@ngocsangairvds/vsaf 3.2.14 → 3.2.15

package/tools/vds-scripts/audit_orchestrator/tests/unit/engine/test_cross_repo_config_phase122.py

@@ -1,613 +0,0 @@
-"""Focused regression tests for Phase 122 cross-repo config awareness (FR-122.3).
-
-Covers:
-- RepoRole enum and classify_repo_role() heuristics (TSK-122.12)
-- EvidenceDiscovery.source_repo_role and role-filtered query (TSK-122.13)
-- CROSS_REPO_CONFIG_ENABLED feature flag (AC-122.3.5)
-- Config-repo companion search and negative evidence (TSK-122.14)
-- Row-selective config awareness (DD-122.6)
-"""
-
-from __future__ import annotations
-
-from datetime import UTC, datetime
-from pathlib import Path
-from typing import Any
-from unittest.mock import MagicMock, patch
-
-import pytest
-from vds_audit_orchestrator.config import FeatureFlag, FeaturesConfig
-from vds_audit_orchestrator.engine.project_evidence_context import (
-    EvidenceDiscovery,
-    EvidenceDiscoveryType,
-    ProjectEvidenceContext,
-    ProjectEvidenceStore,
-)
-from vds_audit_orchestrator.engine.project_topology import (
-    ProjectTopology,
-    RepoRole,
-    RepoTopologyEntry,
-    classify_repo_role,
-)
-from vds_audit_orchestrator.engine.repo_type_classifier import RepoType
-from vds_audit_orchestrator.engine.tool_first_planner import ToolFirstPlanner
-from vds_audit_orchestrator.logging_config import configure_logging
-
-# ---------------------------------------------------------------------------
-# TSK-122.12: RepoRole enum and classify_repo_role() tests
-# ---------------------------------------------------------------------------
-
-
-class TestRepoRoleEnum:
-    """AC-122.3.1: repo_role values are correct."""
-
-    def test_all_role_values_present(self) -> None:
-        expected = {"service", "config", "lib", "infra", "deployment", "frontend", "unknown"}
-        actual = {role.value for role in RepoRole}
-        assert actual == expected
-
-    def test_unknown_is_default(self) -> None:
-        assert RepoRole.UNKNOWN == "unknown"
-
-
-class TestClassifyRepoRoleNaming:
-    """AC-122.3.2: Deterministic heuristic-driven classification — naming layer."""
-
-    def test_config_repo_suffix(self) -> None:
-        assert classify_repo_role(repo_key="merchant-config") == RepoRole.CONFIG
-
-    def test_config_repo_with_configuration_suffix(self) -> None:
-        assert classify_repo_role(repo_key="payment-configuration") == RepoRole.CONFIG
-
-    def test_config_repo_prefix(self) -> None:
-        assert classify_repo_role(repo_key="config-server") == RepoRole.CONFIG
-
-    def test_config_repo_properties(self) -> None:
-        assert classify_repo_role(repo_key="app-properties") == RepoRole.CONFIG
-
-    def test_config_repo_settings(self) -> None:
-        assert classify_repo_role(repo_key="service-settings") == RepoRole.CONFIG
-
-    def test_service_repo_suffix(self) -> None:
-        assert classify_repo_role(repo_key="merchant-service") == RepoRole.SERVICE
-
-    def test_service_repo_api(self) -> None:
-        assert classify_repo_role(repo_key="payment-api") == RepoRole.SERVICE
-
-    def test_service_repo_backend(self) -> None:
-        assert classify_repo_role(repo_key="user-backend") == RepoRole.SERVICE
-
-    def test_service_repo_gateway(self) -> None:
-        assert classify_repo_role(repo_key="api-gateway") == RepoRole.SERVICE
-
-    def test_lib_repo_common(self) -> None:
-        assert classify_repo_role(repo_key="merchant-common") == RepoRole.LIB
-
-    def test_lib_repo_sdk(self) -> None:
-        assert classify_repo_role(repo_key="payment-sdk") == RepoRole.LIB
-
-    def test_lib_repo_shared(self) -> None:
-        assert classify_repo_role(repo_key="shared-utils") == RepoRole.LIB
-
-    def test_infra_repo(self) -> None:
-        assert classify_repo_role(repo_key="platform-infra") == RepoRole.INFRA
-
-    def test_infra_repo_devops(self) -> None:
-        assert classify_repo_role(repo_key="devops-tools") == RepoRole.INFRA
-
-    def test_deployment_repo_helm(self) -> None:
-        assert classify_repo_role(repo_key="merchant-helm") == RepoRole.DEPLOYMENT
-
-    def test_deployment_repo_k8s(self) -> None:
-        assert classify_repo_role(repo_key="k8s-manifests") == RepoRole.DEPLOYMENT
-
-    def test_deployment_repo_terraform(self) -> None:
-        assert classify_repo_role(repo_key="terraform-modules") == RepoRole.DEPLOYMENT
-
-    def test_frontend_repo_fe(self) -> None:
-        assert classify_repo_role(repo_key="merchant-fe") == RepoRole.FRONTEND
-
-    def test_frontend_repo_web(self) -> None:
-        assert classify_repo_role(repo_key="payment-web") == RepoRole.FRONTEND
-
-    def test_frontend_repo_portal(self) -> None:
-        assert classify_repo_role(repo_key="admin-portal") == RepoRole.FRONTEND
-
-    def test_unknown_repo(self) -> None:
-        assert classify_repo_role(repo_key="something-random") == RepoRole.UNKNOWN
-
-
-class TestClassifyRepoRoleStructure:
-    """AC-122.3.2: Structure heuristics layer."""
-
-    def test_config_structure_no_source(self, tmp_path: Path) -> None:
-        """Config files without source code → config role."""
-        (tmp_path / "application.yml").touch()
-        (tmp_path / "application-dev.yml").touch()
-        result = classify_repo_role(repo_key="my-repo", repo_path=tmp_path)
-        assert result == RepoRole.CONFIG
-
-    def test_config_dir_no_source(self, tmp_path: Path) -> None:
-        (tmp_path / "config").mkdir()
-        result = classify_repo_role(repo_key="my-repo", repo_path=tmp_path)
-        assert result == RepoRole.CONFIG
-
-    def test_config_files_with_source_not_config(self, tmp_path: Path) -> None:
-        """Config files WITH source code → not classified as config by structure."""
-        (tmp_path / "application.yml").touch()
-        (tmp_path / "src").mkdir()
-        (tmp_path / "pom.xml").touch()
-        result = classify_repo_role(repo_key="my-repo", repo_path=tmp_path)
-        # Has source code, so structure heuristic won't classify as config
-        assert result != RepoRole.CONFIG
-
-    def test_deployment_structure(self, tmp_path: Path) -> None:
-        (tmp_path / "helm").mkdir()
-        (tmp_path / "charts").mkdir()
-        result = classify_repo_role(repo_key="my-repo", repo_path=tmp_path)
-        assert result == RepoRole.DEPLOYMENT
-
-    def test_lib_structure(self, tmp_path: Path) -> None:
-        (tmp_path / "packages").mkdir()
-        result = classify_repo_role(repo_key="my-repo", repo_path=tmp_path)
-        assert result == RepoRole.LIB
-
-    def test_nonexistent_path_falls_through(self) -> None:
-        result = classify_repo_role(
-            repo_key="my-repo",
-            repo_path=Path("/nonexistent/path"),
-        )
-        assert result == RepoRole.UNKNOWN
-
-
-class TestClassifyRepoRoleFallback:
-    """Fallback from RepoType when naming/structure don't match."""
-
-    def test_backend_type_maps_to_service(self) -> None:
-        result = classify_repo_role(repo_key="my-repo", repo_type=RepoType.BACKEND)
-        assert result == RepoRole.SERVICE
-
-    def test_frontend_type_maps_to_frontend(self) -> None:
-        result = classify_repo_role(repo_key="my-repo", repo_type=RepoType.FRONTEND)
-        assert result == RepoRole.FRONTEND
-
-    def test_infra_type_maps_to_infra(self) -> None:
-        result = classify_repo_role(repo_key="my-repo", repo_type=RepoType.INFRA)
-        assert result == RepoRole.INFRA
-
-    def test_fullstack_type_maps_to_service(self) -> None:
-        result = classify_repo_role(repo_key="my-repo", repo_type=RepoType.FULLSTACK)
-        assert result == RepoRole.SERVICE
-
-    def test_unknown_type_stays_unknown(self) -> None:
-        result = classify_repo_role(repo_key="my-repo", repo_type=RepoType.UNKNOWN)
-        assert result == RepoRole.UNKNOWN
-
-    def test_naming_takes_priority_over_type(self) -> None:
-        """Naming heuristic wins over RepoType fallback."""
-        result = classify_repo_role(repo_key="merchant-config", repo_type=RepoType.BACKEND)
-        assert result == RepoRole.CONFIG
-
-
-class TestClassifyRepoRoleDeterminism:
-    """DD-122.5: Classification is deterministic."""
-
-    def test_same_input_same_output(self) -> None:
-        for _ in range(10):
-            assert classify_repo_role(repo_key="merchant-config") == RepoRole.CONFIG
-
-    def test_case_insensitive_naming(self) -> None:
-        assert classify_repo_role(repo_key="Merchant-Config") == RepoRole.CONFIG
-        assert classify_repo_role(repo_key="MERCHANT-CONFIG") == RepoRole.CONFIG
-
-
-class TestRepoTopologyEntryRole:
-    """repo_role field on RepoTopologyEntry."""
-
-    def test_default_role_is_unknown(self) -> None:
-        entry = RepoTopologyEntry(
-            repo_key="test",
-            repo_path="/tmp/test",
-            repo_type=RepoType.BACKEND,
-        )
-        assert entry.repo_role == RepoRole.UNKNOWN
-
-    def test_explicit_role(self) -> None:
-        entry = RepoTopologyEntry(
-            repo_key="test",
-            repo_path="/tmp/test",
-            repo_type=RepoType.BACKEND,
-            repo_role=RepoRole.CONFIG,
-        )
-        assert entry.repo_role == RepoRole.CONFIG
-
-    def test_role_serializes_in_topology(self) -> None:
-        entry = RepoTopologyEntry(
-            repo_key="merchant-config",
-            repo_path="/tmp/merchant-config",
-            repo_type=RepoType.BACKEND,
-            repo_role=RepoRole.CONFIG,
-        )
-        topology = ProjectTopology(
-            project_storage_key="88718940",
-            repos=[entry],
-        )
-        data = topology.model_dump()
-        assert data["repos"][0]["repo_role"] == "config"
-
-
-# ---------------------------------------------------------------------------
-# TSK-122.13: source_repo_role on EvidenceDiscovery and role-filtered query
-# ---------------------------------------------------------------------------
-
-
-class TestEvidenceDiscoverySourceRepoRole:
-    """AC-122.3.3: source_repo_role on EvidenceDiscovery."""
-
-    def test_default_source_repo_role_is_none(self) -> None:
-        discovery = EvidenceDiscovery(
-            source_repo="merchant-service",
-            discovery_type=EvidenceDiscoveryType.CONFIG_PATTERN,
-            ref="application.yml",
-            excerpt="spring.datasource.url=...",
-            confidence=0.9,
-        )
-        assert discovery.source_repo_role is None
-
-    def test_explicit_source_repo_role(self) -> None:
-        discovery = EvidenceDiscovery(
-            source_repo="merchant-config",
-            discovery_type=EvidenceDiscoveryType.CONFIG_PATTERN,
-            ref="application.yml",
-            excerpt="spring.datasource.url=...",
-            confidence=0.9,
-            source_repo_role="config",
-        )
-        assert discovery.source_repo_role == "config"
-
-    def test_from_row_extracts_source_repo_role_from_metadata(self) -> None:
-        row = {
-            "source_repo": "merchant-config",
-            "discovery_type": "config_pattern",
-            "ref": "application.yml",
-            "excerpt": "spring.datasource.url=...",
-            "confidence": 0.9,
-            "created_at": datetime.now(UTC),
-            "requirement_type_tag": None,
-            "metadata": {"source_repo_role": "config"},
-        }
-        discovery = EvidenceDiscovery.from_row(row)
-        assert discovery.source_repo_role == "config"
-
-    def test_from_row_no_role_in_metadata(self) -> None:
-        row = {
-            "source_repo": "merchant-service",
-            "discovery_type": "config_pattern",
-            "ref": "application.yml",
-            "excerpt": "test",
-            "confidence": 0.8,
-            "created_at": datetime.now(UTC),
-            "requirement_type_tag": None,
-            "metadata": {},
-        }
-        discovery = EvidenceDiscovery.from_row(row)
-        assert discovery.source_repo_role is None
-
-
-class TestProjectEvidenceStoreRoleFilter:
-    """AC-122.3.3: Role-filtered query on ProjectEvidenceStore."""
-
-    def _make_store(self, rows: list[dict[str, Any]]) -> ProjectEvidenceStore:
-        state_store = MagicMock()
-        state_store.list_project_evidence_discoveries.return_value = rows
-        return ProjectEvidenceStore(state_store=state_store)
-
-    def _make_context(self) -> ProjectEvidenceContext:
-        return ProjectEvidenceContext.create(
-            project_key="88718940",
-            thread_id="test-thread",
-        )
-
-    def _make_row(self, source_repo: str, role: str | None = None) -> dict[str, Any]:
-        metadata: dict[str, Any] = {}
-        if role:
-            metadata["source_repo_role"] = role
-        return {
-            "source_repo": source_repo,
-            "discovery_type": "config_pattern",
-            "ref": "application.yml",
-            "excerpt": "test",
-            "confidence": 0.9,
-            "created_at": datetime.now(UTC),
-            "requirement_type_tag": None,
-            "metadata": metadata,
-        }
-
-    def test_query_without_role_filter_returns_all(self) -> None:
-        store = self._make_store(
-            [
-                self._make_row("repo-a", "config"),
-                self._make_row("repo-b", "service"),
-            ]
-        )
-        results = store.query(self._make_context(), current_repo="repo-c")
-        assert len(results) == 2
-
-    def test_query_with_role_filter_returns_matching(self) -> None:
-        store = self._make_store(
-            [
-                self._make_row("repo-a", "config"),
-                self._make_row("repo-b", "service"),
-                self._make_row("repo-c", "config"),
-            ]
-        )
-        results = store.query(
-            self._make_context(),
-            current_repo="repo-d",
-            source_repo_role="config",
-        )
-        assert len(results) == 2
-        assert all(d.source_repo_role == "config" for d in results)
-
-    def test_query_with_role_filter_no_matches(self) -> None:
-        store = self._make_store(
-            [
-                self._make_row("repo-a", "service"),
-            ]
-        )
-        results = store.query(
-            self._make_context(),
-            current_repo="repo-b",
-            source_repo_role="config",
-        )
-        assert len(results) == 0
-
-
-# ---------------------------------------------------------------------------
-# TSK-122.13: CROSS_REPO_CONFIG_ENABLED feature flag
-# ---------------------------------------------------------------------------
-
-
-class TestCrossRepoConfigFeatureFlag:
-    """AC-122.3.5: Feature config defaults to true."""
-
-    def test_flag_exists_in_enum(self) -> None:
-        assert hasattr(FeatureFlag, "CROSS_REPO_CONFIG_ENABLED")
-        assert FeatureFlag.CROSS_REPO_CONFIG_ENABLED == "cross_repo_config_enabled"
-
-    def test_features_config_defaults_true(self) -> None:
-        assert FeaturesConfig().cross_repo_config_enabled is True
-
-    def test_env_var_name(self) -> None:
-        """Nested config env var follows VDS_AUDIT_FEATURES__ convention."""
-        flag_value = FeatureFlag.CROSS_REPO_CONFIG_ENABLED.value
-        env_var = f"VDS_AUDIT_FEATURES__{flag_value.upper()}"
-        assert env_var == "VDS_AUDIT_FEATURES__CROSS_REPO_CONFIG_ENABLED"
-
-
-# ---------------------------------------------------------------------------
-# TSK-122.14: Config-repo companion search and negative evidence
-# ---------------------------------------------------------------------------
-
-
-class TestIsConfigAwareRow:
-    """DD-122.6: Config-aware retrieval is row-selective."""
-
-    def test_config_pattern_tag(self) -> None:
-        assert ToolFirstPlanner._is_config_aware_row("anything", "config_pattern") is True
-
-    def test_infrastructure_tag(self) -> None:
-        assert ToolFirstPlanner._is_config_aware_row("anything", "infrastructure") is True
-
-    def test_technology_stack_tag(self) -> None:
-        assert ToolFirstPlanner._is_config_aware_row("anything", "technology_stack") is True
-
-    def test_config_keyword_in_text(self) -> None:
-        assert ToolFirstPlanner._is_config_aware_row("Check database configuration in application.yml", "") is True
-
-    def test_datasource_keyword(self) -> None:
-        assert ToolFirstPlanner._is_config_aware_row("Verify spring.datasource settings", "") is True
-
-    def test_vietnamese_config_keyword(self) -> None:
-        assert ToolFirstPlanner._is_config_aware_row("Kiểm tra cấu hình database", "") is True
-
-    def test_non_config_row(self) -> None:
-        assert ToolFirstPlanner._is_config_aware_row("Check unit test coverage", "") is False
-
-    def test_empty_text_and_tag(self) -> None:
-        assert ToolFirstPlanner._is_config_aware_row("", "") is False
-
-
-class TestBuildConfigRepoCompanionRefs:
-    """FR-122.3: Config-repo companion search."""
-
-    @pytest.fixture(autouse=True)
-    def _configure_structured_log_capture(self) -> list[dict[str, Any]]:
-        buffer: list[dict[str, Any]] = []
-        configure_logging(json_output=True, log_level="DEBUG", capture_logs=buffer)
-        return buffer
-
-    def _make_context(
-        self,
-        *,
-        cross_repo_config_enabled: str = "true",
-        state_dsn: str = "postgresql://localhost/test",
-        project_key: str = "88718940",
-        repo_key: str = "merchant-service",
-        context_id: str = "ctx-123",
-        thread_id: str = "thread-1",
-        requirement_interpretation: dict[str, Any] | None = None,
-    ) -> dict[str, Any]:
-        return {
-            "tool_get_row_context_output": {
-                "context": {
-                    "requirement_interpretation": dict(requirement_interpretation or {}),
-                    "runtime_context": {
-                        "cross_repo_config_enabled": cross_repo_config_enabled,
-                        "state_dsn": state_dsn,
-                        "project_key": project_key,
-                        "repo_key": repo_key,
-                        "thread_id": thread_id,
-                        "project_evidence_context": {
-                            "context_id": context_id,
-                            "thread_id": thread_id,
-                        },
-                    },
-                },
-            },
-        }
-
-    def test_disabled_flag_returns_empty(self) -> None:
-        ctx = self._make_context(cross_repo_config_enabled="false")
-        result = ToolFirstPlanner._build_config_repo_companion_refs(
-            context=ctx,
-            requirement_text="Check database configuration",
-            requirement_tag="config_pattern",
-        )
-        assert result == []
-
-    def test_non_config_row_returns_empty(self) -> None:
-        ctx = self._make_context()
-        result = ToolFirstPlanner._build_config_repo_companion_refs(
-            context=ctx,
-            requirement_text="Check unit test coverage",
-            requirement_tag="testing",
-        )
-        assert result == []
-
-    @patch("vds_audit_orchestrator.engine.tool_first_planner.query_evidence_discoveries")
-    @patch("vds_audit_orchestrator.engine.tool_first_planner.PostgresStateStore")
-    def test_guidance_driven_config_row_triggers_even_with_non_config_tag(
-        self,
-        mock_store_cls: MagicMock,
-        mock_query: MagicMock,
-        _configure_structured_log_capture: list[dict[str, Any]],
-    ) -> None:
-        mock_store_cls.return_value = MagicMock()
-        mock_query.return_value = []
-        ctx = self._make_context(
-            requirement_interpretation={
-                "detailed_guidance": (
-                    "Kiểm tra repo app-config theo đúng tên service và môi trường production. "
-                    "Mở file application.properties hoặc application.yml và kiểm tra datasource.url, "
-                    "minimum-idle, maximum-pool-size."
-                ),
-                "code_targets": ["application.yml", "application.properties", "DatabaseConfig.java"],
-                "evidence_targets": ["code", "docs"],
-                "acceptance_signals": ["Hướng dẫn chi tiết: kiểm tra app-config và datasource"],
-            }
-        )
-        result = ToolFirstPlanner._build_config_repo_companion_refs(
-            context=ctx,
-            requirement_text="2. Sử dụng Connection Pooling riêng biệt và có giới hạn (Limit).",
-            requirement_tag="hybrid_balanced",
-        )
-        assert len(result) == 1
-        assert result[0]["ref_type"] == "config_repo_companion_negative"
-        mock_query.assert_called_once()
-        assert mock_query.call_args.kwargs.get("requirement_type_tag") == "config_pattern"
-        events = [entry.get("event") for entry in _configure_structured_log_capture]
-        assert "config_repo_companion_negative_evidence" in events
-
-    def test_missing_state_dsn_returns_empty(self) -> None:
-        ctx = self._make_context(state_dsn="")
-        result = ToolFirstPlanner._build_config_repo_companion_refs(
-            context=ctx,
-            requirement_text="Check database configuration",
-            requirement_tag="config_pattern",
-        )
-        assert result == []
-
-    def test_missing_context_id_returns_empty(self) -> None:
-        ctx = self._make_context(context_id="")
-        result = ToolFirstPlanner._build_config_repo_companion_refs(
-            context=ctx,
-            requirement_text="Check database configuration",
-            requirement_tag="config_pattern",
-        )
-        assert result == []
-
-    @patch("vds_audit_orchestrator.engine.tool_first_planner.query_evidence_discoveries")
-    @patch("vds_audit_orchestrator.engine.tool_first_planner.PostgresStateStore")
-    def test_discoveries_found_returns_companion_refs(
-        self,
-        mock_store_cls: MagicMock,
-        mock_query: MagicMock,
-        _configure_structured_log_capture: list[dict[str, Any]],
-    ) -> None:
-        """AC-122.3.3: Config-aware rows get companion evidence from config repos."""
-        mock_store_cls.return_value = MagicMock()
-        mock_query.return_value = [
-            EvidenceDiscovery(
-                source_repo="merchant-config",
-                discovery_type=EvidenceDiscoveryType.CONFIG_PATTERN,
-                ref="application.yml",
-                excerpt="spring.datasource.url=jdbc:postgresql://...",
-                confidence=0.95,
-                source_repo_role="config",
-            ),
-        ]
-        ctx = self._make_context()
-        result = ToolFirstPlanner._build_config_repo_companion_refs(
-            context=ctx,
-            requirement_text="Check database configuration",
-            requirement_tag="config_pattern",
-        )
-        assert len(result) == 1
-        assert result[0]["ref_type"] == "config_repo_companion"
-        assert result[0]["source_repo"] == "merchant-config"
-        assert result[0]["source_repo_role"] == "config"
-        assert result[0]["cross_repo"] is True
-        # Verify query was called with source_repo_role="config"
-        mock_query.assert_called_once()
-        call_kwargs = mock_query.call_args
-        assert call_kwargs.kwargs.get("source_repo_role") == "config" or (
-            len(call_kwargs.args) == 0 and call_kwargs[1].get("source_repo_role") == "config"
-        )
-        assert call_kwargs.kwargs.get("requirement_type_tag") == "config_pattern" or (
-            len(call_kwargs.args) == 0 and call_kwargs[1].get("requirement_type_tag") == "config_pattern"
-        )
-        events = [entry.get("event") for entry in _configure_structured_log_capture]
-        assert "config_repo_companion_found" in events
-
-    @patch("vds_audit_orchestrator.engine.tool_first_planner.query_evidence_discoveries")
-    @patch("vds_audit_orchestrator.engine.tool_first_planner.PostgresStateStore")
-    def test_no_discoveries_returns_negative_evidence(
-        self,
-        mock_store_cls: MagicMock,
-        mock_query: MagicMock,
-        _configure_structured_log_capture: list[dict[str, Any]],
-    ) -> None:
-        """DD-122.7 / AC-122.3.4: Empty config repos → explicit negative evidence."""
-        mock_store_cls.return_value = MagicMock()
-        mock_query.return_value = []
-        ctx = self._make_context()
-        result = ToolFirstPlanner._build_config_repo_companion_refs(
-            context=ctx,
-            requirement_text="Check database configuration",
-            requirement_tag="config_pattern",
-        )
-        assert len(result) == 1
-        assert result[0]["ref_type"] == "config_repo_companion_negative"
-        assert result[0]["negative_evidence"] is True
-        assert result[0]["confidence"] == 0.0
-        assert result[0]["source_repo_role"] == "config"
-        assert "No config-repo companion evidence" in result[0]["excerpt"]
-        events = [entry.get("event") for entry in _configure_structured_log_capture]
-        assert "config_repo_companion_negative_evidence" in events
-
-    @patch("vds_audit_orchestrator.engine.tool_first_planner.query_evidence_discoveries")
-    @patch("vds_audit_orchestrator.engine.tool_first_planner.PostgresStateStore")
-    def test_state_store_always_closed(self, mock_store_cls: MagicMock, mock_query: MagicMock) -> None:
-        """State store is closed even if query raises."""
-        mock_store_instance = MagicMock()
-        mock_store_cls.return_value = mock_store_instance
-        mock_query.side_effect = RuntimeError("db error")
-        ctx = self._make_context()
-        with pytest.raises(RuntimeError, match="db error"):
-            ToolFirstPlanner._build_config_repo_companion_refs(
-                context=ctx,
-                requirement_text="Check database configuration",
-                requirement_tag="config_pattern",
-            )
-        mock_store_instance.close.assert_called_once()