fix: harden career report producer contracts

scripts/career-report.test.ts

@@ -8,29 +8,29 @@ import {
 import type { HomeInsightSnapshots, InsightSnapshot } from "../src/v1/analytics/home-insight-snapshot.js";
 import type { QscoreProxyResult } from "../src/services/qscore-proxy.js";
 
-const categoryIds = [
-  "learning_credentials",
-  "resume_presence",
-  "linkedin_presence",
-  "matching_activity",
-  "interview_performance",
-  "pathway_progress",
-  "roleplay_performance",
-  "engagement_consistency",
-  "goals_readiness",
+const categorySpecs = [
+  ["learning_credentials", "Learning & Credentials"],
+  ["resume_presence", "Resume Presence"],
+  ["linkedin_presence", "LinkedIn Presence"],
+  ["matching_activity", "Matching Activity"],
+  ["interview_performance", "Interview Performance"],
+  ["pathway_progress", "Pathway Progress"],
+  ["roleplay_performance", "Roleplay Performance"],
+  ["engagement_consistency", "Engagement & Consistency"],
+  ["goals_readiness", "Goals & Readiness"],
 ];
 
 function displayFixture() {
   let signalIndex = 0;
-  const categories = categoryIds.map((id, categoryIndex) => {
-    const count = categoryIndex === categoryIds.length - 1 ? 3 : 8;
+  const categories = categorySpecs.map(([id, label], categoryIndex) => {
+    const count = categoryIndex === categorySpecs.length - 1 ? 3 : 8;
     const signals = Array.from({ length: count }, () => {
       const index = signalIndex++;
       return { id: `signal.${index}`, label: `Signal ${index}`, present: index < 4, score: index < 4 ? 50 : 0 };
     });
     return {
       id,
-      label: id,
+      label,
       input_ids: [`input_${categoryIndex}`],
       weight_percent: 10,
       score: signals.some((signal) => signal.present) ? 50 : 0,
@@ -162,6 +162,73 @@ assert.equal(report.sources.find((source) => source.id === "grow_events")?.statu
 const malformed = structuredClone(displayFixture());
 malformed.registered_signal_count = 66;
 assert.equal(parseCareerReportDisplay(malformed), null, "mislabelled canonical display must be rejected");
+const reportWithMalformedDisplay = buildCareerReportProjection({
+  profile: { status: "ready", data: {} },
+  qscore: { status: "ready", data: { ...qscore, breakdown: { display: malformed } } },
+  qscoreHistory: { status: "ready", data: [] },
+  snapshots,
+  producerStatuses,
+  activity,
+});
+assert.equal(reportWithMalformedDisplay.rqScore.display.status, "unavailable");
+assert.equal(reportWithMalformedDisplay.rqScore.display.value, null);
+assert.equal(reportWithMalformedDisplay.rqScore.display.reason, "display_contract_invalid");
+
+const wrongCategoryId = structuredClone(displayFixture());
+wrongCategoryId.categories[0].id = "not_a_canonical_category";
+assert.equal(parseCareerReportDisplay(wrongCategoryId), null, "wrong category ids must be rejected");
+
+const wrongCategoryOrder = structuredClone(displayFixture());
+[wrongCategoryOrder.categories[0], wrongCategoryOrder.categories[1]] = [wrongCategoryOrder.categories[1], wrongCategoryOrder.categories[0]];
+assert.equal(parseCareerReportDisplay(wrongCategoryOrder), null, "canonical categories out of order must be rejected");
+
+const outOfRangeCategoryScore = structuredClone(displayFixture());
+outOfRangeCategoryScore.categories[0].score = 101;
+assert.equal(parseCareerReportDisplay(outOfRangeCategoryScore), null, "category scores above 100 must be rejected");
+
+const outOfRangeSignalScore = structuredClone(displayFixture());
+outOfRangeSignalScore.categories[0].signals[0].score = -1;
+assert.equal(parseCareerReportDisplay(outOfRangeSignalScore), null, "signal scores below zero must be rejected");
+
+const outOfRangeWeight = structuredClone(displayFixture());
+outOfRangeWeight.categories[0].weight_percent = 101;
+assert.equal(parseCareerReportDisplay(outOfRangeWeight), null, "category weights above 100 must be rejected");
+
+const duplicatedSignal = structuredClone(displayFixture());
+duplicatedSignal.categories[1].signals[0].id = duplicatedSignal.categories[0].signals[0].id;
+assert.equal(parseCareerReportDisplay(duplicatedSignal), null, "signals assigned more than once must be rejected");
+
+const categoryCountMismatch = structuredClone(displayFixture());
+categoryCountMismatch.categories[0].present_rules += 1;
+assert.equal(parseCareerReportDisplay(categoryCountMismatch), null, "category count mismatches must be rejected");
+
+const malformedOnboarding = buildCareerReportProjection({
+  profile: {
+    status: "ready",
+    data: {
+      preferences: {
+        onboarding: {
+          responses: {
+            target_role: 42,
+            desired_outcomes: ["Real goal", 7],
+          },
+        },
+      },
+    },
+  },
+  qscore: { status: "ready", data: qscore },
+  qscoreHistory: { status: "ready", data: [] },
+  snapshots,
+  producerStatuses,
+  activity,
+});
+assert.equal(malformedOnboarding.subject.targetRole.status, "unavailable");
+assert.equal(malformedOnboarding.subject.targetRole.value, null);
+assert.equal(malformedOnboarding.subject.targetRole.reason, "producer_response_invalid");
+assert.equal(malformedOnboarding.subject.goals.status, "unavailable");
+assert.equal(malformedOnboarding.subject.goals.value, null);
+assert.equal(malformedOnboarding.subject.barriers.status, "empty", "missing optional arrays remain confirmed empty");
+assert.deepEqual(malformedOnboarding.subject.barriers.value, []);
 
 const unavailable = buildCareerReportProjection({
   profile: { status: "unavailable", reason: "profile_unavailable" },

scripts/home-insight-snapshot.test.ts

@@ -1,6 +1,7 @@
 import assert from "node:assert/strict";
 
 import { buildHomeInsightSnapshots } from "../src/v1/analytics/home-insight-snapshot.js";
+import type { HomeInsightProducerStatuses } from "../src/v1/analytics/home-insight-snapshot.js";
 import type { QscoreProxyResult, QscoreReadResult } from "../src/services/qscore-proxy.js";
 
 function qscoreFixture(): QscoreProxyResult {
@@ -218,4 +219,21 @@ assert.equal(malformedA2a.opportunity.status, "ready", "valid qscore category is
 assert.equal(malformedA2a.opportunity.source, "qscore.breakdown.display");
 assert.equal(malformedA2a.opportunity.value, 75);
 
+let malformedDirectStatuses: HomeInsightProducerStatuses | null = null;
+await buildHomeInsightSnapshots({
+  userId: "user_fixture",
+  qscore: readyQscore,
+  qscoreHistory: history,
+  recentEvents: [],
+  onProducerStatuses: (statuses) => { malformedDirectStatuses = statuses; },
+}, {
+  ...producers,
+  resumeState: async () => ({}),
+  assessments: async () => ({}),
+});
+assert.equal(malformedDirectStatuses?.resume.status, "unavailable", "malformed resume objects must not mark the direct source ready");
+assert.equal(malformedDirectStatuses?.resume.reason, "producer_response_invalid");
+assert.equal(malformedDirectStatuses?.assessment.status, "unavailable", "malformed assessment objects must not mark the direct source ready");
+assert.equal(malformedDirectStatuses?.assessment.reason, "producer_response_invalid");
+
 console.log("home insight snapshot contract: ok");