@ngocsangairvds/vsaf 3.2.13 → 3.2.15

package/tools/vds-scripts/audit_orchestrator/tests/test_agents/test_code_agent.py

@@ -1,2311 +0,0 @@
-"""Tests for CodeAnalysisAgent.
-
-Phase 23 Refinement (FR-1.1):
-- Updated tests to use SecurityPatternScanner instead of grepai
-- Tests now mock SecurityPatternScanner for security pattern detection
-- Source changed from "grepai" to "pattern_scanner"
-"""
-
-from __future__ import annotations
-
-import asyncio
-from types import SimpleNamespace
-from unittest.mock import AsyncMock, MagicMock, patch
-
-import pytest
-from vds_agent_core.config import LLMProtocolType
-from vds_audit_orchestrator.agents.code_agent import CodeAnalysisAgent
-from vds_audit_orchestrator.agents.pydantic_base import (
-    CodeFindings,
-    CodeIssue,
-)
-from vds_audit_orchestrator.agents.security_scanner import ScanResult
-from vds_audit_orchestrator.llm.provider import LLMSettings
-from vds_audit_orchestrator.models.evidence import Evidence, EvidenceBundle, EvidenceStatus
-from vds_audit_orchestrator.models.task import AuditTask
-
-
-@pytest.fixture
-def mock_evidence_bundle():
-    """Create a mock evidence bundle."""
-    return EvidenceBundle(
-        repository="test-repo",
-        git_evidence=[
-            Evidence(
-                source="git_file",
-                source_id="src/main.py",
-                title="Main App",
-                content="def main():\n    # TODO: Implement feature\n    pass",
-                content_hash="hash1",
-                status=EvidenceStatus.FOUND,
-            ),
-            Evidence(
-                source="git_file",
-                source_id="src/utils.py",
-                title="Utils",
-                content="def util():\n    # FIXME: broken logic\n    pass",
-                content_hash="hash2",
-                status=EvidenceStatus.FOUND,
-            ),
-        ],
-    )
-
-
-@pytest.fixture
-def empty_evidence_bundle():
-    """Create an empty evidence bundle for edge case testing."""
-    return EvidenceBundle(
-        repository="empty-repo",
-        git_evidence=[],
-    )
-
-
-@pytest.fixture
-def single_file_evidence_bundle():
-    """Create a single file evidence bundle."""
-    return EvidenceBundle(
-        repository="single-file-repo",
-        git_evidence=[
-            Evidence(
-                source="git_file",
-                source_id="README.md",
-                title="Readme",
-                content="# My Project\n\nA simple project with one file.",
-                content_hash="hash3",
-                status=EvidenceStatus.FOUND,
-            ),
-        ],
-    )
-
-
-@pytest.fixture
-def large_evidence_bundle():
-    """Create a large evidence bundle with many files."""
-    return EvidenceBundle(
-        repository="large-repo",
-        git_evidence=[
-            Evidence(
-                source="git_file",
-                source_id=f"src/module_{i}.py",
-                title=f"Module {i}",
-                content=f"def function_{i}():\n    pass",
-                content_hash=f"hash{i}",
-                status=EvidenceStatus.FOUND,
-            )
-            for i in range(100)
-        ],
-    )
-
-
-@pytest.fixture
-def varied_severity_bundle():
-    """Create evidence bundle with various severity patterns."""
-    return EvidenceBundle(
-        repository="severity-test-repo",
-        git_evidence=[
-            Evidence(
-                source="git_file",
-                source_id="src/high_severity.py",
-                title="High Severity",
-                content="def risky():\n    except:\n        pass  # Bare except",
-                content_hash="hash_high",
-                status=EvidenceStatus.FOUND,
-            ),
-            Evidence(
-                source="git_file",
-                source_id="src/medium_severity.py",
-                title="Medium Severity",
-                content="def medium():\n    # FIXME: fix this later\n    pass",
-                content_hash="hash_med",
-                status=EvidenceStatus.FOUND,
-            ),
-            Evidence(
-                source="git_file",
-                source_id="src/low_severity.py",
-                title="Low Severity",
-                content="def minor():\n    # TODO: add documentation\n    pass",
-                content_hash="hash_low",
-                status=EvidenceStatus.FOUND,
-            ),
-            Evidence(
-                source="git_file",
-                source_id="src/info_severity.py",
-                title="Info Severity",
-                content="def ignore():\n    x = 1  # type: ignore\n    pass",
-                content_hash="hash_info",
-                status=EvidenceStatus.FOUND,
-            ),
-        ],
-    )
-
-
-@pytest.mark.asyncio
-async def test_pattern_scanner_logged_in_metadata(monkeypatch, mock_evidence_bundle, tmp_path):
-    """Ensure SecurityPatternScanner usage is recorded in agent metadata.
-
-    Phase 23 Refinement: Updated to test pattern_scanner instead of grepai.
-    """
-    # Create a mock repo path
-    repo_path = tmp_path / "test-repo"
-    repo_path.mkdir()
-
-    # Create a test file with a security pattern
-    test_file = repo_path / "test.py"
-    test_file.write_text("password = 'secret123'")
-
-    # Mock _get_repo_path to return our test repo
-    agent = CodeAnalysisAgent(settings=LLMSettings(enabled=False))
-    agent._get_repo_path = lambda evidence, profile: repo_path
-
-    result = await agent.analyze(mock_evidence_bundle)
-
-    assert result.metadata.get("pattern_scanner_used") is True
-    assert "pattern_scanner_findings" in result.metadata
-
-
-class TestCodeAnalysisAgent:
-    """Tests for CodeAnalysisAgent."""
-
-    # ============================================================================
-    # BASIC FUNCTIONALITY TESTS (Original)
-    # ============================================================================
-
-    @pytest.mark.asyncio
-    async def test_analyze_bundle_missing(self):
-        """Test handling of missing evidence bundle."""
-        agent = CodeAnalysisAgent()
-        result = await agent.analyze({})
-        assert result.success is False
-        assert result.error and "Evidence bundle missing" in result.error
-
-    @pytest.mark.asyncio
-    async def test_analyze_patterns(self, mock_evidence_bundle):
-        """Test pattern matching analysis.
-
-        Phase 23 Refinement: Removed grepai mock, pattern scanner is skipped
-        when repo_path is not available.
-        """
-        agent = CodeAnalysisAgent()
-        result = await agent.analyze(mock_evidence_bundle)
-
-        assert result.success is True
-        findings = result.findings
-
-        # Should find TODO and FIXME
-        todos = [f for f in findings if "TODO" in f["description"]]
-        fixmes = [f for f in findings if "FIXME" in f["description"]]
-
-        assert len(todos) == 1
-        assert todos[0]["location"] == "src/main.py"
-        assert todos[0]["type"] == "technical_debt"
-
-        assert len(fixmes) == 1
-        assert fixmes[0]["location"] == "src/utils.py"
-
-    @pytest.mark.asyncio
-    @patch("vds_audit_orchestrator.agents.code_agent.SecurityPatternScanner")
-    async def test_analyze_security_patterns(self, mock_scanner_class, mock_evidence_bundle, tmp_path):
-        """Test integration with SecurityPatternScanner.
-
-        Phase 23 Refinement: Updated to use SecurityPatternScanner instead of grepai.
-        """
-        # Create mock scan results
-        mock_scanner = MagicMock()
-        mock_scanner.scan.return_value = [
-            ScanResult(
-                pattern_name="hardcoded_password",
-                severity="CRITICAL",
-                description="Hardcoded password detected",
-                file_path="src/auth.py",
-                line_number=10,
-                line_content="password = '123456'",
-                match_text="password = '123456'",
-            )
-        ]
-        mock_scanner_class.return_value = mock_scanner
-
-        # Create a mock repo path
-        repo_path = tmp_path / "test-repo"
-        repo_path.mkdir()
-
-        agent = CodeAnalysisAgent()
-        # Mock _get_repo_path to return our test repo
-        agent._get_repo_path = lambda evidence, profile: repo_path
-
-        result = await agent.analyze(mock_evidence_bundle)
-
-        assert result.success is True
-        findings = result.findings
-
-        security_findings = [f for f in findings if f.get("source") == "pattern_scanner"]
-        assert len(security_findings) >= 1
-        assert security_findings[0]["type"] == "security_hardcoded_password"
-        assert security_findings[0]["severity"] == "critical"
-
-    @pytest.mark.asyncio
-    async def test_analyze_llm(self, mock_evidence_bundle):
-        """Test LLM-based analysis.
-
-        Phase 23 Refinement: Removed grepai mock, pattern scanner is skipped
-        when repo_path is not available.
-        """
-        mock_settings = MagicMock()
-        mock_settings.enabled = True
-
-        llm_output = CodeFindings(
-            score=8.0,
-            issues=[
-                CodeIssue(
-                    severity="low",
-                    category="quality",
-                    description="Good structure",
-                    file_path="src/main.py",
-                )
-            ],
-            patterns=[],
-            confidence=0.85,
-            reasoning="Code follows good practices",
-            files_analyzed=2,
-            tech_stack=["python"],
-        )
-
-        agent = CodeAnalysisAgent(settings=mock_settings, agentic_mode="off")
-        agent._run_pydantic_ai_analysis = AsyncMock(return_value=llm_output)
-
-        result = await agent.analyze(mock_evidence_bundle)
-
-        assert result.success is True
-        llm_findings = [f for f in result.findings if f.get("source") == "pydantic_ai_analysis"]
-        assert len(llm_findings) == 1
-        assert llm_findings[0]["type"] == "quality"  # Uses issue.category, not issue.type
-        assert result.metadata["llm_summary"]["score"] == 8.0
-
-    # ============================================================================
-    # EDGE CASE TESTS
-    # ============================================================================
-
-    @pytest.mark.asyncio
-    async def test_empty_repository(self, empty_evidence_bundle):
-        """Test analysis of empty repository with no files.
-
-        Phase 23 Refinement: Removed grepai mock, pattern scanner is skipped
-        when repo_path is not available.
-        """
-        agent = CodeAnalysisAgent()
-        result = await agent.analyze(empty_evidence_bundle)
-
-        assert result.success is True
-        assert result.findings == []
-        assert result.metadata["files_analyzed"] == 0
-        assert result.metadata["total_findings"] == 0
-
-    @pytest.mark.asyncio
-    async def test_llm_skips_empty_placeholder_files(self):
-        """LLM analysis should not run when evidence files have empty content only."""
-        bundle = EvidenceBundle(
-            repository="placeholder-repo",
-            git_evidence=[
-                Evidence(
-                    source="git_file",
-                    source_id="README.md",
-                    title="README.md",
-                    content="",
-                    content_hash="",
-                    status=EvidenceStatus.MISSING,
-                ),
-                Evidence(
-                    source="git_file",
-                    source_id="docs/architecture.md",
-                    title="architecture.md",
-                    content="   ",
-                    content_hash="",
-                    status=EvidenceStatus.MISSING,
-                ),
-            ],
-        )
-        settings = MagicMock()
-        settings.enabled = True
-        agent = CodeAnalysisAgent(settings=settings)
-        agent._run_pydantic_agent = AsyncMock(side_effect=AssertionError("LLM should not be called"))
-
-        result = await agent.analyze(bundle)
-
-        assert result.success is True
-        assert "llm_summary" not in result.metadata
-        assert "llm_error" not in result.metadata
-        assert result.metadata["files_analyzed"] == 2
-
-    @pytest.mark.asyncio
-    async def test_single_file_repository(self, single_file_evidence_bundle):
-        """Test analysis of repository with single file.
-
-        Phase 23 Refinement: Removed grepai mock, pattern scanner is skipped
-        when repo_path is not available.
-        """
-        agent = CodeAnalysisAgent()
-        result = await agent.analyze(single_file_evidence_bundle)
-
-        assert result.success is True
-        assert result.metadata["files_analyzed"] == 1
-        # Single clean file should have no pattern findings
-        pattern_findings = [f for f in result.findings if f.get("source") == "pattern_scan"]
-        assert len(pattern_findings) == 0
-
-    @pytest.mark.asyncio
-    async def test_none_evidence_bundle(self):
-        """Test handling of None as evidence bundle.
-
-        Phase 23 Refinement: Removed grepai mock.
-        """
-        agent = CodeAnalysisAgent()
-        result = await agent.analyze(None)
-
-        assert result.success is False
-        assert result.error and "Evidence bundle missing" in result.error
-
-    @pytest.mark.asyncio
-    async def test_dict_with_evidence_bundle_key(self, mock_evidence_bundle):
-        """Test dictionary input with evidence_bundle key.
-
-        Phase 23 Refinement: Removed grepai mock.
-        """
-        agent = CodeAnalysisAgent()
-        result = await agent.analyze({"evidence_bundle": mock_evidence_bundle})
-
-        assert result.success is True
-        assert result.metadata["files_analyzed"] == 2
-
-    @pytest.mark.asyncio
-    async def test_dict_with_evidence_key(self, mock_evidence_bundle):
-        """Test dictionary input with evidence key.
-
-        Phase 23 Refinement: Removed grepai mock.
-        """
-        agent = CodeAnalysisAgent()
-        result = await agent.analyze({"evidence": mock_evidence_bundle})
-
-        assert result.success is True
-        assert result.metadata["files_analyzed"] == 2
-
-    # ============================================================================
-    # PATTERN SCANNER FAILURE AND ERROR HANDLING TESTS
-    # ============================================================================
-
-    @pytest.mark.asyncio
-    @patch("vds_audit_orchestrator.agents.code_agent.SecurityPatternScanner")
-    async def test_pattern_scanner_exception(self, mock_scanner_class, mock_evidence_bundle, tmp_path):
-        """Test handling when SecurityPatternScanner raises an exception.
-
-        Phase 23 Refinement: Updated to test SecurityPatternScanner instead of grepai.
-        """
-        mock_scanner_class.side_effect = Exception("Scanner not available")
-
-        # Create a mock repo path
-        repo_path = tmp_path / "test-repo"
-        repo_path.mkdir()
-
-        agent = CodeAnalysisAgent()
-        agent._get_repo_path = lambda e, p: repo_path
-
-        result = await agent.analyze(mock_evidence_bundle)
-
-        # Should continue with pattern matching despite scanner failure
-        assert result.success is True
-        scanner_findings = [f for f in result.findings if f.get("source") == "pattern_scanner"]
-        assert len(scanner_findings) == 0
-        # Pattern findings should still be present
-        pattern_findings = [f for f in result.findings if f.get("source") == "pattern_scan"]
-        assert len(pattern_findings) > 0
-
-    @pytest.mark.asyncio
-    async def test_pattern_scanner_no_repo_path(self, mock_evidence_bundle):
-        """Test handling when repo_path is not available.
-
-        Phase 23 Refinement: Tests graceful handling when repo_path cannot be determined.
-        """
-        agent = CodeAnalysisAgent()
-        result = await agent.analyze(mock_evidence_bundle)
-
-        # Should continue with pattern matching despite missing repo_path
-        assert result.success is True
-        assert result.metadata.get("pattern_scanner_skipped") == "repo_path not available"
-        # Pattern findings should still be present
-        pattern_findings = [f for f in result.findings if f.get("source") == "pattern_scan"]
-        assert len(pattern_findings) > 0
-
-    @pytest.mark.asyncio
-    @patch("vds_audit_orchestrator.agents.code_agent.SecurityPatternScanner")
-    async def test_pattern_scanner_returns_empty_list(self, mock_scanner_class, mock_evidence_bundle, tmp_path):
-        """Test when SecurityPatternScanner returns empty results.
-
-        Phase 23 Refinement: Updated to test SecurityPatternScanner instead of grepai.
-        """
-        mock_scanner = MagicMock()
-        mock_scanner.scan.return_value = []
-        mock_scanner_class.return_value = mock_scanner
-
-        # Create a mock repo path
-        repo_path = tmp_path / "test-repo"
-        repo_path.mkdir()
-
-        agent = CodeAnalysisAgent()
-        agent._get_repo_path = lambda e, p: repo_path
-
-        result = await agent.analyze(mock_evidence_bundle)
-
-        assert result.success is True
-        scanner_findings = [f for f in result.findings if f.get("source") == "pattern_scanner"]
-        assert len(scanner_findings) == 0
-        # Should still have pattern findings
-        assert len(result.findings) > 0
-
-    @pytest.mark.asyncio
-    @patch("vds_audit_orchestrator.agents.code_agent.SecurityPatternScanner")
-    async def test_pattern_scanner_multiple_security_patterns(self, mock_scanner_class, mock_evidence_bundle, tmp_path):
-        """Test SecurityPatternScanner detecting multiple security issues.
-
-        Phase 23 Refinement: Updated to test SecurityPatternScanner instead of grepai.
-        """
-        mock_scanner = MagicMock()
-        mock_scanner.scan.return_value = [
-            ScanResult(
-                pattern_name="hardcoded_password",
-                severity="CRITICAL",
-                description="Hardcoded password detected",
-                file_path="src/auth.py",
-                line_number=10,
-                line_content="password = 'secret'",
-                match_text="password = 'secret'",
-            ),
-            ScanResult(
-                pattern_name="sql_string_concat",
-                severity="HIGH",
-                description="Potential SQL injection via string concatenation",
-                file_path="src/db.py",
-                line_number=25,
-                line_content='query = f"SELECT * FROM {user_input}"',
-                match_text='query = f"SELECT * FROM {user_input}"',
-            ),
-            ScanResult(
-                pattern_name="ssl_verify_false",
-                severity="HIGH",
-                description="SSL verification disabled",
-                file_path="src/api.py",
-                line_number=15,
-                line_content="verify=False",
-                match_text="verify=False",
-            ),
-        ]
-        mock_scanner_class.return_value = mock_scanner
-
-        # Create a mock repo path
-        repo_path = tmp_path / "test-repo"
-        repo_path.mkdir()
-
-        agent = CodeAnalysisAgent()
-        agent._get_repo_path = lambda e, p: repo_path
-
-        result = await agent.analyze(mock_evidence_bundle)
-
-        assert result.success is True
-        scanner_findings = [f for f in result.findings if f.get("source") == "pattern_scanner"]
-        assert len(scanner_findings) == 3
-
-        finding_types = {f["type"] for f in scanner_findings}
-        assert "security_hardcoded_password" in finding_types
-        assert "security_sql_string_concat" in finding_types
-        assert "security_ssl_verify_false" in finding_types
-
-    # ============================================================================
-    # LARGE CODEBASE HANDLING TESTS
-    # ============================================================================
-
-    @pytest.mark.asyncio
-    async def test_large_codebase_pattern_scan(self, large_evidence_bundle):
-        """Test pattern scanning on large codebase (100 files).
-
-        Phase 23 Refinement: Removed grepai mock.
-        """
-        agent = CodeAnalysisAgent()
-        result = await agent.analyze(large_evidence_bundle)
-
-        assert result.success is True
-        assert result.metadata["files_analyzed"] == 100
-        # Each file has a "pass" statement, check findings were generated
-        # The pass pattern only triggers with comment, so let's check total findings
-        assert len(result.findings) >= 0  # Files may not trigger any patterns if clean
-
-    @pytest.mark.asyncio
-    async def test_large_codebase_llm_sampling(self, large_evidence_bundle):
-        """Test LLM analysis samples only subset of large codebase.
-
-        Phase 23 Refinement: Removed grepai mock.
-        """
-        mock_settings = MagicMock()
-        mock_settings.enabled = True
-
-        llm_output = CodeFindings(
-            score=8.0,
-            issues=[
-                CodeIssue(
-                    type="structure",
-                    severity="low",
-                    category="quality",
-                    description="Test",
-                    file_path="src/module_0.py",
-                )
-            ],
-            patterns=[],
-            confidence=0.85,
-            reasoning="Large codebase analyzed",
-            files_analyzed=100,
-            tech_stack=["python"],
-        )
-
-        agent = CodeAnalysisAgent(settings=mock_settings, agentic_mode="off")
-        agent._run_pydantic_ai_analysis = AsyncMock(return_value=llm_output)
-
-        result = await agent.analyze(large_evidence_bundle)
-
-        assert result.success is True
-        assert result.metadata["files_analyzed"] == 100
-        llm_findings = [f for f in result.findings if f.get("source") == "pydantic_ai_analysis"]
-        assert len(llm_findings) == 1
-
-    # ============================================================================
-    # CONCURRENCY AND ASYNC EXECUTION TESTS
-    # ============================================================================
-
-    @pytest.mark.asyncio
-    async def test_concurrent_analyses(self, mock_evidence_bundle):
-        """Test multiple concurrent analysis executions.
-
-        Phase 23 Refinement: Removed grepai mock.
-        """
-        agent = CodeAnalysisAgent()
-
-        # Run multiple analyses concurrently
-        results = await asyncio.gather(
-            agent.analyze(mock_evidence_bundle),
-            agent.analyze(mock_evidence_bundle),
-            agent.analyze(mock_evidence_bundle),
-        )
-
-        # All should succeed
-        for result in results:
-            assert result.success is True
-            assert len(result.findings) > 0
-
-    @pytest.mark.asyncio
-    @patch("vds_audit_orchestrator.agents.code_agent.SecurityPatternScanner")
-    async def test_async_pattern_scanner_calls(self, mock_scanner_class, mock_evidence_bundle, tmp_path):
-        """Test that SecurityPatternScanner calls are handled properly in async context.
-
-        Phase 23 Refinement: Updated to test SecurityPatternScanner instead of grepai.
-        """
-        call_count = [0]
-
-        def mock_scan(*args, **kwargs):
-            call_count[0] += 1
-            return []
-
-        mock_scanner = MagicMock()
-        mock_scanner.scan = MagicMock(side_effect=mock_scan)
-        mock_scanner_class.return_value = mock_scanner
-
-        # Create a mock repo path
-        repo_path = tmp_path / "test-repo"
-        repo_path.mkdir()
-
-        agent = CodeAnalysisAgent()
-        agent._get_repo_path = lambda e, p: repo_path
-
-        result = await agent.analyze(mock_evidence_bundle)
-
-        assert result.success is True
-        # Should have called scanner once
-        assert call_count[0] == 1
-
-    # ============================================================================
-    # ERROR SCENARIOS WHEN PATTERN SCANNER FAILS
-    # ============================================================================
-
-    @pytest.mark.asyncio
-    @patch("vds_audit_orchestrator.agents.code_agent.SecurityPatternScanner")
-    async def test_pattern_scanner_attribute_error(self, mock_scanner_class, mock_evidence_bundle, tmp_path):
-        """Test handling when SecurityPatternScanner has attribute errors.
-
-        Phase 23 Refinement: Updated to test SecurityPatternScanner instead of SkillExecutor.
-        """
-        mock_scanner_class.side_effect = AttributeError("Module not found")
-
-        # Create a mock repo path
-        repo_path = tmp_path / "test-repo"
-        repo_path.mkdir()
-
-        agent = CodeAnalysisAgent()
-        agent._get_repo_path = lambda e, p: repo_path
-
-        result = await agent.analyze(mock_evidence_bundle)
-
-        # Should gracefully handle the error
-        assert result.success is True
-        scanner_findings = [f for f in result.findings if f.get("source") == "pattern_scanner"]
-        assert len(scanner_findings) == 0
-
-    @pytest.mark.asyncio
-    @patch("vds_audit_orchestrator.agents.code_agent.SecurityPatternScanner")
-    async def test_pattern_scanner_invalid_response(self, mock_scanner_class, mock_evidence_bundle, tmp_path):
-        """Test handling when SecurityPatternScanner returns invalid data.
-
-        Phase 23 Refinement: Updated to test SecurityPatternScanner instead of SkillExecutor.
-        """
-        # Return invalid data structure
-        mock_scanner = MagicMock()
-        mock_scanner.scan.return_value = "invalid string instead of list"
-        mock_scanner_class.return_value = mock_scanner
-
-        # Create a mock repo path
-        repo_path = tmp_path / "test-repo"
-        repo_path.mkdir()
-
-        agent = CodeAnalysisAgent()
-        agent._get_repo_path = lambda e, p: repo_path
-
-        result = await agent.analyze(mock_evidence_bundle)
-
-        # Should handle gracefully
-        assert result.success is True
-        # Pattern findings should still work
-        pattern_findings = [f for f in result.findings if f.get("source") == "pattern_scan"]
-        assert len(pattern_findings) > 0
-
-    # ============================================================================
-    # EMPTY FINDINGS SCENARIOS
-    # ============================================================================
-
-    @pytest.mark.asyncio
-    async def test_empty_findings_all_clean(self):
-        """Test repository with clean code (no issues found).
-
-        Phase 23 Refinement: Removed grepai mock.
-        """
-        clean_bundle = EvidenceBundle(
-            repository="clean-repo",
-            git_evidence=[
-                Evidence(
-                    source="git_file",
-                    source_id="src/clean.py",
-                    title="Clean Code",
-                    content='''def hello():
-    """Say hello."""
-    print("Hello, World!")
-
-if __name__ == "__main__":
-    hello()
-''',
-                    content_hash="clean_hash",
-                    status=EvidenceStatus.FOUND,
-                ),
-            ],
-        )
-
-        agent = CodeAnalysisAgent()
-        result = await agent.analyze(clean_bundle)
-
-        assert result.success is True
-        # Clean code should have minimal or no findings
-        pattern_findings = [f for f in result.findings if f.get("source") == "pattern_scan"]
-        # Might have minimal findings but should be very limited
-        assert len(pattern_findings) == 0
-
-    @pytest.mark.asyncio
-    async def test_empty_scanner_with_pattern_findings(self, mock_evidence_bundle):
-        """Test when SecurityPatternScanner finds nothing but patterns do.
-
-        Phase 23 Refinement: Updated to test SecurityPatternScanner instead of grepai.
-        """
-        agent = CodeAnalysisAgent()
-        result = await agent.analyze(mock_evidence_bundle)
-
-        assert result.success is True
-        assert result.metadata["total_findings"] > 0
-        scanner_findings = [f for f in result.findings if f.get("source") == "pattern_scanner"]
-        pattern_findings = [f for f in result.findings if f.get("source") == "pattern_scan"]
-
-        # Scanner findings may be 0 if repo_path not available
-        assert len(scanner_findings) >= 0
-        assert len(pattern_findings) > 0
-
-    # ============================================================================
-    # VARIOUS SEVERITY LEVELS TESTS
-    # ============================================================================
-
-    @pytest.mark.asyncio
-    @patch("vds_audit_orchestrator.agents.code_agent.SecurityPatternScanner")
-    async def test_all_severity_levels(self, mock_scanner_class, varied_severity_bundle, tmp_path):
-        """Test detection of findings across all severity levels.
-
-        Phase 23 Refinement: Updated to test SecurityPatternScanner instead of grepai.
-        """
-        mock_scanner = MagicMock()
-        mock_scanner.scan.return_value = [
-            # Return a critical severity security finding
-            ScanResult(
-                pattern_name="hardcoded_password",
-                severity="CRITICAL",
-                description="Hardcoded password detected",
-                file_path="src/auth.py",
-                line_number=1,
-                line_content="hardcoded password",
-                match_text="hardcoded password",
-            )
-        ]
-        mock_scanner_class.return_value = mock_scanner
-
-        # Create a mock repo path
-        repo_path = tmp_path / "test-repo"
-        repo_path.mkdir()
-
-        agent = CodeAnalysisAgent()
-        agent._get_repo_path = lambda evidence, profile: repo_path
-
-        result = await agent.analyze(varied_severity_bundle)
-
-        assert result.success is True
-
-        # Check all severity levels are present
-        severities = {f.get("severity") for f in result.findings}
-        # critical comes from pattern scanner security
-        assert "critical" in severities
-        assert "medium" in severities
-        assert "low" in severities
-        assert "info" in severities
-
-    @pytest.mark.asyncio
-    async def test_high_severity_bare_except(self):
-        """Test detection of high-severity bare except clauses.
-
-        Phase 23 Refinement: Removed grepai mock.
-        """
-        bundle = EvidenceBundle(
-            repository="except-test",
-            git_evidence=[
-                Evidence(
-                    source="git_file",
-                    source_id="bad.py",
-                    title="Bad Error Handling",
-                    content="try:\n    risky()\nexcept:\n    pass",
-                    content_hash="hash1",
-                    status=EvidenceStatus.FOUND,
-                ),
-            ],
-        )
-
-        agent = CodeAnalysisAgent()
-        result = await agent.analyze(bundle)
-
-        assert result.success is True
-        bare_except = [f for f in result.findings if "bare except" in f.get("description", "").lower()]
-        assert len(bare_except) == 1
-        assert bare_except[0]["severity"] == "medium"
-
-    @pytest.mark.asyncio
-    async def test_info_severity_suppressions(self):
-        """Test detection of info-level code quality suppressions.
-
-        Phase 23 Refinement: Removed grepai mock.
-        """
-        bundle = EvidenceBundle(
-            repository="suppression-test",
-            git_evidence=[
-                Evidence(
-                    source="git_file",
-                    source_id="suppressed.py",
-                    title="Suppressed Code",
-                    content="x = 1  # type: ignore\ny = 2  # noqa",
-                    content_hash="hash1",
-                    status=EvidenceStatus.FOUND,
-                ),
-            ],
-        )
-
-        agent = CodeAnalysisAgent()
-        result = await agent.analyze(bundle)
-
-        assert result.success is True
-        info_findings = [f for f in result.findings if f.get("severity") == "info"]
-        assert len(info_findings) >= 2
-
-    # ============================================================================
-    # LLM ERROR HANDLING TESTS
-    # ============================================================================
-
-    @pytest.mark.asyncio
-    async def test_llm_client_unavailable(self, mock_evidence_bundle):
-        """Test handling when LLM client is not available.
-
-        Phase 23 Refinement: Removed grepai mock.
-        """
-        # Create agent with LLM disabled
-        mock_settings = MagicMock()
-        mock_settings.enabled = False
-
-        agent = CodeAnalysisAgent(settings=mock_settings, agentic_mode="off")
-        result = await agent.analyze(mock_evidence_bundle)
-
-        assert result.success is True
-        # Should still have pattern findings
-        pattern_findings = [f for f in result.findings if f.get("source") == "pattern_scan"]
-        assert len(pattern_findings) > 0
-        # No LLM findings
-        llm_findings = [f for f in result.findings if f.get("source") == "llm_analysis"]
-        assert len(llm_findings) == 0
-
-    @pytest.mark.asyncio
-    async def test_llm_response_parse_error(self, mock_evidence_bundle):
-        """Test handling when LLM response cannot be parsed.
-
-        Phase 23 Refinement: Removed grepai mock.
-        """
-        mock_settings = MagicMock()
-        mock_settings.enabled = True
-
-        agent = CodeAnalysisAgent(settings=mock_settings, agentic_mode="off")
-        agent._run_pydantic_ai_analysis = AsyncMock(side_effect=ValueError("Invalid LLM output"))
-
-        result = await agent.analyze(mock_evidence_bundle)
-
-        # When PydanticAI analysis fails, agent continues with other layers (graceful degradation)
-        assert result.success is True
-        # LLM error should be recorded in metadata
-        assert "llm_error" in result.metadata
-        assert "Invalid LLM output" in result.metadata["llm_error"]
-
-    @pytest.mark.asyncio
-    async def test_llm_json_in_markdown_fallback(self, mock_evidence_bundle):
-        """Test structured LLM output handling.
-
-        Phase 23 Refinement: Removed grepai mock.
-        """
-        mock_settings = MagicMock()
-        mock_settings.enabled = True
-
-        llm_output = CodeFindings(
-            score=7.0,
-            issues=[
-                CodeIssue(
-                    type="structure",
-                    severity="low",
-                    category="quality",
-                    description="Test finding",
-                    file_path="src/main.py",
-                )
-            ],
-            patterns=[],
-            confidence=0.85,
-            reasoning="Test analysis",
-            files_analyzed=2,
-            tech_stack=["python"],
-        )
-
-        agent = CodeAnalysisAgent(settings=mock_settings, agentic_mode="off")
-        agent._run_pydantic_ai_analysis = AsyncMock(return_value=llm_output)
-
-        result = await agent.analyze(mock_evidence_bundle)
-
-        assert result.success is True
-        llm_findings = [f for f in result.findings if f.get("source") == "pydantic_ai_analysis"]
-        assert len(llm_findings) == 1
-        assert result.metadata["llm_summary"]["score"] == 7.0
-
-    # ============================================================================
-    # PATTERN MATCHING EDGE CASES
-    # ============================================================================
-
-    @pytest.mark.asyncio
-    async def test_multiple_patterns_same_file(self):
-        """Test detection of multiple patterns in same file.
-
-        Phase 23 Refinement: Removed grepai mock.
-        """
-        bundle = EvidenceBundle(
-            repository="multi-pattern",
-            git_evidence=[
-                Evidence(
-                    source="git_file",
-                    source_id="complex.py",
-                    title="Complex File",
-                    content="""# TODO: Implement this
-# FIXME: Fix that
-# HACK: Quick workaround
-# XXX: Review needed
-try:
-    pass
-except:
-    pass
-""",
-                    content_hash="hash1",
-                    status=EvidenceStatus.FOUND,
-                ),
-            ],
-        )
-
-        agent = CodeAnalysisAgent()
-        result = await agent.analyze(bundle)
-
-        assert result.success is True
-        pattern_findings = [f for f in result.findings if f.get("source") == "pattern_scan"]
-        # Should find TODO, FIXME, HACK, XXX, bare except
-        assert len(pattern_findings) >= 5
-
-    @pytest.mark.asyncio
-    async def test_case_insensitive_pattern_matching(self):
-        """Test that pattern matching is case-insensitive.
-
-        Phase 23 Refinement: Removed grepai mock.
-        """
-        bundle = EvidenceBundle(
-            repository="case-test",
-            git_evidence=[
-                Evidence(
-                    source="git_file",
-                    source_id="mixed.py",
-                    title="Mixed Case",
-                    content="todo: implement\nTodo: design\ntODO: test\nFIXME: bug\nfixme: error",
-                    content_hash="hash1",
-                    status=EvidenceStatus.FOUND,
-                ),
-            ],
-        )
-
-        agent = CodeAnalysisAgent()
-        result = await agent.analyze(bundle)
-
-        assert result.success is True
-        # All case variations should be detected
-        todo_findings = [f for f in result.findings if "todo" in f.get("description", "").lower()]
-        # Count should reflect all matches (case-insensitive)
-        total_todo_count = sum(f.get("count", 0) for f in todo_findings)
-        assert total_todo_count >= 3
-
-    # ============================================================================
-    # METADATA AND ANALYSIS LAYERS TESTS
-    # ============================================================================
-
-    @pytest.mark.asyncio
-    async def test_analysis_layers_metadata(self, mock_evidence_bundle):
-        """Test that analysis layers are properly tracked in metadata.
-
-        Phase 23 Refinement: Removed grepai mock.
-        """
-        agent = CodeAnalysisAgent()
-        result = await agent.analyze(mock_evidence_bundle)
-
-        assert result.success is True
-        assert "analysis_layers" in result.metadata
-        # Should have pattern_matching at minimum
-        assert "pattern_matching" in result.metadata["analysis_layers"]
-
-    @pytest.mark.asyncio
-    @patch("vds_audit_orchestrator.agents.code_agent.SecurityPatternScanner")
-    async def test_all_analysis_layers_active(self, mock_scanner_class, mock_evidence_bundle, tmp_path):
-        """Test metadata when all analysis layers are active.
-
-        Phase 23 Refinement: Updated to use SecurityPatternScanner instead of grepai.
-        """
-        # Enable pattern scanner - return results
-        mock_scanner = MagicMock()
-        mock_scanner.scan.return_value = [
-            ScanResult(
-                pattern_name="hardcoded_password",
-                severity="CRITICAL",
-                description="Hardcoded password detected",
-                file_path="test.py",
-                line_number=1,
-                line_content="secret",
-                match_text="secret",
-            )
-        ]
-        mock_scanner_class.return_value = mock_scanner
-
-        # Create a mock repo path
-        repo_path = tmp_path / "test-repo"
-        repo_path.mkdir()
-
-        mock_settings = MagicMock()
-        mock_settings.enabled = True
-
-        # Mock PydanticAI analysis to return findings
-        llm_output = CodeFindings(
-            score=7.5,
-            issues=[
-                CodeIssue(
-                    severity="low",
-                    category="quality",
-                    description="Test finding from LLM",
-                    file_path="test.py",
-                )
-            ],
-            patterns=[],
-            confidence=0.85,
-            reasoning="All layers active",
-            files_analyzed=2,
-            tech_stack=["python"],
-        )
-
-        agent = CodeAnalysisAgent(settings=mock_settings, agentic_mode="off")
-        agent._get_repo_path = lambda evidence, profile: repo_path
-        agent._run_pydantic_ai_analysis = AsyncMock(return_value=llm_output)
-
-        result = await agent.analyze(mock_evidence_bundle)
-
-        assert result.success is True
-        assert "pattern_scanner_security" in result.metadata["analysis_layers"]
-        assert "pattern_matching" in result.metadata["analysis_layers"]
-        # LLM layer should be present (PydanticAI quality analysis)
-        assert "pydantic_ai_quality" in result.metadata["analysis_layers"]
-
-
-# Import at end for Python 3.8 compatibility
-
-
-# =============================================================================
-# LLM CODE REVIEW AND DEDUPLICATION TESTS (FR-1.3)
-# =============================================================================
-
-
-class TestLLMCodeReviewAndDeduplication:
-    """Tests for LLM-based code review and finding deduplication (FR-1.3)."""
-
-    @pytest.mark.asyncio
-    @patch("vds_audit_orchestrator.agents.code_agent.SecurityPatternScanner")
-    async def test_llm_code_review_enabled(self, mock_scanner_class, mock_evidence_bundle, tmp_path):
-        """Test that LLM code review is called when enabled.
-
-        FR-1.3: LLM analysis of pre-collected code evidence pack.
-        """
-        mock_scanner = MagicMock()
-        mock_scanner.scan.return_value = []
-        mock_scanner_class.return_value = mock_scanner
-
-        repo_path = tmp_path / "test-repo"
-        repo_path.mkdir()
-
-        # Create a test file for code pack
-        (repo_path / "README.md").write_text("# Test Project")
-
-        mock_settings = MagicMock()
-        mock_settings.enabled = True
-
-        llm_output = CodeFindings(
-            score=7.0,
-            issues=[
-                CodeIssue(
-                    severity="high",
-                    category="security",
-                    description="Potential security issue found by LLM",
-                    file_path="src/auth.py",
-                    line_number=15,
-                    recommendation="Use environment variables for secrets",
-                )
-            ],
-            patterns=[],
-            confidence=0.85,
-            reasoning="LLM code review analysis",
-            files_analyzed=1,
-            tech_stack=["python"],
-        )
-
-        agent = CodeAnalysisAgent(settings=mock_settings, agentic_mode="off")
-        agent._get_repo_path = lambda e, p: repo_path
-        agent._get_runtime_config = lambda: SimpleNamespace(
-            agentic=SimpleNamespace(enabled=False),
-            llm=SimpleNamespace(
-                code_review_layer_enabled=True,
-                code_review_max_files=20,
-                code_review_max_total_chars=120000,
-            ),
-        )
-        agent._analyze_code_with_llm = AsyncMock(
-            return_value=[
-                {
-                    "type": "security_security",
-                    "severity": "high",
-                    "description": "Potential security issue found by LLM",
-                    "location": "src/auth.py:15",
-                    "details": {
-                        "file_path": "src/auth.py",
-                        "line_number": 15,
-                        "recommendation": "Use environment variables for secrets",
-                    },
-                    "source": "llm_code_review",
-                }
-            ]
-        )
-        agent._run_pydantic_ai_analysis = AsyncMock(return_value=llm_output)
-
-        result = await agent.analyze(mock_evidence_bundle)
-
-        assert result.success is True
-        assert result.metadata.get("llm_code_review_used") is True
-        assert result.metadata.get("code_pack_included") == 1
-        assert result.metadata.get("code_pack_scanned") == 1
-        assert result.metadata.get("code_pack_files") == ["README.md"]
-        llm_review_findings = [f for f in result.findings if f.get("source") == "llm_code_review"]
-        assert len(llm_review_findings) >= 1
-
-    @pytest.mark.asyncio
-    async def test_llm_code_review_disabled_when_llm_disabled(self, mock_evidence_bundle, tmp_path):
-        """Test that LLM code review is skipped when LLM is disabled."""
-        repo_path = tmp_path / "test-repo"
-        repo_path.mkdir()
-
-        mock_settings = MagicMock()
-        mock_settings.enabled = False
-
-        agent = CodeAnalysisAgent(settings=mock_settings, agentic_mode="off")
-        agent._get_repo_path = lambda e, p: repo_path
-
-        result = await agent.analyze(mock_evidence_bundle)
-
-        assert result.success is True
-        assert result.metadata.get("llm_code_review_used") is not True
-        llm_review_findings = [f for f in result.findings if f.get("source") == "llm_code_review"]
-        assert len(llm_review_findings) == 0
-
-    @pytest.mark.asyncio
-    async def test_merge_findings_deduplication_keeps_highest_severity(self):
-        """Test that deduplication keeps the highest severity finding.
-
-        FR-1.3: Merge pattern scanner + LLM findings with deduplication,
-        preserving highest severity when merging duplicates.
-        """
-        agent = CodeAnalysisAgent()
-
-        pattern_findings = [
-            {
-                "type": "security_hardcoded_password",
-                "severity": "medium",
-                "description": "Hardcoded password from pattern scanner",
-                "location": "src/auth.py:10",
-                "source": "pattern_scanner",
-            }
-        ]
-
-        llm_findings = [
-            {
-                "type": "security_hardcoded_password",
-                "severity": "critical",  # Higher severity
-                "description": "Hardcoded password from LLM review",
-                "location": "src/auth.py:10",
-                "source": "llm_code_review",
-            }
-        ]
-
-        merged = agent._merge_findings_with_deduplication(pattern_findings, llm_findings)
-
-        assert len(merged) == 1
-        # Should keep the critical severity (from LLM)
-        assert merged[0]["severity"] == "critical"
-        assert merged[0]["source"] == "llm_code_review"
-
-    @pytest.mark.asyncio
-    async def test_merge_findings_deduplication_keeps_pattern_when_higher(self):
-        """Test that deduplication keeps pattern scanner finding when it has higher severity."""
-        agent = CodeAnalysisAgent()
-
-        pattern_findings = [
-            {
-                "type": "security_sql_injection",
-                "severity": "critical",  # Higher severity
-                "description": "SQL injection from pattern scanner",
-                "location": "src/db.py:25",
-                "source": "pattern_scanner",
-            }
-        ]
-
-        llm_findings = [
-            {
-                "type": "security_sql_injection",
-                "severity": "high",  # Lower severity
-                "description": "SQL injection from LLM review",
-                "location": "src/db.py:25",
-                "source": "llm_code_review",
-            }
-        ]
-
-        merged = agent._merge_findings_with_deduplication(pattern_findings, llm_findings)
-
-        assert len(merged) == 1
-        # Should keep the critical severity (from pattern scanner)
-        assert merged[0]["severity"] == "critical"
-        assert merged[0]["source"] == "pattern_scanner"
-
-    @pytest.mark.asyncio
-    async def test_merge_findings_no_duplicates(self):
-        """Test that non-duplicate findings are all preserved."""
-        agent = CodeAnalysisAgent()
-
-        pattern_findings = [
-            {
-                "type": "security_hardcoded_password",
-                "severity": "critical",
-                "description": "Hardcoded password",
-                "location": "src/auth.py:10",
-                "source": "pattern_scanner",
-            }
-        ]
-
-        llm_findings = [
-            {
-                "type": "security_sql_injection",
-                "severity": "high",
-                "description": "SQL injection",
-                "location": "src/db.py:25",
-                "source": "llm_code_review",
-            }
-        ]
-
-        merged = agent._merge_findings_with_deduplication(pattern_findings, llm_findings)
-
-        assert len(merged) == 2
-        types = {f["type"] for f in merged}
-        assert "security_hardcoded_password" in types
-        assert "security_sql_injection" in types
-
-    @pytest.mark.asyncio
-    async def test_merge_findings_empty_inputs(self):
-        """Test merging with empty inputs."""
-        agent = CodeAnalysisAgent()
-
-        # Both empty
-        merged = agent._merge_findings_with_deduplication([], [])
-        assert len(merged) == 0
-
-        # Only pattern findings
-        pattern_findings = [{"type": "test", "severity": "low", "location": "test.py"}]
-        merged = agent._merge_findings_with_deduplication(pattern_findings, [])
-        assert len(merged) == 1
-
-        # Only LLM findings
-        llm_findings = [{"type": "test2", "severity": "medium", "location": "test2.py"}]
-        merged = agent._merge_findings_with_deduplication([], llm_findings)
-        assert len(merged) == 1
-
-    @pytest.mark.asyncio
-    async def test_merge_findings_multiple_duplicates(self):
-        """Test merging with multiple duplicate findings."""
-        agent = CodeAnalysisAgent()
-
-        pattern_findings = [
-            {"type": "security_a", "severity": "low", "location": "a.py"},
-            {"type": "security_b", "severity": "medium", "location": "b.py"},
-            {"type": "security_c", "severity": "high", "location": "c.py"},
-        ]
-
-        llm_findings = [
-            {"type": "security_a", "severity": "critical", "location": "a.py"},  # Upgrade
-            {"type": "security_b", "severity": "low", "location": "b.py"},  # Downgrade (keep original)
-            {"type": "security_d", "severity": "medium", "location": "d.py"},  # New
-        ]
-
-        merged = agent._merge_findings_with_deduplication(pattern_findings, llm_findings)
-
-        assert len(merged) == 4  # a, b, c, d
-
-        # Find each finding
-        findings_by_type = {f["type"]: f for f in merged}
-
-        # security_a should be critical (upgraded from LLM)
-        assert findings_by_type["security_a"]["severity"] == "critical"
-
-        # security_b should be medium (kept from pattern scanner)
-        assert findings_by_type["security_b"]["severity"] == "medium"
-
-        # security_c should be high (only from pattern scanner)
-        assert findings_by_type["security_c"]["severity"] == "high"
-
-        # security_d should be medium (only from LLM)
-        assert findings_by_type["security_d"]["severity"] == "medium"
-
-    @pytest.mark.asyncio
-    @patch("vds_audit_orchestrator.agents.code_agent.SecurityPatternScanner")
-    async def test_llm_code_review_error_handling(self, mock_scanner_class, mock_evidence_bundle, tmp_path):
-        """Test graceful handling when LLM code review fails."""
-        mock_scanner = MagicMock()
-        mock_scanner.scan.return_value = [
-            ScanResult(
-                pattern_name="hardcoded_password",
-                severity="CRITICAL",
-                description="Hardcoded password",
-                file_path="test.py",
-                line_number=1,
-                line_content="secret",
-                match_text="secret",
-            )
-        ]
-        mock_scanner_class.return_value = mock_scanner
-
-        repo_path = tmp_path / "test-repo"
-        repo_path.mkdir()
-        (repo_path / "README.md").write_text("# Test")
-
-        mock_settings = MagicMock()
-        mock_settings.enabled = True
-
-        agent = CodeAnalysisAgent(settings=mock_settings, agentic_mode="off")
-        agent._get_repo_path = lambda e, p: repo_path
-        agent._get_runtime_config = lambda: SimpleNamespace(
-            agentic=SimpleNamespace(enabled=False),
-            llm=SimpleNamespace(
-                code_review_layer_enabled=True,
-                code_review_max_files=20,
-                code_review_max_total_chars=120000,
-            ),
-        )
-        agent._analyze_code_with_llm = AsyncMock(side_effect=Exception("LLM service unavailable"))
-        agent._run_pydantic_ai_analysis = AsyncMock(return_value=None)
-
-        result = await agent.analyze(mock_evidence_bundle)
-
-        # Should still succeed with pattern scanner findings
-        assert result.success is True
-        assert "llm_code_review_error" in result.metadata
-        # Pattern scanner findings should still be present
-        scanner_findings = [f for f in result.findings if f.get("source") == "pattern_scanner"]
-        assert len(scanner_findings) >= 1
-
-    @pytest.mark.asyncio
-    async def test_format_code_pack_for_review(self, tmp_path):
-        """Test code pack formatting for LLM review."""
-        from vds_audit_orchestrator.evidence.code_pack import CodeEvidence, CodeEvidencePack
-
-        code_pack = CodeEvidencePack(
-            repo_path=str(tmp_path),
-            files=[
-                CodeEvidence(
-                    file_path="README.md",
-                    content="# Test Project\n\nDescription here.",
-                    truncated=False,
-                    original_lines=3,
-                    original_bytes=35,
-                    priority=1,
-                ),
-                CodeEvidence(
-                    file_path="src/main.py",
-                    content="def main():\n    pass",
-                    truncated=True,
-                    original_lines=100,
-                    original_bytes=5000,
-                    priority=8,
-                ),
-            ],
-            total_files_scanned=10,
-            total_files_included=2,
-        )
-
-        agent = CodeAnalysisAgent()
-        formatted = agent._format_code_pack_for_review(code_pack)
-
-        assert "Code Evidence Pack" in formatted
-        assert "README.md" in formatted
-        assert "HIGH PRIORITY" in formatted
-        assert "src/main.py" in formatted
-        assert "[TRUNCATED]" in formatted
-        assert "NORMAL" in formatted
-
-    @pytest.mark.asyncio
-    async def test_select_files_for_llm_prefers_source(self):
-        """LLM input should prioritize source files while preserving infra context."""
-        from vds_audit_orchestrator.evidence.code_pack import CodeEvidence, CodeEvidencePack
-
-        code_pack = CodeEvidencePack(
-            repo_path="/tmp/test",
-            files=[
-                CodeEvidence(
-                    file_path="README.md",
-                    content="# Project",
-                    truncated=False,
-                    original_lines=1,
-                    original_bytes=9,
-                    priority=1,
-                ),
-                CodeEvidence(
-                    file_path="pyproject.toml",
-                    content="[project]",
-                    truncated=False,
-                    original_lines=1,
-                    original_bytes=9,
-                    priority=5,
-                ),
-                CodeEvidence(
-                    file_path="src/core/service.py",
-                    content="def run(): pass",
-                    truncated=False,
-                    original_lines=1,
-                    original_bytes=15,
-                    priority=9,
-                ),
-                CodeEvidence(
-                    file_path="src/core/handler.py",
-                    content="def handler(): pass",
-                    truncated=False,
-                    original_lines=1,
-                    original_bytes=19,
-                    priority=9,
-                ),
-            ],
-            total_files_scanned=4,
-            total_files_included=4,
-        )
-
-        agent = CodeAnalysisAgent()
-        selected = agent._select_files_for_llm(
-            code_pack,
-            max_files=3,
-            max_infra_files=1,
-            min_source_files=2,
-        )
-        selected_paths = [file_ev.file_path for file_ev in selected]
-        assert "pyproject.toml" in selected_paths
-        assert "src/core/service.py" in selected_paths
-        assert "src/core/handler.py" in selected_paths
-
-    @pytest.mark.asyncio
-    async def test_build_llm_code_review_prompt(self):
-        """Test LLM code review prompt building."""
-        agent = CodeAnalysisAgent()
-
-        code_context = "## Code Evidence Pack\n\n### File: test.py\n```\nprint('hello')\n```"
-        profile = {"domain": "insurance", "criticality": "high"}
-
-        prompt = agent._build_llm_code_review_prompt(code_context, profile)
-
-        assert "insurance" in prompt
-        assert "high" in prompt
-        assert "security" in prompt.lower()
-        assert "test.py" in prompt
-
-    @pytest.mark.asyncio
-    async def test_metadata_includes_merged_findings_count(self, mock_evidence_bundle, tmp_path):
-        """Test that metadata includes merged findings count."""
-        repo_path = tmp_path / "test-repo"
-        repo_path.mkdir()
-
-        mock_settings = MagicMock()
-        mock_settings.enabled = False  # Disable LLM to simplify test
-
-        agent = CodeAnalysisAgent(settings=mock_settings)
-        agent._get_repo_path = lambda e, p: repo_path
-
-        result = await agent.analyze(mock_evidence_bundle)
-
-        assert result.success is True
-        assert "merged_security_findings" in result.metadata
-
-    @pytest.mark.asyncio
-    async def test_select_files_for_llm_respects_char_budget(self):
-        """_select_files_for_llm stops adding files when total chars exceed budget.
-
-        Phase 64+: Budget guard prevents prompt bloat for non-agentic LLM calls.
-        """
-        from vds_audit_orchestrator.evidence.code_pack import CodeEvidence, CodeEvidencePack
-
-        # Create files that exceed a small budget
-        files = []
-        for i in range(10):
-            files.append(
-                CodeEvidence(
-                    file_path=f"src/module_{i}.py",
-                    content="x" * 5000,  # 5K chars each → 50K total
-                    truncated=False,
-                    original_lines=100,
-                    original_bytes=5000,
-                    priority=9,
-                )
-            )
-
-        code_pack = CodeEvidencePack(
-            repo_path="/tmp/test",
-            files=files,
-            total_files_scanned=10,
-            total_files_included=10,
-        )
-
-        agent = CodeAnalysisAgent()
-
-        # With a 12K budget, per-file caps allow a few files while enforcing total budget
-        selected = agent._select_files_for_llm(
-            code_pack,
-            max_files=20,
-            max_infra_files=0,
-            min_source_files=1,
-            max_total_chars=12_000,
-        )
-        assert len(selected) >= 1  # first file always included
-        assert len(selected) <= 5  # budget + per-file caps bound the final selection
-        total_chars = sum(len(f.content) for f in selected)
-        assert total_chars <= 12_000
-
-    @pytest.mark.asyncio
-    async def test_select_files_for_llm_default_budget_caps_large_packs(self):
-        """_select_files_for_llm uses MAX_TOTAL_CODE_CONTEXT_CHARS to cap large packs.
-
-        Phase 64+: Prevents the 240K+ char prompts observed in real runs when
-        auditing repos with many source files.
-        """
-        from vds_audit_orchestrator.evidence.code_pack import CodeEvidence, CodeEvidencePack
-
-        # Create many large files that would exceed 30K default budget
-        files = []
-        for i in range(20):
-            files.append(
-                CodeEvidence(
-                    file_path=f"src/large_{i}.py",
-                    content="y" * 10_000,  # 10K chars each → 200K total uncapped
-                    truncated=False,
-                    original_lines=200,
-                    original_bytes=10_000,
-                    priority=9,
-                )
-            )
-
-        code_pack = CodeEvidencePack(
-            repo_path="/tmp/test",
-            files=files,
-            total_files_scanned=20,
-            total_files_included=20,
-        )
-
-        agent = CodeAnalysisAgent()
-        selected = agent._select_files_for_llm(code_pack)
-        total_chars = sum(len(f.content) for f in selected)
-
-        # Should be hard-capped at MAX_TOTAL_CODE_CONTEXT_CHARS (30K)
-        assert total_chars <= agent.MAX_TOTAL_CODE_CONTEXT_CHARS
-        assert len(selected) < 20  # Not all 20 files — budget stopped early
-
-    @pytest.mark.asyncio
-    async def test_select_files_for_llm_small_files_all_included(self):
-        """Small files that fit within budget are all included."""
-        from vds_audit_orchestrator.evidence.code_pack import CodeEvidence, CodeEvidencePack
-
-        files = []
-        for i in range(5):
-            files.append(
-                CodeEvidence(
-                    file_path=f"src/small_{i}.py",
-                    content="print('hi')",  # ~11 chars each → 55 total
-                    truncated=False,
-                    original_lines=1,
-                    original_bytes=11,
-                    priority=9,
-                )
-            )
-
-        code_pack = CodeEvidencePack(
-            repo_path="/tmp/test",
-            files=files,
-            total_files_scanned=5,
-            total_files_included=5,
-        )
-
-        agent = CodeAnalysisAgent()
-        selected = agent._select_files_for_llm(code_pack)
-
-        # All 5 small files should be included — well within 30K budget
-        assert len(selected) == 5
-
-    @pytest.mark.asyncio
-    async def test_select_files_for_llm_mixed_sizes_respects_budget(self):
-        """Mixed file sizes: small infra files + large source files stay within budget.
-
-        Phase 64+: Verifies the realistic scenario where infra files (README,
-        pyproject.toml) are small but source files can be large.
-        """
-        from vds_audit_orchestrator.evidence.code_pack import CodeEvidence, CodeEvidencePack
-
-        files = [
-            # Small infra files (always included)
-            CodeEvidence(
-                file_path="README.md",
-                content="# Project\nSmall readme.",
-                truncated=False,
-                original_lines=2,
-                original_bytes=25,
-                priority=1,
-            ),
-            CodeEvidence(
-                file_path="pyproject.toml",
-                content='[project]\nname = "test"',
-                truncated=False,
-                original_lines=2,
-                original_bytes=28,
-                priority=5,
-            ),
-        ]
-        # Add large source files
-        for i in range(15):
-            files.append(
-                CodeEvidence(
-                    file_path=f"src/service_{i}.py",
-                    content="z" * 8_000,  # 8K chars each → 120K total for source
-                    truncated=False,
-                    original_lines=200,
-                    original_bytes=8_000,
-                    priority=9,
-                )
-            )
-
-        code_pack = CodeEvidencePack(
-            repo_path="/tmp/test",
-            files=files,
-            total_files_scanned=17,
-            total_files_included=17,
-        )
-
-        agent = CodeAnalysisAgent()
-        selected = agent._select_files_for_llm(code_pack, max_total_chars=25_000)
-        selected_paths = [f.file_path for f in selected]
-        total_chars = sum(len(f.content) for f in selected)
-
-        # At least one infra file should be included (they're small)
-        assert "pyproject.toml" in selected_paths
-        # Total should be within configured budget
-        assert total_chars <= 25_000
-        # Should NOT include all 15 source files
-        source_selected = [p for p in selected_paths if p.startswith("src/")]
-        assert len(source_selected) < 15
-
-    @pytest.mark.asyncio
-    async def test_select_files_for_llm_keeps_source_on_tight_budget(self):
-        """Tight budgets should still retain at least one source file when available."""
-        from vds_audit_orchestrator.evidence.code_pack import CodeEvidence, CodeEvidencePack
-
-        code_pack = CodeEvidencePack(
-            repo_path="/tmp/test",
-            files=[
-                CodeEvidence(
-                    file_path="README.md",
-                    content="r" * 50_000,
-                    truncated=False,
-                    original_lines=1000,
-                    original_bytes=50_000,
-                    priority=1,
-                ),
-                CodeEvidence(
-                    file_path="src/service.py",
-                    content="s" * 8_000,
-                    truncated=False,
-                    original_lines=300,
-                    original_bytes=8_000,
-                    priority=9,
-                ),
-            ],
-            total_files_scanned=2,
-            total_files_included=2,
-        )
-
-        agent = CodeAnalysisAgent()
-        selected = agent._select_files_for_llm(
-            code_pack,
-            max_files=4,
-            max_total_chars=12_000,
-        )
-
-        selected_paths = [f.file_path for f in selected]
-        assert any(path.startswith("src/") for path in selected_paths)
-        assert sum(len(f.content) for f in selected) <= 12_000
-
-    @pytest.mark.asyncio
-    async def test_select_files_for_llm_skips_oversized_and_keeps_smaller_followups(self):
-        """Selection should skip oversized candidates and continue filling with smaller files."""
-        from vds_audit_orchestrator.evidence.code_pack import CodeEvidence, CodeEvidencePack
-
-        code_pack = CodeEvidencePack(
-            repo_path="/tmp/test",
-            files=[
-                CodeEvidence(
-                    file_path="README.md",
-                    content="r" * 500,
-                    truncated=False,
-                    original_lines=20,
-                    original_bytes=500,
-                    priority=1,
-                ),
-                CodeEvidence(
-                    file_path="src/huge.py",
-                    content="h" * 20_000,
-                    truncated=False,
-                    original_lines=500,
-                    original_bytes=20_000,
-                    priority=9,
-                ),
-                CodeEvidence(
-                    file_path="src/small.py",
-                    content="s" * 1200,
-                    truncated=False,
-                    original_lines=40,
-                    original_bytes=1200,
-                    priority=9,
-                ),
-            ],
-            total_files_scanned=3,
-            total_files_included=3,
-        )
-
-        agent = CodeAnalysisAgent()
-        selected = agent._select_files_for_llm(
-            code_pack,
-            max_files=4,
-            max_total_chars=2_500,
-            max_infra_files=1,
-            min_source_files=2,
-        )
-        selected_paths = [f.file_path for f in selected]
-        assert "src/small.py" in selected_paths
-        assert sum(len(f.content) for f in selected) <= 2_500
-
-    @pytest.mark.asyncio
-    async def test_select_files_for_llm_prefers_non_truncated_source_when_available(self):
-        """Non-truncated source files should be preferred over truncated source files."""
-        from vds_audit_orchestrator.evidence.code_pack import CodeEvidence, CodeEvidencePack
-
-        code_pack = CodeEvidencePack(
-            repo_path="/tmp/test",
-            files=[
-                CodeEvidence(
-                    file_path="src/security_guard.py",
-                    content="x" * 5000,
-                    truncated=True,
-                    original_lines=900,
-                    original_bytes=5000,
-                    priority=9,
-                ),
-                CodeEvidence(
-                    file_path="src/safe_path.py",
-                    content="def safe_path():\n    return True\n",
-                    truncated=False,
-                    original_lines=2,
-                    original_bytes=30,
-                    priority=9,
-                ),
-                CodeEvidence(
-                    file_path="src/input_validation.py",
-                    content="def validate(v):\n    return bool(v)\n",
-                    truncated=False,
-                    original_lines=2,
-                    original_bytes=36,
-                    priority=9,
-                ),
-                CodeEvidence(
-                    file_path="Dockerfile",
-                    content="FROM python:3.14-slim\n",
-                    truncated=False,
-                    original_lines=1,
-                    original_bytes=22,
-                    priority=3,
-                ),
-            ],
-            total_files_scanned=4,
-            total_files_included=4,
-        )
-
-        agent = CodeAnalysisAgent()
-        selected = agent._select_files_for_llm(
-            code_pack,
-            max_files=3,
-            min_source_files=2,
-            max_total_chars=20_000,
-        )
-        selected_paths = [f.file_path for f in selected]
-        assert "src/safe_path.py" in selected_paths
-        assert "src/input_validation.py" in selected_paths
-
-    @pytest.mark.asyncio
-    async def test_analyze_uses_runtime_code_review_prompt_budget(self, mock_evidence_bundle, tmp_path):
-        """Code review file selection should use runtime-configured prompt budget."""
-        from vds_audit_orchestrator.evidence.code_pack import CodeEvidence, CodeEvidencePack
-
-        repo_path = tmp_path / "repo"
-        repo_path.mkdir()
-        code_pack = CodeEvidencePack(
-            repo_path=str(repo_path),
-            files=[
-                CodeEvidence(
-                    file_path="src/main.py",
-                    content="print('ok')",
-                    truncated=False,
-                    original_lines=1,
-                    original_bytes=11,
-                    priority=9,
-                )
-            ],
-            total_files_scanned=1,
-            total_files_included=1,
-        )
-
-        mock_settings = MagicMock()
-        mock_settings.enabled = True
-        agent = CodeAnalysisAgent(settings=mock_settings, agentic_mode="off")
-        agent._get_repo_path = lambda e, p: repo_path
-        agent._build_code_pack = lambda p: code_pack
-        agent._scan_security_patterns = AsyncMock(return_value=[])
-        agent._run_pydantic_ai_analysis = AsyncMock(return_value=None)
-
-        selected_files = [code_pack.files[0]]
-        select_mock = MagicMock(return_value=selected_files)
-        agent._select_files_for_llm = select_mock
-        agent._analyze_code_with_llm = AsyncMock(return_value=[])
-
-        runtime_cfg = MagicMock()
-        runtime_cfg.llm.code_review_max_files = 3
-        runtime_cfg.llm.code_review_max_total_chars = 12_000
-        agent._get_runtime_config = lambda: runtime_cfg
-
-        result = await agent.analyze(mock_evidence_bundle)
-
-        assert result.success is True
-        select_mock.assert_called_once_with(
-            code_pack,
-            max_files=3,
-            max_total_chars=12_000,
-        )
-
-    @pytest.mark.asyncio
-    async def test_pydantic_analysis_uses_runtime_code_review_prompt_budget(self, mock_evidence_bundle, tmp_path):
-        """Pydantic analysis path should use runtime-configured prompt budget."""
-        from vds_audit_orchestrator.evidence.code_pack import CodeEvidence, CodeEvidencePack
-
-        repo_path = tmp_path / "repo"
-        repo_path.mkdir()
-        code_pack = CodeEvidencePack(
-            repo_path=str(repo_path),
-            files=[
-                CodeEvidence(
-                    file_path="src/main.py",
-                    content="print('ok')",
-                    truncated=False,
-                    original_lines=1,
-                    original_bytes=11,
-                    priority=9,
-                )
-            ],
-            total_files_scanned=1,
-            total_files_included=1,
-        )
-
-        agent = CodeAnalysisAgent(agentic_mode="off")
-        agent._get_repo_path = lambda e, p: repo_path
-        select_mock = MagicMock(return_value=[code_pack.files[0]])
-        agent._select_files_for_llm = select_mock
-        agent._format_code_pack = MagicMock(return_value="### File: src/main.py\n```\nprint('ok')\n```")
-        agent._run_pydantic_agent = AsyncMock(return_value=None)
-        agent.settings.protocol = LLMProtocolType.ANTHROPIC
-
-        runtime_cfg = MagicMock()
-        runtime_cfg.llm.code_review_max_files = 2
-        runtime_cfg.llm.code_review_max_total_chars = 9_000
-        agent._get_runtime_config = lambda: runtime_cfg
-
-        with patch("vds_audit_orchestrator.agents.agentic_investigator.CodePackBuilder") as builder_cls:
-            builder = builder_cls.return_value
-            builder.build.return_value = code_pack
-            _ = await agent._run_pydantic_ai_analysis(mock_evidence_bundle)
-
-        select_mock.assert_called_once_with(
-            code_pack,
-            max_files=2,
-            max_total_chars=9_000,
-        )
-
-    @pytest.mark.asyncio
-    async def test_pydantic_analysis_uses_direct_ollama_client(self, mock_evidence_bundle, tmp_path):
-        """OLLAMA code analysis should use direct client path to avoid OpenAI-compat message-shape issues."""
-        from vds_audit_orchestrator.evidence.code_pack import CodeEvidence, CodeEvidencePack
-
-        repo_path = tmp_path / "repo"
-        repo_path.mkdir()
-        code_pack = CodeEvidencePack(
-            repo_path=str(repo_path),
-            files=[
-                CodeEvidence(
-                    file_path="src/main.py",
-                    content="print('ok')",
-                    truncated=False,
-                    original_lines=1,
-                    original_bytes=11,
-                    priority=9,
-                )
-            ],
-            total_files_scanned=1,
-            total_files_included=1,
-        )
-
-        agent = CodeAnalysisAgent(agentic_mode="off")
-        agent._get_repo_path = lambda e, p: repo_path
-        agent._run_pydantic_agent = AsyncMock(return_value=None)
-        agent.settings.protocol = LLMProtocolType.OPENAI
-        agent.settings.model_standard = "glm-4.7-flash"
-        agent.settings.base_url = "http://127.0.0.1:11434"
-        agent.settings.max_tokens_per_request = 512
-
-        mock_client = MagicMock()
-        mock_message = MagicMock()
-        mock_block = MagicMock()
-        mock_block.text = (
-            '{"score":7.5,"issues":[{"file_path":"src/main.py","line_number":1,'
-            '"severity":"low","category":"quality","description":"sample","recommendation":"fix"}],'
-            '"patterns":[],"confidence":0.7,"reasoning":"ok","files_analyzed":1,"tech_stack":["python"]}'
-        )
-        mock_message.content = [mock_block]
-        mock_client.messages.create.return_value = mock_message
-
-        runtime_cfg = MagicMock()
-        runtime_cfg.llm.code_review_max_files = 2
-        runtime_cfg.llm.code_review_max_total_chars = 9_000
-        agent._get_runtime_config = lambda: runtime_cfg
-
-        with patch.object(type(agent.settings), "get_client", return_value=mock_client):
-            with patch("vds_audit_orchestrator.agents.agentic_investigator.CodePackBuilder") as builder_cls:
-                builder = builder_cls.return_value
-                builder.build.return_value = code_pack
-                output = await agent._run_pydantic_ai_analysis(mock_evidence_bundle)
-
-        assert isinstance(output, CodeFindings)
-        assert output.score == 7.5
-        assert output.files_analyzed == 1
-        agent._run_pydantic_agent.assert_not_awaited()
-        assert mock_client.messages.create.call_count == 1
-        call_kwargs = mock_client.messages.create.call_args.kwargs
-        assert call_kwargs["temperature"] == 0.0
-        assert call_kwargs["format"] == "json"
-        assert call_kwargs["options"] == {}
-
-    @pytest.mark.asyncio
-    async def test_layer2_skipped_metadata_when_agentic(self, mock_evidence_bundle):
-        """Layer 2 is skipped with reason 'agentic_tool_first' when agentic mode active."""
-        mock_settings = MagicMock()
-        mock_settings.enabled = True
-
-        agent = CodeAnalysisAgent(settings=mock_settings, agentic_mode="on")
-        # Agentic runtime must resolve for agentic to activate
-        agent._resolve_agentic_runtime = lambda: {
-            "enabled": True,
-            "max_turns": 5,
-            "max_tool_calls": 10,
-            "tool_timeout_sec": 5,
-            "safe_extensions": (".py",),
-            "max_read_bytes": 1024,
-        }
-        agent._get_repo_path = lambda e, p: None
-        agent._run_pydantic_ai_analysis = AsyncMock(return_value=None)
-
-        result = await agent.analyze(mock_evidence_bundle)
-
-        assert result.success is True
-        assert result.metadata.get("llm_code_review_skipped") == "agentic_tool_first"
-
-    @pytest.mark.asyncio
-    async def test_layer2_skipped_metadata_when_disabled_by_config(self, mock_evidence_bundle):
-        """Layer 2 is skipped with reason 'disabled_by_config' when runtime config disables it."""
-        mock_settings = MagicMock()
-        mock_settings.enabled = True
-
-        agent = CodeAnalysisAgent(settings=mock_settings, agentic_mode="off")
-        agent._get_repo_path = lambda e, p: None
-        agent._run_pydantic_ai_analysis = AsyncMock(return_value=None)
-
-        runtime_cfg = MagicMock()
-        runtime_cfg.llm.code_review_layer_enabled = False
-        runtime_cfg.llm.code_review_max_files = 4
-        runtime_cfg.llm.code_review_max_total_chars = 12_000
-        agent._get_runtime_config = lambda: runtime_cfg
-
-        result = await agent.analyze(mock_evidence_bundle)
-
-        assert result.success is True
-        assert result.metadata.get("llm_code_review_skipped") == "disabled_by_config"
-
-    @pytest.mark.asyncio
-    async def test_ollama_skips_redundant_layer4_after_successful_layer2(self, mock_evidence_bundle):
-        """Ollama non-agentic flow should not run duplicate deep pass after layer-2 findings."""
-        from pathlib import Path
-
-        from vds_agent_core.config import LLMProtocolType
-
-        mock_settings = MagicMock()
-        mock_settings.enabled = True
-        mock_settings.protocol = LLMProtocolType.OPENAI
-
-        agent = CodeAnalysisAgent(settings=mock_settings, agentic_mode="off")
-        agent._get_repo_path = lambda e, p: Path("/tmp/repo")
-        agent._resolve_agentic_runtime = lambda: None
-        agent._scan_security_patterns = AsyncMock(return_value=[])
-        agent._scan_for_patterns = MagicMock(return_value=[])
-        agent._build_code_pack = MagicMock(
-            return_value=MagicMock(total_files_included=1, total_files_scanned=1, files=[])
-        )
-        agent._select_files_for_llm = MagicMock(return_value=[])
-        agent._analyze_code_with_llm = AsyncMock(
-            return_value=[
-                {
-                    "type": "quality",
-                    "severity": "medium",
-                    "description": "Layer2 finding",
-                    "location": "src/main.py:1",
-                    "source": "llm_code_review",
-                }
-            ]
-        )
-        agent._run_pydantic_ai_analysis = AsyncMock(return_value=None)
-
-        runtime_cfg = MagicMock()
-        runtime_cfg.llm.code_review_layer_enabled = True
-        runtime_cfg.llm.code_review_max_files = 4
-        runtime_cfg.llm.code_review_max_total_chars = 12_000
-        agent._get_runtime_config = lambda: runtime_cfg
-
-        result = await agent.analyze(mock_evidence_bundle)
-
-        assert result.success is True
-        assert result.metadata.get("pydantic_ai_quality_skipped") == "local_openai_non_agentic_layer2_sufficient"
-        agent._analyze_code_with_llm.assert_awaited_once()
-        agent._run_pydantic_ai_analysis.assert_not_awaited()
-
-
-def test_tool_efficiency_kpi_detects_high_repetition() -> None:
-    """FR-78: KPI gate should fail high-repetition runs."""
-    summary = {
-        "tool_calls_completed": 10,
-        "tool_repetition_rate": 0.7,
-        "skill_calls_total": 0,
-    }
-    assert CodeAnalysisAgent._is_tool_efficiency_kpi_unsatisfied(summary) is True
-
-
-def test_tool_efficiency_kpi_detects_low_effective_skill_rate() -> None:
-    """FR-78: KPI gate should fail when skill calls are mostly ineffective."""
-    summary = {
-        "tool_calls_completed": 9,
-        "tool_repetition_rate": 0.3,
-        "skill_calls_total": 4,
-        "skill_effective_rate": 0.25,
-    }
-    assert CodeAnalysisAgent._is_tool_efficiency_kpi_unsatisfied(summary) is True
-
-
-def test_tool_efficiency_kpi_passes_efficient_usage() -> None:
-    """FR-78: efficient tool usage should pass KPI gate."""
-    summary = {
-        "tool_calls_completed": 10,
-        "tool_repetition_rate": 0.3,
-        "skill_calls_total": 2,
-        "skill_effective_rate": 1.0,
-    }
-    assert CodeAnalysisAgent._is_tool_efficiency_kpi_unsatisfied(summary) is False
-
-
-def test_tool_efficiency_kpi_threshold_boundaries_are_stable() -> None:
-    """TSK-660.75: KPI guard stays strict only above configured thresholds."""
-    summary = {
-        "tool_calls_completed": 10,
-        "tool_repetition_rate": 0.6,  # strict comparison is > 0.6
-        "skill_calls_total": 3,
-        "skill_effective_rate": 0.5,  # strict comparison is < 0.5
-    }
-    assert CodeAnalysisAgent._is_tool_efficiency_kpi_unsatisfied(summary) is False
-
-
-def test_repetitive_non_progress_detects_signature_churn() -> None:
-    """TSK-660.75: signature churn should trigger corrective non-progress path."""
-    telemetry = {
-        "event_tool_calls_completed": 9,
-        "event_tool_names": ["grep_search", "read_file"],
-        "event_tool_count_by_name": {"grep_search": 6, "read_file": 3},
-        "event_tool_signatures": [
-            'grep_search|{"pattern":"auth"}',
-            'grep_search|{"pattern":"auth"}',
-            'grep_search|{"pattern":"auth"}',
-            'grep_search|{"pattern":"jwt"}',
-            'grep_search|{"pattern":"jwt"}',
-            'read_file|{"path":"a.py"}',
-            'read_file|{"path":"a.py"}',
-            'read_file|{"path":"b.py"}',
-            'read_file|{"path":"b.py"}',
-        ],
-    }
-    assert CodeAnalysisAgent._is_repetitive_non_progress_tool_usage(telemetry) is True
-
-
-def test_repetitive_non_progress_allows_productive_high_signal_mix() -> None:
-    """TSK-660.75: diverse high-signal tool usage should avoid false corrective pivots."""
-    telemetry = {
-        "event_tool_calls_completed": 9,
-        "event_tool_names": ["grep_search", "read_file", "get_definition", "find_references", "workspace_symbol"],
-        "event_tool_count_by_name": {
-            "grep_search": 2,
-            "read_file": 2,
-            "get_definition": 2,
-            "find_references": 2,
-            "workspace_symbol": 1,
-        },
-        "event_tool_signatures": [
-            'grep_search|{"pattern":"auth"}',
-            'grep_search|{"pattern":"jwt"}',
-            'read_file|{"path":"src/auth.py"}',
-            'read_file|{"path":"src/jwt.py"}',
-            'get_definition|{"symbol":"validate_token"}',
-            'get_definition|{"symbol":"parse_claims"}',
-            'find_references|{"symbol":"validate_token"}',
-            'find_references|{"symbol":"parse_claims"}',
-            'workspace_symbol|{"query":"Security"}',
-        ],
-    }
-    assert CodeAnalysisAgent._is_repetitive_non_progress_tool_usage(telemetry) is False
-
-
-def test_repetitive_non_progress_detects_mixed_signature_churn_with_low_read_progress() -> None:
-    """Mixed search/read loops with repeated signatures should be treated as non-progress."""
-    telemetry = {
-        "event_tool_calls_completed": 10,
-        "event_tool_names": ["grep_search", "read_file", "search_evidence", "list_directory"],
-        "event_tool_count_by_name": {
-            "grep_search": 4,
-            "search_evidence": 2,
-            "list_directory": 2,
-            "read_file": 1,
-            "read_evidence_document": 0,
-            "get_definition": 0,
-            "find_references": 0,
-            "workspace_symbol": 0,
-        },
-        "event_tool_signatures": [
-            'grep_search|{"pattern":"auth"}',
-            'grep_search|{"pattern":"auth"}',
-            'grep_search|{"pattern":"auth"}',
-            'search_evidence|{"query":"auth flow"}',
-            'search_evidence|{"query":"auth flow"}',
-            'list_directory|{"path":"src"}',
-            'list_directory|{"path":"src"}',
-            'read_file|{"path":"src/auth/service.py"}',
-            'grep_search|{"pattern":"token"}',
-            'grep_search|{"pattern":"token"}',
-        ],
-    }
-    assert CodeAnalysisAgent._is_repetitive_non_progress_tool_usage(telemetry) is True
-
-
-def test_tool_efficiency_corrective_prompt_contains_required_guidance() -> None:
-    """FR-78: corrective path appends concrete efficiency instructions."""
-    base = "investigate repo"
-    corrected = CodeAnalysisAgent._build_tool_efficiency_corrective_prompt(base)
-    assert "TOOL EFFICIENCY KPI CORRECTIVE PATH" in corrected
-    assert corrected.startswith(base)
-
-
-def test_agentic_mode_on_overrides_disabled_runtime_flag() -> None:
-    """Explicit agentic_mode='on' should force-enable runtime even when config flag is false."""
-
-    class _Policy:
-        def model_dump(self) -> dict[str, float]:
-            return {"min_calls": 6, "dominance_ratio": 0.6}
-
-    agent = CodeAnalysisAgent(agentic_mode="on")
-    agent._get_runtime_config = lambda: SimpleNamespace(
-        llm=SimpleNamespace(enabled=True),
-        agentic=SimpleNamespace(
-            enabled=False,
-            safe_extensions=[".py", ".md"],
-            max_turns=6,
-            max_tool_calls=24,
-            tool_timeout_sec=30,
-            max_read_bytes=12000,
-            max_read_lines=500,
-            strict_no_fallback=False,
-            non_progress_policy=_Policy(),
-            tool_allowlists={"code": ["grep_search", "read_file"]},
-        ),
-    )
-
-    runtime = agent._resolve_agentic_runtime()
-
-    assert isinstance(runtime, dict)
-    assert runtime["enabled"] is True
-    assert runtime["max_turns"] == 12
-    assert runtime["max_tool_calls"] == 40
-    assert runtime["tool_allowlist"] == ["grep_search", "read_file"]
-
-
-def test_normalize_evidence_promotes_row_context_requirement_interpretation() -> None:
-    """Row context payload should populate state_context requirement interpretation for planner routing."""
-    agent = CodeAnalysisAgent(settings=LLMSettings(enabled=False))
-    bundle = EvidenceBundle(repository="demo-repo", git_evidence=[])
-    task = AuditTask(
-        type="code_analysis",
-        description="Analyze code",
-        assignee="code",
-        input_data={
-            "evidence_bundle": bundle,
-            "state_context": {"project_key": "demo"},
-            "row_context": {
-                "row_id": "CL-001:row_12",
-                "context": {
-                    "requirement_interpretation": {
-                        "intent": "Validate workflow runbook orchestration",
-                        "control_objective": "workflow",
-                        "evidence_targets": ["docs"],
-                    }
-                },
-            },
-        },
-    )
-
-    normalized = agent._normalize_evidence(task)
-
-    assert normalized is bundle
-    assert isinstance(agent._state_context.get("requirement_interpretation"), dict)
-    assert agent._state_context["requirement_interpretation"]["intent"] == "Validate workflow runbook orchestration"
-
-
-def test_requirement_skill_decision_reads_wrapped_row_context_interpretation() -> None:
-    """Skill activation should use requirement interpretation from row_context.context payload shape."""
-    decision = CodeAnalysisAgent._resolve_requirement_skill_activation_decision(
-        state_context={
-            "row_context": {
-                "row_id": "CL-001:row_12",
-                "context": {
-                    "requirement_interpretation": {
-                        "intent": "Validate workflow runbook orchestration",
-                        "control_objective": "workflow",
-                        "evidence_targets": ["docs"],
-                        "skill_objectives": ["Use vds-scripts-skill to validate command usage"],
-                    }
-                },
-            }
-        }
-    )
-
-    assert decision["skills_needed"] is True
-    assert decision["reason"] == "requirement_interpretation_skill_objectives_present"
-    assert decision["decision_source"] == "requirement_interpretation"
-
-
-def test_requirement_skill_decision_marks_operational_script_keywords_as_skill_needed() -> None:
-    """Operational keywords like script should remain skill-needed even with code-focused targets."""
-    decision = CodeAnalysisAgent._resolve_requirement_skill_activation_decision(
-        state_context={
-            "requirement_interpretation": {
-                "intent": "Implement script load Docker Image from offline tar",
-                "control_objective": "deployment",
-                "evidence_targets": ["code"],
-                "code_targets": ["scripts/load-image.sh"],
-                "acceptance_signals": ["Provide offline load procedure"],
-            }
-        }
-    )
-
-    assert decision["skills_needed"] is True
-    assert decision["reason"] == "requirement_interpretation_operational_keyword:script"
-    assert decision["decision_source"] == "heuristic"