@patronage/factory-ci 0.2.1 → 1.0.0-alpha.13

package/src/push-identity-workflow.ts

@@ -0,0 +1,448 @@
+import type { PinnedAction } from "./actions.ts";
+import type { WorkflowStep } from "./factory-workflow.ts";
+import { assertPinnedAction } from "./pinned-action.ts";
+
+export const FACTORY_PUSH_IDENTITY_SCHEMA_VERSION = 1;
+export const FACTORY_PUSH_IDENTITY_ARTIFACT_PREFIX = "factory-push-identity";
+export const FACTORY_PUSH_IDENTITY_RECORD_STEP_ID =
+  "factory_push_identity_record";
+export const FACTORY_PUSH_IDENTITY_LOOKUP_STEP_ID =
+  "factory_push_identity_lookup";
+export const FACTORY_PUSH_IDENTITY_DOWNLOAD_STEP_ID =
+  "factory_push_identity_download";
+export const FACTORY_PUSH_IDENTITY_CHECKOUT_STEP_ID =
+  "factory_push_identity_checkout";
+export const FACTORY_PUSH_IDENTITY_VALIDATE_STEP_ID = "factory_push_identity";
+
+/** Versioned document uploaded by a push-triggered verification run. */
+export interface FactoryPushIdentityEnvelope {
+  readonly after: string;
+  readonly before: string;
+  readonly repository: string;
+  readonly runId: string;
+  readonly schemaVersion: typeof FACTORY_PUSH_IDENTITY_SCHEMA_VERSION;
+}
+
+export type FactoryPushIdentityDisposition = "refused" | "usable";
+
+const ARTIFACT_MAX_BYTES = 16_384;
+const ENVELOPE_MAX_BYTES = 4096;
+
+const expression = (value: string): string => `\${{ ${value} }}`;
+const artifactName = (runId: string): string =>
+  `${FACTORY_PUSH_IDENTITY_ARTIFACT_PREFIX}-${runId}`;
+
+const producerScript = String.raw`identity="$RUNNER_TEMP/factory-push-identity.json"
+produced=false
+reason='producer_error'
+before=''
+event_after=''
+rm -f "$identity"
+
+is_hex_sha() {
+  [ "$(printf '%s' "$1" | wc -c | tr -d '[:space:]')" -eq 40 ] &&
+    case "$1" in *[!0-9a-f]*) false;; *) true;; esac
+}
+
+is_nonzero_sha() {
+  is_hex_sha "$1" && [ "$1" != '0000000000000000000000000000000000000000' ]
+}
+
+if [ "$GITHUB_EVENT_NAME" != 'push' ]; then
+  reason='not_push_event'
+elif ! printf '%s' "$GITHUB_REPOSITORY" | grep -Eq '^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$'; then
+  reason='repository_invalid'
+elif ! printf '%s' "$GITHUB_RUN_ID" | grep -Eq '^[1-9][0-9]*$'; then
+  reason='run_id_invalid'
+elif ! before="$(jq -er '.before | select(type == "string")' "$GITHUB_EVENT_PATH" 2>/dev/null)"; then
+  reason='event_before_missing'
+elif ! event_after="$(jq -er '.after | select(type == "string")' "$GITHUB_EVENT_PATH" 2>/dev/null)"; then
+  reason='event_after_missing'
+elif ! is_hex_sha "$before"; then
+  reason='event_before_invalid'
+elif ! is_nonzero_sha "$event_after" || ! is_nonzero_sha "$GITHUB_SHA"; then
+  reason='event_after_invalid'
+elif [ "$event_after" != "$GITHUB_SHA" ]; then
+  reason='event_after_mismatch'
+elif jq -cn \
+  --argjson schemaVersion '${FACTORY_PUSH_IDENTITY_SCHEMA_VERSION}' \
+  --arg repository "$GITHUB_REPOSITORY" \
+  --arg runId "$GITHUB_RUN_ID" \
+  --arg before "$before" \
+  --arg after "$event_after" \
+  '{schemaVersion: $schemaVersion, repository: $repository, runId: $runId, before: $before, after: $after}' > "$identity"; then
+  produced=true
+  reason='produced'
+fi
+
+printf 'produced=%s\nreason=%s\n' "$produced" "$reason" >> "$GITHUB_OUTPUT"
+{
+  printf '## Exact push identity producer\n\n'
+  printf -- '- Status: %s\n' "$reason"
+  printf -- '- Repository/run: %s / %s\n' "$GITHUB_REPOSITORY" "$GITHUB_RUN_ID"
+  if [ "$produced" = true ]; then
+    printf -- '- Bound push: %s → %s\n' "$before" "$event_after"
+  else
+    printf -- '- Identity transport was not produced; downstream classification will refuse withdrawal.\n'
+  fi
+} >> "$GITHUB_STEP_SUMMARY"`;
+
+const lookupScript = String.raw`status='refused'
+reason='artifact_lookup_failed'
+artifact_id=''
+matches="$RUNNER_TEMP/factory-push-identity-artifacts.tsv"
+artifact_name='${FACTORY_PUSH_IDENTITY_ARTIFACT_PREFIX}-'"$EXPECTED_RUN_ID"
+rm -f "$matches"
+
+is_sha() {
+  [ "$(printf '%s' "$1" | wc -c | tr -d '[:space:]')" -eq 40 ] &&
+    [ "$1" != '0000000000000000000000000000000000000000' ] &&
+    case "$1" in *[!0-9a-f]*) false;; *) true;; esac
+}
+
+if [ "$EXPECTED_EVENT_NAME" != 'workflow_run' ]; then
+  reason='event_not_workflow_run'
+elif [ "$EXPECTED_WORKFLOW_EVENT" != 'push' ]; then
+  reason='triggering_workflow_not_push'
+elif [ "$EXPECTED_CONCLUSION" != 'success' ]; then
+  reason='triggering_workflow_not_successful'
+elif [ "$EXPECTED_WORKFLOW_REPOSITORY" != "$EXPECTED_REPOSITORY" ]; then
+  reason='triggering_repository_mismatch'
+elif ! printf '%s' "$EXPECTED_REPOSITORY" | grep -Eq '^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$'; then
+  reason='triggering_repository_invalid'
+elif ! printf '%s' "$EXPECTED_RUN_ID" | grep -Eq '^[1-9][0-9]*$'; then
+  reason='triggering_run_id_invalid'
+elif ! is_sha "$EXPECTED_AFTER_SHA"; then
+  reason='triggering_head_sha_invalid'
+elif ! gh api --paginate \
+  "repos/$EXPECTED_REPOSITORY/actions/runs/$EXPECTED_RUN_ID/artifacts?per_page=100" \
+  --jq ".artifacts[] | select(.name == \"$artifact_name\") | [.id, .size_in_bytes, .expired] | @tsv" \
+  > "$matches" 2>/dev/null; then
+  reason='artifact_lookup_failed'
+else
+  count="$(awk 'END { print NR + 0 }' "$matches")"
+  if [ "$count" -eq 0 ]; then
+    reason='artifact_missing'
+  elif [ "$count" -ne 1 ]; then
+    reason='artifact_duplicate'
+  else
+    IFS="$(printf '\t')" read -r artifact_id artifact_size artifact_expired < "$matches" || true
+    if ! printf '%s' "$artifact_id" | grep -Eq '^[1-9][0-9]*$' ||
+      ! printf '%s' "$artifact_size" | grep -Eq '^[0-9]+$' ||
+      { [ "$artifact_expired" != 'false' ] && [ "$artifact_expired" != 'true' ]; }; then
+      reason='artifact_metadata_invalid'
+      artifact_id=''
+    elif [ "$artifact_expired" = 'true' ]; then
+      reason='artifact_expired'
+      artifact_id=''
+    elif [ "$artifact_size" -gt '${ARTIFACT_MAX_BYTES}' ]; then
+      reason='artifact_oversized'
+      artifact_id=''
+    else
+      status='available'
+      reason='artifact_available'
+    fi
+  fi
+fi
+
+printf 'status=%s\nreason=%s\nartifact_id=%s\n' "$status" "$reason" "$artifact_id" >> "$GITHUB_OUTPUT"`;
+
+const validationScript = String.raw`disposition='refused'
+reason='validation_error'
+before=''
+after=''
+identity_directory="$RUNNER_TEMP/factory-push-identity"
+identity="$identity_directory/factory-push-identity.json"
+artifact_name='${FACTORY_PUSH_IDENTITY_ARTIFACT_PREFIX}-'"$EXPECTED_RUN_ID"
+
+is_sha() {
+  [ "$(printf '%s' "$1" | wc -c | tr -d '[:space:]')" -eq 40 ] &&
+    [ "$1" != '0000000000000000000000000000000000000000' ] &&
+    case "$1" in *[!0-9a-f]*) false;; *) true;; esac
+}
+
+if [ "$EXPECTED_EVENT_NAME" != 'workflow_run' ]; then
+  reason='event_not_workflow_run'
+elif [ "$EXPECTED_WORKFLOW_EVENT" != 'push' ]; then
+  reason='triggering_workflow_not_push'
+elif [ "$EXPECTED_CONCLUSION" != 'success' ]; then
+  reason='triggering_workflow_not_successful'
+elif [ "$EXPECTED_WORKFLOW_REPOSITORY" != "$EXPECTED_REPOSITORY" ]; then
+  reason='triggering_repository_mismatch'
+elif ! printf '%s' "$EXPECTED_REPOSITORY" | grep -Eq '^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$'; then
+  reason='triggering_repository_invalid'
+elif ! printf '%s' "$EXPECTED_RUN_ID" | grep -Eq '^[1-9][0-9]*$'; then
+  reason='triggering_run_id_invalid'
+elif ! is_sha "$EXPECTED_AFTER_SHA"; then
+  reason='triggering_head_sha_invalid'
+elif [ "$LOOKUP_STATUS" != 'available' ]; then
+  if [ -n "$LOOKUP_REASON" ]; then
+    reason="$LOOKUP_REASON"
+  else
+    reason='artifact_lookup_failed'
+  fi
+elif [ "$DOWNLOAD_OUTCOME" != 'success' ]; then
+  reason='artifact_download_failed'
+elif [ "$CHECKOUT_OUTCOME" != 'success' ]; then
+  reason='checkout_failed'
+elif [ ! -d "$identity_directory" ]; then
+  reason='artifact_contents_missing'
+else
+  entry_count="$(find "$identity_directory" -mindepth 1 -maxdepth 1 -print 2>/dev/null | awk 'END { print NR + 0 }')"
+  if [ "$entry_count" -ne 1 ] || [ ! -f "$identity" ] || [ -L "$identity" ]; then
+    reason='artifact_contents_invalid'
+  else
+    envelope_size="$(wc -c < "$identity" | tr -d '[:space:]')"
+    if ! printf '%s' "$envelope_size" | grep -Eq '^[0-9]+$'; then
+      reason='envelope_size_unreadable'
+    elif [ "$envelope_size" -gt '${ENVELOPE_MAX_BYTES}' ]; then
+      reason='envelope_oversized'
+    elif ! jq -e --argjson schemaVersion '${FACTORY_PUSH_IDENTITY_SCHEMA_VERSION}' '
+      type == "object" and
+      keys == ["after", "before", "repository", "runId", "schemaVersion"] and
+      .schemaVersion == $schemaVersion and
+      (.repository | type == "string") and
+      (.runId | type == "string" and test("^[1-9][0-9]*$")) and
+      (.before | type == "string" and test("^[0-9a-f]{40}$") and (test("^0{40}$") | not)) and
+      (.after | type == "string" and test("^[0-9a-f]{40}$") and (test("^0{40}$") | not))
+    ' "$identity" >/dev/null 2>&1; then
+      reason='envelope_malformed'
+    else
+      repository="$(jq -r '.repository' "$identity")"
+      run_id="$(jq -r '.runId' "$identity")"
+      before="$(jq -r '.before' "$identity")"
+      after="$(jq -r '.after' "$identity")"
+
+      if [ "$repository" != "$EXPECTED_REPOSITORY" ]; then
+        reason='envelope_repository_mismatch'
+      elif [ "$run_id" != "$EXPECTED_RUN_ID" ]; then
+        reason='envelope_run_id_mismatch'
+      elif [ "$after" != "$EXPECTED_AFTER_SHA" ]; then
+        reason='envelope_after_mismatch'
+      elif ! actual_head="$(git rev-parse --verify HEAD 2>/dev/null)" || [ "$actual_head" != "$EXPECTED_AFTER_SHA" ]; then
+        reason='checkout_head_mismatch'
+      elif ! git cat-file -e "$before^{commit}" 2>/dev/null || ! git cat-file -e "$after^{commit}" 2>/dev/null; then
+        reason='envelope_commit_unreachable'
+      elif [ "$before" = "$after" ]; then
+        reason='envelope_commits_contradictory'
+      elif ! git merge-base --is-ancestor "$before" "$after"; then
+        reason='before_not_ancestor'
+      else
+        disposition='usable'
+        reason='identity_bound'
+      fi
+    fi
+  fi
+fi
+
+if [ "$disposition" != 'usable' ]; then
+  before=''
+  after=''
+fi
+
+provenance="$(jq -cn \
+  --argjson schemaVersion '${FACTORY_PUSH_IDENTITY_SCHEMA_VERSION}' \
+  --arg disposition "$disposition" \
+  --arg reason "$reason" \
+  --arg repository "$EXPECTED_REPOSITORY" \
+  --arg runId "$EXPECTED_RUN_ID" \
+  --arg expectedAfter "$EXPECTED_AFTER_SHA" \
+  --arg artifactName "$artifact_name" \
+  --arg artifactId "$ARTIFACT_ID" \
+  --arg before "$before" \
+  --arg after "$after" \
+  '{schemaVersion: $schemaVersion, disposition: $disposition, reason: $reason, repository: $repository, runId: $runId, expectedAfter: $expectedAfter, artifactName: $artifactName, artifactId: (if $artifactId == "" then null else $artifactId end), before: (if $before == "" then null else $before end), after: (if $after == "" then null else $after end)}')"
+
+printf 'disposition=%s\nreason=%s\nbefore=%s\nafter=%s\nprovenance=%s\n' \
+  "$disposition" "$reason" "$before" "$after" "$provenance" >> "$GITHUB_OUTPUT"
+{
+  printf '## Exact push identity\n\n'
+  printf -- '- Disposition: %s\n' "$disposition"
+  printf -- '- Reason: %s\n' "$reason"
+  printf -- '- Repository/run: %s / %s\n' "$EXPECTED_REPOSITORY" "$EXPECTED_RUN_ID"
+  printf -- '- Expected verified head: %s\n' "$EXPECTED_AFTER_SHA"
+  if [ "$disposition" = 'usable' ]; then
+    printf -- '- Bound push: %s → %s\n' "$before" "$after"
+  else
+    printf -- '- Production impact classification refused; every consumer-owned production target remains demanded.\n'
+  fi
+  printf '\nFactory telemetry provenance: %s\n' "$provenance"
+} >> "$GITHUB_STEP_SUMMARY"`;
+
+export interface FactoryPushIdentityProducerOptions {
+  /** Explicit caller-owned upload-artifact pin from its workflow artifact. */
+  readonly uploadArtifact: PinnedAction;
+  /** Optional consumer trigger policy combined with the required push event. */
+  readonly if?: string;
+}
+
+export interface FactoryPushIdentityProducer {
+  readonly artifactName: string;
+  readonly steps: readonly WorkflowStep[];
+}
+
+/**
+ * Record and upload the exact push-event identity without changing the Verify
+ * result when transport is unavailable. Place these steps after verification.
+ */
+export const factoryPushIdentityProducer = (
+  options: FactoryPushIdentityProducerOptions
+): FactoryPushIdentityProducer => {
+  assertPinnedAction(
+    "uploadArtifact",
+    options.uploadArtifact,
+    "actions/upload-artifact"
+  );
+  const condition = options.if
+    ? `github.event_name == 'push' && (${options.if})`
+    : "github.event_name == 'push'";
+  const name = artifactName(expression("github.run_id"));
+  return Object.freeze({
+    artifactName: name,
+    steps: Object.freeze([
+      {
+        continueOnError: true,
+        id: FACTORY_PUSH_IDENTITY_RECORD_STEP_ID,
+        if: condition,
+        name: "Record exact push identity",
+        run: producerScript,
+      },
+      {
+        continueOnError: true,
+        if: `${condition} && steps.${FACTORY_PUSH_IDENTITY_RECORD_STEP_ID}.outputs.produced == 'true'`,
+        name: "Upload exact push identity",
+        uses: options.uploadArtifact.uses,
+        with: {
+          "if-no-files-found": "error",
+          name,
+          path: `${expression("runner.temp")}/factory-push-identity.json`,
+          "retention-days": "7",
+        },
+      },
+    ]),
+  });
+};
+
+export interface FactoryPushIdentityConsumer {
+  /** Job outputs suitable for a caller-owned decision job and telemetry. */
+  readonly outputs: Readonly<
+    Record<"after" | "before" | "disposition" | "provenance" | "reason", string>
+  >;
+  readonly requiredPermissions: Readonly<{
+    actions: "read";
+    contents: "read";
+  }>;
+  readonly steps: readonly WorkflowStep[];
+  /** Run classification only when exact identity transport is usable. */
+  readonly usableIf: string;
+}
+
+export interface FactoryPushIdentityConsumerOptions {
+  /** Explicit caller-owned checkout pin from its action family. */
+  readonly checkout: PinnedAction;
+  /** Explicit caller-owned download-artifact pin from its workflow artifact. */
+  readonly downloadArtifact: PinnedAction;
+}
+
+/**
+ * Download and validate identity from exactly the triggering workflow run in
+ * the current repository. Every failure becomes a typed refusal; consumers
+ * retain deploy policy, credentials, commands, topology, and convergence.
+ */
+export const factoryPushIdentityConsumer = (
+  options: FactoryPushIdentityConsumerOptions
+): FactoryPushIdentityConsumer => {
+  assertPinnedAction("checkout", options.checkout, "actions/checkout");
+  assertPinnedAction(
+    "downloadArtifact",
+    options.downloadArtifact,
+    "actions/download-artifact"
+  );
+  const currentRepository = expression("github.repository");
+  const triggeringRun = expression("github.event.workflow_run.id");
+  const triggeringHead = expression("github.event.workflow_run.head_sha");
+  const lookupOutput = (name: string): string =>
+    expression(`steps.${FACTORY_PUSH_IDENTITY_LOOKUP_STEP_ID}.outputs.${name}`);
+  const validateOutput = (name: string): string =>
+    expression(
+      `steps.${FACTORY_PUSH_IDENTITY_VALIDATE_STEP_ID}.outputs.${name}`
+    );
+
+  const contextEnvironment = {
+    EXPECTED_AFTER_SHA: triggeringHead,
+    EXPECTED_CONCLUSION: expression("github.event.workflow_run.conclusion"),
+    EXPECTED_EVENT_NAME: expression("github.event_name"),
+    EXPECTED_REPOSITORY: currentRepository,
+    EXPECTED_RUN_ID: triggeringRun,
+    EXPECTED_WORKFLOW_EVENT: expression("github.event.workflow_run.event"),
+    EXPECTED_WORKFLOW_REPOSITORY: expression(
+      "github.event.workflow_run.repository.full_name"
+    ),
+  };
+  const steps: readonly WorkflowStep[] = [
+    {
+      continueOnError: true,
+      env: {
+        GH_TOKEN: expression("github.token"),
+        ...contextEnvironment,
+      },
+      id: FACTORY_PUSH_IDENTITY_LOOKUP_STEP_ID,
+      name: "Resolve exact push identity artifact",
+      run: lookupScript,
+    },
+    {
+      continueOnError: true,
+      id: FACTORY_PUSH_IDENTITY_DOWNLOAD_STEP_ID,
+      if: `steps.${FACTORY_PUSH_IDENTITY_LOOKUP_STEP_ID}.outputs.status == 'available'`,
+      name: "Download exact push identity",
+      uses: options.downloadArtifact.uses,
+      with: {
+        "artifact-ids": lookupOutput("artifact_id"),
+        "github-token": expression("github.token"),
+        path: `${expression("runner.temp")}/factory-push-identity`,
+        repository: currentRepository,
+        "run-id": triggeringRun,
+      },
+    },
+    {
+      continueOnError: true,
+      id: FACTORY_PUSH_IDENTITY_CHECKOUT_STEP_ID,
+      if: `steps.${FACTORY_PUSH_IDENTITY_LOOKUP_STEP_ID}.outputs.status == 'available'`,
+      name: "Checkout exact verified head",
+      uses: options.checkout.uses,
+      with: { "fetch-depth": "0", ref: triggeringHead },
+    },
+    {
+      continueOnError: true,
+      env: {
+        ARTIFACT_ID: lookupOutput("artifact_id"),
+        CHECKOUT_OUTCOME: expression(
+          `steps.${FACTORY_PUSH_IDENTITY_CHECKOUT_STEP_ID}.outcome`
+        ),
+        DOWNLOAD_OUTCOME: expression(
+          `steps.${FACTORY_PUSH_IDENTITY_DOWNLOAD_STEP_ID}.outcome`
+        ),
+        LOOKUP_REASON: lookupOutput("reason"),
+        LOOKUP_STATUS: lookupOutput("status"),
+        ...contextEnvironment,
+      },
+      id: FACTORY_PUSH_IDENTITY_VALIDATE_STEP_ID,
+      if: "always()",
+      name: "Validate exact push identity",
+      run: validationScript,
+    },
+  ];
+
+  return Object.freeze({
+    outputs: Object.freeze({
+      after: validateOutput("after"),
+      before: validateOutput("before"),
+      disposition: validateOutput("disposition"),
+      provenance: validateOutput("provenance"),
+      reason: validateOutput("reason"),
+    }),
+    requiredPermissions: Object.freeze({ actions: "read", contents: "read" }),
+    steps: Object.freeze(steps),
+    usableIf: `steps.${FACTORY_PUSH_IDENTITY_VALIDATE_STEP_ID}.outputs.disposition == 'usable'`,
+  });
+};

package/src/vitest-profile-reader.test.ts

@@ -0,0 +1,208 @@
+import { describe, expect, it } from "vitest";
+
+import { readVitestProfileDocument } from "./vitest-profile-reader.ts";
+import type { VitestProfile } from "./vitest-profile.ts";
+
+const durations = {
+  maximum: 16_200,
+  mean: 15_800,
+  median: 15_700,
+  minimum: 15_300,
+};
+
+/** A document shaped exactly as `runVitestProfile` writes it. */
+const validProfile = (): VitestProfile => ({
+  command: ["vitest", "run", "--reporter=json", "--maxWorkers=2"],
+  endedAt: "2026-08-06T12:01:00.000Z",
+  environment: {
+    arch: "x64",
+    availableParallelism: 4,
+    cpuCount: 4,
+    cpuModel: "AMD EPYC 9R45",
+    gitDirty: false,
+    gitHead: "0123456789abcdef0123456789abcdef01234567",
+    node: "v24.0.0",
+    osRelease: "6.8.0",
+    platform: "linux",
+    totalMemoryBytes: 16_000_000_000,
+    vitest: "3.0.0",
+  },
+  options: { maxWorkers: 2, samples: 3, slowLimit: 20 },
+  rawReportDirectory: "/tmp/profile.raw/abc",
+  runs: [
+    {
+      counts: {
+        failed: 0,
+        passed: 900,
+        pending: 0,
+        suites: 80,
+        tests: 900,
+        todo: 0,
+      },
+      durationMs: 15_300,
+      endedAt: "2026-08-06T12:00:20.000Z",
+      exitCode: 0,
+      failure: null,
+      files: [{ durationMs: 900, path: "src/slow.test.ts", status: "passed" }],
+      reportAvailable: true,
+      sample: 1,
+      startedAt: "2026-08-06T12:00:00.000Z",
+      tests: [
+        {
+          durationMs: 450,
+          file: "src/slow.test.ts",
+          name: "slow case",
+          status: "passed",
+        },
+      ],
+    },
+  ],
+  schemaVersion: 1,
+  startedAt: "2026-08-06T12:00:00.000Z",
+  summary: {
+    durationMs: { ...durations },
+    slowFiles: [
+      { durationMs: { ...durations }, path: "src/slow.test.ts", samples: 3 },
+    ],
+    slowTests: [
+      {
+        durationMs: { ...durations },
+        file: "src/slow.test.ts",
+        name: "slow case",
+        samples: 3,
+      },
+    ],
+  },
+  tool: "factory-ci-vitest-profile",
+});
+
+describe("readVitestProfileDocument", () => {
+  it("accepts a document the writer emitted", () => {
+    const result = readVitestProfileDocument(validProfile());
+
+    expect(result.kind).toBe("profile");
+    if (result.kind === "profile") {
+      expect(result.profile.environment.cpuModel).toBe("AMD EPYC 9R45");
+      expect(result.profile.summary.durationMs.median).toBe(15_700);
+    }
+  });
+
+  it("names the tool mismatch instead of guessing", () => {
+    const result = readVitestProfileDocument({
+      ...validProfile(),
+      tool: "someone-elses-artifact",
+    });
+
+    expect(result).toEqual({
+      kind: "unrecognized",
+      reason:
+        'tool is "someone-elses-artifact" rather than "factory-ci-vitest-profile"',
+    });
+  });
+
+  it("refuses a future schema version rather than misreading it", () => {
+    const result = readVitestProfileDocument({
+      ...validProfile(),
+      schemaVersion: 2,
+    });
+
+    expect(result).toEqual({
+      kind: "unrecognized",
+      reason: "schemaVersion is 2 rather than 1",
+    });
+  });
+
+  it("refuses a document whose environment lost the cpuModel field", () => {
+    const document = validProfile() as unknown as {
+      environment: Record<string, unknown>;
+    };
+    delete document.environment.cpuModel;
+
+    expect(readVitestProfileDocument(document)).toEqual({
+      kind: "unrecognized",
+      reason: "environment.cpuModel is neither a string nor null",
+    });
+  });
+
+  it("refuses a run without a finite duration", () => {
+    const document = validProfile();
+    (document.runs[0] as unknown as Record<string, unknown>).durationMs =
+      "fast";
+
+    expect(readVitestProfileDocument(document)).toEqual({
+      kind: "unrecognized",
+      reason: "runs[0].durationMs is not a finite number",
+    });
+  });
+
+  it("refuses a summary without duration statistics", () => {
+    const document = validProfile() as unknown as {
+      summary: { durationMs: Record<string, unknown> };
+    };
+    delete document.summary.durationMs.median;
+
+    expect(readVitestProfileDocument(document)).toEqual({
+      kind: "unrecognized",
+      reason: "summary.durationMs.median is not a finite number",
+    });
+  });
+
+  it("refuses empty counts rather than serving undefined fields", () => {
+    const document = validProfile();
+    (document.runs[0] as unknown as Record<string, unknown>).counts = {};
+
+    expect(readVitestProfileDocument(document)).toEqual({
+      kind: "unrecognized",
+      reason: "runs[0].counts.failed is not a finite number",
+    });
+  });
+
+  it("refuses a null slowFiles entry rather than crashing projection", () => {
+    const document = validProfile() as unknown as {
+      summary: { slowFiles: unknown[] };
+    };
+    document.summary.slowFiles = [null];
+
+    expect(readVitestProfileDocument(document)).toEqual({
+      kind: "unrecognized",
+      reason: "summary.slowFiles[0] is not an object",
+    });
+  });
+
+  it("refuses a slow test whose duration summary is incomplete", () => {
+    const document = validProfile() as unknown as {
+      summary: { slowTests: { durationMs: Record<string, unknown> }[] };
+    };
+    const [slowTest] = document.summary.slowTests;
+    if (slowTest) {
+      delete slowTest.durationMs.median;
+    }
+
+    expect(readVitestProfileDocument(document)).toEqual({
+      kind: "unrecognized",
+      reason: "summary.slowTests[0].durationMs.median is not a finite number",
+    });
+  });
+
+  it("refuses a slow file without a path string", () => {
+    const document = validProfile() as unknown as {
+      summary: { slowFiles: Record<string, unknown>[] };
+    };
+    const [slowFile] = document.summary.slowFiles;
+    if (slowFile) {
+      delete slowFile.path;
+    }
+
+    expect(readVitestProfileDocument(document)).toEqual({
+      kind: "unrecognized",
+      reason: "summary.slowFiles[0].path is not a string",
+    });
+  });
+
+  it("refuses non-object input", () => {
+    expect(readVitestProfileDocument(null)).toEqual({
+      kind: "unrecognized",
+      reason: "the document is not an object",
+    });
+  });
+});