@a5c-ai/krate 5.0.1-staging.00fa5317c

package/tests/agent-provider-config-controller.test.js

@@ -0,0 +1,376 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  createAgentProviderConfigController,
+  validateAgentProviderConfig,
+  createResource,
+  AGENT_PROVIDER_CONFIG_CONTROLLER_BOUNDARY
+} from '../src/index.js';
+
+// ---------------------------------------------------------------------------
+// Acceptance criteria: Slice 1.2c — Agent Provider Config Controller
+//
+// An AgentProviderConfig defines how to connect to an LLM model provider.
+// It specifies provider name/type, API endpoint, credential secret reference,
+// default model, rate limit configuration, and feature flags.
+//
+// Supported provider types: anthropic, openai, azure-openai, google-vertex,
+// foundry, custom.
+// ---------------------------------------------------------------------------
+
+const VALID_PROVIDER_TYPES = ['anthropic', 'openai', 'azure-openai', 'google-vertex', 'foundry', 'custom'];
+
+function makeProviderConfig(name, overrides = {}) {
+  return createResource('AgentProviderConfig', { name, namespace: 'krate-org-default' }, {
+    organizationRef: 'default',
+    providerType: 'anthropic',
+    endpoint: 'https://api.anthropic.com/v1',
+    credentialRef: 'anthropic-api-key',
+    defaultModel: 'claude-opus-4-5',
+    ...overrides
+  });
+}
+
+// ---------------------------------------------------------------------------
+// 1. Factory and shape
+// ---------------------------------------------------------------------------
+
+test('createAgentProviderConfigController returns controller with validate, resolveEndpoint, getFeatureFlags', () => {
+  const controller = createAgentProviderConfigController();
+  assert.ok(controller, 'controller must be truthy');
+  assert.equal(typeof controller.validate, 'function', 'controller must expose validate');
+  assert.equal(typeof controller.resolveEndpoint, 'function', 'controller must expose resolveEndpoint');
+  assert.equal(typeof controller.getFeatureFlags, 'function', 'controller must expose getFeatureFlags');
+  assert.equal(controller.role, 'agent-provider-config-controller', 'controller must declare its role');
+});
+
+// ---------------------------------------------------------------------------
+// 2. validate — happy path
+// ---------------------------------------------------------------------------
+
+test('validate accepts valid config with name, providerType, endpoint, credentialRef', () => {
+  const controller = createAgentProviderConfigController();
+  const config = makeProviderConfig('anthropic-provider');
+  const result = controller.validate(config);
+
+  assert.equal(result.valid, true, 'valid config must pass validation');
+  assert.ok(Array.isArray(result.errors), 'result must contain an errors array');
+  assert.equal(result.errors.length, 0, 'errors array must be empty for a valid config');
+});
+
+// ---------------------------------------------------------------------------
+// 3. validate — missing name
+// ---------------------------------------------------------------------------
+
+test('validate rejects config with missing name', () => {
+  const controller = createAgentProviderConfigController();
+  const config = {
+    apiVersion: 'krate.a5c.ai/v1alpha1',
+    kind: 'AgentProviderConfig',
+    metadata: { namespace: 'krate-org-default', labels: {}, annotations: {} },
+    spec: {
+      providerType: 'anthropic',
+      endpoint: 'https://api.anthropic.com/v1',
+      credentialRef: 'anthropic-api-key'
+    },
+    status: {}
+  };
+  const result = controller.validate(config);
+
+  assert.equal(result.valid, false, 'config without a name must fail validation');
+  assert.ok(result.errors.length > 0, 'errors array must not be empty');
+  assert.ok(
+    result.errors.some((e) => /name/i.test(e)),
+    'at least one error must mention "name"'
+  );
+});
+
+// ---------------------------------------------------------------------------
+// 4. validate — missing providerType
+// ---------------------------------------------------------------------------
+
+test('validate rejects config with missing providerType', () => {
+  const controller = createAgentProviderConfigController();
+  const config = makeProviderConfig('no-type-provider');
+  delete config.spec.providerType;
+  const result = controller.validate(config);
+
+  assert.equal(result.valid, false, 'config without providerType must fail validation');
+  assert.ok(result.errors.length > 0, 'errors array must not be empty');
+  assert.ok(
+    result.errors.some((e) => /providerType/i.test(e)),
+    'at least one error must mention "providerType"'
+  );
+  assert.ok(
+    result.errors.some((e) => VALID_PROVIDER_TYPES.some((t) => e.includes(t))),
+    'error must enumerate valid provider types'
+  );
+});
+
+// ---------------------------------------------------------------------------
+// 5. validate — invalid providerType
+// ---------------------------------------------------------------------------
+
+test('validate rejects config with invalid providerType', () => {
+  const controller = createAgentProviderConfigController();
+  const config = makeProviderConfig('bad-type-provider', { providerType: 'cohere' });
+  const result = controller.validate(config);
+
+  assert.equal(result.valid, false, 'config with unsupported providerType must fail validation');
+  assert.ok(result.errors.length > 0, 'errors array must not be empty');
+  assert.ok(
+    result.errors.some((e) => /providerType/i.test(e)),
+    'at least one error must mention "providerType"'
+  );
+  assert.ok(
+    result.errors.some((e) => VALID_PROVIDER_TYPES.some((t) => e.includes(t))),
+    'error must enumerate valid provider types'
+  );
+});
+
+// ---------------------------------------------------------------------------
+// 6. validate — missing credentialRef (security: always require)
+// ---------------------------------------------------------------------------
+
+test('validate rejects config with missing credentialRef', () => {
+  const controller = createAgentProviderConfigController();
+  const config = makeProviderConfig('no-cred-provider');
+  delete config.spec.credentialRef;
+  const result = controller.validate(config);
+
+  assert.equal(result.valid, false, 'config without credentialRef must fail validation');
+  assert.ok(result.errors.length > 0, 'errors array must not be empty');
+  assert.ok(
+    result.errors.some((e) => /credentialRef/i.test(e)),
+    'at least one error must mention "credentialRef"'
+  );
+});
+
+// ---------------------------------------------------------------------------
+// 7. resolveEndpoint — returns endpoint from spec
+// ---------------------------------------------------------------------------
+
+test('resolveEndpoint returns endpoint from spec when explicitly set', () => {
+  const controller = createAgentProviderConfigController();
+  const config = makeProviderConfig('explicit-endpoint-provider', {
+    providerType: 'anthropic',
+    endpoint: 'https://custom.anthropic.proxy/v1'
+  });
+  const endpoint = controller.resolveEndpoint(config);
+
+  assert.equal(endpoint, 'https://custom.anthropic.proxy/v1', 'must return explicit spec endpoint');
+});
+
+// ---------------------------------------------------------------------------
+// 8. resolveEndpoint — defaults for known providers
+// ---------------------------------------------------------------------------
+
+test('resolveEndpoint returns default endpoint for anthropic when no endpoint in spec', () => {
+  const controller = createAgentProviderConfigController();
+  const config = makeProviderConfig('anthropic-default-provider', { providerType: 'anthropic' });
+  delete config.spec.endpoint;
+  const endpoint = controller.resolveEndpoint(config);
+
+  assert.ok(endpoint.includes('api.anthropic.com'), 'must return anthropic default endpoint');
+});
+
+test('resolveEndpoint returns default endpoint for openai when no endpoint in spec', () => {
+  const controller = createAgentProviderConfigController();
+  const config = makeProviderConfig('openai-default-provider', {
+    providerType: 'openai',
+    credentialRef: 'openai-api-key'
+  });
+  delete config.spec.endpoint;
+  const endpoint = controller.resolveEndpoint(config);
+
+  assert.ok(endpoint.includes('api.openai.com'), 'must return openai default endpoint');
+});
+
+// ---------------------------------------------------------------------------
+// 9. getFeatureFlags — returns flags from spec with defaults
+// ---------------------------------------------------------------------------
+
+test('getFeatureFlags returns feature flags from spec with defaults applied', () => {
+  const controller = createAgentProviderConfigController();
+  const config = makeProviderConfig('flags-provider', {
+    featureFlags: { streaming: true, vision: false }
+  });
+  const flags = controller.getFeatureFlags(config);
+
+  assert.ok(flags, 'getFeatureFlags must return a value');
+  assert.equal(typeof flags, 'object', 'flags must be an object');
+  assert.equal(flags.streaming, true, 'streaming flag must be set from spec');
+  assert.equal(flags.vision, false, 'vision flag must be set from spec');
+  // tool_use should have a default
+  assert.ok('tool_use' in flags, 'tool_use flag must have a default');
+});
+
+test('getFeatureFlags returns all defaults when no featureFlags in spec', () => {
+  const controller = createAgentProviderConfigController();
+  const config = makeProviderConfig('no-flags-provider');
+  const flags = controller.getFeatureFlags(config);
+
+  assert.ok(flags, 'getFeatureFlags must return a value even with no spec flags');
+  assert.ok('streaming' in flags, 'streaming must have a default');
+  assert.ok('tool_use' in flags, 'tool_use must have a default');
+  assert.ok('vision' in flags, 'vision must have a default');
+});
+
+// ---------------------------------------------------------------------------
+// 10. getRateLimits — returns rate limit config with defaults
+// ---------------------------------------------------------------------------
+
+test('getRateLimits returns rate limit config with defaults', () => {
+  const controller = createAgentProviderConfigController();
+  const config = makeProviderConfig('rate-limit-provider', {
+    rateLimits: { requestsPerMinute: 60 }
+  });
+  const limits = controller.getRateLimits(config);
+
+  assert.ok(limits, 'getRateLimits must return a value');
+  assert.equal(limits.requestsPerMinute, 60, 'must use spec requestsPerMinute');
+  assert.ok(Number.isFinite(limits.tokensPerMinute), 'tokensPerMinute must have a numeric default');
+});
+
+test('getRateLimits returns all defaults when no rateLimits in spec', () => {
+  const controller = createAgentProviderConfigController();
+  const config = makeProviderConfig('no-limits-provider');
+  const limits = controller.getRateLimits(config);
+
+  assert.ok(limits, 'getRateLimits must return a value');
+  assert.ok(Number.isFinite(limits.requestsPerMinute), 'requestsPerMinute must have a numeric default');
+  assert.ok(Number.isFinite(limits.tokensPerMinute), 'tokensPerMinute must have a numeric default');
+});
+
+// ---------------------------------------------------------------------------
+// 11. validate — rejects null resource
+// ---------------------------------------------------------------------------
+
+test('validate rejects null resource with a clear error', () => {
+  const controller = createAgentProviderConfigController();
+  const result = controller.validate(null);
+
+  assert.equal(result.valid, false, 'null resource must fail validation');
+  assert.ok(result.errors.length > 0, 'errors array must not be empty');
+  assert.ok(
+    result.errors.some((e) => /null|undefined/i.test(e)),
+    'error must mention null or undefined'
+  );
+});
+
+// ---------------------------------------------------------------------------
+// 12. BOUNDARY — exported with correct role
+// ---------------------------------------------------------------------------
+
+test('AGENT_PROVIDER_CONFIG_CONTROLLER_BOUNDARY is exported with correct role', () => {
+  assert.ok(AGENT_PROVIDER_CONFIG_CONTROLLER_BOUNDARY, 'BOUNDARY must be exported');
+  assert.equal(
+    AGENT_PROVIDER_CONFIG_CONTROLLER_BOUNDARY.role,
+    'agent-provider-config-controller',
+    'BOUNDARY role must be "agent-provider-config-controller"'
+  );
+  assert.ok(
+    Array.isArray(AGENT_PROVIDER_CONFIG_CONTROLLER_BOUNDARY.owns),
+    'BOUNDARY must declare owned concerns'
+  );
+});
+
+// ---------------------------------------------------------------------------
+// 13. getSupportedProviderTypes — returns valid provider types array
+// ---------------------------------------------------------------------------
+
+test('getSupportedProviderTypes returns valid provider types array', () => {
+  const controller = createAgentProviderConfigController();
+  const types = controller.getSupportedProviderTypes();
+
+  assert.ok(Array.isArray(types), 'getSupportedProviderTypes must return an array');
+  assert.ok(types.length >= 6, 'must return at least 6 provider types');
+  assert.ok(types.includes('anthropic'), 'must include anthropic');
+  assert.ok(types.includes('openai'), 'must include openai');
+  assert.ok(types.includes('azure-openai'), 'must include azure-openai');
+  assert.ok(types.includes('google-vertex'), 'must include google-vertex');
+  assert.ok(types.includes('foundry'), 'must include foundry');
+  assert.ok(types.includes('custom'), 'must include custom');
+});
+
+// ---------------------------------------------------------------------------
+// 14. validateAgentProviderConfig — standalone export follows existing pattern
+// ---------------------------------------------------------------------------
+
+test('validateAgentProviderConfig standalone export follows existing pattern', () => {
+  assert.equal(typeof validateAgentProviderConfig, 'function', 'validateAgentProviderConfig must be a named export');
+
+  const config = makeProviderConfig('standalone-validate-provider');
+  const result = validateAgentProviderConfig(config);
+
+  assert.ok(result, 'validateAgentProviderConfig must return a result');
+  assert.ok('valid' in result, 'result must have a valid property');
+  assert.ok(Array.isArray(result.errors), 'result must have an errors array');
+  assert.equal(result.valid, true, 'a fully-specified config must pass standalone validation');
+});
+
+// ---------------------------------------------------------------------------
+// 15. validate — all valid provider types are accepted
+// ---------------------------------------------------------------------------
+
+test('validate accepts all valid provider types', () => {
+  const controller = createAgentProviderConfigController();
+  for (const providerType of VALID_PROVIDER_TYPES) {
+    const config = makeProviderConfig(`${providerType}-provider`, { providerType });
+    const result = controller.validate(config);
+    assert.equal(result.valid, true, `providerType "${providerType}" must pass validation`);
+  }
+});
+
+// ---------------------------------------------------------------------------
+// 16. validate — accumulates multiple errors
+// ---------------------------------------------------------------------------
+
+test('validate accumulates all errors when multiple fields are invalid', () => {
+  const controller = createAgentProviderConfigController();
+  const config = {
+    apiVersion: 'krate.a5c.ai/v1alpha1',
+    kind: 'AgentProviderConfig',
+    metadata: { namespace: 'krate-org-default', labels: {}, annotations: {} },
+    spec: { providerType: 'bad-provider' },
+    status: {}
+  };
+  const result = controller.validate(config);
+
+  assert.equal(result.valid, false, 'config with multiple invalid fields must fail');
+  assert.ok(result.errors.length >= 2, 'must accumulate at least two errors');
+  assert.ok(
+    result.errors.some((e) => /name/i.test(e)),
+    'errors must include a name error'
+  );
+  assert.ok(
+    result.errors.some((e) => /providerType/i.test(e)),
+    'errors must include a providerType error'
+  );
+});
+
+// ---------------------------------------------------------------------------
+// 17. resolveEndpoint — throws on null resource
+// ---------------------------------------------------------------------------
+
+test('resolveEndpoint throws on null resource', () => {
+  const controller = createAgentProviderConfigController();
+  assert.throws(
+    () => controller.resolveEndpoint(null),
+    /null|undefined/i,
+    'resolveEndpoint must throw on null resource'
+  );
+});
+
+// ---------------------------------------------------------------------------
+// 18. getFeatureFlags — throws on null resource
+// ---------------------------------------------------------------------------
+
+test('getFeatureFlags throws on null resource', () => {
+  const controller = createAgentProviderConfigController();
+  assert.throws(
+    () => controller.getFeatureFlags(null),
+    /null|undefined/i,
+    'getFeatureFlags must throw on null resource'
+  );
+});

package/tests/agent-resources.test.js

@@ -0,0 +1,228 @@
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import {
+  CONFIG_KINDS,
+  AGGREGATED_KINDS,
+  ALL_KINDS,
+  RESOURCE_DEFINITIONS,
+  createResource,
+  validateResource,
+  resourceSchemaForKind,
+  storageClassForKind,
+  listResourceDefinitions
+} from '../src/resource-model.js';
+
+const AGENT_CONFIG_KINDS = [
+  'AgentStack',
+  'AgentSubagent',
+  'AgentToolProfile',
+  'AgentMcpServer',
+  'AgentSkill',
+  'AgentTriggerRule',
+  'AgentContextLabel',
+  'KrateWorkspacePolicy',
+  'AgentServiceAccount',
+  'AgentRoleBinding',
+  'AgentSecretGrant',
+  'AgentConfigGrant',
+  'AgentAdapter',
+  'AgentTransportBinding',
+  'AgentProviderConfig',
+  'KrateProject',
+  'AgentGatewayConfig',
+  'AgentMemoryRepository',
+  'AgentMemorySource',
+  'AgentMemoryOntology',
+  'AgentMemoryAssociation',
+  'KrateWorkspace'
+];
+
+const AGENT_AGGREGATED_KINDS = [
+  'AgentDispatchRun',
+  'AgentDispatchAttempt',
+  'AgentSession',
+  'AgentContextBundle',
+  'KrateArtifact',
+  'AgentApproval',
+  'AgentTriggerExecution',
+  'AgentCapabilityRequirement',
+  'WorkItemSessionLink',
+  'WorkItemWorkspaceLink',
+  'AgentSessionTranscript',
+  'AgentSessionAttachment',
+  'KrateWorkspaceRuntime',
+  'AgentMemorySnapshot',
+  'AgentMemoryQuery',
+  'AgentMemoryUpdate',
+  'AgentRunMemoryImport'
+];
+
+const ALL_AGENT_KINDS = [...AGENT_CONFIG_KINDS, ...AGENT_AGGREGATED_KINDS];
+
+/** Minimal valid spec for each agent kind, satisfying requiredSpec. */
+function minimalSpecForKind(kind) {
+  const specs = {
+    AgentStack: { organizationRef: 'default', baseAgent: 'claude-code', adapter: 'babysitter', runtimeIdentity: 'sa-agent' },
+    AgentSubagent: { organizationRef: 'default', rolePrompt: 'Code reviewer', taskKinds: ['review'] },
+    AgentToolProfile: { organizationRef: 'default', filesystemPolicy: 'read-write', approvalPolicyByTool: { shell: 'auto' } },
+    AgentMcpServer: { organizationRef: 'default', transport: 'stdio', scope: 'workspace' },
+    AgentSkill: { organizationRef: 'default', format: 'markdown', sourceRef: 'skills/debug.md' },
+    AgentTriggerRule: { organizationRef: 'default', sources: ['ci-failure'], agentStack: 'default-stack', taskKind: 'fix' },
+    AgentContextLabel: { organizationRef: 'default', promptFragment: 'Always run tests before committing', allowedSources: ['admin'] },
+    KrateWorkspacePolicy: { organizationRef: 'default', mode: 'worktree', retentionPolicy: '7d' },
+    AgentServiceAccount: { organizationRef: 'default', namespace: 'krate-agents', serviceAccountName: 'agent-runner' },
+    AgentRoleBinding: { organizationRef: 'default', subject: 'agent-runner', roleRef: 'agent-role', scope: 'namespace' },
+    AgentSecretGrant: { organizationRef: 'default', subject: 'agent-runner', secretRef: 'api-keys', purpose: 'API access' },
+    AgentConfigGrant: { organizationRef: 'default', subject: 'agent-runner', configMapRef: 'agent-config', purpose: 'Configuration' },
+    AgentDispatchRun: { organizationRef: 'default', repository: 'app', sourceRefs: ['refs/heads/main'], agentStack: 'default-stack', taskKind: 'fix' },
+    AgentDispatchAttempt: { organizationRef: 'default', agentDispatchRun: 'run-1', attemptReason: 'initial', agentStackSnapshot: { baseAgent: 'claude-code' } },
+    AgentSession: { organizationRef: 'default', agentMuxSessionId: 'sess-123', dispatchRun: 'run-1' },
+    AgentContextBundle: { organizationRef: 'default', dispatchRun: 'run-1', digest: 'sha256:abc', sources: ['repo-context'] },
+    KrateArtifact: { organizationRef: 'default', dispatchRun: 'run-1', kind: 'patch', digest: 'sha256:def' },
+    AgentApproval: { organizationRef: 'default', dispatchRun: 'run-1', action: 'write-back', requestedBy: 'agent-runner' },
+    KrateWorkspace: { organizationRef: 'default', repository: 'app', volumeSpec: { storageClassName: 'standard', capacity: '10Gi', accessModes: ['ReadWriteOnce'] } },
+    AgentTriggerExecution: { organizationRef: 'default', triggerRule: 'on-ci-fail', sourceEvent: 'pipeline-failed', decision: 'dispatch' },
+    AgentCapabilityRequirement: { organizationRef: 'default', ownerRef: 'stack-1', requiredRoles: ['shell', 'git'] },
+    WorkItemSessionLink: { organizationRef: 'default', workItemRef: 'issue-1', agentSession: 'sess-123' },
+    WorkItemWorkspaceLink: { organizationRef: 'default', workItemRef: 'issue-1', workspace: 'ws-1' },
+    AgentAdapter: { organizationRef: 'default', adapterType: 'claude-code', transport: 'stdio' },
+    AgentTransportBinding: { organizationRef: 'default', adapterRef: 'claude-code', endpoint: 'https://agent.example.test', protocol: 'https' },
+    AgentProviderConfig: { organizationRef: 'default', provider: 'anthropic', authType: 'api-key' },
+    KrateProject: { organizationRef: 'default', displayName: 'Platform' },
+    AgentGatewayConfig: { organizationRef: 'default', gatewayUrl: 'https://mux.example.test' },
+    AgentSessionTranscript: { organizationRef: 'default', sessionRef: 'sess-123', messages: [{ role: 'user', content: 'hello' }] },
+    AgentSessionAttachment: { organizationRef: 'default', sessionRef: 'sess-123', sourceType: 'upload', digest: 'sha256:abc' },
+    KrateWorkspaceRuntime: { organizationRef: 'default', workspaceRef: 'ws-1', status: 'running' },
+    AgentMemoryRepository: { organizationRef: 'default', repositoryRef: 'memory-repo', defaultBranch: 'main', layoutProfile: 'standard' },
+    AgentMemorySource: { organizationRef: 'default', repositoryRef: 'memory-repo', appliesTo: 'team:platform', include: ['decisions/**', 'runbooks/**'] },
+    AgentMemoryOntology: { organizationRef: 'default', memoryRepository: 'memory-repo', ontologyPath: '.memory/ontology.yaml' },
+    AgentMemoryAssociation: { organizationRef: 'default', memoryRef: 'decision-001', targetRef: 'issue-42', relationship: 'informs' },
+    AgentMemorySnapshot: { organizationRef: 'default', memoryRepository: 'memory-repo', requestedRef: 'refs/heads/main', resolvedCommit: 'a'.repeat(40) },
+    AgentMemoryQuery: { organizationRef: 'default', snapshotRef: 'snap-1', requester: 'agent-runner', query: 'deployment patterns' },
+    AgentMemoryUpdate: { organizationRef: 'default', memoryRepository: 'memory-repo', sourceRun: 'run-1', changes: [{ path: 'decisions/001.md', op: 'add' }] },
+    AgentRunMemoryImport: { organizationRef: 'default', memoryRepository: 'memory-repo', source: 'babysitter-run-42', include: ['journal', 'effects'] }
+  };
+  return specs[kind];
+}
+
+describe('agent resource set membership', () => {
+  for (const kind of AGENT_CONFIG_KINDS) {
+    it(`${kind} is in CONFIG_KINDS`, () => {
+      assert.ok(CONFIG_KINDS.has(kind), `${kind} should be in CONFIG_KINDS`);
+    });
+  }
+
+  for (const kind of AGENT_AGGREGATED_KINDS) {
+    it(`${kind} is in AGGREGATED_KINDS`, () => {
+      assert.ok(AGGREGATED_KINDS.has(kind), `${kind} should be in AGGREGATED_KINDS`);
+    });
+  }
+
+  for (const kind of ALL_AGENT_KINDS) {
+    it(`${kind} is in ALL_KINDS`, () => {
+      assert.ok(ALL_KINDS.has(kind), `${kind} should be in ALL_KINDS`);
+    });
+  }
+});
+
+describe('RESOURCE_DEFINITIONS for agent kinds', () => {
+  for (const kind of ALL_AGENT_KINDS) {
+    it(`${kind} has valid definition with storage, context, plural, purpose, requiredSpec`, () => {
+      const def = RESOURCE_DEFINITIONS[kind];
+      assert.ok(def, `${kind} should exist in RESOURCE_DEFINITIONS`);
+      assert.ok(['etcd', 'postgres'].includes(def.storage), `${kind} storage should be etcd or postgres`);
+      assert.ok(typeof def.context === 'string' && def.context.length > 0, `${kind} context should be a non-empty string`);
+      assert.ok(typeof def.plural === 'string' && def.plural.length > 0, `${kind} plural should be a non-empty string`);
+      assert.ok(typeof def.purpose === 'string' && def.purpose.length > 0, `${kind} purpose should be a non-empty string`);
+      assert.ok(Array.isArray(def.requiredSpec) && def.requiredSpec.length > 0, `${kind} requiredSpec should be a non-empty array`);
+    });
+  }
+});
+
+describe('createResource for agent kinds', () => {
+  for (const kind of ALL_AGENT_KINDS) {
+    it(`creates a valid ${kind} resource`, () => {
+      const spec = minimalSpecForKind(kind);
+      const resource = createResource(kind, { name: `test-${kind.toLowerCase()}` }, spec);
+      assert.equal(resource.apiVersion, 'krate.a5c.ai/v1alpha1');
+      assert.equal(resource.kind, kind);
+      assert.equal(resource.metadata.name, `test-${kind.toLowerCase()}`);
+      assert.equal(resource.metadata.namespace, 'default');
+      assert.ok(resource.metadata.labels !== undefined);
+      assert.ok(resource.metadata.annotations !== undefined);
+      assert.ok(typeof resource.spec === 'object');
+      assert.ok(typeof resource.status === 'object');
+    });
+  }
+});
+
+describe('validateResource rejects missing required spec fields for agent kinds', () => {
+  for (const kind of ALL_AGENT_KINDS) {
+    it(`throws on empty spec for ${kind}`, () => {
+      const resource = {
+        apiVersion: 'krate.a5c.ai/v1alpha1',
+        kind,
+        metadata: { name: `invalid-${kind.toLowerCase()}` },
+        spec: {},
+        status: {}
+      };
+      const def = RESOURCE_DEFINITIONS[kind];
+      assert.throws(
+        () => validateResource(resource),
+        (err) => {
+          assert.ok(err.message.includes(`${kind} spec.${def.requiredSpec[0]} is required`));
+          return true;
+        }
+      );
+    });
+  }
+});
+
+describe('resourceSchemaForKind for agent kinds', () => {
+  for (const kind of ALL_AGENT_KINDS) {
+    it(`returns correct schema for ${kind}`, () => {
+      const schema = resourceSchemaForKind(kind);
+      assert.equal(schema.apiVersion, 'krate.a5c.ai/v1alpha1');
+      assert.equal(schema.kind, kind);
+      assert.ok(typeof schema.plural === 'string');
+      assert.ok(['etcd', 'postgres'].includes(schema.storage));
+      assert.ok(Array.isArray(schema.required.metadata));
+      assert.ok(schema.required.metadata.includes('name'));
+      assert.ok(Array.isArray(schema.required.spec));
+      assert.ok(schema.required.spec.length > 0);
+      assert.deepEqual(schema.status, ['storage', 'phase', 'conditions']);
+    });
+  }
+});
+
+describe('storageClassForKind for agent kinds', () => {
+  for (const kind of AGENT_CONFIG_KINDS) {
+    it(`${kind} returns etcd`, () => {
+      assert.equal(storageClassForKind(kind), 'etcd');
+    });
+  }
+
+  for (const kind of AGENT_AGGREGATED_KINDS) {
+    it(`${kind} returns postgres`, () => {
+      assert.equal(storageClassForKind(kind), 'postgres');
+    });
+  }
+});
+
+describe('kind set counts', () => {
+  it('CONFIG_KINDS has 46 members', () => {
+    assert.equal(CONFIG_KINDS.size, 46);
+  });
+
+  it('AGGREGATED_KINDS has 29 members', () => {
+    assert.equal(AGGREGATED_KINDS.size, 29);
+  });
+
+  it('ALL_KINDS has 75 members', () => {
+    assert.equal(ALL_KINDS.size, 75);
+  });
+
+  it('listResourceDefinitions returns 75 definitions', () => {
+    assert.equal(listResourceDefinitions().length, 75);
+  });
+});