code-foundry 1.10.1 → 1.11.0

package/.github/code-foundry.yml

@@ -23,7 +23,11 @@ unit_runner: ubuntu-slim
 performance_runner: ubuntu-latest
 cache_packages: auto
 cache_build: auto
+required_capabilities:
+coverage_enforcement: auto
 coverage_minimum: 80
+coverage_metrics: lines
+coverage_report:
 turbo_remote: auto
 ci_runner: ubuntu-latest
 test_runner: ubuntu-latest

package/.github/workflows/ci.yml

@@ -63,6 +63,7 @@ jobs:
           sparse-checkout: |
             .github/actions
             src/lib
+            src/runtime-core.mjs
             src/runtime.mjs
       - name: Install runtime
         run: |
@@ -107,6 +108,7 @@ jobs:
           sparse-checkout: |
             .github/actions
             src/lib
+            src/runtime-core.mjs
             src/runtime.mjs
       - name: Install runtime
         run: |
@@ -146,6 +148,7 @@ jobs:
           sparse-checkout: |
             .github/actions
             src/lib
+            src/runtime-core.mjs
             src/runtime.mjs
       - name: Install runtime
         run: |
@@ -190,6 +193,7 @@ jobs:
           sparse-checkout: |
             .github/actions
             src/lib
+            src/runtime-core.mjs
             src/runtime.mjs
       - name: Install runtime
         run: |

package/.github/workflows/codeql.yml

@@ -118,6 +118,7 @@ jobs:
           sparse-checkout: |
             .github/actions
             src/lib
+            src/runtime-core.mjs
             src/runtime.mjs
       - name: Install runtime
         run: |
@@ -210,6 +211,7 @@ jobs:
           sparse-checkout: |
             .github/actions
             src/lib
+            src/runtime-core.mjs
             src/runtime.mjs
       - name: Install runtime
         if: ${{ matrix.entry.changed == true }}

package/.github/workflows/security.yml

@@ -88,6 +88,7 @@ jobs:
           sparse-checkout: |
             .github/actions
             src/lib
+            src/runtime-core.mjs
             src/runtime.mjs
       - name: Install runtime
         run: |
@@ -210,6 +211,7 @@ jobs:
           sparse-checkout: |
             .github/actions
             src/lib
+            src/runtime-core.mjs
             src/runtime.mjs
       - name: Install runtime
         run: |

package/.github/workflows/test.yml

@@ -78,6 +78,7 @@ jobs:
           sparse-checkout: |
             .github/actions
             src/lib
+            src/runtime-core.mjs
             src/runtime.mjs
       - name: Install runtime
         run: |
@@ -143,6 +144,7 @@ jobs:
           sparse-checkout: |
             .github/actions
             src/lib
+            src/runtime-core.mjs
             src/runtime.mjs
       - name: Install runtime
         run: |
@@ -208,6 +210,7 @@ jobs:
           sparse-checkout: |
             .github/actions
             src/lib
+            src/runtime-core.mjs
             src/runtime.mjs
       - name: Install runtime
         run: |
@@ -257,6 +260,7 @@ jobs:
           sparse-checkout: |
             .github/actions
             src/lib
+            src/runtime-core.mjs
             src/runtime.mjs
       - name: Install runtime
         run: |
@@ -318,6 +322,7 @@ jobs:
           sparse-checkout: |
             .github/actions
             src/lib
+            src/runtime-core.mjs
             src/runtime.mjs
       - name: Install runtime
         run: |

package/.github/workflows/validation-no-codeql.yml

@@ -143,6 +143,7 @@ jobs:
           path: .github/.code-foundry
           sparse-checkout: |
             src/lib
+            src/runtime-core.mjs
             src/runtime.mjs
       - name: Install runtime
         run: mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"

package/.github/workflows/validation.yml

@@ -155,6 +155,7 @@ jobs:
           path: .github/.code-foundry
           sparse-checkout: |
             src/lib
+            src/runtime-core.mjs
             src/runtime.mjs
       - name: Install runtime
         run: mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"

package/.github/workflows/validation_self-ci.yml

@@ -45,6 +45,7 @@ jobs:
           path: .github/.code-foundry
           sparse-checkout: |
             src/lib
+            src/runtime-core.mjs
             src/runtime.mjs
       - name: Install runtime
         run: mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.11.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.10.1...v1.11.0) (2026-09-09)
+
+
+### Features
+
+* **validation:** enforce required capabilities, coverage, and task evidence ([#534](https://github.com/0xPlayerOne/code-foundry/issues/534)) ([2e341d9](https://github.com/0xPlayerOne/code-foundry/commit/2e341d94381599f1d78ec1394d42883157b30ea6))
+
 ## [1.10.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.10.0...v1.10.1) (2026-09-09)
 
 

package/docs/CONFIGURATION.md

@@ -36,10 +36,15 @@ repository manifests and source
 | `package_manager`          | `bun`, `pnpm`, `yarn`, `npm`, `none`                                             | JavaScript setup                                                                                                    |
 | `toolchain`                | `auto`, `native`, `mise`                                                         | Environment setup policy; defaults to `auto`                                                                        |
 | `staging_validation_mode`  | `fast`, `audit`                                                                  | Staging-release-only validation tier; omitted from direct repositories                                              |
-| `performance`              | `auto`, `true`, `false`                                                          | Run a deterministic performance task when a supported entrypoint exists; defaults to `auto`                         |
+| `performance`              | `auto`, `true`, `false`                                                          | `auto` discovers an optional task; `true` requires a supported performance entrypoint; `false` disables discovery   |
 | `performance_command`      | JSON argv array or array of argv arrays                                          | One or more ordered commands for non-package harnesses; package scripts take precedence                             |
 | `performance_profile`      | empty, `node-package`                                                            | Optional shared package import, memory, archive, and dependency budget harness                                      |
 | `performance_budget_file`  | repository path                                                                  | Budget policy for the shared package harness; defaults to `performance-package-budgets.json`                        |
+| `required_capabilities`    | comma-separated task names                                                       | Fail closed when a required task or `coverage` evidence is unavailable; defaults to none                            |
+| `coverage_enforcement`     | `auto`, `required`, `off`                                                        | Shared coverage report policy; `auto` accepts explicit skips, `required` rejects missing reports, `off` skips it    |
+| `coverage_minimum`         | percentage from `0` to `100`                                                     | Minimum measured coverage; defaults to `80`                                                                         |
+| `coverage_metrics`         | `lines`, `functions`, `branches`, `statements`                                   | Metrics checked by the shared coverage gate; defaults to `lines`                                                    |
+| `coverage_report`          | comma-separated repository paths                                                 | Istanbul summary or LCOV evidence files; defaults to standard coverage paths                                        |
 | `features`                 | `all` or a list                                                                  | Standard workflow callers                                                                                           |
 | `codeql`                   | `auto`, `true`, `false`                                                          | CodeQL policy; public repositories default to enabled, non-public repositories default to disabled                  |
 | `codeql_rust_shards`       | JSON array of paths                                                              | Rust scan scopes; `["all"]` keeps the safe single full scan                                                         |

package/docs/README.md

@@ -13,6 +13,7 @@ its own names, environments, and deployment details.
 - [Publishing packages](PUBLISHING.md)
 - [Caching and remote caching](CACHING.md)
 - [Performance budgets and baselines](PERFORMANCE.md)
+- [Required capabilities and task evidence](required-capabilities.md)
 
 ## Repository-specific documentation
 

package/docs/required-capabilities.md

@@ -0,0 +1,82 @@
+# Required capabilities and task evidence
+
+Declared requirements fail closed when discovery cannot find an executable task.
+Existing optional task discovery remains available. Configure scalar values in
+`.github/code-foundry.yml`:
+
+```yaml
+required_capabilities: type_check,unit,e2e,performance,coverage
+performance: true
+coverage_enforcement: required
+coverage_minimum: 80
+coverage_metrics: lines,branches
+coverage_report: coverage/coverage-summary.json
+```
+
+Supported task capabilities are `format`, `lint`, `type_check`, `build`, `unit`,
+`integration`, `e2e`, `smoke`, and `performance`. `coverage` additionally requires
+unit tests. Unknown names, contradictory requirements, and invalid thresholds
+are errors. `performance: true` now means required, not merely enabled when a
+script happens to exist. Use `performance: auto` to retain optional discovery.
+
+The public `src/runtime.mjs` entrypoint delegates ecosystem execution to the
+unchanged private `src/runtime-core.mjs`. Keep both files and `src/lib` when
+vendoring the runtime. Published packages and the reusable workflows' existing
+cone-mode sparse checkout include both files. Do not call the private executor
+from consumer CI: it intentionally does not enforce the public policy contract.
+
+## Coverage migration
+
+`coverage_enforcement` accepts:
+
+- `auto` (default): missing reports are explicitly reported as skipped; present
+  reports must be fresh, valid, and meet the threshold.
+- `required`: missing reports also fail, as does required capability `coverage`.
+- `off`: skip the shared report gate. This does not disable a test runner's own
+  coverage threshold, and cannot be combined with required coverage.
+
+The default report candidates are `coverage/coverage-summary.json` (Istanbul
+summary) and `coverage/lcov.info`. `coverage_report` accepts a comma-separated
+list of repository-relative files. When multiple reports exist, every report
+must meet the selected metrics. Percentages are recomputed from measured counts,
+not trusted from reported `pct` fields. Empty reports, unmeasured selected
+metrics, stale files, traversal, and escaping symlinks fail. LCOV supports lines,
+functions, and branches; use JSON summaries for statement coverage.
+
+Configure the repository-owned unit-test command to generate the report on each
+run before enabling required mode. The runtime does not inject coverage tooling,
+install a new runner, delete old reports, or lower thresholds. Auto mode preserves
+repos that declare a threshold but have not yet configured report generation;
+a passing unit task with `coverage.status: skipped` is **not** coverage evidence.
+
+## Results and validation tiers
+
+Each executed CI task writes `.code-foundry/results/<task>.json`, including its
+status (`passed`, `failed`, or `skipped`), discovery reason, delegated command and
+exit status, source SHA when available, timestamps, and evidence paths. Coverage
+has its own nested status. Discovery also records optional skips. Task reports
+appear in the GitHub job summary when `GITHUB_STEP_SUMMARY` is available.
+
+The recorded command is the delegated executor invocation, not a transcript of
+all nested package scripts. No environment variables or captured command output
+are copied into the report. Repository scripts remain responsible for sanitizing
+their own logs. Upload `.code-foundry/results/*.json` with `if: always()` and
+`include-hidden-files: true` to retain downloadable reports; only upload this
+specific directory, not arbitrary hidden files or the entire checkout.
+
+`node src/runtime.mjs ci plan` prints a JSON discovery plan without executing
+checks. Discovery validates every required task before reusable workflows select
+jobs. A fast/unit-only tier is still a subset: discovery proves that E2E exists,
+not that E2E ran. Require the existing audit validation gate before merging.
+
+Native task detection rejects known no-ops such as a JavaScript project with no
+build script or a Python project with no supported type-check command. Add a
+repository-owned script for unsupported layouts or toolchains. Do not infer that
+an installed package manager or discovered project proves task execution.
+
+## Verification
+
+`node --test test/task-policy.test.mjs` exercises policy parsing, discovery,
+coverage parsing/thresholds/freshness/path safety, exit propagation, and reports
+with a deterministic executor fixture. The unchanged ecosystem executor remains
+covered by `test/runtime.test.mjs` in the full suite.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.10.1",
+  "version": "1.11.0",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/sync.mjs

@@ -1288,7 +1288,11 @@ function createDefaultConfig(root, source, configuredWorkflow) {
     prune_standard: 'false',
     cache_packages: 'auto',
     cache_build: 'auto',
+    required_capabilities: '',
+    coverage_enforcement: 'auto',
     coverage_minimum: '80',
+    coverage_metrics: 'lines',
+    coverage_report: '',
     turbo_remote: 'auto',
     release_type: detectPackageManager(root) === 'none' ? 'auto' : 'node',
     npm_publish: 'false',

package/src/lib/task-policy.mjs

@@ -0,0 +1,290 @@
+// @ts-check
+
+import { existsSync, readFileSync, realpathSync, statSync } from 'node:fs'
+import { spawnSync } from 'node:child_process'
+import { isAbsolute, relative, resolve, sep } from 'node:path'
+import { createHash } from 'node:crypto'
+import { listValue, readConfig } from './config.mjs'
+
+export const TASKS = Object.freeze([
+  'format',
+  'lint',
+  'type_check',
+  'build',
+  'unit',
+  'integration',
+  'e2e',
+  'smoke',
+  'performance',
+])
+
+/** @type {Readonly<Record<string, readonly string[]>>} */
+export const TASK_SCRIPTS = Object.freeze({
+  format: ['format:check', 'format', 'fmt'],
+  lint: ['lint'],
+  type_check: ['type-check', 'typecheck', 'type:check'],
+  build: ['build'],
+  unit: ['test:unit', 'test:coverage', 'test'],
+  integration: ['test:integration'],
+  e2e: ['test:e2e', 'e2e'],
+  smoke: ['test:smoke', 'smoke'],
+  performance: ['performance:check', 'perf:check'],
+})
+
+/** @param {string} root */
+export function readTaskPolicy(root) {
+  const config = readConfig(resolve(root, '.github/code-foundry.yml'))
+  const required = listValue(config.required_capabilities ?? '')
+  for (const capability of required) {
+    if (![...TASKS, 'coverage'].includes(capability))
+      throw new Error(`Unknown required capability: ${capability}`)
+  }
+  if (!['true', 'false', 'auto'].includes(config.performance ?? 'auto'))
+    throw new Error('performance must be true, false, or auto')
+  const coverageMode = config.coverage_enforcement ?? 'auto'
+  if (!['auto', 'required', 'off'].includes(coverageMode))
+    throw new Error('coverage_enforcement must be auto, required, or off')
+  if (required.includes('coverage') && coverageMode === 'off')
+    throw new Error('Required coverage cannot use coverage_enforcement: off')
+  if (required.includes('performance') && config.performance === 'false')
+    throw new Error('Required performance cannot use performance: false')
+  if (config.performance === 'true' && !required.includes('performance'))
+    required.push('performance')
+  const coverageRequired = required.includes('coverage') || coverageMode === 'required'
+  if (coverageRequired && !required.includes('unit')) required.push('unit')
+  const minimum = Number(config.coverage_minimum ?? '80')
+  if (!Number.isFinite(minimum) || minimum < 0 || minimum > 100)
+    throw new Error('coverage_minimum must be a finite percentage between 0 and 100')
+  const metrics = listValue(config.coverage_metrics ?? 'lines')
+  if (
+    !metrics.length ||
+    metrics.some(
+      (metricName) => !['lines', 'functions', 'branches', 'statements'].includes(metricName)
+    )
+  )
+    throw new Error('coverage_metrics must select lines, functions, branches, or statements')
+  return { config, required, coverageMode, coverageRequired, minimum, metrics }
+}
+
+/** @param {string} root @returns {Record<string, any>} */
+export function readTaskPackage(root) {
+  const file = resolve(root, 'package.json')
+  if (!existsSync(file)) return {}
+  const value = JSON.parse(readFileSync(file, 'utf8'))
+  if (!value || typeof value !== 'object' || Array.isArray(value))
+    throw new Error('package.json must contain an object')
+  return value
+}
+
+/**
+ * Explain the core's applicability decision and reject known native no-ops.
+ * Discovery is not execution; a native command may still fail at run time.
+ * @param {string} root
+ * @param {string} task
+ * @param {Record<string, string>} profile
+ */
+export function describeTask(root, task, profile) {
+  if (!TASKS.includes(task)) throw new Error(`Unknown CI task: ${task}`)
+  const policy = readTaskPolicy(root)
+  const pkg = readTaskPackage(root)
+  const script = TASK_SCRIPTS[task]?.find((name) => {
+    const value = pkg.scripts?.[name]
+    return typeof value === 'string' && value.trim().length > 0
+  })
+  const required = policy.required.includes(task)
+  let applicable = profile.applicable === 'true'
+  let reason = applicable ? 'native runtime discovery' : 'no supported entrypoint was discovered'
+  if (script && applicable) reason = `package-script:${script}`
+  if (applicable && !script && ['format', 'lint', 'type_check', 'build'].includes(task)) {
+    const rust = profile.rust === 'true' && existsSync(resolve(root, 'Cargo.toml'))
+    const python =
+      profile.python === 'true' &&
+      (existsSync(resolve(root, 'pyproject.toml')) ||
+        existsSync(resolve(root, 'requirements.txt')) ||
+        existsSync(resolve(root, 'uv.lock')))
+    const js = profile.javascript === 'true' && existsSync(resolve(root, 'package.json'))
+    const native =
+      rust ||
+      (['format', 'lint'].includes(task) && python) ||
+      (task === 'type_check' && existsSync(resolve(root, 'tsconfig.json'))) ||
+      (js && task === 'format' && hasNativeToolSetup(root, pkg, 'oxfmt')) ||
+      (js && task === 'lint' && hasNativeToolSetup(root, pkg, 'oxlint'))
+    if (!native) {
+      applicable = false
+      reason = 'repository detected, but no executable script or supported native fallback exists'
+    }
+  }
+  if (required && !applicable) throw new Error(`Required capability ${task}: ${reason}`)
+  return {
+    task,
+    applicable,
+    required,
+    reason,
+    source: script ? `package-script:${script}` : 'runtime',
+  }
+}
+
+/** @param {string} root @returns {string[]} */
+function repositoryFiles(root) {
+  const result = spawnSync('git', ['ls-files'], { cwd: root, encoding: 'utf8' })
+  return result.status === 0 ? result.stdout.split(/\r?\n/).filter(Boolean) : []
+}
+
+/** @param {string} root @param {Record<string, any>} pkg @param {'oxfmt'|'oxlint'} tool */
+function hasNativeToolSetup(root, pkg, tool) {
+  const dependencies = {
+    ...pkg.dependencies,
+    ...pkg.devDependencies,
+    ...pkg.optionalDependencies,
+    ...pkg.peerDependencies,
+  }
+  if (dependencies[tool]) return true
+  if (
+    Object.values(pkg.scripts ?? {}).some((value) =>
+      new RegExp(`\\b${tool}\\b`).test(String(value))
+    )
+  )
+    return true
+  const config =
+    tool === 'oxfmt'
+      ? /(^|\/)(\.oxfmtrc\.json|oxfmt\.config\.[^/]*)$/
+      : /(^|\/)(\.oxlintrc\.json|oxlint\.config\.[^/]*)$/
+  return repositoryFiles(root).some((file) => config.test(file))
+}
+
+/** Repository-owned evidence must never escape the checkout through paths or symlinks.
+ * @param {string} root @param {string} file
+ */
+export function evidencePath(root, file) {
+  if (!file || isAbsolute(file)) throw new Error('Evidence paths must be repository-relative')
+  const base = realpathSync(root)
+  const target = resolve(base, file)
+  const inside = relative(base, target)
+  if (inside === '..' || inside.startsWith(`..${sep}`))
+    throw new Error(`Evidence path escapes repository: ${file}`)
+
+  // Resolve the deepest existing ancestor so a missing report cannot hide
+  // behind a symlinked directory outside the checkout.
+  let existing = target
+  while (!existsSync(existing)) {
+    const parent = resolve(existing, '..')
+    if (parent === existing) break
+    existing = parent
+  }
+  const actual = relative(base, realpathSync(existing))
+  if (actual === '..' || actual.startsWith(`..${sep}`))
+    throw new Error(`Evidence symlink escapes repository: ${file}`)
+  if (existsSync(target) && !statSync(target).isFile())
+    throw new Error(`Evidence must be a regular file: ${file}`)
+  return target
+}
+
+/** @param {string} root @param {ReturnType<typeof readTaskPolicy>} policy */
+export function coverageFiles(root, policy) {
+  const configured = listValue(policy.config.coverage_report ?? '')
+  return (
+    configured.length ? configured : ['coverage/coverage-summary.json', 'coverage/lcov.info']
+  ).map((file) => ({ file, path: evidencePath(root, file) }))
+}
+
+/** @param {string} path */
+export function fingerprint(path) {
+  if (!existsSync(path)) return null
+  const stat = statSync(path)
+  return `${stat.mtimeMs}:${stat.ctimeMs}:${stat.size}:${createHash('sha256').update(readFileSync(path)).digest('hex')}`
+}
+
+/** @param {number} total @param {number} covered @param {string} label */
+function metric(total, covered, label) {
+  if (
+    !Number.isSafeInteger(total) ||
+    !Number.isSafeInteger(covered) ||
+    total < 0 ||
+    covered < 0 ||
+    covered > total
+  )
+    throw new Error(`Invalid coverage counts for ${label}`)
+  return { total, covered, percent: total ? (covered * 100) / total : null }
+}
+
+/** @param {string} content @param {'json'|'lcov'} format */
+export function parseCoverage(content, format) {
+  /** @type {Record<string, {total: number, covered: number, percent: number|null}>} */
+  const metrics = {}
+  if (format === 'json') {
+    const report = JSON.parse(content)
+    if (!report?.total || typeof report.total !== 'object')
+      throw new Error('Coverage summary is missing total')
+    for (const name of ['lines', 'functions', 'branches', 'statements']) {
+      if (report.total[name])
+        metrics[name] = metric(report.total[name].total, report.total[name].covered, name)
+    }
+  } else {
+    const fields = { lines: ['LF', 'LH'], functions: ['FNF', 'FNH'], branches: ['BRF', 'BRH'] }
+    const records = content.split(/end_of_record\s*(?:\r?\n|$)/).filter((record) => record.trim())
+    if (!records.length) throw new Error('LCOV report contains no records')
+    for (const record of records) {
+      if (!/^SF:.+/m.test(record)) throw new Error('LCOV record is missing SF')
+      for (const [name, [totalKey, hitKey]] of Object.entries(fields)) {
+        const totalMatch = record.match(new RegExp(`^${totalKey}:(\\d+)\\r?$`, 'm'))
+        const hitMatch = record.match(new RegExp(`^${hitKey}:(\\d+)\\r?$`, 'm'))
+        if (!totalMatch && !hitMatch) continue
+        if (!totalMatch || !hitMatch) throw new Error(`Incomplete LCOV ${name} counts`)
+        const current = metric(Number(totalMatch[1]), Number(hitMatch[1]), name)
+        const previous = metrics[name] ?? { total: 0, covered: 0 }
+        metrics[name] = metric(
+          previous.total + current.total,
+          previous.covered + current.covered,
+          name
+        )
+      }
+    }
+  }
+  if (!metrics.lines?.total) throw new Error('Coverage report measured no lines')
+  return metrics
+}
+
+/**
+ * Auto enforces present reports but reports absence explicitly. Required mode also
+ * rejects absent/stale reports. Reports are never deleted to manufacture freshness.
+ * @param {string} root
+ * @param {ReturnType<typeof readTaskPolicy>} policy
+ * @param {Record<string, string|null>} before
+ */
+export function evaluateCoverage(root, policy, before) {
+  if (policy.coverageMode === 'off')
+    return { status: 'skipped', reason: 'coverage enforcement explicitly disabled', artifacts: [] }
+  const files = coverageFiles(root, policy).filter(({ path }) => existsSync(path))
+  if (!files.length) {
+    if (policy.coverageRequired) throw new Error('Required coverage report was not produced')
+    return {
+      status: 'skipped',
+      reason: 'no coverage report; set coverage_enforcement: required to require evidence',
+      artifacts: [],
+    }
+  }
+  const reports = files.map(({ file, path }) => {
+    if (fingerprint(path) === before[file])
+      throw new Error(`Coverage report was not refreshed by this run: ${file}`)
+    const metrics = parseCoverage(
+      readFileSync(path, 'utf8'),
+      file.endsWith('.info') ? 'lcov' : 'json'
+    )
+    for (const name of policy.metrics) {
+      const value = metrics[name]
+      if (!value || value.percent === null)
+        throw new Error(`Coverage report has no measured ${name}: ${file}`)
+      if (value.percent < policy.minimum)
+        throw new Error(
+          `${name} coverage ${value.percent.toFixed(2)}% is below ${policy.minimum}% (${file})`
+        )
+    }
+    return { file, metrics }
+  })
+  return {
+    status: 'passed',
+    reason: 'fresh coverage meets configured thresholds',
+    artifacts: files.map(({ file }) => file),
+    reports,
+  }
+}