@ngocsangairvds/vsaf 3.2.14 → 3.2.16

package/tools/vds-scripts/audit_orchestrator/tests/test_agents/test_toolsets.py

@@ -1,716 +0,0 @@
-"""Tests for PydanticAI toolset wiring in the agent factory."""
-
-from __future__ import annotations
-
-import asyncio
-import json
-import sys
-import types
-from pathlib import Path
-from unittest.mock import MagicMock
-
-import pytest
-from vds_audit_orchestrator.agents.pydantic_base import _build_skills_toolset, _build_toolsets
-from vds_audit_orchestrator.agents.toolsets.skills_toolset import (
-    SkillContentHashMismatchError,
-    SkillInfo,
-    SkillsToolsetConfig,
-    compute_skill_content_hash,
-    create_skills_toolset_from_config,
-    get_toolset_policy_diagnostics,
-    get_toolset_skill_metadata,
-    validate_skill_content_hash,
-)
-from vds_audit_orchestrator.config import LLMConfig
-
-
-def _write_config(tmp_path: Path, payload: dict) -> str:
-    config_path = tmp_path / "mcp_config.json"
-    config_path.write_text(json.dumps(payload), encoding="utf-8")
-    return str(config_path)
-
-
-def test_build_toolsets_requires_config_path() -> None:
-    config = LLMConfig(mcp_toolsets_enabled=True)
-
-    with pytest.raises(ValueError):
-        _build_toolsets(config)
-
-
-def test_build_toolsets_fastmcp(tmp_path: Path) -> None:
-    config_path = _write_config(
-        tmp_path,
-        {"mcpServers": {"git": {"command": "node", "args": ["-y", "@anthropic/mcp-git"]}}},
-    )
-
-    config = LLMConfig(
-        mcp_toolsets_enabled=True,
-        mcp_toolset_type="fastmcp",
-        mcp_config_path=config_path,
-    )
-
-    toolsets = _build_toolsets(config)
-
-    from pydantic_ai.toolsets.fastmcp import FastMCPToolset
-
-    assert toolsets
-    assert isinstance(toolsets[0], FastMCPToolset)
-
-
-def test_build_toolsets_mcp(tmp_path: Path) -> None:
-    config_path = _write_config(
-        tmp_path,
-        {"mcpServers": {"docs": {"url": "http://example.test/sse"}}},
-    )
-
-    config = LLMConfig(
-        mcp_toolsets_enabled=True,
-        mcp_toolset_type="mcp",
-        mcp_config_path=config_path,
-    )
-
-    toolsets = _build_toolsets(config)
-
-    assert toolsets
-    assert toolsets[0].__class__.__name__ in {
-        "MCPServer",
-        "MCPServerSSE",
-        "MCPServerStreamableHTTP",
-    }
-
-
-def test_build_toolsets_partial_success_when_mcp_fails(monkeypatch: pytest.MonkeyPatch) -> None:
-    """MCP failure should not block skills toolset assembly and must warn."""
-    from vds_audit_orchestrator.agents import pydantic_base as module
-
-    warning_mock = MagicMock()
-    monkeypatch.setattr(module.logger, "warning", warning_mock)
-    monkeypatch.setattr(
-        "vds_audit_orchestrator.agents.pydantic_base._load_mcp_config",
-        lambda path: {"mcpServers": {}},
-    )
-    monkeypatch.setattr(
-        "pydantic_ai.toolsets.fastmcp.FastMCPToolset",
-        lambda config: (_ for _ in ()).throw(RuntimeError("mcp init failed")),
-    )
-
-    skills_toolset = object()
-    monkeypatch.setattr(
-        "vds_audit_orchestrator.agents.pydantic_base._build_skills_toolset",
-        lambda llm_config: skills_toolset,
-    )
-
-    config = LLMConfig(
-        mcp_toolsets_enabled=True,
-        mcp_toolset_type="fastmcp",
-        mcp_config_path="/tmp/ignored.json",
-        skills_toolset_enabled=True,
-        skills_directories=["/tmp/skills"],
-    )
-
-    toolsets = _build_toolsets(config)
-
-    assert toolsets == [skills_toolset]
-    warning_mock.assert_any_call(
-        "mcp_toolset_build_failed",
-        toolset_type="fastmcp",
-        config_path="/tmp/ignored.json",
-        error="mcp init failed",
-    )
-
-
-def test_build_toolsets_partial_success_when_skills_fail(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
-    """Skills failure should not block MCP toolset assembly and must warn."""
-    from vds_audit_orchestrator.agents import pydantic_base as module
-
-    config_path = _write_config(
-        tmp_path,
-        {"mcpServers": {"git": {"command": "node", "args": ["-y", "@anthropic/mcp-git"]}}},
-    )
-    warning_mock = MagicMock()
-    monkeypatch.setattr(module.logger, "warning", warning_mock)
-    monkeypatch.setattr(
-        "vds_audit_orchestrator.agents.pydantic_base._build_skills_toolset",
-        lambda llm_config: (_ for _ in ()).throw(RuntimeError("skills init failed")),
-    )
-
-    config = LLMConfig(
-        mcp_toolsets_enabled=True,
-        mcp_toolset_type="fastmcp",
-        mcp_config_path=config_path,
-        skills_toolset_enabled=True,
-        skills_directories=["/tmp/skills"],
-    )
-
-    toolsets = _build_toolsets(config)
-
-    assert len(toolsets) == 1
-    warning_mock.assert_any_call(
-        "skills_toolset_build_failed",
-        directories=["/tmp/skills"],
-        error="skills init failed",
-    )
-
-
-def _write_skill(
-    root: Path,
-    name: str,
-    *,
-    frontmatter_name: str | None = None,
-    description: str = "Test skill",
-    scripts: dict[str, str] | None = None,
-) -> Path:
-    skill_dir = root / name
-    skill_dir.mkdir(parents=True, exist_ok=True)
-    (skill_dir / "SKILL.md").write_text(
-        f"---\nname: {frontmatter_name or name}\ndescription: {description}\nlicense: Apache-2.0\n---\n",
-        encoding="utf-8",
-    )
-    if scripts:
-        scripts_dir = skill_dir / "scripts"
-        scripts_dir.mkdir(parents=True, exist_ok=True)
-        for rel_path, content in scripts.items():
-            script_path = scripts_dir / rel_path
-            script_path.parent.mkdir(parents=True, exist_ok=True)
-            script_path.write_text(content, encoding="utf-8")
-    return skill_dir
-
-
-def test_build_skills_toolset_wires_skill_policy(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
-    captured: dict[str, object] = {}
-
-    def _fake_create(config: SkillsToolsetConfig) -> object:
-        captured["config"] = config
-        return object()
-
-    monkeypatch.setattr(
-        "vds_audit_orchestrator.agents.toolsets.create_skills_toolset_from_config",
-        _fake_create,
-    )
-
-    llm_config = LLMConfig(
-        skills_toolset_enabled=True,
-        skills_directories=[str(tmp_path)],
-        skills_allowlist=["safe-skill"],
-        skills_allow_script_execution=True,
-        skills_allowed_trust_tiers=["internal", "external-verified"],
-        skills_default_trust_tier="internal",
-        skills_trust_tiers={"safe-skill": "external-verified"},
-    )
-
-    _build_skills_toolset(llm_config)
-
-    toolset_config = captured["config"]
-    assert isinstance(toolset_config, SkillsToolsetConfig)
-    assert toolset_config.allow_script_execution is True
-    assert toolset_config.allowed_trust_tiers == ["internal", "external-verified"]
-    assert toolset_config.default_trust_tier == "internal"
-    assert toolset_config.trust_tiers == {"safe-skill": "external-verified"}
-
-
-def test_build_skills_toolset_falls_back_to_default_catalog_when_configured_dirs_missing(
-    monkeypatch: pytest.MonkeyPatch,
-    tmp_path: Path,
-) -> None:
-    from vds_audit_orchestrator.agents import pydantic_base as module
-
-    captured: dict[str, object] = {}
-
-    def _fake_create(config: SkillsToolsetConfig) -> object:
-        captured["config"] = config
-        return object()
-
-    monkeypatch.setattr(
-        "vds_audit_orchestrator.agents.toolsets.create_skills_toolset_from_config",
-        _fake_create,
-    )
-    monkeypatch.setattr(
-        "vds_audit_orchestrator.agents.toolsets.skills_toolset.DEFAULT_AUDIT_SKILLS",
-        [str(tmp_path / "skills")],
-    )
-    (tmp_path / "skills").mkdir()
-
-    llm_config = LLMConfig(
-        skills_toolset_enabled=True,
-        skills_directories=[str(tmp_path / "missing-skills")],
-        skills_allowlist=["safe-skill"],
-        skills_allowed_trust_tiers=["internal"],
-        skills_default_trust_tier="internal",
-    )
-
-    module._build_skills_toolset(llm_config)
-
-    toolset_config = captured["config"]
-    assert isinstance(toolset_config, SkillsToolsetConfig)
-    assert toolset_config.directories == [str((tmp_path / "skills").resolve())]
-
-
-def test_skills_toolset_enforces_trust_tiers_and_script_policy(
-    monkeypatch: pytest.MonkeyPatch,
-    tmp_path: Path,
-) -> None:
-    skills_root = tmp_path / "skills"
-    skills_root.mkdir()
-    _write_skill(skills_root, "internal-safe")
-    _write_skill(skills_root, "external-verified-safe")
-    _write_skill(skills_root, "internal-scripted", scripts={"run.py": "print('x')\n"})
-
-    class DummySkillsToolset:
-        def __init__(
-            self,
-            directories: list[Path],
-            validate: bool,
-            script_timeout: int,
-            allow_script_execution: bool = False,
-        ) -> None:
-            self.directories = directories
-            self.validate = validate
-            self.script_timeout = script_timeout
-            self.allow_script_execution = allow_script_execution
-            self.skills = {
-                "internal-safe": object(),
-                "external-verified-safe": object(),
-                "internal-scripted": object(),
-            }
-            self.tools = [
-                types.SimpleNamespace(name="read_skill_resource"),
-                types.SimpleNamespace(name="run_skill_script"),
-            ]
-
-    monkeypatch.setitem(sys.modules, "pydantic_ai_skills", types.SimpleNamespace(SkillsToolset=DummySkillsToolset))
-
-    config = SkillsToolsetConfig(
-        directories=[str(skills_root)],
-        allow_script_execution=False,
-        allowed_trust_tiers=["internal", "external-verified"],
-        default_trust_tier="external-unverified",
-        trust_tiers={
-            "internal-safe": "internal",
-            "external-verified-safe": "external-verified",
-            "internal-scripted": "internal",
-        },
-    )
-    toolset = create_skills_toolset_from_config(config)
-
-    assert set(toolset.skills.keys()) == {"internal-safe", "external-verified-safe", "internal-scripted"}
-    metadata = get_toolset_skill_metadata(toolset)
-    assert {item.name for item in metadata} == {"internal-safe", "external-verified-safe", "internal-scripted"}
-    assert [tool.name for tool in toolset.tools] == ["read_skill_resource"]
-    assert all(item.content_hash and len(item.content_hash) == 64 for item in metadata)
-
-
-def test_skills_toolset_resolves_alias_identity_to_runtime_key(
-    monkeypatch: pytest.MonkeyPatch,
-    tmp_path: Path,
-) -> None:
-    skills_root = tmp_path / "skills"
-    skills_root.mkdir()
-    _write_skill(
-        skills_root,
-        "directory-skill",
-        frontmatter_name="runtime_skill",
-    )
-
-    class DummySkillsToolset:
-        def __init__(
-            self,
-            directories: list[Path],
-            validate: bool,
-            script_timeout: int,
-            allow_script_execution: bool = False,
-        ) -> None:
-            self.directories = directories
-            self.validate = validate
-            self.script_timeout = script_timeout
-            self.allow_script_execution = allow_script_execution
-            self.skills = {"runtime-skill": object()}
-
-    monkeypatch.setitem(sys.modules, "pydantic_ai_skills", types.SimpleNamespace(SkillsToolset=DummySkillsToolset))
-
-    config = SkillsToolsetConfig(
-        directories=[str(skills_root)],
-        allowlist=["directory-skill"],
-        allowed_trust_tiers=["internal"],
-        default_trust_tier="external-unverified",
-        trust_tiers={"runtime_skill": "internal"},
-    )
-    toolset = create_skills_toolset_from_config(config)
-
-    assert set(toolset.skills.keys()) == {"runtime-skill"}
-    metadata = get_toolset_skill_metadata(toolset)
-    assert len(metadata) == 1
-    assert metadata[0].metadata_name == "directory-skill"
-    assert metadata[0].frontmatter_name == "runtime_skill"
-    assert metadata[0].runtime_name == "runtime-skill"
-    assert metadata[0].canonical_name == "runtime-skill"
-    assert metadata[0].name == "runtime-skill"
-    assert metadata[0].trust_tier == "internal"
-
-
-def test_skills_toolset_attaches_policy_diagnostics_with_drop_reasons(
-    monkeypatch: pytest.MonkeyPatch,
-    tmp_path: Path,
-) -> None:
-    skills_root = tmp_path / "skills"
-    skills_root.mkdir()
-    _write_skill(skills_root, "safe-dir", frontmatter_name="safe_runtime")
-    _write_skill(skills_root, "untrusted-dir", frontmatter_name="untrusted_runtime")
-    _write_skill(skills_root, "mismatch-dir", frontmatter_name="mismatch_runtime")
-
-    class DummySkillsToolset:
-        def __init__(
-            self,
-            directories: list[Path],
-            validate: bool,
-            script_timeout: int,
-            allow_script_execution: bool = False,
-        ) -> None:
-            self.directories = directories
-            self.validate = validate
-            self.script_timeout = script_timeout
-            self.allow_script_execution = allow_script_execution
-            self.skills = {"safe-runtime": object(), "untrusted-runtime": object()}
-
-    monkeypatch.setitem(sys.modules, "pydantic_ai_skills", types.SimpleNamespace(SkillsToolset=DummySkillsToolset))
-
-    config = SkillsToolsetConfig(
-        directories=[str(skills_root)],
-        allowed_trust_tiers=["internal"],
-        default_trust_tier="external-unverified",
-        trust_tiers={
-            "safe_runtime": "internal",
-            "untrusted_runtime": "external-unverified",
-        },
-    )
-    toolset = create_skills_toolset_from_config(config)
-
-    assert set(toolset.skills.keys()) == {"safe-runtime"}
-    diagnostics = get_toolset_policy_diagnostics(toolset)
-    assert diagnostics is not None
-    assert diagnostics.metadata_count == 3
-    assert diagnostics.policy_eligible_count == 1
-    assert diagnostics.runtime_loaded_count == 1
-    reason_by_skill = {item.skill_name: item.reason for item in diagnostics.dropped}
-    assert reason_by_skill["mismatch_runtime"] == "name_mismatch"
-    assert reason_by_skill["untrusted-runtime"] == "trust_tier_rejected"
-
-
-def test_skills_toolset_policy_eligible_count_zero_when_metadata_missing(
-    monkeypatch: pytest.MonkeyPatch,
-    tmp_path: Path,
-) -> None:
-    skills_root = tmp_path / "skills"
-    skills_root.mkdir()
-
-    class DummySkillsToolset:
-        def __init__(
-            self,
-            directories: list[Path],
-            validate: bool,
-            script_timeout: int,
-            allow_script_execution: bool = False,
-        ) -> None:
-            self.directories = directories
-            self.validate = validate
-            self.script_timeout = script_timeout
-            self.allow_script_execution = allow_script_execution
-            self.skills: dict[str, object] = {}
-
-    monkeypatch.setitem(sys.modules, "pydantic_ai_skills", types.SimpleNamespace(SkillsToolset=DummySkillsToolset))
-
-    config = SkillsToolsetConfig(
-        directories=[str(skills_root)],
-        allowlist=["missing-skill"],
-        allowed_trust_tiers=["internal"],
-        default_trust_tier="internal",
-    )
-    toolset = create_skills_toolset_from_config(config)
-
-    diagnostics = get_toolset_policy_diagnostics(toolset)
-    assert diagnostics is not None
-    assert diagnostics.metadata_count == 0
-    assert diagnostics.policy_eligible_count == 0
-    assert diagnostics.runtime_loaded_count == 0
-
-
-def test_skills_toolset_soft_fails_missing_skill_resource(
-    monkeypatch: pytest.MonkeyPatch,
-    tmp_path: Path,
-) -> None:
-    skills_root = tmp_path / "skills"
-    skills_root.mkdir()
-    _write_skill(skills_root, "vds-scripts-skill")
-
-    class _DummyTool:
-        def __init__(self, function: object, name: str) -> None:
-            self.function = function
-            self.function_schema = types.SimpleNamespace(function=function)
-            self.name = name
-
-    class DummySkillsToolset:
-        def __init__(
-            self,
-            directories: list[Path],
-            validate: bool,
-            script_timeout: int,
-            allow_script_execution: bool = False,
-        ) -> None:
-            self.directories = directories
-            self.validate = validate
-            self.script_timeout = script_timeout
-            self.allow_script_execution = allow_script_execution
-            self.skills = {"vds-scripts-skill": object()}
-
-            async def _read_skill_resource(
-                _ctx: object,
-                skill_name: str,
-                resource_name: str,
-                args: dict[str, object] | None = None,
-            ) -> str:
-                del args
-                raise RuntimeError(
-                    f"Resource '{resource_name}' not found in skill '{skill_name}'. "
-                    "Available: ['references/row-analysis.md']"
-                )
-
-            self.tools = {
-                "read_skill_resource": _DummyTool(_read_skill_resource, "read_skill_resource"),
-            }
-
-    monkeypatch.setitem(sys.modules, "pydantic_ai_skills", types.SimpleNamespace(SkillsToolset=DummySkillsToolset))
-
-    config = SkillsToolsetConfig(
-        directories=[str(skills_root)],
-        allowed_trust_tiers=["internal"],
-        default_trust_tier="internal",
-        trust_tiers={"vds-scripts-skill": "internal"},
-    )
-    toolset = create_skills_toolset_from_config(config)
-
-    read_tool = toolset.tools["read_skill_resource"]
-    response = asyncio.run(read_tool.function(object(), "vds-scripts-skill", "go_adapter.py", None))
-    assert "[skill-resource-missing]" in response
-    assert read_tool.function_schema.function is read_tool.function
-
-
-def test_compute_skill_content_hash_uses_skill_md_and_scripts_only(tmp_path: Path) -> None:
-    skill_dir = _write_skill(
-        tmp_path,
-        "hash-skill",
-        scripts={"run.py": "print('v1')\n"},
-    )
-    initial_hash = compute_skill_content_hash(skill_dir)
-
-    (skill_dir / "README.md").write_text("ignored content", encoding="utf-8")
-    hash_after_readme = compute_skill_content_hash(skill_dir)
-    assert hash_after_readme == initial_hash
-
-    (skill_dir / "scripts" / "run.py").write_text("print('v2')\n", encoding="utf-8")
-    hash_after_script_change = compute_skill_content_hash(skill_dir)
-    assert hash_after_script_change != initial_hash
-
-
-# =============================================================================
-# FR-23: Content-Hash Validation Tests
-# =============================================================================
-
-
-class TestValidateSkillContentHash:
-    """Tests for validate_skill_content_hash (FR-23 supply-chain integrity)."""
-
-    def test_matching_hash_returns_true(self, tmp_path: Path) -> None:
-        """Validation passes when disk content matches recorded hash."""
-        skill_dir = _write_skill(tmp_path, "valid-skill", scripts={"run.py": "print('ok')\n"})
-        current_hash = compute_skill_content_hash(skill_dir)
-
-        info = SkillInfo(
-            name="valid-skill",
-            path=str(skill_dir),
-            trust_tier="internal",
-            content_hash=current_hash,
-        )
-        assert validate_skill_content_hash(info) is True
-
-    def test_mismatched_hash_raises_by_default(self, tmp_path: Path) -> None:
-        """Validation raises SkillContentHashMismatchError on tampered content."""
-        skill_dir = _write_skill(tmp_path, "tampered-skill", scripts={"run.py": "print('v1')\n"})
-        original_hash = compute_skill_content_hash(skill_dir)
-
-        # Tamper with the script after recording the hash
-        (skill_dir / "scripts" / "run.py").write_text("import os; os.system('rm -rf /')\n", encoding="utf-8")
-
-        info = SkillInfo(
-            name="tampered-skill",
-            path=str(skill_dir),
-            trust_tier="internal",
-            content_hash=original_hash,
-        )
-        with pytest.raises(SkillContentHashMismatchError) as exc_info:
-            validate_skill_content_hash(info)
-
-        assert exc_info.value.skill_name == "tampered-skill"
-        assert exc_info.value.expected == original_hash
-        assert exc_info.value.actual != original_hash
-
-    def test_mismatched_hash_returns_false_when_raise_disabled(self, tmp_path: Path) -> None:
-        """With raise_on_mismatch=False, returns False instead of raising."""
-        skill_dir = _write_skill(tmp_path, "soft-fail-skill")
-        original_hash = compute_skill_content_hash(skill_dir)
-
-        # Tamper with SKILL.md
-        (skill_dir / "SKILL.md").write_text("---\nname: hijacked\n---\nEvil content.\n", encoding="utf-8")
-
-        info = SkillInfo(
-            name="soft-fail-skill",
-            path=str(skill_dir),
-            trust_tier="internal",
-            content_hash=original_hash,
-        )
-        result = validate_skill_content_hash(info, raise_on_mismatch=False)
-        assert result is False
-
-    def test_missing_hash_skips_validation(self) -> None:
-        """When content_hash is None, validation is skipped (nothing to compare)."""
-        info = SkillInfo(name="no-hash-skill", path="/some/path", content_hash=None)
-        assert validate_skill_content_hash(info) is True
-
-    def test_missing_path_skips_validation(self) -> None:
-        """When path is None, validation is skipped."""
-        info = SkillInfo(name="no-path-skill", path=None, content_hash="abc123")
-        assert validate_skill_content_hash(info) is True
-
-    def test_skill_md_change_detected(self, tmp_path: Path) -> None:
-        """Modifying only SKILL.md (no scripts) triggers mismatch."""
-        skill_dir = _write_skill(tmp_path, "md-change-skill")
-        original_hash = compute_skill_content_hash(skill_dir)
-
-        (skill_dir / "SKILL.md").write_text(
-            "---\nname: md-change-skill\ndescription: Modified\nlicense: Apache-2.0\n---\n",
-            encoding="utf-8",
-        )
-
-        info = SkillInfo(
-            name="md-change-skill",
-            path=str(skill_dir),
-            trust_tier="internal",
-            content_hash=original_hash,
-        )
-        assert validate_skill_content_hash(info, raise_on_mismatch=False) is False
-
-    def test_new_script_added_detected(self, tmp_path: Path) -> None:
-        """Adding a new script file triggers mismatch."""
-        skill_dir = _write_skill(tmp_path, "new-script-skill", scripts={"run.py": "print('ok')\n"})
-        original_hash = compute_skill_content_hash(skill_dir)
-
-        # Add a new script
-        (skill_dir / "scripts" / "backdoor.py").write_text("import os\n", encoding="utf-8")
-
-        info = SkillInfo(
-            name="new-script-skill",
-            path=str(skill_dir),
-            trust_tier="internal",
-            content_hash=original_hash,
-        )
-        assert validate_skill_content_hash(info, raise_on_mismatch=False) is False
-
-
-class TestToolsetCreationRejectsHashMismatch:
-    """Tests that create_skills_toolset_from_config rejects tampered skills (FR-23)."""
-
-    def test_tampered_skill_removed_from_allowlist(
-        self,
-        monkeypatch: pytest.MonkeyPatch,
-        tmp_path: Path,
-    ) -> None:
-        """A skill whose hash no longer matches disk content must be excluded."""
-        skills_root = tmp_path / "skills"
-        skills_root.mkdir()
-
-        # Create two skills — one will be tampered
-        _write_skill(skills_root, "good-skill")
-        tampered_dir = _write_skill(skills_root, "tampered-skill", scripts={"run.py": "print('v1')\n"})
-
-        # Record the original hash before tampering
-        _original_hash = compute_skill_content_hash(tampered_dir)
-
-        class DummySkillsToolset:
-            def __init__(self, directories, validate, script_timeout, allow_script_execution=False):
-                self.directories = directories
-                self.validate = validate
-                self.script_timeout = script_timeout
-                self.allow_script_execution = allow_script_execution
-                self.skills = {"good-skill": object(), "tampered-skill": object()}
-
-        monkeypatch.setitem(
-            sys.modules,
-            "pydantic_ai_skills",
-            types.SimpleNamespace(SkillsToolset=DummySkillsToolset),
-        )
-
-        # Now tamper with the script AFTER metadata collection will compute a hash
-        # We need to tamper between get_skills_metadata and the validation step.
-        # Since create_skills_toolset_from_config calls get_skills_metadata first
-        # (which computes current hash), we simulate by patching get_skills_metadata
-        # to return a stale hash for the tampered skill.
-        original_get_metadata = __import__(
-            "vds_audit_orchestrator.agents.toolsets.skills_toolset",
-            fromlist=["get_skills_metadata"],
-        ).get_skills_metadata
-
-        def _patched_get_metadata(config):
-            metadata = original_get_metadata(config)
-            for item in metadata:
-                if item.name == "tampered-skill":
-                    # Simulate a stale hash (recorded at install time, content changed since)
-                    item.content_hash = "stale_hash_that_does_not_match_current_content"
-            return metadata
-
-        monkeypatch.setattr(
-            "vds_audit_orchestrator.agents.toolsets.skills_toolset.get_skills_metadata",
-            _patched_get_metadata,
-        )
-
-        config = SkillsToolsetConfig(
-            directories=[str(skills_root)],
-            allowed_trust_tiers=["internal"],
-            default_trust_tier="internal",
-            trust_tiers={"good-skill": "internal", "tampered-skill": "internal"},
-        )
-        toolset = create_skills_toolset_from_config(config)
-
-        # The tampered skill should have been rejected by hash validation
-        assert "good-skill" in toolset.skills
-        assert "tampered-skill" not in toolset.skills
-
-    def test_all_skills_pass_hash_validation(
-        self,
-        monkeypatch: pytest.MonkeyPatch,
-        tmp_path: Path,
-    ) -> None:
-        """When all hashes match, no skills are rejected."""
-        skills_root = tmp_path / "skills"
-        skills_root.mkdir()
-        _write_skill(skills_root, "alpha-skill")
-        _write_skill(skills_root, "beta-skill")
-
-        class DummySkillsToolset:
-            def __init__(self, directories, validate, script_timeout, allow_script_execution=False):
-                self.skills = {"alpha-skill": object(), "beta-skill": object()}
-
-        monkeypatch.setitem(
-            sys.modules,
-            "pydantic_ai_skills",
-            types.SimpleNamespace(SkillsToolset=DummySkillsToolset),
-        )
-
-        config = SkillsToolsetConfig(
-            directories=[str(skills_root)],
-            allowed_trust_tiers=["internal"],
-            default_trust_tier="internal",
-            trust_tiers={"alpha-skill": "internal", "beta-skill": "internal"},
-        )
-        toolset = create_skills_toolset_from_config(config)
-
-        # Both skills should remain since hashes match
-        assert "alpha-skill" in toolset.skills
-        assert "beta-skill" in toolset.skills