#!/usr/bin/env python3
"""Deterministic verification checks for Kaiju router outputs."""
from __future__ import annotations
import json
from pathlib import Path
from typing import Any
FORBIDDEN_TOKENS = ["sk_live_", "sk_test_", "rk_live_", "pplx-", "AIza", "anthropic_api_key"]
def check(name: str, ok: bool, detail: str) -> dict[str, Any]:
return {"name": name, "ok": bool(ok), "detail": detail}
def read_text(path: Path | None) -> str:
if path is None or not path.exists() or not path.is_file():
return ""
return path.read_text(encoding="utf-8")
def read_project_files(project_dir: Path | None) -> dict[str, str]:
if project_dir is None or not project_dir.exists():
return {}
files: dict[str, str] = {}
for path in project_dir.rglob("*"):
if path.is_file() and path.stat().st_size < 500_000:
files[str(path.relative_to(project_dir))] = path.read_text(encoding="utf-8")
return files
def no_forbidden_tokens(text: str) -> bool:
lower = text.lower()
return not any(token.lower() in lower for token in FORBIDDEN_TOKENS)
def package_has_scripts(package_text: str, scripts: list[str]) -> bool:
try:
package = json.loads(package_text or "{}")
except json.JSONDecodeError:
return False
package_scripts = package.get("scripts", {}) if isinstance(package, dict) else {}
return all(script in package_scripts for script in scripts)
def verify_output(
*,
task_type: str,
artifact_path: Path | None,
project_dir: Path | None,
changed_files: list[str],
response_text: str,
spec: dict[str, Any],
) -> list[dict[str, Any]]:
artifact_text = read_text(artifact_path)
project_files = read_project_files(project_dir)
combined = "\n".join([artifact_text, response_text, json.dumps(spec, ensure_ascii=False), *project_files.values()])
lower_artifact = artifact_text.lower()
lower_combined = combined.lower()
results: list[dict[str, Any]] = [
check("artifact_or_project_exists", bool(artifact_text or project_files), "artifact file or project/repo files exist"),
check("changed_files_present", len(changed_files) > 0, "changed files were reported"),
check("no_hardcoded_secrets", no_forbidden_tokens(combined), "no obvious provider secret tokens found"),
]
if task_type == "website":
results.extend(
[
check("complete_html", all(token in lower_artifact for token in [""]), "HTML document is complete"),
check("required_sections", all(token in lower_artifact for token in ['id="services"', 'id="pricing"', 'id="hours"', 'id="contact"']), "required business sections exist"),
check("external_images", "![]()
", "viewport"]), "HTML artifacts are complete and responsive"),
check("growth_artifacts", "score,company" in project_files.get("08-lead-generator/prospects.csv", "").lower() and "stage,lead" in project_files.get("09-sales-closer/pipeline.csv", "").lower(), "lead and sales CSV artifacts exist"),
check("no_owner_developer_setup", "open a terminal" not in readme and "create an oauth app" not in readme, "owner-facing docs avoid developer setup"),
]
)
elif task_type == "coding":
results.extend(
[
check("markdown_title", artifact_text.lstrip().startswith("# "), "coding artifact starts with a Markdown title"),
check("code_blocks", "```ts" in artifact_text or "```typescript" in lower_artifact, "TypeScript code block exists"),
check("tests_present", "describe(" in artifact_text and "expect(" in artifact_text, "Vitest-style tests exist"),
check("state_config_safety", all(term in lower_artifact for term in ["state", "config", "safety", "verification"]), "state/config/safety/verification sections exist"),
]
)
elif task_type == "app":
results.extend(
[
check("complete_html", all(token in lower_artifact for token in [""]), "app HTML document is complete"),
check("interactive_form", " list[str]:
return [f"{item['name']}: {item['detail']}" for item in results if not item.get("ok")]