@ngocsangairvds/vsaf 3.2.14 → 3.2.16

package/tools/vds-scripts/audit_orchestrator/src/vds_audit_orchestrator/config.py

@@ -1,1943 +0,0 @@
-"""Configuration management for VDS Audit Orchestrator.
-
-This module provides centralized configuration with support for:
-1. The shared VDS audit config file under the resolved config root
-2. Environment variables (VDS_AUDIT_* prefix)
-3. Sensible defaults
-
-Configuration Precedence:
-    1. Environment variables (highest priority)
-    2. Shared audit config file (non-sensitive settings only)
-    3. Default values (lowest priority)
-
-Example audit.yaml:
-    llm:
-      enabled: true
-      protocol: openai
-      base_url: https://api.openai.com/v1
-      model_simple: qwen3-coder:8b
-      model_standard: qwen3-coder:30b
-
-    embedding:
-      model: bge-m3
-      dimensions: 1024
-
-    paths:
-      template_dir: ~/audit/templates
-      output_dir: ./reports
-
-    features:
-      checkpoint_enabled: true
-"""
-
-from __future__ import annotations
-
-import json
-import os
-from enum import StrEnum
-from pathlib import Path
-from typing import Any, Literal, cast
-from urllib.parse import urlparse
-
-import structlog
-from pydantic import BaseModel, Field, SecretStr, field_validator, model_validator
-from pydantic_settings import BaseSettings, SettingsConfigDict
-from vds_agent_core.config import (
-    VDS_BASE_SETTINGS_CONFIG,
-    AgentRuntimeMode,
-    LangGraphConfig,
-    LLMProtocolType,
-    LLMRuntimeConfig,
-    NonProgressPolicyConfig,
-    NonProgressPreset,
-)
-from vds_agent_core.config import (
-    AgenticConfig as _CoreAgenticConfig,
-)
-from vds_cli_common.env import load_shared_env
-from vds_cli_common.paths import get_vds_cache_root, get_vds_config_root
-from vds_platform_core.credentials import resolve_secret
-from vds_platform_core.serialization import safe_dump
-
-logger = structlog.get_logger(__name__)
-
-# Default config directory
-DEFAULT_CONFIG_DIR = get_vds_config_root()
-DEFAULT_CONFIG_FILE = DEFAULT_CONFIG_DIR / "audit.yaml"
-
-# FR-79 SLA defaults (TSK-660.36)
-SLA_ROW_LATENCY_P95_SEC = 45.0
-SLA_MEMORY_CEILING_MB = 2048
-SLA_THROUGHPUT_ROWS_PER_MIN = 3.0
-
-
-def _is_truthy(value: str | None, *, default: bool = True) -> bool:
-    if value is None:
-        return default
-    return value.strip().lower() in {"1", "true", "yes", "on"}
-
-
-def _parse_strict_bool_env(key: str, raw_value: str) -> bool:
-    normalized = raw_value.strip().lower()
-    if normalized == "true":
-        return True
-    if normalized == "false":
-        return False
-    raise ValueError(f"Invalid {key}={raw_value!r}. Expected 'true' or 'false'.")
-
-
-def _resolve_base_url(base_url: str | None) -> str | None:
-    return str(base_url or "").strip() or None
-
-
-class FeatureFlag(StrEnum):
-    """Feature flag identifiers."""
-
-    ADAPTIVE_WEIGHTING_ENABLED = "adaptive_weighting_enabled"
-    CHECKPOINT_ENABLED = "checkpoint_enabled"
-    LLM_ENABLED = "llm_enabled"
-    SEARCH_STRATEGY_ENABLED = "search_strategy_enabled"
-    ADVISORY_SEARCH_STRATEGY_ENABLED = "advisory_search_strategy_enabled"
-    SCOPE_ESCALATION_ENABLED = "scope_escalation_enabled"
-    AST_GREP_ENABLED = "ast_grep_enabled"
-    CROSS_REPO_EVIDENCE_ENABLED = "cross_repo_evidence_enabled"
-    KNOWLEDGE_AGENT_ENABLED = "knowledge_agent_enabled"
-    KNOWLEDGE_ACCUMULATION_ENABLED = "knowledge_accumulation_enabled"
-    KNOWLEDGE_RETRIEVAL_ENABLED = "knowledge_retrieval_enabled"
-    MANUAL_CHECK_GATING_ENABLED = "manual_check_gating_enabled"
-    CROSS_REPO_CONFIG_ENABLED = "cross_repo_config_enabled"
-    REQUIREMENT_SCOPE_ENABLED = "requirement_scope_enabled"
-    SHARED_RESOURCE_INDEXING_ENABLED = "shared_resource_indexing_enabled"
-    INSTRUCTION_ANALYSIS_ENABLED = "instruction_analysis_enabled"
-
-
-TrustTier = Literal["internal", "external-verified", "external-unverified"]
-LLM_MODEL_TIER_SENTINEL = "__VDS_MODEL_REQUIRED__"
-LLM_MODEL_TIER_ENV_MAP: dict[str, str] = {
-    "model_simple": "VDS_AUDIT_LLM__MODEL_SIMPLE",
-    "model_standard": "VDS_AUDIT_LLM__MODEL_STANDARD",
-    "model_complex": "VDS_AUDIT_LLM__MODEL_COMPLEX",
-}
-LLM_REASONING_EFFORT_VALUES: tuple[str, ...] = ("none", "minimal", "low", "medium", "high", "xhigh")
-
-# Mapping from VDS canonical reasoning effort to Anthropic anthropic_effort.
-# Anthropic accepts: low, medium, high, max.  "none" and "minimal" have no
-# Anthropic equivalent and are mapped to None (omit).
-_VDS_TO_ANTHROPIC_EFFORT: dict[str, str | None] = {
-    "none": None,
-    "minimal": None,
-    "low": "low",
-    "medium": "medium",
-    "high": "high",
-    "xhigh": "max",
-}
-
-
-def normalize_reasoning_effort(value: str | None, *, key: str = "reasoning_effort") -> str | None:
-    """Normalize and validate LLM reasoning effort values."""
-    if value is None:
-        return None
-    normalized = str(value).strip().lower()
-    if normalized not in LLM_REASONING_EFFORT_VALUES:
-        allowed = ", ".join(LLM_REASONING_EFFORT_VALUES)
-        raise ValueError(f"Invalid {key}={value!r}. Allowed values: {allowed}.")
-    return normalized
-
-
-def inject_reasoning_effort(
-    settings: dict[str, Any],
-    reasoning_effort: str | None,
-    protocol: LLMProtocolType | str | None = None,
-) -> None:
-    """Inject provider-appropriate reasoning effort into model settings dict.
-
-    For ``anthropic`` protocol, maps to ``anthropic_effort`` (accepted values:
-    low, medium, high, max).  For all other protocols (openai, openai-codex,
-    gemini, ollama), maps to ``openai_reasoning_effort``.
-    """
-    if reasoning_effort is None:
-        return
-    protocol_value = str(getattr(protocol, "value", protocol) or "").strip().lower()
-    if protocol_value == "anthropic":
-        anthropic_value = _VDS_TO_ANTHROPIC_EFFORT.get(reasoning_effort)
-        if anthropic_value is not None:
-            settings["anthropic_effort"] = anthropic_value
-    else:
-        settings["openai_reasoning_effort"] = reasoning_effort
-
-
-class EmbeddingConfig(BaseModel):
-    """Embedding model configuration for corpus vectorization (Phase 47).
-
-    BGE-M3 is the default embedding model, validated by VN-MTEB benchmark (EACL 2026)
-    as the best-performing model for Vietnamese text. Nomic-embed-text is the fallback
-    when BGE-M3 is unavailable.
-
-    Reference: https://arxiv.org/abs/2502.08569 (VN-MTEB: Vietnamese Massive Text Embedding Benchmark)
-    """
-
-    # Primary embedding model
-    model: str = Field(
-        default="bge-m3",
-        description="Default embedding model for corpus vectorization (bge-m3 recommended for Vietnamese)",
-    )
-    dimensions: int = Field(
-        default=1024,
-        description="Embedding vector dimensions (1024 for bge-m3, 768 for nomic-embed-text)",
-    )
-
-    # Fallback configuration
-    fallback_model: str = Field(
-        default="nomic-embed-text",
-        description="Fallback embedding model when primary is unavailable",
-    )
-    fallback_dimensions: int = Field(
-        default=768,
-        description="Fallback model dimensions (768 for nomic-embed-text)",
-    )
-
-    # Batch and timeout settings
-    batch_size: int = Field(default=25, ge=1, le=25, description="Embedding batch size (max 25)")
-    timeout_seconds: float = Field(default=30.0, ge=5.0, description="Embedding request timeout in seconds")
-    retries: int = Field(default=2, ge=0, description="Number of retries for failed embedding requests")
-    base_url: str | None = Field(
-        default=None,
-        description="Embedding API base URL override (defaults to llm.base_url, then http://127.0.0.1:11434)",
-    )
-    api_key: SecretStr | None = Field(
-        default=None,
-        description="Embedding API key override (read from VDS_AUDIT_EMBEDDING__API_KEY when provided)",
-    )
-
-
-class LLMConfig(LLMRuntimeConfig):
-    """LLM protocol configuration — inherits from vds_agent_core.config.LLMRuntimeConfig.
-
-    Overrides env_prefix to VDS_AUDIT__ for audit-specific env vars.
-    Adds audit-specific fields on top of the shared runtime config.
-    """
-
-    model_config = SettingsConfigDict(
-        env_prefix="VDS_AUDIT__",
-        **VDS_BASE_SETTINGS_CONFIG,
-    )
-
-    # Audit-specific fields (not in LLMRuntimeConfig)
-    use_pydantic_ai: bool = Field(default=True, description="Use PydanticAI agents for LLM calls")
-    api_key: SecretStr | None = None
-    base_url: str | None = None
-    stream: bool = Field(
-        default=False,
-        description="Enable provider streaming mode for Anthropic-compatible SSE endpoints",
-    )
-    agent_stream: bool = Field(
-        default=True,
-        description="Enable streaming PydanticAI agent execution mode (run_stream) for supported protocols",
-    )
-    reasoning_effort: str | None = Field(
-        default=None,
-        description="OpenAI-compatible reasoning effort override: none|minimal|low|medium|high|xhigh",
-    )
-
-    ollama_num_ctx: int | None = Field(
-        default=None,
-        ge=1024,
-        le=262_144,
-        description="Optional Ollama num_ctx override for native /api/chat calls",
-    )
-
-    # Models (tiered)
-    model_simple: str = LLM_MODEL_TIER_SENTINEL
-    model_standard: str = LLM_MODEL_TIER_SENTINEL
-    model_complex: str = LLM_MODEL_TIER_SENTINEL
-
-    # Cost controls
-    max_cost_per_repo: float = 2.00
-    max_tokens_per_request: int = 12000
-    code_review_max_total_chars: int = Field(
-        default=30_000,
-        ge=2_000,
-        le=120_000,
-        description="Maximum total code-context chars embedded in non-agentic code-review prompts",
-    )
-    code_review_max_files: int = Field(
-        default=20,
-        ge=1,
-        le=50,
-        description="Maximum code-pack files selected for non-agentic code-review prompts",
-    )
-    code_review_layer_enabled: bool = Field(
-        default=True,
-        description="Enable Layer-2 semantic code-review LLM pass before deep quality analysis",
-    )
-
-    # Cache settings
-    cache_enabled: bool = True
-    cache_ttl_hours: int = 24
-
-    # PydanticAI retry policy (Phase 8)
-    agent_retries: int = Field(default=2, ge=0, description="Model retries for PydanticAI agents")
-    output_retries: int = Field(
-        default=2,
-        ge=0,
-        description="Output validation retries for PydanticAI agents",
-    )
-    agent_timeout_seconds: float = Field(
-        default=1200.0,
-        ge=30.0,
-        le=3600.0,
-        description="Base timeout budget for agent LLM calls in seconds (generous: 20 min)",
-    )
-    agent_timeout_max_seconds: float = Field(
-        default=3600.0,
-        ge=60.0,
-        le=7200.0,
-        description="Maximum timeout budget for agent LLM calls in seconds (generous: 1 hour)",
-    )
-    agent_timeout_extension_seconds: float = Field(
-        default=600.0,
-        ge=0.0,
-        le=1800.0,
-        description="Per-extension timeout increment for long-running agent calls (generous: 10 min)",
-    )
-    agent_timeout_extension_attempts: int = Field(
-        default=6,
-        ge=0,
-        le=10,
-        description="Maximum timeout extensions for long-running agent calls (generous: 6 attempts)",
-    )
-    agent_timeout_heartbeat_seconds: float = Field(
-        default=30.0,
-        ge=5.0,
-        le=300.0,
-        description="Progress heartbeat interval while waiting on long-running agent calls",
-    )
-    agent_rate_limit_retry_attempts: int = Field(
-        default=5,
-        ge=0,
-        le=8,
-        description="Additional retries for transient provider rate-limit responses (generous: 5)",
-    )
-    agent_rate_limit_retry_backoff_seconds: float = Field(
-        default=1.5,
-        ge=0.1,
-        le=60.0,
-        description="Base exponential backoff in seconds for provider rate-limit retries (generous: 1.5s)",
-    )
-    row_failover_profiles: list[str] = Field(
-        default_factory=list,
-        description="Ordered fallback runtime profiles for mid-row provider failover",
-    )
-    row_failover_max_provider_hops: int = Field(
-        default=5,
-        ge=0,
-        le=10,
-        description="Maximum provider hops per row evaluation (generous: 5 hops across 17 profiles)",
-    )
-    agent_idle_timeout_seconds: float = Field(
-        default=360.0,
-        ge=30.0,
-        le=1800.0,
-        description="Abort tool-enabled runs when no event progress occurs (generous: 6 min)",
-    )
-    row_progress_lease_seconds: int = Field(
-        default=0,
-        ge=0,
-        le=1800,
-        description="Row progress lease window in seconds (0 disables lease mode)",
-    )
-    row_stall_detection_seconds: int = Field(
-        default=30,
-        ge=1,
-        le=900,
-        description="Row stall detection window in seconds while lease mode is enabled",
-    )
-    row_absolute_timeout_ms: int = Field(
-        default=600_000,
-        ge=1000,
-        le=3_600_000,
-        description="Absolute row timeout ceiling in milliseconds while lease mode is enabled",
-    )
-    agent_event_stream_enabled: bool = Field(
-        default=True,
-        description="Enable PydanticAI event-stream handler for realtime tool/result logging",
-    )
-    agent_event_stream_log_text_deltas: bool = Field(
-        default=False,
-        description="Enable verbose realtime text-delta logging from model response stream",
-    )
-    agent_trace_payload_enabled: bool = Field(
-        default=False,
-        description="Emit payload-level prompt/response/tool trace diagnostics",
-    )
-    agent_trace_payload_max_chars: int = Field(
-        default=20_000,
-        ge=1_000,
-        le=200_000,
-        description="Maximum characters kept per traced payload field",
-    )
-
-    # Toolset integration (Phase 8)
-    mcp_toolsets_enabled: bool = Field(default=False, description="Enable MCP toolsets for agents")
-    mcp_toolset_type: str = Field(default="fastmcp", description="Toolset type: fastmcp or mcp")
-    mcp_config_path: str | None = Field(default=None, description="Path to MCP config (JSON/YAML)")
-    skills_toolset_enabled: bool = Field(default=False, description="Enable AgentSkills toolset")
-    skills_directories: list[str] = Field(default_factory=list, description="Skill directories for SkillsToolset")
-    skills_allowlist: list[str] = Field(
-        default_factory=list,
-        max_length=200,
-        description="Optional allowlist of skill names for SkillsToolset",
-    )
-    skills_allow_script_execution: bool = Field(
-        default=False,
-        description="Disable skill script execution by default unless explicitly opted in",
-    )
-    skills_allowed_trust_tiers: list[TrustTier] = Field(
-        default_factory=lambda: [cast("TrustTier", "internal")],
-        min_length=1,
-        max_length=3,
-        description="Allowed skill trust tiers",
-    )
-    skills_default_trust_tier: TrustTier = Field(
-        default="external-unverified",
-        description="Default trust tier for skills not present in skills_trust_tiers",
-    )
-    skills_trust_tiers: dict[str, TrustTier] = Field(
-        default_factory=dict,
-        max_length=200,
-        description="Optional mapping of skill name to trust tier",
-    )
-    skills_scope_map: dict[str, list[str]] = Field(
-        default_factory=dict,
-        description="Optional mapping of skill name to allowed scopes",
-    )
-
-    @field_validator("skills_allowlist")
-    @classmethod
-    def _validate_skills_allowlist(cls, value: list[str]) -> list[str]:
-        normalized = [item.strip() for item in value if item.strip()]
-        if len(normalized) != len(value):
-            raise ValueError("skills_allowlist entries must be non-empty strings")
-        return normalized
-
-    @field_validator("skills_allowed_trust_tiers")
-    @classmethod
-    def _validate_skills_allowed_trust_tiers(
-        cls,
-        value: list[TrustTier],
-    ) -> list[TrustTier]:
-        deduped = list(dict.fromkeys(value))
-        if not deduped:
-            raise ValueError("skills_allowed_trust_tiers must contain at least one tier")
-        return deduped
-
-    @field_validator("reasoning_effort")
-    @classmethod
-    def _validate_reasoning_effort(cls, value: str | None) -> str | None:
-        return normalize_reasoning_effort(value)
-
-
-class PathsConfig(BaseModel):
-    """File path configuration."""
-
-    config_dir: Path = Field(default_factory=get_vds_config_root)
-    template_dir: Path = Field(default_factory=lambda: get_vds_config_root() / "audit" / "templates")
-    checkpoint_dir: Path = Field(default_factory=lambda: get_vds_config_root() / "audit" / "checkpoints")
-    cache_dir: Path = Field(default_factory=lambda: get_vds_cache_root() / "vds_audit")
-    materials_cache_dir: Path = Field(default_factory=lambda: get_vds_cache_root() / "confluence")
-    output_dir: Path = Field(default_factory=lambda: Path.cwd() / "audit_reports")
-
-    def ensure_dirs_exist(self) -> None:
-        """Create directories if they don't exist."""
-        for path_attr in ["template_dir", "checkpoint_dir", "cache_dir", "materials_cache_dir", "output_dir"]:
-            path = getattr(self, path_attr)
-            path.mkdir(parents=True, exist_ok=True)
-
-
-class FeaturesConfig(BaseModel):
-    """Feature flags configuration."""
-
-    adaptive_weighting_enabled: bool = True
-    checkpoint_enabled: bool = True
-    llm_enabled: bool = False  # Disabled by default, requires explicit opt-in
-    search_strategy_enabled: bool = True  # Phase 115: Enabled by default
-    advisory_search_strategy_enabled: bool = True  # Phase 115: Enabled by default
-    scope_escalation_enabled: bool = True
-    ast_grep_enabled: bool = True  # Phase 116: Enabled by default (gracefully degrades if sg not installed)
-    cross_repo_evidence_enabled: bool = True  # Phase 117: Enabled by default
-    knowledge_agent_enabled: bool = True  # Phase 118: Enabled by default
-    knowledge_accumulation_enabled: bool = True  # Phase 118: Enabled by default
-    knowledge_retrieval_enabled: bool = True  # Phase 118: Enabled by default
-    manual_check_gating_enabled: bool = True  # Phase 122: Enabled by default
-    cross_repo_config_enabled: bool = True  # Phase 122: Enabled by default
-    requirement_scope_enabled: bool = True  # Phase 122: Enabled by default
-    shared_resource_indexing_enabled: bool = True  # Phase 122: Enabled by default
-    instruction_analysis_enabled: bool = True  # Phase 122: Enabled by default
-
-    def is_enabled(self, flag: FeatureFlag) -> bool:
-        """Check if a specific feature flag is enabled."""
-        return getattr(self, flag.value, False)
-
-    def with_override(self, **overrides: bool) -> FeaturesConfig:
-        """Create a new FeaturesConfig instance with overrides.
-
-        Args:
-            **overrides: Feature flag overrides (e.g., google_sheets_enabled=False)
-
-        Returns:
-            New FeaturesConfig instance with specified flags overridden
-        """
-        values = safe_dump(self)
-        values.update(overrides)
-        return FeaturesConfig(**values)
-
-
-class VDSIntegrationConfig(BaseModel):
-    """VDS services integration configuration."""
-
-    # Phase 118 knowledge agent
-    knowledge_ttl_days: int = 30
-    knowledge_confidence_threshold: float = 0.8
-
-    @model_validator(mode="before")
-    @classmethod
-    def _apply_phase118_flat_env_aliases(cls, value: Any) -> Any:
-        if not isinstance(value, dict):
-            return value
-        data = dict(value)
-        if "knowledge_ttl_days" not in data:
-            env_ttl = os.getenv("VDS_AUDIT_KNOWLEDGE_TTL_DAYS")
-            if env_ttl:
-                data["knowledge_ttl_days"] = env_ttl
-        if "knowledge_confidence_threshold" not in data:
-            env_threshold = os.getenv("VDS_AUDIT_KNOWLEDGE_CONFIDENCE_THRESHOLD")
-            if env_threshold:
-                data["knowledge_confidence_threshold"] = env_threshold
-        return data
-
-    # Confluence
-    confluence_base_url: str | None = None
-    confluence_space_key: str | None = None
-
-    # Phase 120 (FR-120.6) Canonical Checklist integration
-    backend_checklist_confluence_page_id: str = "88722450"
-    frontend_checklist_confluence_page_id: str = "88729031"
-    backend_checklist_google_sheet_gid: str = "2126622691"
-    backend_checklist_schema_extensions: list[str] = Field(
-        default_factory=lambda: ["Check = Manual", "Hướng dẫn chi tiết"],
-        description="Phase 120 widened operator-facing schema fields.",
-    )
-
-    # Jira
-    jira_base_url: str | None = None
-    jira_project_key: str | None = None
-
-    # Bitbucket
-    bitbucket_base_url: str | None = None
-    bitbucket_project_key: str | None = None
-
-    # SonarQube
-    sonarqube_base_url: str | None = None
-    sonarqube_token: SecretStr | None = None
-
-
-class PerformanceSLAConfig(BaseModel):
-    """Performance SLA guardrails (FR-79)."""
-
-    row_latency_p95_sec: float = Field(
-        default=SLA_ROW_LATENCY_P95_SEC,
-        ge=0.1,
-        description="Single-row evaluation latency P95 ceiling in seconds",
-    )
-    memory_ceiling_mb: int = Field(
-        default=SLA_MEMORY_CEILING_MB,
-        ge=128,
-        description="Peak RSS memory ceiling in MB for a 55-row checklist run",
-    )
-    throughput_rows_per_min: float = Field(
-        default=SLA_THROUGHPUT_ROWS_PER_MIN,
-        ge=0.1,
-        description="Minimum sustained checklist throughput in rows per minute",
-    )
-
-
-_NON_PROGRESS_PRESET_OVERRIDES: dict[NonProgressPreset, dict[str, Any]] = {
-    NonProgressPreset.STRICT: {
-        "high_repeat_min_tool_calls": 6,
-        "fallback_single_tool_min_tool_calls": 4,
-        "dominant_repetition_ratio": 0.35,
-    },
-    NonProgressPreset.BALANCED: {},
-    NonProgressPreset.PERMISSIVE: {
-        "high_repeat_min_tool_calls": 20,
-        "high_repeat_max_repeat": 8,
-        "high_volume_repetition_min_tool_calls": 40,
-    },
-}
-
-
-def resolve_non_progress_policy(
-    preset: NonProgressPreset | str | None,
-    overrides: dict[str, Any] | None = None,
-) -> NonProgressPolicyConfig:
-    """Resolve final non-progress policy from preset + optional field-level overrides."""
-    selected = NonProgressPreset.BALANCED if preset is None else NonProgressPreset(str(preset).strip().lower())
-    base = NonProgressPolicyConfig(**_NON_PROGRESS_PRESET_OVERRIDES[selected])
-    if not overrides:
-        return base
-    return NonProgressPolicyConfig.model_validate(base.model_copy(update=overrides).model_dump())
-
-
-class AgenticConfig(_CoreAgenticConfig):
-    """Configuration for agentic investigation mode (Phase 41).
-
-    Controls the bounded, read-only tool-enabled investigation path
-    for CodeAnalysisAgent. Default-enabled for Phase 61 default-on semantics.
-
-    NOTE: The canonical generic base is vds_agent_core.config.AgenticConfig.
-    This class extends it with audit-specific defaults and additional fields
-    (strict_no_fallback, synthesis caps, local_openai_* aliases, audit tool_allowlists).
-    """
-
-    enabled: bool = Field(default=True, description="Enable agentic investigation mode")
-    max_turns: int = Field(default=40, ge=1, le=100, description="Maximum agent turns per evaluation (generous: 40)")
-    max_tool_calls: int = Field(
-        default=400, ge=1, le=1000, description="Maximum total tool calls per evaluation (generous: 400)"
-    )
-    tool_timeout_sec: int = Field(
-        default=60, ge=1, le=300, description="Per-tool call timeout in seconds (generous: 60s)"
-    )
-    safe_extensions: list[str] = Field(
-        default_factory=lambda: [".py", ".md", ".json", ".yaml", ".toml", ".xml", ".js", ".ts", ".java", ".go"],
-        description="File extensions allowed for read_file tool",
-    )
-    max_read_bytes: int = Field(default=200_000, ge=1024, le=10_000_000, description="Maximum bytes per file read")
-    max_read_lines: int = Field(
-        default=300,
-        ge=50,
-        le=5000,
-        description="Maximum lines returned by read_file when no explicit line range is provided",
-    )
-    strict_no_fallback: bool = Field(
-        default=True,
-        description=(
-            "Fail-fast without budget/guard fallback retries; "
-            "agent must satisfy tool-grounded requirements in first pass"
-        ),
-    )
-    strict_cap_max_turns: int = Field(
-        default=20,
-        ge=1,
-        le=100,
-        description="Maximum turns for strict mode (generous: 20, was 10)",
-    )
-    strict_cap_max_tool_calls: int = Field(
-        default=48,
-        ge=1,
-        le=1000,
-        description="Maximum tool calls for strict mode (generous: 48, was 24)",
-    )
-    local_openai_synthesis_max_turns: int = Field(
-        default=8,
-        ge=1,
-        le=20,
-        description="Turn cap for local OpenAI synthesis-retry (generous: 8, was 4)",
-    )
-    local_openai_synthesis_max_tool_calls: int = Field(
-        default=4,
-        ge=0,
-        le=20,
-        description="Tool-call cap for local OpenAI synthesis-retry (generous: 4, was 2)",
-    )
-    local_openai_hard_synthesis_max_turns: int = Field(
-        default=4,
-        ge=1,
-        le=10,
-        description="Turn cap for hard synthesis mode (generous: 4, was 2)",
-    )
-    local_openai_hard_synthesis_max_tool_calls: int = Field(
-        default=2,
-        ge=0,
-        le=5,
-        description="Tool-call cap for hard synthesis mode (generous: 2, was 0)",
-    )
-    synthesis_max_turns: int = Field(
-        default=8,
-        ge=1,
-        le=20,
-        description=(
-            "Generic turn cap for strict synthesis-retry mode after usage-limit "
-            "errors (preferred over local_openai_synthesis_max_turns)."
-        ),
-    )
-    synthesis_max_tool_calls: int = Field(
-        default=2,
-        ge=0,
-        le=20,
-        description=(
-            "Generic tool-call cap for strict synthesis-retry mode after usage-limit "
-            "errors (preferred over local_openai_synthesis_max_tool_calls)."
-        ),
-    )
-    hard_synthesis_max_turns: int = Field(
-        default=4,
-        ge=1,
-        le=10,
-        description="Generic turn cap for hard synthesis mode (generous: 4, was 2)",
-    )
-    hard_synthesis_max_tool_calls: int = Field(
-        default=2,
-        ge=0,
-        le=5,
-        description="Generic tool-call cap for hard synthesis mode (generous: 2, was 0)",
-    )
-    non_progress_preset: NonProgressPreset | None = Field(
-        default=None,
-        description="Named non-progress policy preset (strict|balanced|permissive)",
-    )
-    non_progress_policy: NonProgressPolicyConfig = Field(
-        default_factory=NonProgressPolicyConfig,
-        description="Configurable thresholds used by non-progress retry guards",
-    )
-    tool_allowlists: dict[str, list[str]] = Field(
-        default_factory=lambda: {
-            "code": [
-                "list_directory",
-                "read_file",
-                "grep_search",
-                "rg_search",
-                "ast_grep_search",
-                "get_definition",
-                "find_references",
-                "workspace_symbol",
-                "list_evidence_documents",
-                "search_evidence",
-                "read_evidence_document",
-                "search_evidence_vector",
-                "search_code_vector",
-                "vector_retrieval_status",
-                "list_skills",
-                "load_skill",
-                "read_skill_resource",
-                "run_skill_script",
-            ],
-            "docs": [
-                "list_evidence_documents",
-                "search_evidence",
-                "read_evidence_document",
-                "search_evidence_vector",
-            ],
-            "security": [
-                "list_evidence_documents",
-                "search_evidence",
-                "read_evidence_document",
-                "search_evidence_vector",
-                "search_code_vector",
-                "grep_search",
-                "rg_search",
-                "ast_grep_search",
-                "read_file",
-            ],
-        },
-        description="Per-agent tool allowlists used for invalid-tool diagnostics and guardrails",
-    )
-
-    @model_validator(mode="after")
-    def _resolve_generic_synthesis_aliases(self) -> AgenticConfig:
-        """Prefer generic synthesis keys while preserving legacy local_openai overrides."""
-        if self.synthesis_max_turns == 8 and self.local_openai_synthesis_max_turns != 8:
-            self.synthesis_max_turns = int(self.local_openai_synthesis_max_turns)
-        if self.synthesis_max_tool_calls == 2 and self.local_openai_synthesis_max_tool_calls != 2:
-            self.synthesis_max_tool_calls = int(self.local_openai_synthesis_max_tool_calls)
-        if self.hard_synthesis_max_turns == 4 and self.local_openai_hard_synthesis_max_turns != 4:
-            self.hard_synthesis_max_turns = int(self.local_openai_hard_synthesis_max_turns)
-        if self.hard_synthesis_max_tool_calls == 2 and self.local_openai_hard_synthesis_max_tool_calls != 2:
-            self.hard_synthesis_max_tool_calls = int(self.local_openai_hard_synthesis_max_tool_calls)
-        return self
-
-    @field_validator("tool_allowlists")
-    @classmethod
-    def _validate_tool_allowlists(
-        cls,
-        value: dict[str, list[str]],
-    ) -> dict[str, list[str]]:
-        normalized: dict[str, list[str]] = {}
-        for agent_name, tools in value.items():
-            key = str(agent_name or "").strip().lower()
-            if not key:
-                raise ValueError("agentic.tool_allowlists keys must be non-empty strings")
-            if not isinstance(tools, list):
-                raise ValueError("agentic.tool_allowlists values must be lists of tool names")
-            cleaned: list[str] = []
-            for tool_name in tools:
-                tool = str(tool_name or "").strip()
-                if not tool:
-                    raise ValueError("agentic.tool_allowlists entries must be non-empty strings")
-                if tool not in cleaned:
-                    cleaned.append(tool)
-            normalized[key] = cleaned
-        return normalized
-
-
-class AuditConfig(BaseSettings):
-    """Main configuration for VDS Audit Orchestrator.
-
-    Configuration is loaded from (in order of precedence):
-    1. Environment variables (VDS_AUDIT_* prefix)
-    2. Effective audit.yaml config file resolved through the shared VDS path/config layer
-    3. Default values
-
-    Environment Variables:
-        VDS_AUDIT_LLM_ENABLED: Enable LLM features
-        VDS_AUDIT_LLM_PROTOCOL: LLM protocol (anthropic, openai, gemini, openai-codex)
-        VDS_AUDIT_TEMPLATE_DIR: Directory for audit templates
-        VDS_AUDIT_OUTPUT_DIR: Directory for audit reports
-        VDS_AUDIT_LLM__API_KEY: API key for selected protocol
-        VDS_AUDIT_LLM__BASE_URL: Optional endpoint override for selected protocol
-    """
-
-    model_config = SettingsConfigDict(
-        env_prefix="VDS_AUDIT_",
-        env_nested_delimiter="__",
-        case_sensitive=False,
-        extra="ignore",
-    )
-
-    # Sub-configurations
-    llm: LLMConfig = Field(default_factory=LLMConfig)
-    embedding: EmbeddingConfig = Field(default_factory=EmbeddingConfig)
-    paths: PathsConfig = Field(default_factory=PathsConfig)
-    features: FeaturesConfig = Field(default_factory=FeaturesConfig)
-    vds: VDSIntegrationConfig = Field(default_factory=VDSIntegrationConfig)
-    langgraph: LangGraphConfig = Field(default_factory=LangGraphConfig)
-    performance: PerformanceSLAConfig = Field(default_factory=PerformanceSLAConfig)
-    agentic: AgenticConfig = Field(default_factory=AgenticConfig)
-
-    # General settings
-    project_root: Path = Field(default_factory=Path.cwd)
-    default_concurrency: int = 5
-    default_timeout: int = 300
-    log_level: str = "INFO"
-
-    @classmethod
-    def load(cls, config_file: Path | None = None) -> AuditConfig:
-        """Load configuration from file and environment.
-
-        Args:
-            config_file: Path to config file (defaults to the effective shared audit config path)
-
-        Returns:
-            Loaded AuditConfig instance
-        """
-        config_file = config_file or DEFAULT_CONFIG_FILE
-        bootstrap_home = _is_truthy(os.getenv("VDS_AUDIT_BOOTSTRAP_HOME"), default=True)
-        if bootstrap_home:
-            DEFAULT_CONFIG_DIR.mkdir(parents=True, exist_ok=True)
-            if not config_file.exists():
-                try:
-                    create_sample_config(config_file)
-                except Exception as exc:
-                    logger.warning("failed_to_create_sample_config", path=str(config_file), error=str(exc))
-
-        if bootstrap_home:
-            load_shared_env()
-        # Auto-apply runtime profile defaults when config is loaded outside CLI callback.
-        # If VDS_AUDIT_PROFILE is explicitly requested, it must override stale active-profile context.
-        active_profile = (os.getenv("VDS_AUDIT_ACTIVE_PROFILE") or "").strip()
-        requested_profile = (os.getenv("VDS_AUDIT_PROFILE") or "").strip() or None
-        should_apply_profile = False
-        should_apply_profile = requested_profile != active_profile if requested_profile else not active_profile
-
-        if should_apply_profile:
-            try:
-                from vds_audit_orchestrator.runtime_profiles import apply_runtime_profile
-
-                activation = apply_runtime_profile(
-                    requested_profile,
-                    force_override=bool(requested_profile),
-                )
-                if activation.profile_name:
-                    logger.info(
-                        "auto_runtime_profile_applied",
-                        profile=activation.profile_name,
-                        source=activation.source,
-                        path=str(activation.profile_path),
-                        applied_env_keys=len(activation.applied_env_keys),
-                    )
-            except Exception as exc:
-                logger.warning("auto_runtime_profile_apply_failed", error=str(exc))
-        file_config: dict[str, Any] = {}
-
-        # Load from YAML file if exists
-        if config_file.exists():
-            try:
-                import yaml
-
-                with open(config_file) as f:
-                    file_config = yaml.safe_load(f) or {}
-                if os.getenv("VDS_AUDIT_LOG_CONFIG_LOADS", "false").strip().lower() in {"1", "true", "yes", "on"}:
-                    logger.info("Loaded config from file", path=str(config_file))
-            except ImportError:
-                logger.warning("PyYAML not installed, skipping config file")
-            except Exception as e:
-                logger.warning("Failed to load config file", path=str(config_file), error=str(e))
-
-        # Merge with environment variables (env takes precedence)
-        return cls._merge_config(file_config)
-
-    @classmethod
-    def _merge_config(cls, file_config: dict[str, Any]) -> AuditConfig:
-        """Merge file config with environment variables."""
-
-        allowed_trust_tiers: set[str] = {"internal", "external-verified", "external-unverified"}
-
-        def _section_config(section: str) -> dict[str, Any]:
-            """Return a mapping-like config section, tolerating null/invalid YAML values."""
-            raw = file_config.get(section, {})
-            if raw is None:
-                return {}
-            if isinstance(raw, dict):
-                return dict(raw)
-            logger.warning(
-                "invalid_audit_yaml_section_type",
-                section=section,
-                section_type=type(raw).__name__,
-            )
-            return {}
-
-        def _parse_env_list(raw_value: str) -> list[str]:
-            value = raw_value.strip()
-            if not value:
-                return []
-            if value.startswith("["):
-                try:
-                    parsed = json.loads(value)
-                except json.JSONDecodeError:
-                    logger.warning("invalid_json_list_env", raw=raw_value)
-                    return []
-                if isinstance(parsed, list):
-                    return [str(item).strip() for item in parsed if str(item).strip()]
-                logger.warning("invalid_json_list_type_env", raw=raw_value, parsed_type=type(parsed).__name__)
-                return []
-            return [item.strip() for item in value.split(",") if item.strip()]
-
-        def _parse_env_trust_tier_map(raw_value: str) -> tuple[bool, dict[str, TrustTier]]:
-            value = raw_value.strip()
-            if not value:
-                return True, {}
-
-            raw_mapping: dict[str, Any] = {}
-            if value.startswith("{"):
-                try:
-                    parsed = json.loads(value)
-                except json.JSONDecodeError:
-                    logger.warning(
-                        "invalid_json_map_env",
-                        env="VDS_AUDIT_LLM__SKILLS_TRUST_TIERS",
-                        raw=raw_value,
-                    )
-                    return False, {}
-                if not isinstance(parsed, dict):
-                    logger.warning(
-                        "invalid_json_map_type_env",
-                        env="VDS_AUDIT_LLM__SKILLS_TRUST_TIERS",
-                        raw=raw_value,
-                        parsed_type=type(parsed).__name__,
-                    )
-                    return False, {}
-                raw_mapping = dict(parsed)
-            else:
-                for token in (item.strip() for item in value.split(",")):
-                    if not token:
-                        continue
-                    if "=" in token:
-                        raw_name, raw_tier = token.split("=", 1)
-                    elif ":" in token:
-                        raw_name, raw_tier = token.split(":", 1)
-                    else:
-                        logger.warning(
-                            "invalid_trust_tier_map_entry_env",
-                            env="VDS_AUDIT_LLM__SKILLS_TRUST_TIERS",
-                            entry=token,
-                        )
-                        continue
-                    skill_name = str(raw_name).strip()
-                    trust_tier = str(raw_tier).strip()
-                    if skill_name:
-                        raw_mapping[skill_name] = trust_tier
-
-            validated: dict[str, TrustTier] = {}
-            for raw_name, raw_tier in raw_mapping.items():
-                skill_name = str(raw_name).strip()
-                trust_tier = str(raw_tier).strip()
-                if not skill_name:
-                    continue
-                if trust_tier not in allowed_trust_tiers:
-                    logger.warning(
-                        "invalid_trust_tier_env_entry",
-                        env="VDS_AUDIT_LLM__SKILLS_TRUST_TIERS",
-                        skill_name=skill_name,
-                        trust_tier=trust_tier,
-                    )
-                    continue
-                validated[skill_name] = cast("TrustTier", trust_tier)
-            return True, validated
-
-        # Build nested config from file.
-        # Sensitive protocol credentials must come from the shared VDS env layer.
-        llm_file_config = _section_config("llm")
-        for sensitive_key in ("api_key",):
-            sensitive_value = llm_file_config.get(sensitive_key)
-            if sensitive_value:
-                logger.warning(
-                    "sensitive_llm_credential_ignored_in_audit_yaml",
-                    key=sensitive_key,
-                    source=str(DEFAULT_CONFIG_FILE),
-                )
-                llm_file_config.pop(sensitive_key, None)
-        llm_config = LLMConfig(**llm_file_config)
-        vds_file_config = _section_config("vds")
-        for sensitive_key in ("sonarqube_token",):
-            sensitive_value = vds_file_config.get(sensitive_key)
-            if sensitive_value:
-                logger.warning(
-                    "sensitive_vds_credential_ignored_in_audit_yaml",
-                    key=sensitive_key,
-                    source=str(DEFAULT_CONFIG_FILE),
-                )
-                vds_file_config.pop(sensitive_key, None)
-        langgraph_file_config = _section_config("langgraph")
-        if langgraph_file_config.get("postgres_dsn"):
-            logger.warning(
-                "sensitive_langgraph_setting_ignored_in_audit_yaml",
-                key="postgres_dsn",
-                source=str(DEFAULT_CONFIG_FILE),
-            )
-            langgraph_file_config.pop("postgres_dsn", None)
-        paths_config = PathsConfig(**_section_config("paths"))
-        features_config = FeaturesConfig(**_section_config("features"))
-        vds_config = VDSIntegrationConfig(**vds_file_config)
-        langgraph_config = LangGraphConfig(**langgraph_file_config)
-        performance_config = PerformanceSLAConfig(**_section_config("performance"))
-        agentic_file_config = _section_config("agentic")
-        file_policy_overrides_raw = agentic_file_config.get("non_progress_policy")
-        file_policy_overrides = file_policy_overrides_raw if isinstance(file_policy_overrides_raw, dict) else None
-        agentic_config = AgenticConfig(**agentic_file_config)
-        embedding_config = EmbeddingConfig(**_section_config("embedding"))
-
-        # Override with environment variables
-        # LLM settings
-        if os.getenv("VDS_AUDIT_LLM_ENABLED"):
-            llm_config.enabled = os.getenv("VDS_AUDIT_LLM_ENABLED", "").lower() in ("true", "1", "yes")
-        protocol_env = os.getenv("VDS_AUDIT_LLM_PROTOCOL")
-        if protocol_env:
-            llm_config.protocol = LLMProtocolType(protocol_env)
-        runtime_mode_env = os.getenv("VDS_AUDIT_LLM__AGENT_RUNTIME_MODE")
-        if runtime_mode_env:
-            try:
-                llm_config.agent_runtime_mode = AgentRuntimeMode(runtime_mode_env)
-            except ValueError as exc:
-                # FR-37: Hard-cut rejection for removed runtime modes
-                raise ValueError(
-                    f"Invalid VDS_AUDIT_LLM__AGENT_RUNTIME_MODE='{runtime_mode_env}'. "
-                    f"Phase 64 single-mode architecture only supports: {', '.join(m.value for m in AgentRuntimeMode)}. "
-                    f"Migration: Remove VDS_AUDIT_LLM__AGENT_RUNTIME_MODE or set to 'pydanticai'."
-                ) from exc
-        if os.getenv("VDS_AUDIT_LLM__MODEL_SIMPLE"):
-            llm_config.model_simple = os.getenv("VDS_AUDIT_LLM__MODEL_SIMPLE", llm_config.model_simple)
-        if os.getenv("VDS_AUDIT_LLM__MODEL_STANDARD"):
-            llm_config.model_standard = os.getenv("VDS_AUDIT_LLM__MODEL_STANDARD", llm_config.model_standard)
-        if os.getenv("VDS_AUDIT_LLM__MODEL_COMPLEX"):
-            llm_config.model_complex = os.getenv("VDS_AUDIT_LLM__MODEL_COMPLEX", llm_config.model_complex)
-        if os.getenv("VDS_AUDIT_LLM__STREAM"):
-            llm_config.stream = _parse_strict_bool_env(
-                "VDS_AUDIT_LLM__STREAM",
-                os.getenv("VDS_AUDIT_LLM__STREAM", ""),
-            )
-        if os.getenv("VDS_AUDIT_LLM__AGENT_STREAM"):
-            llm_config.agent_stream = _parse_strict_bool_env(
-                "VDS_AUDIT_LLM__AGENT_STREAM",
-                os.getenv("VDS_AUDIT_LLM__AGENT_STREAM", ""),
-            )
-        reasoning_effort = os.getenv("VDS_AUDIT_LLM__REASONING_EFFORT")
-        if reasoning_effort:
-            llm_config.reasoning_effort = normalize_reasoning_effort(
-                reasoning_effort,
-                key="VDS_AUDIT_LLM__REASONING_EFFORT",
-            )
-        if os.getenv("VDS_AUDIT_LLM__MAX_TOKENS_PER_REQUEST"):
-            llm_config.max_tokens_per_request = int(
-                os.getenv("VDS_AUDIT_LLM__MAX_TOKENS_PER_REQUEST", str(llm_config.max_tokens_per_request))
-            )
-        code_review_chars_env = os.getenv("VDS_AUDIT_LLM__CODE_REVIEW_MAX_TOTAL_CHARS")
-        code_review_chars_alias_env = os.getenv("VDS_AUDIT_AGENTIC_CODE_REVIEW_MAX_TOTAL_CHARS")
-        if code_review_chars_env:
-            llm_config.code_review_max_total_chars = int(
-                os.getenv(
-                    "VDS_AUDIT_LLM__CODE_REVIEW_MAX_TOTAL_CHARS",
-                    str(llm_config.code_review_max_total_chars),
-                )
-            )
-        elif code_review_chars_alias_env:
-            llm_config.code_review_max_total_chars = int(code_review_chars_alias_env)
-        if os.getenv("VDS_AUDIT_LLM__CODE_REVIEW_MAX_FILES"):
-            llm_config.code_review_max_files = int(
-                os.getenv("VDS_AUDIT_LLM__CODE_REVIEW_MAX_FILES", str(llm_config.code_review_max_files))
-            )
-        if os.getenv("VDS_AUDIT_LLM__CODE_REVIEW_LAYER_ENABLED"):
-            llm_config.code_review_layer_enabled = os.getenv(
-                "VDS_AUDIT_LLM__CODE_REVIEW_LAYER_ENABLED",
-                "",
-            ).lower() in ("true", "1", "yes")
-        if os.getenv("VDS_AUDIT_LLM__AGENT_RETRIES"):
-            llm_config.agent_retries = int(os.getenv("VDS_AUDIT_LLM__AGENT_RETRIES", "2"))
-        if os.getenv("VDS_AUDIT_LLM__OUTPUT_RETRIES"):
-            llm_config.output_retries = int(os.getenv("VDS_AUDIT_LLM__OUTPUT_RETRIES", "2"))
-        row_failover_profiles_env = os.getenv("VDS_AUDIT_LLM__ROW_FAILOVER_PROFILES")
-        if row_failover_profiles_env is not None:
-            try:
-                parsed_profiles = json.loads(row_failover_profiles_env)
-            except Exception:
-                parsed_profiles = [item.strip() for item in row_failover_profiles_env.split(",") if item.strip()]
-            if isinstance(parsed_profiles, list):
-                llm_config.row_failover_profiles = [str(item).strip() for item in parsed_profiles if str(item).strip()]
-            else:
-                llm_config.row_failover_profiles = []
-        if os.getenv("VDS_AUDIT_LLM__ROW_FAILOVER_MAX_PROVIDER_HOPS"):
-            llm_config.row_failover_max_provider_hops = int(
-                os.getenv(
-                    "VDS_AUDIT_LLM__ROW_FAILOVER_MAX_PROVIDER_HOPS",
-                    str(llm_config.row_failover_max_provider_hops),
-                )
-            )
-        if os.getenv("VDS_AUDIT_LLM__AGENT_TIMEOUT_SECONDS"):
-            llm_config.agent_timeout_seconds = float(os.getenv("VDS_AUDIT_LLM__AGENT_TIMEOUT_SECONDS", "600.0"))
-        if os.getenv("VDS_AUDIT_LLM__AGENT_TIMEOUT_MAX_SECONDS"):
-            llm_config.agent_timeout_max_seconds = float(
-                os.getenv("VDS_AUDIT_LLM__AGENT_TIMEOUT_MAX_SECONDS", "1800.0")
-            )
-        if os.getenv("VDS_AUDIT_LLM__AGENT_TIMEOUT_EXTENSION_SECONDS"):
-            llm_config.agent_timeout_extension_seconds = float(
-                os.getenv("VDS_AUDIT_LLM__AGENT_TIMEOUT_EXTENSION_SECONDS", "300.0")
-            )
-        if os.getenv("VDS_AUDIT_LLM__AGENT_TIMEOUT_EXTENSION_ATTEMPTS"):
-            llm_config.agent_timeout_extension_attempts = int(
-                os.getenv("VDS_AUDIT_LLM__AGENT_TIMEOUT_EXTENSION_ATTEMPTS", "3")
-            )
-        if os.getenv("VDS_AUDIT_LLM__AGENT_TIMEOUT_HEARTBEAT_SECONDS"):
-            llm_config.agent_timeout_heartbeat_seconds = float(
-                os.getenv("VDS_AUDIT_LLM__AGENT_TIMEOUT_HEARTBEAT_SECONDS", "30.0")
-            )
-        if os.getenv("VDS_AUDIT_LLM__AGENT_RATE_LIMIT_RETRY_ATTEMPTS"):
-            llm_config.agent_rate_limit_retry_attempts = int(
-                os.getenv("VDS_AUDIT_LLM__AGENT_RATE_LIMIT_RETRY_ATTEMPTS", "2")
-            )
-        if os.getenv("VDS_AUDIT_LLM__AGENT_RATE_LIMIT_RETRY_BACKOFF_SECONDS"):
-            llm_config.agent_rate_limit_retry_backoff_seconds = float(
-                os.getenv("VDS_AUDIT_LLM__AGENT_RATE_LIMIT_RETRY_BACKOFF_SECONDS", "2.0")
-            )
-        if os.getenv("VDS_AUDIT_LLM__AGENT_IDLE_TIMEOUT_SECONDS"):
-            llm_config.agent_idle_timeout_seconds = float(
-                os.getenv("VDS_AUDIT_LLM__AGENT_IDLE_TIMEOUT_SECONDS", "180.0")
-            )
-        if os.getenv("VDS_AUDIT_TIMEOUT_POLICY__ROW_PROGRESS_LEASE_SECONDS"):
-            llm_config.row_progress_lease_seconds = int(
-                os.getenv("VDS_AUDIT_TIMEOUT_POLICY__ROW_PROGRESS_LEASE_SECONDS", "0")
-            )
-        if os.getenv("VDS_AUDIT_TIMEOUT_POLICY__ROW_STALL_DETECTION_SECONDS"):
-            llm_config.row_stall_detection_seconds = int(
-                os.getenv("VDS_AUDIT_TIMEOUT_POLICY__ROW_STALL_DETECTION_SECONDS", "30")
-            )
-        if os.getenv("VDS_AUDIT_TIMEOUT_POLICY__ROW_ABSOLUTE_TIMEOUT_MS"):
-            llm_config.row_absolute_timeout_ms = int(
-                os.getenv("VDS_AUDIT_TIMEOUT_POLICY__ROW_ABSOLUTE_TIMEOUT_MS", "600000")
-            )
-        if os.getenv("VDS_AUDIT_LLM__AGENT_EVENT_STREAM_ENABLED"):
-            llm_config.agent_event_stream_enabled = os.getenv(
-                "VDS_AUDIT_LLM__AGENT_EVENT_STREAM_ENABLED", ""
-            ).lower() in ("true", "1", "yes")
-        if os.getenv("VDS_AUDIT_LLM__AGENT_EVENT_STREAM_LOG_TEXT_DELTAS"):
-            llm_config.agent_event_stream_log_text_deltas = os.getenv(
-                "VDS_AUDIT_LLM__AGENT_EVENT_STREAM_LOG_TEXT_DELTAS",
-                "",
-            ).lower() in ("true", "1", "yes")
-        if os.getenv("VDS_AUDIT_LLM__AGENT_TRACE_PAYLOAD_ENABLED"):
-            llm_config.agent_trace_payload_enabled = os.getenv(
-                "VDS_AUDIT_LLM__AGENT_TRACE_PAYLOAD_ENABLED",
-                "",
-            ).lower() in ("true", "1", "yes")
-        if os.getenv("VDS_AUDIT_LLM__AGENT_TRACE_PAYLOAD_MAX_CHARS"):
-            llm_config.agent_trace_payload_max_chars = int(
-                os.getenv("VDS_AUDIT_LLM__AGENT_TRACE_PAYLOAD_MAX_CHARS", "20000")
-            )
-        if os.getenv("VDS_AUDIT_LLM__MCP_TOOLSETS_ENABLED"):
-            llm_config.mcp_toolsets_enabled = os.getenv("VDS_AUDIT_LLM__MCP_TOOLSETS_ENABLED", "").lower() in (
-                "true",
-                "1",
-                "yes",
-            )
-        if os.getenv("VDS_AUDIT_LLM__MCP_TOOLSET_TYPE"):
-            llm_config.mcp_toolset_type = os.getenv("VDS_AUDIT_LLM__MCP_TOOLSET_TYPE", llm_config.mcp_toolset_type)
-        if os.getenv("VDS_AUDIT_LLM__MCP_CONFIG_PATH"):
-            llm_config.mcp_config_path = os.getenv("VDS_AUDIT_LLM__MCP_CONFIG_PATH", llm_config.mcp_config_path)
-        if os.getenv("VDS_AUDIT_LLM__SKILLS_TOOLSET_ENABLED"):
-            llm_config.skills_toolset_enabled = os.getenv("VDS_AUDIT_LLM__SKILLS_TOOLSET_ENABLED", "").lower() in (
-                "true",
-                "1",
-                "yes",
-            )
-        if os.getenv("VDS_AUDIT_LLM__SKILLS_DIRECTORIES"):
-            raw_dirs = os.getenv("VDS_AUDIT_LLM__SKILLS_DIRECTORIES", "")
-            parsed_dirs = _parse_env_list(raw_dirs)
-            if parsed_dirs:
-                llm_config.skills_directories = parsed_dirs
-        if os.getenv("VDS_AUDIT_LLM__SKILLS_ALLOWLIST"):
-            raw_allowlist = os.getenv("VDS_AUDIT_LLM__SKILLS_ALLOWLIST", "")
-            llm_config.skills_allowlist = _parse_env_list(raw_allowlist)
-        if os.getenv("VDS_AUDIT_LLM__SKILLS_ALLOW_SCRIPT_EXECUTION"):
-            llm_config.skills_allow_script_execution = os.getenv(
-                "VDS_AUDIT_LLM__SKILLS_ALLOW_SCRIPT_EXECUTION",
-                "",
-            ).lower() in ("true", "1", "yes")
-        if os.getenv("VDS_AUDIT_LLM__SKILLS_ALLOWED_TRUST_TIERS"):
-            raw_trust_tiers = os.getenv("VDS_AUDIT_LLM__SKILLS_ALLOWED_TRUST_TIERS", "")
-            parsed_trust_tiers = _parse_env_list(raw_trust_tiers)
-            if parsed_trust_tiers:
-                validated_tiers = [
-                    cast("TrustTier", tier) for tier in parsed_trust_tiers if tier in allowed_trust_tiers
-                ]
-                if validated_tiers:
-                    llm_config.skills_allowed_trust_tiers = validated_tiers
-        if os.getenv("VDS_AUDIT_LLM__SKILLS_DEFAULT_TRUST_TIER"):
-            default_tier = os.getenv("VDS_AUDIT_LLM__SKILLS_DEFAULT_TRUST_TIER", "")
-            if default_tier in allowed_trust_tiers:
-                llm_config.skills_default_trust_tier = cast("TrustTier", default_tier)
-        skills_trust_tiers_env = os.getenv("VDS_AUDIT_LLM__SKILLS_TRUST_TIERS")
-        if skills_trust_tiers_env is not None:
-            parsed_ok, parsed_trust_tier_map = _parse_env_trust_tier_map(skills_trust_tiers_env)
-            if parsed_ok:
-                llm_config.skills_trust_tiers = parsed_trust_tier_map
-        api_key = os.getenv("VDS_AUDIT_LLM__API_KEY")
-        if api_key:
-            llm_config.api_key = SecretStr(api_key)
-        base_url = os.getenv("VDS_AUDIT_LLM__BASE_URL")
-        if base_url:
-            llm_config.base_url = base_url
-        ollama_num_ctx_raw = os.getenv("VDS_AUDIT_LLM__OLLAMA_NUM_CTX")
-        if ollama_num_ctx_raw:
-            try:
-                llm_config.ollama_num_ctx = int(ollama_num_ctx_raw)
-            except (ValueError, TypeError):
-                logger.warning(
-                    "invalid_ollama_num_ctx_env",
-                    raw=ollama_num_ctx_raw,
-                    fallback="None (field default)",
-                )
-        sonarqube_token = os.getenv("SONARQUBE_TOKEN")
-        if sonarqube_token:
-            vds_config.sonarqube_token = SecretStr(sonarqube_token)
-
-        # Path settings
-        template_dir = os.getenv("VDS_AUDIT_TEMPLATE_DIR")
-        if template_dir:
-            paths_config.template_dir = Path(template_dir).expanduser()
-        output_dir = os.getenv("VDS_AUDIT_OUTPUT_DIR")
-        if output_dir:
-            paths_config.output_dir = Path(output_dir).expanduser()
-        cache_dir = os.getenv("VDS_AUDIT_CACHE_DIR")
-        if cache_dir:
-            paths_config.cache_dir = Path(cache_dir).expanduser()
-        materials_cache_dir = os.getenv("VDS_AUDIT_MATERIALS_CACHE_DIR")
-        if materials_cache_dir:
-            paths_config.materials_cache_dir = Path(materials_cache_dir).expanduser()
-        checkpoint_dir = os.getenv("VDS_AUDIT_CHECKPOINT_DIR")
-        if checkpoint_dir:
-            paths_config.checkpoint_dir = Path(checkpoint_dir).expanduser()
-        # Feature flags from environment
-        for flag in FeatureFlag:
-            env_key = f"VDS_AUDIT_{flag.value.upper()}"
-            if os.getenv(env_key):
-                setattr(features_config, flag.value, os.getenv(env_key, "").lower() in ("true", "1", "yes"))
-
-        # LangGraph settings from environment
-        if os.getenv("VDS_AUDIT_LANGGRAPH__CHECKPOINTER_TYPE"):
-            langgraph_config.checkpointer_type = os.getenv("VDS_AUDIT_LANGGRAPH__CHECKPOINTER_TYPE", "memory")
-        postgres_dsn = os.getenv("VDS_AUDIT_LANGGRAPH__POSTGRES_DSN")
-        if postgres_dsn:
-            langgraph_config.postgres_dsn = postgres_dsn
-
-        # Performance SLA settings from environment (FR-79)
-        if os.getenv("VDS_AUDIT_SLA_ROW_LATENCY_P95_SEC"):
-            performance_config.row_latency_p95_sec = float(
-                os.getenv("VDS_AUDIT_SLA_ROW_LATENCY_P95_SEC", str(SLA_ROW_LATENCY_P95_SEC))
-            )
-        if os.getenv("VDS_AUDIT_SLA_MEMORY_CEILING_MB"):
-            performance_config.memory_ceiling_mb = int(
-                os.getenv("VDS_AUDIT_SLA_MEMORY_CEILING_MB", str(SLA_MEMORY_CEILING_MB))
-            )
-        if os.getenv("VDS_AUDIT_SLA_THROUGHPUT_ROWS_PER_MIN"):
-            performance_config.throughput_rows_per_min = float(
-                os.getenv("VDS_AUDIT_SLA_THROUGHPUT_ROWS_PER_MIN", str(SLA_THROUGHPUT_ROWS_PER_MIN))
-            )
-
-        # Agentic mode from environment
-        if os.getenv("VDS_AUDIT_AGENTIC_ENABLED"):
-            agentic_config.enabled = os.getenv("VDS_AUDIT_AGENTIC_ENABLED", "").lower() in ("true", "1", "yes")
-        if os.getenv("VDS_AUDIT_AGENTIC_MAX_TURNS"):
-            agentic_config.max_turns = int(os.getenv("VDS_AUDIT_AGENTIC_MAX_TURNS", "20"))
-        if os.getenv("VDS_AUDIT_AGENTIC_MAX_TOOL_CALLS"):
-            agentic_config.max_tool_calls = int(os.getenv("VDS_AUDIT_AGENTIC_MAX_TOOL_CALLS", "200"))
-        if os.getenv("VDS_AUDIT_AGENTIC_TOOL_TIMEOUT_SEC"):
-            agentic_config.tool_timeout_sec = int(os.getenv("VDS_AUDIT_AGENTIC_TOOL_TIMEOUT_SEC", "30"))
-        if os.getenv("VDS_AUDIT_AGENTIC_MAX_READ_BYTES"):
-            agentic_config.max_read_bytes = int(os.getenv("VDS_AUDIT_AGENTIC_MAX_READ_BYTES", "200000"))
-        if os.getenv("VDS_AUDIT_AGENTIC_MAX_READ_LINES"):
-            agentic_config.max_read_lines = int(os.getenv("VDS_AUDIT_AGENTIC_MAX_READ_LINES", "300"))
-        if os.getenv("VDS_AUDIT_AGENTIC_STRICT_NO_FALLBACK"):
-            agentic_config.strict_no_fallback = os.getenv("VDS_AUDIT_AGENTIC_STRICT_NO_FALLBACK", "").lower() in (
-                "true",
-                "1",
-                "yes",
-            )
-        if os.getenv("VDS_AUDIT_AGENTIC_STRICT_CAP_MAX_TURNS"):
-            agentic_config.strict_cap_max_turns = int(os.getenv("VDS_AUDIT_AGENTIC_STRICT_CAP_MAX_TURNS", "10"))
-        if os.getenv("VDS_AUDIT_AGENTIC_STRICT_CAP_MAX_TOOL_CALLS"):
-            agentic_config.strict_cap_max_tool_calls = int(
-                os.getenv("VDS_AUDIT_AGENTIC_STRICT_CAP_MAX_TOOL_CALLS", "24")
-            )
-        if os.getenv("VDS_AUDIT_AGENTIC_LOCAL_OPENAI_SYNTHESIS_MAX_TURNS"):
-            agentic_config.local_openai_synthesis_max_turns = int(
-                os.getenv("VDS_AUDIT_AGENTIC_LOCAL_OPENAI_SYNTHESIS_MAX_TURNS", "4")
-            )
-        if os.getenv("VDS_AUDIT_AGENTIC_LOCAL_OPENAI_SYNTHESIS_MAX_TOOL_CALLS"):
-            agentic_config.local_openai_synthesis_max_tool_calls = int(
-                os.getenv("VDS_AUDIT_AGENTIC_LOCAL_OPENAI_SYNTHESIS_MAX_TOOL_CALLS", "2")
-            )
-        if os.getenv("VDS_AUDIT_AGENTIC_LOCAL_OPENAI_HARD_SYNTHESIS_MAX_TURNS"):
-            agentic_config.local_openai_hard_synthesis_max_turns = int(
-                os.getenv("VDS_AUDIT_AGENTIC_LOCAL_OPENAI_HARD_SYNTHESIS_MAX_TURNS", "2")
-            )
-        if os.getenv("VDS_AUDIT_AGENTIC_LOCAL_OPENAI_HARD_SYNTHESIS_MAX_TOOL_CALLS"):
-            agentic_config.local_openai_hard_synthesis_max_tool_calls = int(
-                os.getenv("VDS_AUDIT_AGENTIC_LOCAL_OPENAI_HARD_SYNTHESIS_MAX_TOOL_CALLS", "0")
-            )
-        if os.getenv("VDS_AUDIT_AGENTIC_SYNTHESIS_MAX_TURNS"):
-            agentic_config.synthesis_max_turns = int(os.getenv("VDS_AUDIT_AGENTIC_SYNTHESIS_MAX_TURNS", "4"))
-        if os.getenv("VDS_AUDIT_AGENTIC_SYNTHESIS_MAX_TOOL_CALLS"):
-            agentic_config.synthesis_max_tool_calls = int(os.getenv("VDS_AUDIT_AGENTIC_SYNTHESIS_MAX_TOOL_CALLS", "2"))
-        if os.getenv("VDS_AUDIT_AGENTIC_HARD_SYNTHESIS_MAX_TURNS"):
-            agentic_config.hard_synthesis_max_turns = int(os.getenv("VDS_AUDIT_AGENTIC_HARD_SYNTHESIS_MAX_TURNS", "2"))
-        if os.getenv("VDS_AUDIT_AGENTIC_HARD_SYNTHESIS_MAX_TOOL_CALLS"):
-            agentic_config.hard_synthesis_max_tool_calls = int(
-                os.getenv("VDS_AUDIT_AGENTIC_HARD_SYNTHESIS_MAX_TOOL_CALLS", "0")
-            )
-        if os.getenv("VDS_AUDIT_AGENTIC_SAFE_EXTENSIONS"):
-            raw_extensions = os.getenv("VDS_AUDIT_AGENTIC_SAFE_EXTENSIONS", "")
-            parsed_extensions = [ext.strip() for ext in raw_extensions.split(",") if ext.strip()]
-            if parsed_extensions:
-                agentic_config.safe_extensions = parsed_extensions
-        if os.getenv("VDS_AUDIT_AGENTIC_NON_PROGRESS_POLICY"):
-            raw_policy = os.getenv("VDS_AUDIT_AGENTIC_NON_PROGRESS_POLICY", "")
-            try:
-                decoded_policy = json.loads(raw_policy)
-            except json.JSONDecodeError:
-                logger.warning(
-                    "agentic_non_progress_policy_env_invalid",
-                    env_var="VDS_AUDIT_AGENTIC_NON_PROGRESS_POLICY",
-                )
-            else:
-                if isinstance(decoded_policy, dict):
-                    try:
-                        NonProgressPolicyConfig.model_validate(decoded_policy)
-                        file_policy_overrides = decoded_policy
-                    except Exception as exc:
-                        logger.warning(
-                            "agentic_non_progress_policy_env_validation_failed",
-                            env_var="VDS_AUDIT_AGENTIC_NON_PROGRESS_POLICY",
-                            error=str(exc),
-                        )
-        non_progress_preset_env = os.getenv("VDS_AUDIT_AGENTIC_NON_PROGRESS_PRESET")
-        if non_progress_preset_env:
-            try:
-                agentic_config.non_progress_preset = NonProgressPreset(non_progress_preset_env.strip().lower())
-            except ValueError as exc:
-                raise ValueError(
-                    "Invalid VDS_AUDIT_AGENTIC_NON_PROGRESS_PRESET="
-                    f"'{non_progress_preset_env}'. Allowed values: strict, balanced, permissive."
-                ) from exc
-        if os.getenv("VDS_AUDIT_AGENTIC_TOOL_ALLOWLISTS"):
-            raw_allowlists = os.getenv("VDS_AUDIT_AGENTIC_TOOL_ALLOWLISTS", "")
-            try:
-                decoded_allowlists = json.loads(raw_allowlists)
-            except json.JSONDecodeError:
-                logger.warning(
-                    "agentic_tool_allowlists_env_invalid",
-                    env_var="VDS_AUDIT_AGENTIC_TOOL_ALLOWLISTS",
-                )
-            else:
-                if isinstance(decoded_allowlists, dict):
-                    try:
-                        agentic_config.tool_allowlists = AgenticConfig.model_validate(
-                            {"tool_allowlists": decoded_allowlists}
-                        ).tool_allowlists
-                    except Exception as exc:
-                        logger.warning(
-                            "agentic_tool_allowlists_env_validation_failed",
-                            env_var="VDS_AUDIT_AGENTIC_TOOL_ALLOWLISTS",
-                            error=str(exc),
-                        )
-        agentic_config.non_progress_policy = resolve_non_progress_policy(
-            agentic_config.non_progress_preset,
-            file_policy_overrides,
-        )
-
-        # Embedding settings from environment (Phase 47)
-        if os.getenv("VDS_AUDIT_EMBEDDING__MODEL"):
-            embedding_config.model = os.getenv("VDS_AUDIT_EMBEDDING__MODEL", embedding_config.model)
-        if os.getenv("VDS_AUDIT_EMBEDDING__DIMENSIONS"):
-            embedding_config.dimensions = int(os.getenv("VDS_AUDIT_EMBEDDING__DIMENSIONS", "1024"))
-        if os.getenv("VDS_AUDIT_EMBEDDING__FALLBACK_MODEL"):
-            embedding_config.fallback_model = os.getenv(
-                "VDS_AUDIT_EMBEDDING__FALLBACK_MODEL", embedding_config.fallback_model
-            )
-        if os.getenv("VDS_AUDIT_EMBEDDING__FALLBACK_DIMENSIONS"):
-            embedding_config.fallback_dimensions = int(os.getenv("VDS_AUDIT_EMBEDDING__FALLBACK_DIMENSIONS", "768"))
-        if os.getenv("VDS_AUDIT_EMBEDDING__BATCH_SIZE"):
-            embedding_config.batch_size = int(os.getenv("VDS_AUDIT_EMBEDDING__BATCH_SIZE", "10"))
-        if os.getenv("VDS_AUDIT_EMBEDDING__TIMEOUT_SECONDS"):
-            embedding_config.timeout_seconds = float(os.getenv("VDS_AUDIT_EMBEDDING__TIMEOUT_SECONDS", "30.0"))
-        if os.getenv("VDS_AUDIT_EMBEDDING__RETRIES"):
-            embedding_config.retries = int(os.getenv("VDS_AUDIT_EMBEDDING__RETRIES", "2"))
-        if os.getenv("VDS_AUDIT_EMBEDDING__BASE_URL"):
-            embedding_config.base_url = os.getenv("VDS_AUDIT_EMBEDDING__BASE_URL")
-        if os.getenv("VDS_AUDIT_EMBEDDING__API_KEY"):
-            embedding_config.api_key = SecretStr(os.getenv("VDS_AUDIT_EMBEDDING__API_KEY", ""))
-
-        # General settings from environment
-        log_level = os.getenv("VDS_AUDIT_LOG_LEVEL", "INFO")
-        default_concurrency = int(os.getenv("VDS_AUDIT_CONCURRENCY", "5"))
-        default_timeout = int(os.getenv("VDS_AUDIT_TIMEOUT", "300"))
-
-        return cls(
-            llm=llm_config,
-            embedding=embedding_config,
-            paths=paths_config,
-            features=features_config,
-            vds=vds_config,
-            langgraph=langgraph_config,
-            performance=performance_config,
-            agentic=agentic_config,
-            log_level=log_level,
-            default_concurrency=default_concurrency,
-            default_timeout=default_timeout,
-        )
-
-    def validate_required(self) -> list[str]:
-        """Validate required configuration is set.
-
-        Returns:
-            List of missing required configurations
-        """
-        missing = []
-
-        # If LLM is enabled, check protocol-specific requirements
-        if self.features.llm_enabled or (self.llm.enabled and self.llm.protocol in {LLMProtocolType.ANTHROPIC, LLMProtocolType.GEMINI} and not self.llm.api_key):
-                missing.append("VDS_AUDIT_LLM__API_KEY (required when LLM protocol is anthropic or gemini)")
-
-        return missing
-
-    def validate_model_tier_requirements(self) -> list[str]:
-        """Validate that required model tiers are explicitly configured when LLM is enabled."""
-        if not (self.features.llm_enabled or self.llm.enabled):
-            return []
-
-        missing: list[str] = []
-        guidance: dict[str, str] = {
-            "model_simple": "model.llm.simple",
-            "model_standard": "model.llm.standard",
-            "model_complex": "model.llm.complex",
-        }
-        for tier_key, env_key in LLM_MODEL_TIER_ENV_MAP.items():
-            raw_value = str(getattr(self.llm, tier_key, "") or "").strip()
-            if not raw_value or raw_value == LLM_MODEL_TIER_SENTINEL:
-                missing.append(f"{tier_key} ({env_key} or runtime profile {guidance[tier_key]})")
-
-        if not missing:
-            return []
-        return [
-            "LLM model tier configuration is required when LLM is enabled. "
-            f"Missing/placeholder tiers: {', '.join(missing)}. "
-            "Set explicit model tiers in the effective audit.yaml file, runtime profile model.llm.*, or environment variables."
-        ]
-
-    @staticmethod
-    def _parse_env_list(raw_value: str) -> list[str]:
-        value = raw_value.strip()
-        if not value:
-            return []
-        if value.startswith("["):
-            try:
-                parsed = json.loads(value)
-            except json.JSONDecodeError:
-                return []
-            if isinstance(parsed, list):
-                return [str(item).strip() for item in parsed if str(item).strip()]
-            return []
-        return [item.strip() for item in value.split(",") if item.strip()]
-
-    def validate_runtime_mode_contract(self) -> list[str]:
-        """Validate Phase 64 hard-cut runtime mode contract.
-
-        FR-37: Rejected at startup (not deprecation):
-        - Invalid runtime mode values
-        - Legacy SDK env vars that are no longer supported
-        """
-        errors: list[str] = []
-        mode = self.llm.agent_runtime_mode
-
-        if mode != AgentRuntimeMode.PYDANTICAI:
-            errors.append(f"agent_runtime_mode must be 'pydanticai' (single-mode runtime). Got: {mode.value}.")
-
-        # FR-37: Reject legacy SDK env vars (Phase 64 hard-cut)
-        legacy_sdk_env_keys = [
-            "VDS_AUDIT_CLAUDE_AGENT_SDK__SETTING_SOURCES",
-            "VDS_AUDIT_CLAUDE_AGENT_SDK__ALLOWED_TOOLS",
-            "VDS_AUDIT_CLAUDE_AGENT_SDK__WORKING_DIRECTORY",
-            "VDS_AUDIT_CLAUDE_AGENT_SDK__SKILLS_DIRECTORY",
-            "VDS_AUDIT_CLAUDE_AGENT_SDK__MCP_CONFIG_PATH",
-        ]
-        detected_legacy_vars = [key for key in legacy_sdk_env_keys if os.getenv(key)]
-        if detected_legacy_vars:
-            errors.append(
-                f"Legacy SDK env vars detected (no longer supported): {', '.join(detected_legacy_vars)}. "
-                "Phase 64 single-mode architecture uses PydanticAI. "
-                "Migration: Remove these env vars from your profile or environment."
-            )
-
-        return errors
-
-    def validate_endpoint_model_compatibility(self) -> list[str]:
-        """Validate endpoint/model compatibility policy with actionable diagnostics."""
-        endpoint_override = (os.getenv("VDS_AUDIT_LLM__BASE_URL") or "").strip()
-        if not endpoint_override:
-            return []
-
-        endpoint = (self.llm.base_url or "").strip()
-        if not endpoint:
-            return []
-
-        if self.llm.protocol != LLMProtocolType.ANTHROPIC:
-            return []
-
-        mode = self.llm.agent_runtime_mode.value
-        model = (self.llm.model_standard or "").strip()
-        parsed = urlparse(endpoint)
-        host = (parsed.hostname or "").lower()
-        path = (parsed.path or "").lower()
-
-        endpoint_policy = "custom"
-        if host in {"api.anthropic.com", "api.eu.anthropic.com"}:
-            endpoint_policy = "anthropic-official"
-        elif (
-            host in {"localhost", "127.0.0.1", "0.0.0.0"} or ":11434" in endpoint or "ollama" in host or "llama" in host
-        ):
-            endpoint_policy = "local-proxy"
-        elif path.endswith("/v1"):
-            endpoint_policy = "proxy-v1"
-
-        errors: list[str] = []
-        if endpoint_policy == "anthropic-official" and model and not model.startswith("claude-"):
-            errors.append(
-                "Endpoint/model compatibility check failed: "
-                f"VDS_AUDIT_LLM__BASE_URL='{endpoint}' expects Claude models, "
-                f"but llm.model_standard='{model}'. Use a 'claude-*' model or switch endpoint/protocol."
-            )
-        # Non-official Anthropic endpoints are treated as compatible proxies. They
-        # may expose `/v1` URLs or localhost hosts while still accepting Anthropic
-        # protocol payloads and Claude model ids.
-
-        if errors:
-            logger.error(
-                "runtime_endpoint_model_incompatible",
-                endpoint=endpoint,
-                endpoint_policy=endpoint_policy,
-                model_standard=model,
-                agent_runtime_mode=mode,
-            )
-        return errors
-
-    def validate_coherence(self) -> list[str]:
-        """Validate merged runtime configuration coherence (FR-83)."""
-        errors: list[str] = []
-        policy = self.agentic.non_progress_policy
-        if policy.fallback_single_tool_min_tool_calls > policy.high_repeat_min_tool_calls:
-            errors.append(
-                "CC-01 CONFIG_COHERENCE_VIOLATION: "
-                "agentic.non_progress_policy.fallback_single_tool_min_tool_calls must be <= "
-                "agentic.non_progress_policy.high_repeat_min_tool_calls."
-            )
-
-        batch_timeout_ms_raw = (os.getenv("VDS_AUDIT_BATCH_TIMEOUT_MS") or "").strip()
-        if batch_timeout_ms_raw:
-            try:
-                batch_timeout_ms = float(batch_timeout_ms_raw)
-            except ValueError:
-                batch_timeout_ms = 0.0
-            batch_size_raw = (os.getenv("VDS_AUDIT_BATCH_SIZE") or "").strip() or "8"
-            try:
-                batch_size = int(batch_size_raw)
-            except ValueError:
-                batch_size = 0
-            if batch_timeout_ms > 0 and batch_size > 0:
-                per_row_budget_seconds = (batch_timeout_ms / 1000.0) / float(batch_size)
-                if float(self.agentic.tool_timeout_sec) >= per_row_budget_seconds:
-                    errors.append(
-                        "CC-02 CONFIG_COHERENCE_VIOLATION: agentic.tool_timeout_sec must be strictly less than "
-                        "batch_timeout_ms / batch_size."
-                    )
-
-        strict_budget_enabled = _is_truthy(os.getenv("VDS_AUDIT_STRICT_BUDGET"), default=False) or (
-            (os.getenv("VDS_AUDIT_COST_ENFORCEMENT") or "").strip().lower() == "strict"
-        )
-        if strict_budget_enabled and float(self.llm.max_cost_per_repo) <= 0:
-            errors.append("CC-03 CONFIG_COHERENCE_VIOLATION: strict budget mode requires llm.max_cost_per_repo > 0.")
-
-        model_tier_errors = self.validate_model_tier_requirements()
-        errors.extend(f"CC-04 CONFIG_MODEL_TIER_MISSING: {message}" for message in model_tier_errors)
-
-        dspy_coherence_errors = self._validate_dspy_protocol_model_coherence()
-        errors.extend(f"CC-05 CONFIG_PROFILE_INVALID: {message}" for message in dspy_coherence_errors)
-        dspy_protocol_raw = (os.getenv("VDS_AUDIT_DSPY_PROTOCOL") or "").strip()
-        dspy_model_raw = (os.getenv("VDS_AUDIT_DSPY_MODEL") or "").strip()
-        if dspy_protocol_raw and not dspy_model_raw:
-            errors.append(
-                "CC-08 CONFIG_COHERENCE_VIOLATION: when VDS_AUDIT_DSPY_PROTOCOL is set, "
-                "VDS_AUDIT_DSPY_MODEL must also be set explicitly."
-            )
-
-        if self.llm.agent_timeout_seconds > self.llm.agent_timeout_max_seconds:
-            errors.append(
-                "CC-06 CONFIG_COHERENCE_VIOLATION: llm.agent_timeout_seconds must be <= llm.agent_timeout_max_seconds."
-            )
-
-        preset = self.agentic.non_progress_preset
-        balanced = NonProgressPolicyConfig()
-        if preset == NonProgressPreset.STRICT and (
-            policy.high_repeat_min_tool_calls > balanced.high_repeat_min_tool_calls
-            or policy.fallback_single_tool_min_tool_calls > balanced.fallback_single_tool_min_tool_calls
-            or policy.dominant_repetition_ratio > balanced.dominant_repetition_ratio
-        ):
-            errors.append(
-                "CC-07 CONFIG_COHERENCE_VIOLATION: strict preset conflicts with overrides that reduce strictness."
-            )
-        if preset == NonProgressPreset.PERMISSIVE and (
-            policy.high_repeat_min_tool_calls < balanced.high_repeat_min_tool_calls
-            or policy.high_repeat_max_repeat < balanced.high_repeat_max_repeat
-            or policy.high_volume_repetition_min_tool_calls < balanced.high_volume_repetition_min_tool_calls
-        ):
-            errors.append(
-                "CC-07 CONFIG_COHERENCE_VIOLATION: permissive preset conflicts with overrides that reduce permissiveness."
-            )
-
-        return errors
-
-    def _validate_dspy_protocol_model_coherence(self) -> list[str]:
-        protocol = (self.llm.protocol.value or "").strip().lower()
-        dspy_protocol = (os.getenv("VDS_AUDIT_DSPY_PROTOCOL") or "").strip().lower()
-        dspy_model = (os.getenv("VDS_AUDIT_DSPY_MODEL") or "").strip()
-        if not protocol or not dspy_model:
-            return []
-        supported_protocols = {"anthropic", "openai", "gemini", "openai-codex"}
-        if protocol not in supported_protocols:
-            return []
-        if dspy_protocol and dspy_protocol not in supported_protocols:
-            return [
-                f"Incoherent DSPy model/protocol pairing: invalid VDS_AUDIT_DSPY_PROTOCOL='{dspy_protocol}'. "
-                "Allowed: anthropic, openai, gemini, openai-codex."
-            ]
-        active_protocol = dspy_protocol or protocol
-        coherence_protocol = "openai" if active_protocol == "openai-codex" else active_protocol
-        model_prefix = dspy_model.split("/", 1)[0].lower() if "/" in dspy_model else ""
-        normalized_prefix = "gemini" if model_prefix == "google" else model_prefix
-        expected_prefix = coherence_protocol
-        if model_prefix and coherence_protocol != "openai" and normalized_prefix != expected_prefix:
-            return [
-                f"Incoherent DSPy model/protocol pairing: protocol='{active_protocol}', "
-                f"VDS_AUDIT_DSPY_MODEL='{dspy_model}', expected '{expected_prefix}/...' or no prefix."
-            ]
-
-        lowered_model = dspy_model.lower()
-        if not model_prefix and coherence_protocol != "anthropic" and lowered_model.startswith("claude-"):
-            return [f"Incoherent DSPy model/protocol pairing: protocol='{active_protocol}' cannot use '{dspy_model}'."]
-        if not model_prefix and coherence_protocol != "gemini" and lowered_model.startswith("gemini"):
-            return [f"Incoherent DSPy model/protocol pairing: protocol='{active_protocol}' cannot use '{dspy_model}'."]
-        return []
-
-    def get_llm_client(self):
-        """Get configured LLM client.
-
-        Returns:
-            Configured Anthropic client instance
-
-        Raises:
-            RuntimeError: If LLM features are not enabled
-            ValueError: If required API key is missing or protocol is unsupported
-        """
-        if not self.llm.enabled and not self.features.llm_enabled:
-            raise RuntimeError("LLM features are not enabled. Set VDS_AUDIT_LLM_ENABLED=true")
-
-        from vds_audit_orchestrator.llm.provider import build_anthropic_client
-
-        resolved_base_url = _resolve_base_url(self.llm.base_url)
-
-        if self.llm.protocol == LLMProtocolType.ANTHROPIC:
-            if not self.llm.api_key:
-                raise ValueError(f"VDS_AUDIT_LLM__API_KEY is required for {self.llm.protocol.value}")
-            return build_anthropic_client(
-                api_key=resolve_secret(self.llm.api_key) or "",
-                base_url=resolved_base_url,
-            )
-
-        elif self.llm.protocol in {LLMProtocolType.OPENAI, LLMProtocolType.OPENAI_CODEX}:
-            # OpenAI protocol uses OpenAI SDK directly
-            try:
-                from openai import OpenAI
-
-                api_key = resolve_secret(self.llm.api_key) or "no-key-required"
-                if self.llm.protocol == LLMProtocolType.OPENAI_CODEX and not self.llm.api_key:
-                    raise ValueError(
-                        "VDS_AUDIT_LLM__API_KEY is required for openai-codex runtime config "
-                        "(use ${codex:access_token} in runtime profile)."
-                    )
-                return OpenAI(
-                    api_key=api_key,
-                    base_url=resolved_base_url,
-                )
-            except ImportError:
-                raise ValueError("openai package required for OpenAI protocol: pip install openai") from None
-
-        elif self.llm.protocol == LLMProtocolType.GEMINI:
-            # Gemini protocol uses google-genai SDK directly
-            try:
-                from google.genai import Client as GenAIClient
-
-                api_key = resolve_secret(self.llm.api_key)
-                if not api_key:
-                    raise ValueError(f"VDS_AUDIT_LLM__API_KEY is required for {self.llm.protocol.value}")
-                return GenAIClient(
-                    api_key=api_key,
-                    http_options={"base_url": resolved_base_url} if resolved_base_url else None,
-                )
-            except ImportError:
-                raise ValueError(
-                    "google-genai package required for Gemini protocol: pip install google-genai"
-                ) from None
-
-        raise ValueError(f"Unsupported protocol: {self.llm.protocol}")
-
-
-# Global config instance (lazy-loaded)
-_config: AuditConfig | None = None
-
-
-def get_config() -> AuditConfig:
-    """Get the global configuration instance.
-
-    Loads configuration on first access from:
-    1. Environment variables
-    2. Shared audit config file (if present)
-    3. Default values
-
-    Returns:
-        Global AuditConfig instance
-    """
-    global _config
-    if _config is None:
-        _config = AuditConfig.load()
-    return _config
-
-
-def set_config(config: AuditConfig) -> None:
-    """Set the global configuration instance."""
-    global _config
-    _config = config
-
-
-def reset_config() -> None:
-    """Reset configuration to reload from sources."""
-    global _config
-    _config = None
-
-
-# Convenience function for feature flag checking
-def is_feature_enabled(flag: FeatureFlag) -> bool:
-    """Check if a feature flag is enabled."""
-    return get_config().features.is_enabled(flag)
-
-
-# Create sample config file if needed
-def create_sample_config(path: Path | None = None) -> Path:
-    """Create a sample audit.yaml config file.
-
-    Args:
-        path: Path to create config file (defaults to the effective shared audit config path)
-
-    Returns:
-        Path to created config file
-    """
-    path = path or DEFAULT_CONFIG_FILE
-    path.parent.mkdir(parents=True, exist_ok=True)
-
-    sample_config = """# VDS Audit Orchestrator Configuration
-# This file is loaded from the shared audit config path
-# Environment variables take precedence over these settings
-# Sensitive credentials (VDS_AUDIT_LLM__API_KEY, tokens) belong in the shared VDS env file
-
-llm:
-  # Master switch for LLM features (default: false)
-  enabled: false
-
-  # Protocol: anthropic, openai, gemini (default: openai)
-  # Env override: VDS_AUDIT_LLM_PROTOCOL
-  protocol: openai
-
-  # API key for selected protocol (set in the shared VDS env file, not in this file)
-  # Env: VDS_AUDIT_LLM__API_KEY
-  # api_key: sk-...
-
-  # Optional protocol endpoint override
-  # Env override: VDS_AUDIT_LLM__BASE_URL
-  # base_url: https://api.openai.com/v1
-
-  # Enable Anthropic streaming mode for SSE-only proxy endpoints
-  # Env override: VDS_AUDIT_LLM__STREAM
-  stream: false
-
-  # Model tiers are required when llm.enabled=true
-  model_simple: __VDS_MODEL_REQUIRED__    # Fast, simple checks
-  model_standard: __VDS_MODEL_REQUIRED__  # Standard analysis
-  model_complex: __VDS_MODEL_REQUIRED__   # Complex reasoning
-
-  # Cost controls
-  max_cost_per_repo: 2.00
-  max_tokens_per_request: 12000
-  code_review_max_total_chars: 30000
-  code_review_max_files: 20
-  code_review_layer_enabled: true
-  cache_enabled: true
-  cache_ttl_hours: 24
-
-  # PydanticAI retry policy
-  agent_retries: 2
-  output_retries: 2
-
-  # Agent timeout policy (large-model/tool-use runs)
-  agent_timeout_seconds: 600.0
-  agent_timeout_max_seconds: 1800.0
-  agent_timeout_extension_seconds: 300.0
-  agent_timeout_extension_attempts: 3
-  agent_timeout_heartbeat_seconds: 30.0
-  agent_rate_limit_retry_attempts: 2
-  agent_rate_limit_retry_backoff_seconds: 2.0
-  agent_idle_timeout_seconds: 180.0
-
-  # Toolset integration (Phase 8)
-  mcp_toolsets_enabled: false
-  mcp_toolset_type: fastmcp   # fastmcp or mcp
-  # mcp_config_path: ~/.vds/mcp.yaml
-  skills_toolset_enabled: false
-  # skills_directories:
-  #   - ./skills
-  #   - ./audit_orchestrator/skills
-
-# Embedding configuration (Phase 47)
-# BGE-M3 is validated by VN-MTEB benchmark (EACL 2026) as best for Vietnamese
-embedding:
-  # Primary embedding model for corpus vectorization
-  model: bge-m3
-  # base_url: http://127.0.0.1:11434
-  # api_key: ${VDS_AUDIT_EMBEDDING__API_KEY}
-  dimensions: 1024
-
-  # Fallback model when primary is unavailable
-  fallback_model: nomic-embed-text
-  fallback_dimensions: 768
-
-  # Batch and timeout settings
-  batch_size: 10
-  timeout_seconds: 30.0
-  retries: 2
-
-paths:
-  # Template directory for audit templates
-  template_dir: ~/.vds/audit/templates
-
-  # Checkpoint directory for resumable audits
-  checkpoint_dir: ~/.vds/audit/checkpoints
-
-  # Cache directory for LLM responses
-  cache_dir: ~/.cache/vds_audit
-
-  # Shared cache directory for extracted materials
-  materials_cache_dir: <vds-cache-root>/confluence
-
-  # Default output directory for reports
-  output_dir: ./audit_reports
-
-features:
-  # Enable profile-aware weight adjustments
-  adaptive_weighting_enabled: true
-
-  # Enable checkpoint/resume for long audits
-  checkpoint_enabled: true
-
-  # Enable LLM-powered analysis (requires llm.enabled=true)
-  llm_enabled: false
-
-vds:
-  # VDS service integrations (optional, auto-detected from vds-cli)
-  # confluence_base_url: https://confluence.example.com
-  # jira_base_url: https://jira.example.com
-  # bitbucket_base_url: https://bitbucket.example.com
-  # sonarqube_base_url: https://sonarqube.example.com
-
-langgraph:
-  # LangGraph workflow checkpointing configuration
-  # checkpointer_type: 'memory' (default, local-only debug) or 'postgres' (durable)
-  checkpointer_type: memory
-
-  # PostgreSQL connection string is sensitive and should be set in the shared VDS env file:
-  # VDS_AUDIT_LANGGRAPH__POSTGRES_DSN=postgresql://user:password@host:port/database
-
-  # Thread ID prefix for workflow executions
-  thread_id_prefix: audit
-
-performance:
-  # FR-79 SLA guardrails
-  row_latency_p95_sec: 45.0
-  memory_ceiling_mb: 2048
-  throughput_rows_per_min: 3.0
-
-agentic:
-  # Agentic investigation mode (Phase 41)
-  # When enabled, CodeAnalysisAgent can dynamically explore repository files
-  # using bounded, read-only tools (list_directory, read_file, grep_search)
-  enabled: true
-  max_turns: 20
-  max_tool_calls: 200
-  tool_timeout_sec: 30
-  max_read_bytes: 200000
-  max_read_lines: 300
-  # safe_extensions:
-  #   - .py
-  #   - .md
-  #   - .json
-  #   - .yaml
-  #   - .toml
-"""
-
-    with open(path, "w") as f:
-        f.write(sample_config)
-
-    logger.info("Created sample config file", path=str(path))
-    return path