unsupportedToolCall) {
+    warnings.push('worker used an unsupported tool call (e.g. apply_patch)');
+  }
+  const claimsSuccess = CLAIM_PATTERN.test(text);
+  // For an analysis-only or memory/documentation task, no workspace change is
+  // the expected, correct outcome, not a sign the worker is lying: analysis
+  // tasks aren't supposed to touch code, and memory-task success normally
+  // lives entirely inside .memory/, which is excluded from the workspace
+  // diff by design. Only flag it when the worker also used a tool that's
+  // known to fail.
+  const noVerifiedChange = noChangeExpected ? false : !workspaceChanged;
+  const suspectedFalsePositive = claimsSuccess && (unsupportedToolCall || noVerifiedChange);
+  if (suspectedFalsePositive) {
+    warnings.push('worker claimed success but the change could not be verified');
+  }
+  const { explicitWorkerFailure, explicitFailureEvidence } = detectExplicitFailure(text);
+  if (explicitWorkerFailure) {
+    warnings.push('worker explicitly reported it could not complete the task: ' + explicitFailureEvidence[0]);
+  }
+  return {
+    warnings,
+    unsupportedToolCall: !!unsupportedToolCall,
+    suspectedFalsePositive,
+    explicitWorkerFailure,
+    explicitFailureEvidence
+  };
+}
+
+// These match the actual PowerShell error text produced when a Unix
+// command is really executed. Generic patterns like "cat >" or "<< EOF"
+// are deliberately excluded: they also appear verbatim in our own worker
+// prompt (as examples of what NOT to do), which Codex echoes back into
+// its transcript, so matching them there flags the prompt itself instead
+// of anything the worker actually ran.
+const WINDOWS_SHELL_MISMATCH_PATTERNS = [
+  /não é possível localizar um parâmetro que coincida com o nome de parâmetro 'la'/i,
+  /tail\s*:\s*O termo 'tail' não é reconhecido/i,
+  /Operador '<' reservado para uso futuro/i,
+  /Especificação de arquivo ausente após o operador de redirecionamento/i
+];
+
+export function detectWindowsShellMismatch(output) {
+  const text = String(output || '');
+  return WINDOWS_SHELL_MISMATCH_PATTERNS.some(pattern => pattern.test(text));
+}
+
+async function checkNodeSyntax(filePath) {
+  const result = await execFileRaw(process.execPath, ['--check', filePath], { quiet: true });
+  return result.code === 0 ? { ok: true } : { ok: false, error: summarizeError(result.stderr) };
+}
+
+async function checkJsonSyntax(filePath) {
+  try {
+    JSON.parse(stripBom(await fs.readFile(filePath, 'utf-8')));
+    return { ok: true };
+  } catch (error) {
+    return { ok: false, error: error.message };
+  }
+}
+
+async function checkPythonSyntax(filePath) {
+  try {
+    const result = await execFileRaw('python', ['-m', 'py_compile', filePath], { quiet: true });
+    return result.code === 0 ? { ok: true } : { ok: false, error: summarizeError(result.stderr) };
+  } catch (error) {
+    if (error.code === 'ENOENT') {
+      return { ok: true, skipped: true, error: 'python not available' };
+    }
+    return { ok: false, error: error.message };
+  }
+}
+
+async function checkNonEmptyFile(filePath) {
+  try {
+    const content = await fs.readFile(filePath, 'utf-8');
+    return content.trim().length > 0 ? { ok: true } : { ok: false, error: 'file is empty' };
+  } catch (error) {
+    return { ok: false, error: error.message };
+  }
+}
+
+function summarizeError(text) {
+  return String(text || '').split(/\r?\n/).filter(Boolean).slice(0, 3).join(' | ');
+}
+
+export async function validateChangedFile(relPath) {
+  const fullPath = path.resolve(relPath);
+  const ext = path.extname(relPath).toLowerCase();
+  let result;
+  if (ext === '.js' || ext === '.mjs') {
+    result = await checkNodeSyntax(fullPath);
+  } else if (ext === '.json') {
+    result = await checkJsonSyntax(fullPath);
+  } else if (ext === '.py') {
+    result = await checkPythonSyntax(fullPath);
+  } else if (ext === '.html' || ext === '.css') {
+    result = await checkNonEmptyFile(fullPath);
+  } else {
+    result = { ok: true, skipped: true };
+  }
+  return { path: relPath, type: ext || 'unknown', ...result };
+}
+
+export async function validateChangedFiles(filePaths = []) {
+  const syntaxValidation = await Promise.all(filePaths.map(validateChangedFile));
+  const syntaxValidationFailed = syntaxValidation.some(entry => entry.ok === false);
+  return { syntaxValidation, syntaxValidationFailed };
+}
+
+function normalizeRelPath(value) {
+  return String(value || '').replace(/\\/g, '/').replace(/^\.\//, '').trim();
+}
+
+function isExplicitFilePath(value) {
+  const normalized = normalizeRelPath(value);
+  return Boolean(normalized) && !normalized.endsWith('/') && path.extname(normalized).length > 0;
+}
+
+function isSafeRelativePath(value) {
+  const normalized = normalizeRelPath(value);
+  return Boolean(normalized) &&
+    !path.isAbsolute(normalized) &&
+    !normalized.split('/').includes('..') &&
+    !normalized.includes('\0');
+}
+
+function isMissingPathError(error) {
+  return error && (error.code === 'ENOENT' || error.code === 'ENOTDIR');
+}
+
+function containmentPath(value) {
+  const resolved = path.resolve(value);
+  return process.platform === 'win32' ? resolved.toLowerCase() : resolved;
+}
+
+function isContainedPath(root, target) {
+  const relative = path.relative(containmentPath(root), containmentPath(target));
+  return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
+}
+
+async function realPathForPossiblyMissingTarget(absolutePath) {
+  const targetPath = path.resolve(absolutePath);
+  let existingPath = targetPath;
+
+  while (true) {
+    try {
+      const realAncestor = await fs.realpath(existingPath);
+      const missingTail = path.relative(existingPath, targetPath);
+      if (missingTail && (missingTail.startsWith('..') || path.isAbsolute(missingTail))) {
+        return null;
+      }
+      return missingTail ? path.resolve(realAncestor, missingTail) : realAncestor;
+    } catch (error) {
+      if (!isMissingPathError(error)) {
+        return null;
+      }
+      const parent = path.dirname(existingPath);
+      if (parent === existingPath) {
+        return null;
+      }
+      existingPath = parent;
+    }
+  }
+}
+
+async function realContained(projectRoot, absolutePath) {
+  const logicalRoot = path.resolve(projectRoot);
+  const logicalTarget = path.resolve(absolutePath);
+  if (!isContainedPath(logicalRoot, logicalTarget)) {
+    return false;
+  }
+
+  let realRoot;
+  try {
+    realRoot = await fs.realpath(logicalRoot);
+  } catch (error) {
+    return false;
+  }
+
+  let realTarget;
+  try {
+    realTarget = await fs.realpath(logicalTarget);
+  } catch (error) {
+    if (!isMissingPathError(error)) {
+      return false;
+    }
+    realTarget = await realPathForPossiblyMissingTarget(logicalTarget);
+  }
+
+  return Boolean(realTarget) && isContainedPath(realRoot, realTarget);
+}
+
+function uniqueSorted(values) {
+  return [...new Set((values || []).filter(Boolean).map(String))].sort();
+}
+
+function normalizeTaskText(task) {
+  return stripAccents([
+    task && task.title,
+    task && task.description,
+    ...(Array.isArray(task && task.acceptance) ? task.acceptance : [])
+  ].filter(Boolean).join('\n').toLowerCase());
+}
+
+function requiredExportsFromTask(task) {
+  const exports = [];
+  const acceptance = Array.isArray(task && task.acceptance) ? task.acceptance : [];
+  for (const item of acceptance) {
+    const match = String(item || '').match(/\bExportar\s+([A-Za-z_$][\w$]*)\b/i);
+    if (match) exports.push(match[1]);
+  }
+  return exports;
+}
+
+async function requiredExportsFromSourceSpec(task, projectRoot) {
+  if (!task || !isSafeRelativePath(task.sourceSpec || '')) return [];
+  try {
+    const specPath = path.resolve(projectRoot, normalizeRelPath(task.sourceSpec));
+    const relative = path.relative(projectRoot, specPath);
+    if (!relative || relative.startsWith('..') || path.isAbsolute(relative)) return [];
+    if (!await realContained(projectRoot, specPath)) return [];
+    const content = await fs.readFile(specPath, 'utf-8');
+    const exports = [];
+    const pattern = /^\s*export\s+function\s+([A-Za-z_$][\w$]*)\s*\(/gm;
+    let match;
+    while ((match = pattern.exec(content)) !== null) {
+      exports.push(match[1]);
+    }
+    return exports;
+  } catch (error) {
+    return [];
+  }
+}
+
+function hasExport(content, exportedName) {
+  const escaped = exportedName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  return new RegExp(`\\bexport\\s+(?:async\\s+)?function\\s+${escaped}\\s*\\(`).test(content) ||
+    new RegExp(`\\bexport\\s+(?:const|let|var)\\s+${escaped}\\b`).test(content) ||
+    new RegExp(`\\bexport\\s*\\{[^}]*\\b${escaped}\\b[^}]*\\}`).test(content);
+}
+
+function isTestFile(file) {
+  return /(\.test|\.spec)\.[cm]?[jt]s$/i.test(file) || file.startsWith('tests/');
+}
+
+function placeholderReasons(content) {
+  const normalized = stripAccents(String(content || '').toLowerCase());
+  const reasons = [];
+  const patterns = [
+    [/\bplaceholder\b/, 'placeholder marker present'],
+    [/\btodo\b/, 'TODO marker present'],
+    [/\bstub\b/, 'stub marker present'],
+    [/\bnot implemented\b/, 'not implemented marker present'],
+    [/\bimplementacao pendente\b/, 'pending implementation marker present'],
+    [/\bestrutura inicial\b/, 'initial structure marker present']
+  ];
+  for (const [pattern, reason] of patterns) {
+    if (pattern.test(normalized)) reasons.push(reason);
+  }
+  return reasons;
+}
+
+function countTestCalls(content) {
+  const matches = String(content || '').match(/\b(?:test|it)\s*\(/g);
+  return matches ? matches.length : 0;
+}
+
+function inspectFileContent({ file, content, taskText }) {
+  const failures = [];
+  const warnings = [];
+  const ext = path.extname(file).toLowerCase();
+  const trimmed = String(content || '').trim();
+  if (!trimmed) {
+    failures.push(`expected file is empty: ${file}`);
+    return { failures, warnings };
+  }
+
+  for (const reason of placeholderReasons(content)) {
+    failures.push(`${reason}: ${file}`);
+  }
+
+  if ((taskText.includes('date.now') || taskText.includes('timestamp') || taskText.includes('deterministic')) &&
+      /\b(Date\.now|new Date)\s*\(/.test(content)) {
+    failures.push(`non-deterministic clock usage in expected file: ${file}`);
+  }
+
+  if (ext === '.mjs' || ext === '.js') {
+    if (!/\bexport\b/.test(content) && !/\bimport\b/.test(content)) {
+      warnings.push(`module has no import/export evidence: ${file}`);
+    }
+  }
+
+  if (isTestFile(file)) {
+    if (!/\bnode:test\b/.test(content) && countTestCalls(content) === 0) {
+      failures.push(`test file has no executable test cases: ${file}`);
+    }
+    if (!/\bassert\b/.test(content) && !/\bexpect\s*\(/.test(content)) {
+      failures.push(`test file has no assertions: ${file}`);
+    }
+  }
+
+  return { failures, warnings };
+}
+
+export async function verifyDeliverableEvidence({
+  task,
+  projectRoot = process.cwd(),
+  changedFiles = [],
+  createdFiles = [],
+  deletedFiles = [],
+  outOfScopeChanges = [],
+  syntaxValidation = [],
+  hostValidationFallback = null,
+  noChangeExpected = false
+} = {}) {
+  const expectedFiles = uniqueSorted((task && Array.isArray(task.files) ? task.files : [])
+    .map(normalizeRelPath)
+    .filter(isExplicitFilePath));
+  const changedSet = new Set(uniqueSorted([...changedFiles, ...createdFiles].map(normalizeRelPath)));
+  const deletedSet = new Set(uniqueSorted(deletedFiles.map(normalizeRelPath)));
+  const failures = [];
+  const warnings = [];
+  const acceptedEvidence = [];
+  const missingEvidence = [];
+  const readableContents = [];
+  const taskText = normalizeTaskText(task);
+
+  for (const file of uniqueSorted(outOfScopeChanges.map(normalizeRelPath))) {
+    failures.push(`out-of-scope change detected: ${file}`);
+  }
+
+  if (isAnalysisOnlyTask(task)) {
+    const outcome = failures.length > 0 ? 'rejected' : 'not_applicable';
+    return {
+      schemaVersion: 1,
+      outcome,
+      required: failures.length > 0,
+      expectedFiles,
+      requiredExports: [],
+      failures: uniqueSorted(failures),
+      warnings: uniqueSorted(warnings),
+      acceptedEvidence,
+      missingEvidence,
+      source: 'deliverable-verification'
+    };
+  }
+
+  if (expectedFiles.length === 0) {
+    if (noChangeExpected) {
+      const outcome = failures.length > 0 ? 'rejected' : 'not_applicable';
+      return {
+        schemaVersion: 1,
+        outcome,
+        required: failures.length > 0,
+        failures: uniqueSorted(failures),
+        warnings: uniqueSorted(warnings),
+        acceptedEvidence,
+        missingEvidence,
+        source: 'deliverable-verification'
+      };
+    }
+
+    const evidenceFiles = uniqueSorted([...changedFiles, ...createdFiles].map(normalizeRelPath).filter(isExplicitFilePath));
+    if (evidenceFiles.length === 0) {
+      missingEvidence.push('task declares no expected files and no workspace evidence was found');
+      if (hostValidationFallback && hostValidationFallback.used && hostValidationFallback.result === 'passed') {
+        warnings.push('host validation passed but did not provide workspace evidence for expected files');
+      }
+      const outcome = failures.length > 0 ? 'rejected' : 'inconclusive';
+      return {
+        schemaVersion: 1,
+        outcome,
+        required: true,
+        failures: uniqueSorted(failures),
+        warnings: uniqueSorted(warnings),
+        acceptedEvidence,
+        missingEvidence: uniqueSorted(missingEvidence),
+        source: 'deliverable-verification'
+      };
+    }
+
+    for (const file of evidenceFiles) {
+      if (!isSafeRelativePath(file)) {
+        failures.push(`unsafe workspace evidence path: ${file}`);
+        continue;
+      }
+      if (deletedSet.has(file)) {
+        failures.push(`workspace evidence file was deleted: ${file}`);
+        continue;
+      }
+
+      const absolutePath = path.resolve(projectRoot, file);
+      const relative = path.relative(projectRoot, absolutePath);
+      if (!relative || relative.startsWith('..') || path.isAbsolute(relative)) {
+        failures.push(`workspace evidence resolves outside workspace: ${file}`);
+        continue;
+      }
+      if (!await realContained(projectRoot, absolutePath)) {
+        failures.push(`workspace evidence resolves outside workspace: ${file}`);
+        continue;
+      }
+
+      try {
+        const stat = await fs.stat(absolutePath);
+        if (!stat.isFile()) {
+          failures.push(`workspace evidence path is not a file: ${file}`);
+          continue;
+        }
+        if (stat.size === 0) {
+          failures.push(`expected file is empty: ${file}`);
+          continue;
+        }
+        const content = await fs.readFile(absolutePath, 'utf-8');
+        const inspected = inspectFileContent({ file, content, taskText });
+        failures.push(...inspected.failures);
+        warnings.push(...inspected.warnings);
+        acceptedEvidence.push(`file:${file}:size:${stat.size}`);
+      } catch (error) {
+        failures.push(`workspace evidence file cannot be read: ${file}: ${error.message}`);
+      }
+    }
+
+    for (const entry of Array.isArray(syntaxValidation) ? syntaxValidation : []) {
+      if (entry && entry.ok === false && evidenceFiles.includes(normalizeRelPath(entry.path || entry.file))) {
+        failures.push(`syntax validation failed for workspace evidence file: ${normalizeRelPath(entry.path || entry.file)}`);
+      }
+    }
+
+    let outcome = 'verified';
+    if (failures.length > 0) {
+      outcome = 'rejected';
+    } else if (warnings.length > 0) {
+      outcome = 'verified_with_warnings';
+    }
+
+    return {
+      schemaVersion: 1,
+      outcome,
+      required: true,
+      failures: uniqueSorted(failures),
+      warnings: uniqueSorted(warnings),
+      acceptedEvidence: uniqueSorted(acceptedEvidence),
+      missingEvidence: uniqueSorted(missingEvidence),
+      source: 'deliverable-verification'
+    };
+  }
+
+  const requiredExports = uniqueSorted([
+    ...requiredExportsFromTask(task),
+    ...await requiredExportsFromSourceSpec(task, projectRoot)
+  ]);
+
+  for (const file of expectedFiles) {
+    if (!isSafeRelativePath(file)) {
+      failures.push(`unsafe expected file path: ${file}`);
+      continue;
+    }
+    if (deletedSet.has(file)) {
+      failures.push(`expected file was deleted: ${file}`);
+      continue;
+    }
+    if (!changedSet.has(file)) {
+      missingEvidence.push(`expected file has no workspace evidence: ${file}`);
+    }
+
+    const absolutePath = path.resolve(projectRoot, file);
+    const relative = path.relative(projectRoot, absolutePath);
+    if (!relative || relative.startsWith('..') || path.isAbsolute(relative)) {
+      failures.push(`expected file resolves outside workspace: ${file}`);
+      continue;
+    }
+    if (!await realContained(projectRoot, absolutePath)) {
+      failures.push(`expected file resolves outside workspace: ${file}`);
+      continue;
+    }
+
+    try {
+      const stat = await fs.stat(absolutePath);
+      if (!stat.isFile()) {
+        failures.push(`expected path is not a file: ${file}`);
+        continue;
+      }
+      if (stat.size === 0) {
+        failures.push(`expected file is empty: ${file}`);
+        continue;
+      }
+      const content = await fs.readFile(absolutePath, 'utf-8');
+      readableContents.push({ file, content });
+      const inspected = inspectFileContent({ file, content, taskText });
+      failures.push(...inspected.failures);
+      warnings.push(...inspected.warnings);
+      acceptedEvidence.push(`file:${file}:size:${stat.size}`);
+    } catch (error) {
+      failures.push(`expected file cannot be read: ${file}: ${error.message}`);
+    }
+  }
+
+  const exportCandidateFiles = expectedFiles.filter(file =>
+    ['.mjs', '.js'].includes(path.extname(file).toLowerCase()) && !isTestFile(file)
+  );
+  if (exportCandidateFiles.length > 0) {
+    const exportCandidateContents = readableContents.filter(entry => exportCandidateFiles.includes(entry.file));
+    for (const exportedName of requiredExports) {
+      if (!exportCandidateContents.some(entry => hasExport(entry.content, exportedName))) {
+        failures.push(`required export missing in expected implementation files: ${exportedName}`);
+      }
+    }
+  }
+
+  for (const entry of Array.isArray(syntaxValidation) ? syntaxValidation : []) {
+    if (entry && entry.ok === false && expectedFiles.includes(normalizeRelPath(entry.path || entry.file))) {
+      failures.push(`syntax validation failed for expected file: ${normalizeRelPath(entry.path || entry.file)}`);
+    }
+  }
+
+  if (hostValidationFallback && hostValidationFallback.used && hostValidationFallback.result === 'passed' && missingEvidence.length > 0) {
+    warnings.push('host validation passed but did not provide workspace evidence for expected files');
+  }
+
+  let outcome = 'verified';
+  if (failures.length > 0) {
+    outcome = 'rejected';
+  } else if (missingEvidence.length > 0) {
+    outcome = 'inconclusive';
+  } else if (warnings.length > 0) {
+    outcome = 'verified_with_warnings';
+  }
+
+  return {
+    schemaVersion: 1,
+    outcome,
+    required: true,
+    expectedFiles,
+    requiredExports,
+    failures: uniqueSorted(failures),
+    warnings: uniqueSorted(warnings),
+    acceptedEvidence: uniqueSorted(acceptedEvidence),
+    missingEvidence: uniqueSorted(missingEvidence),
+    source: 'deliverable-verification'
+  };
+}