feat(reporting-governance): wire profile artifacts into contract and orchestrator

plugins/reporting-governance/test/profile-artifact.test.mjs

@@ -3,7 +3,11 @@ import assert from 'node:assert/strict';
 import fs from 'node:fs';
 import path from 'node:path';
 
-import { loadDeploymentProfileArtifact, createDeploymentBindingContract } from '../src/storage/profile-artifact.mjs';
+import {
+  loadDeploymentProfileArtifact,
+  createDeploymentBindingContract,
+  validateDeploymentProfileArtifact,
+} from '../src/storage/profile-artifact.mjs';
 import { createRuntimeBinding } from '../src/adapters/index.mjs';
 
 const packageRoot = path.resolve(import.meta.dirname, '..');
@@ -45,3 +49,58 @@ test('runtime binding can be instantiated from profile artifact binding contract
   assert.equal(runtimeBinding.scripts.bridgeSupervisor, contract.scripts.bridgeSupervisor);
   assert.equal(runtimeBinding.scripts.senderBinding, contract.scripts.senderBinding);
 });
+
+test('deployment profile artifact validation fails closed on boundary drift', () => {
+  assert.throws(
+    () => validateDeploymentProfileArtifact({}),
+    /kind must be DeploymentProfileArtifact/
+  );
+
+  assert.throws(
+    () => validateDeploymentProfileArtifact({
+      kind: 'DeploymentProfileArtifact',
+      apiVersion: 'reporting-governance/v1alpha1',
+      spec: {
+        package: { pluginVersion: '0.1.0-mainline' },
+        bindings: {
+          entrypoint: '',
+          scripts: { watchdog: 'scripts/long_task_watchdog.mjs' },
+          artifact_roots: { queueItems: 'state/operator-notify-queue' },
+        },
+      },
+    }),
+    /spec\.bindings\.entrypoint must be a non-empty string/
+  );
+
+  assert.throws(
+    () => validateDeploymentProfileArtifact({
+      kind: 'DeploymentProfileArtifact',
+      apiVersion: 'reporting-governance/v1alpha1',
+      spec: {
+        package: { pluginVersion: '' },
+        bindings: {
+          entrypoint: 'scripts/watchdog_auto_notify_orchestrator.mjs',
+          scripts: { watchdog: '' },
+          artifact_roots: { queueItems: 'state/operator-notify-queue' },
+        },
+      },
+    }),
+    /spec\.package\.pluginVersion must be a non-empty string/
+  );
+
+  assert.throws(
+    () => validateDeploymentProfileArtifact({
+      kind: 'DeploymentProfileArtifact',
+      apiVersion: 'reporting-governance/v1alpha1',
+      spec: {
+        package: { pluginVersion: '0.1.0-mainline' },
+        bindings: {
+          entrypoint: 'scripts/watchdog_auto_notify_orchestrator.mjs',
+          scripts: [],
+          artifact_roots: { queueItems: 'state/operator-notify-queue' },
+        },
+      },
+    }),
+    /spec\.bindings\.scripts must be an object record/
+  );
+});