def validate_structured_output(payload, schema, allow_extra):
    return {'valid': ..., 'errors': [...]} 

1. require declared fields
2. check primitive and enum types
3. apply an explicit unknown-key policy

• Use only the Python standard library.
• Return deterministic values so every run can be compared with the contract.
• Do not mutate caller-owned inputs.