@ngocsangairvds/vsaf 3.2.16 → 4.0.0

package/tools/vds-scripts/vds_agent_core/tests/unit/test_profiles.py

@@ -1,1571 +0,0 @@
-"""Tests for vds_agent_core.profiles — Wave 2 full extraction."""
-
-from __future__ import annotations
-
-import os
-import textwrap
-from pathlib import Path
-from typing import Any
-from unittest.mock import patch
-
-import pytest
-
-
-class TestCodexCredentialResolverProtocol:
-    """ConfigHooks Protocol structural conformance."""
-
-    def test_protocol_importable(self) -> None:
-        from vds_agent_core.profiles import CodexCredentialResolver
-
-        assert hasattr(CodexCredentialResolver, "resolve")
-
-    def test_protocol_is_runtime_checkable(self) -> None:
-        from vds_agent_core.profiles import CodexCredentialResolver
-
-        class _Good:
-            def resolve(self, field: str) -> str:
-                return field
-
-        class _Bad:
-            pass
-
-        assert isinstance(_Good(), CodexCredentialResolver)
-        assert not isinstance(_Bad(), CodexCredentialResolver)
-
-    def test_protocol_structural_match(self) -> None:
-        """A class with the right method satisfies the protocol without inheriting."""
-        from vds_agent_core.profiles import CodexCredentialResolver
-
-        class MyResolver:
-            def resolve(self, field: str) -> str:
-                return f"resolved:{field}"
-
-        resolver = MyResolver()
-        assert isinstance(resolver, CodexCredentialResolver)
-        assert resolver.resolve("access_token") == "resolved:access_token"
-
-
-class TestDefaultRuntimeProfilesFileExport:
-    def test_exported_from_package_root(self) -> None:
-        from vds_agent_core import DEFAULT_RUNTIME_PROFILES_FILE
-
-        assert isinstance(DEFAULT_RUNTIME_PROFILES_FILE, Path)
-        assert DEFAULT_RUNTIME_PROFILES_FILE.name == "audit.profiles.yaml"
-
-
-class TestRuntimeProfileActivation:
-    """RuntimeProfileActivation dataclass."""
-
-    def test_importable(self) -> None:
-        from vds_agent_core.profiles import RuntimeProfileActivation
-
-        activation = RuntimeProfileActivation(
-            profile_name="test",
-            source="cli",
-            profile_path=Path("/tmp/test.yaml"),
-            applied_env_keys=("KEY_A", "KEY_B"),
-        )
-        assert activation.profile_name == "test"
-        assert activation.source == "cli"
-        assert activation.applied_env_keys == ("KEY_A", "KEY_B")
-
-    def test_none_profile(self) -> None:
-        from vds_agent_core.profiles import RuntimeProfileActivation
-
-        activation = RuntimeProfileActivation(
-            profile_name=None,
-            source="none",
-            profile_path=Path("/tmp/test.yaml"),
-            applied_env_keys=(),
-        )
-        assert activation.profile_name is None
-        assert activation.source == "none"
-
-
-class TestApplyRuntimeProfile:
-    """apply_runtime_profile with full extraction mechanics."""
-
-    def test_importable(self) -> None:
-        from vds_agent_core.profiles import apply_runtime_profile
-
-        assert callable(apply_runtime_profile)
-
-    def test_none_profile_no_yaml(self, tmp_path: Path) -> None:
-        """None profile with no YAML file returns source=none."""
-        from vds_agent_core.profiles import apply_runtime_profile
-
-        fake_yaml = tmp_path / "profiles.yaml"
-        with patch.dict(os.environ, {"VDS_AUDIT_RUNTIME_PROFILES_FILE": str(fake_yaml)}, clear=False):
-            result = apply_runtime_profile(None)
-            assert result.profile_name is None
-            assert result.source == "none"
-            assert result.applied_env_keys == ()
-
-    def test_default_profile_from_yaml(self, tmp_path: Path) -> None:
-        """Default profile is loaded when no explicit profile is requested."""
-        from vds_agent_core.profiles import apply_runtime_profile
-
-        yaml_content = textwrap.dedent("""            default_profile: my-default
-            profiles:
-              my-default:
-                env:
-                  MY_CUSTOM_KEY: hello
-        """)
-        yaml_file = tmp_path / "profiles.yaml"
-        yaml_file.write_text(yaml_content, encoding="utf-8")
-
-        env_patch = {"VDS_AUDIT_RUNTIME_PROFILES_FILE": str(yaml_file)}
-        with patch.dict(os.environ, env_patch, clear=False):
-            os.environ.pop("MY_CUSTOM_KEY", None)
-            result = apply_runtime_profile(None)
-            assert result.profile_name == "my-default"
-            assert result.source == "default"
-            assert "MY_CUSTOM_KEY" in result.applied_env_keys
-            assert os.environ.get("MY_CUSTOM_KEY") == "hello"
-
-    def test_explicit_profile_from_yaml(self, tmp_path: Path) -> None:
-        """Explicit profile name overrides default."""
-        from vds_agent_core.profiles import apply_runtime_profile
-
-        yaml_content = textwrap.dedent("""            default_profile: default-one
-            profiles:
-              default-one:
-                env:
-                  TEST_KEY_A: from-default
-              explicit-one:
-                env:
-                  TEST_KEY_B: from-explicit
-        """)
-        yaml_file = tmp_path / "profiles.yaml"
-        yaml_file.write_text(yaml_content, encoding="utf-8")
-
-        with patch.dict(os.environ, {"VDS_AUDIT_RUNTIME_PROFILES_FILE": str(yaml_file)}, clear=False):
-            os.environ.pop("TEST_KEY_A", None)
-            os.environ.pop("TEST_KEY_B", None)
-            result = apply_runtime_profile("explicit-one")
-            assert result.profile_name == "explicit-one"
-            assert result.source == "cli"
-            assert "TEST_KEY_B" in result.applied_env_keys
-            assert os.environ.get("TEST_KEY_B") == "from-explicit"
-
-    def test_missing_profile_raises(self, tmp_path: Path) -> None:
-        """Requesting a non-existent profile raises ValueError."""
-        from vds_agent_core.profiles import apply_runtime_profile
-
-        yaml_content = textwrap.dedent("""            profiles:
-              existing:
-                env:
-                  X: Y
-        """)
-        yaml_file = tmp_path / "profiles.yaml"
-        yaml_file.write_text(yaml_content, encoding="utf-8")
-
-        with patch.dict(os.environ, {"VDS_AUDIT_RUNTIME_PROFILES_FILE": str(yaml_file)}, clear=False):
-            with pytest.raises(ValueError, match="was not found"):
-                apply_runtime_profile("nonexistent")
-
-    def test_custom_env_prefix(self, tmp_path: Path) -> None:
-        """Custom env_prefix replaces VDS_AUDIT_ in env key mapping."""
-        from vds_agent_core.profiles import apply_runtime_profile
-
-        yaml_content = textwrap.dedent("""            profiles:
-              test-profile:
-                retry_policy:
-                  agent_retries: 3
-        """)
-        yaml_file = tmp_path / "profiles.yaml"
-        yaml_file.write_text(yaml_content, encoding="utf-8")
-
-        with patch.dict(os.environ, {"VDS_AUDIT_RUNTIME_PROFILES_FILE": str(yaml_file)}, clear=False):
-            # Clear any pre-existing keys
-            for k in list(os.environ):
-                if k.startswith("VDS_PROGRESS_"):
-                    os.environ.pop(k, None)
-            result = apply_runtime_profile(
-                "test-profile",
-                env_prefix="VDS_PROGRESS_",
-            )
-            assert result.profile_name == "test-profile"
-            assert "VDS_PROGRESS_LLM__AGENT_RETRIES" in result.applied_env_keys
-            assert os.environ.get("VDS_PROGRESS_LLM__AGENT_RETRIES") == "3"
-
-    def test_config_hooks_accepted(self, tmp_path: Path) -> None:
-        """config_hooks parameter is accepted and functional."""
-        from vds_agent_core.profiles import ConfigHooks, apply_runtime_profile
-
-        class _TrackingHooks:
-            def __init__(self) -> None:
-                self.calls: list[str] = []
-
-            def get_config(self) -> Any:
-                self.calls.append("get")
-                return {}
-
-            def set_config(self, cfg: Any) -> None:
-                self.calls.append("set")
-
-            def reset_config(self) -> None:
-                self.calls.append("reset")
-
-        hooks = _TrackingHooks()
-        assert isinstance(hooks, ConfigHooks)
-
-        yaml_content = textwrap.dedent("""            profiles:
-              hook-test:
-                env:
-                  HOOK_TEST_KEY: value
-        """)
-        yaml_file = tmp_path / "profiles.yaml"
-        yaml_file.write_text(yaml_content, encoding="utf-8")
-
-        with patch.dict(os.environ, {"VDS_AUDIT_RUNTIME_PROFILES_FILE": str(yaml_file)}, clear=False):
-            os.environ.pop("HOOK_TEST_KEY", None)
-            result = apply_runtime_profile("hook-test", _config_hooks=hooks)
-            assert result.profile_name == "hook-test"
-
-    def test_force_override(self, tmp_path: Path) -> None:
-        """force_override=True overwrites existing env vars."""
-        from vds_agent_core.profiles import apply_runtime_profile
-
-        yaml_content = textwrap.dedent("""            profiles:
-              override-test:
-                env:
-                  OVERRIDE_KEY: new-value
-        """)
-        yaml_file = tmp_path / "profiles.yaml"
-        yaml_file.write_text(yaml_content, encoding="utf-8")
-
-        with patch.dict(
-            os.environ,
-            {
-                "VDS_AUDIT_RUNTIME_PROFILES_FILE": str(yaml_file),
-                "OVERRIDE_KEY": "old-value",
-            },
-            clear=False,
-        ):
-            result = apply_runtime_profile("override-test", force_override=True)
-            assert os.environ.get("OVERRIDE_KEY") == "new-value"
-            assert "OVERRIDE_KEY" in result.applied_env_keys
-
-
-class TestBuildLlmSettingsForProfile:
-    """build_llm_settings_for_profile with config_hooks."""
-
-    def test_with_config_hooks_and_factory(self, tmp_path: Path) -> None:
-        """Config hooks are called during build, factory produces settings."""
-        from vds_agent_core.profiles import build_llm_settings_for_profile
-
-        yaml_content = textwrap.dedent("""            profiles:
-              build-test:
-                env:
-                  BUILD_TEST_MARKER: active
-        """)
-        yaml_file = tmp_path / "profiles.yaml"
-        yaml_file.write_text(yaml_content, encoding="utf-8")
-
-        class _MockHooks:
-            def __init__(self) -> None:
-                self.calls: list[str] = []
-
-            def get_config(self) -> Any:
-                self.calls.append("get")
-                return {"original": True}
-
-            def set_config(self, cfg: Any) -> None:
-                self.calls.append(f"set:{cfg}")
-
-            def reset_config(self) -> None:
-                self.calls.append("reset")
-
-        hooks = _MockHooks()
-
-        with patch.dict(os.environ, {"VDS_AUDIT_RUNTIME_PROFILES_FILE": str(yaml_file)}, clear=False):
-            result = build_llm_settings_for_profile(
-                "build-test",
-                config_hooks=hooks,
-                settings_factory=lambda: {"built": True},
-            )
-
-        assert result == {"built": True}
-        assert "get" in hooks.calls
-        assert "reset" in hooks.calls
-        assert any(c.startswith("set:") for c in hooks.calls)
-
-    def test_without_factory_returns_none(self, tmp_path: Path) -> None:
-        """Without settings_factory, returns None."""
-        from vds_agent_core.profiles import build_llm_settings_for_profile
-
-        yaml_content = textwrap.dedent("""            profiles:
-              no-factory:
-                env:
-                  NF_KEY: val
-        """)
-        yaml_file = tmp_path / "profiles.yaml"
-        yaml_file.write_text(yaml_content, encoding="utf-8")
-
-        with patch.dict(os.environ, {"VDS_AUDIT_RUNTIME_PROFILES_FILE": str(yaml_file)}, clear=False):
-            result = build_llm_settings_for_profile("no-factory")
-
-        assert result is None
-
-
-class TestEnvMaps:
-    """_EnvMaps prefix substitution."""
-
-    def test_default_prefix(self) -> None:
-        from vds_agent_core.profiles import _EnvMaps
-
-        maps = _EnvMaps("VDS_AUDIT_")
-        assert maps.retry["agent_retries"] == "VDS_AUDIT_LLM__AGENT_RETRIES"
-        assert maps.active_profile_env == "VDS_AUDIT_ACTIVE_PROFILE"
-
-    def test_custom_prefix(self) -> None:
-        from vds_agent_core.profiles import _EnvMaps
-
-        maps = _EnvMaps("VDS_PROGRESS_")
-        assert maps.retry["agent_retries"] == "VDS_PROGRESS_LLM__AGENT_RETRIES"
-        assert maps.active_profile_env == "VDS_PROGRESS_ACTIVE_PROFILE"
-        assert maps.model_llm["type"] == "VDS_PROGRESS_LLM_PROTOCOL"
-        assert maps.model_dspy["model"] == "VDS_PROGRESS_DSPY_MODEL"
-
-
-class TestProfileProtectedEnvKeys:
-    """profile_protected_env_keys with prefix."""
-
-    def test_default_prefix(self) -> None:
-        from vds_agent_core.profiles import profile_protected_env_keys
-
-        keys = profile_protected_env_keys()
-        assert "VDS_AUDIT_LLM_PROTOCOL" in keys
-        assert "VDS_AUDIT_LLM__API_KEY" in keys
-
-    def test_custom_prefix(self) -> None:
-        from vds_agent_core.profiles import profile_protected_env_keys
-
-        keys = profile_protected_env_keys(env_prefix="VDS_PROGRESS_")
-        assert "VDS_PROGRESS_LLM_PROTOCOL" in keys
-        assert "VDS_PROGRESS_LLM__API_KEY" in keys
-        assert "VDS_AUDIT_LLM_PROTOCOL" not in keys
-
-
-class TestResolveAgenticToolFirstScalar:
-    """resolve_agentic_tool_first_scalar with custom prefix."""
-
-    def test_default_returns_default(self) -> None:
-        from vds_agent_core.profiles import resolve_agentic_tool_first_scalar
-
-        os.environ.pop("VDS_AUDIT_AGENTIC_TOOL_FIRST_MAX_STEPS", None)
-        result = resolve_agentic_tool_first_scalar("tool_first_max_steps", default=10)
-        assert result == 10
-
-    def test_custom_prefix(self) -> None:
-        from vds_agent_core.profiles import resolve_agentic_tool_first_scalar
-
-        os.environ["VDS_PROGRESS_AGENTIC_TOOL_FIRST_MAX_STEPS"] = "25"
-        try:
-            result = resolve_agentic_tool_first_scalar(
-                "tool_first_max_steps",
-                default=10,
-                env_prefix="VDS_PROGRESS_",
-            )
-            assert result == 25
-        finally:
-            os.environ.pop("VDS_PROGRESS_AGENTIC_TOOL_FIRST_MAX_STEPS", None)
-
-
-class TestRealProfileIntegration:
-    """Integration tests using the real ~/.vds/audit.profiles.yaml file.
-
-    These tests exercise the actual YAML loading and env mutation paths
-    that unit tests with mocks cannot cover.
-    """
-
-    def test_resolve_runtime_profiles_path_finds_real_file(self) -> None:
-        from vds_agent_core.profiles import resolve_runtime_profiles_path
-
-        path = resolve_runtime_profiles_path()
-        assert path is not None
-        assert path.exists(), f"Profile file not found at {path}"
-        assert path.suffix == ".yaml"
-
-    def test_list_runtime_profile_names_returns_profiles(self) -> None:
-        from vds_agent_core.profiles import list_runtime_profile_names
-
-        names = list_runtime_profile_names()
-        assert isinstance(names, list)
-        assert len(names) > 0, "Expected at least one profile"
-
-    def test_apply_runtime_profile_none_is_noop(self) -> None:
-        """Applying None profile should not raise and return activation."""
-        from vds_agent_core.profiles import RuntimeProfileActivation, apply_runtime_profile
-
-        result = apply_runtime_profile(None)
-        assert result is not None
-        assert isinstance(result, RuntimeProfileActivation)
-
-    def test_apply_runtime_profile_default_profile(self) -> None:
-        """Apply the default profile from the real YAML file."""
-        import os
-
-        from vds_agent_core.profiles import RuntimeProfileActivation, apply_runtime_profile
-
-        # Save and restore env state
-        saved = {k: v for k, v in os.environ.items() if k.startswith("VDS_AUDIT_")}
-        try:
-            result = apply_runtime_profile("omniroute-dlg1-gpt-openai")
-            assert result is not None
-            assert isinstance(result, RuntimeProfileActivation)
-        finally:
-            # Restore env
-            for k in list(os.environ.keys()):
-                if k.startswith("VDS_AUDIT_") and k not in saved:
-                    del os.environ[k]
-            for k, v in saved.items():
-                os.environ[k] = v
-
-    def test_apply_runtime_profile_unknown_profile_raises(self) -> None:
-        """Applying an unknown profile name should raise ValueError."""
-        import pytest
-        from vds_agent_core.profiles import apply_runtime_profile
-
-        with pytest.raises((ValueError, KeyError, Exception)):
-            apply_runtime_profile("nonexistent-profile-xyz-12345")
-
-    def test_profile_sets_env_vars(self) -> None:
-        """Applying a real profile should set VDS_AUDIT_* env vars."""
-        import os
-
-        from vds_agent_core.profiles import apply_runtime_profile
-
-        saved = {k: v for k, v in os.environ.items() if k.startswith("VDS_AUDIT_")}
-        try:
-            apply_runtime_profile("omniroute-dlg1-gpt-openai")
-            # After applying, at least the active profile env var should be set
-            active = os.environ.get("VDS_AUDIT_ACTIVE_PROFILE")
-            assert active == "omniroute-dlg1-gpt-openai", f"Expected active profile, got {active}"
-        finally:
-            for k in list(os.environ.keys()):
-                if k.startswith("VDS_AUDIT_") and k not in saved:
-                    del os.environ[k]
-            for k, v in saved.items():
-                os.environ[k] = v
-
-    def test_apply_runtime_profile_custom_env_prefix(self) -> None:
-        """env_prefix parameter should be accepted without error."""
-        from vds_agent_core.profiles import apply_runtime_profile
-
-        # Just verify it accepts the parameter — don't check env mutation
-        # since VDS_PROGRESS_ prefix won't match the YAML profile keys
-        result = apply_runtime_profile(None, env_prefix="VDS_PROGRESS_")
-        assert result is not None
-
-
-class TestRealProfilePolicyApplication:
-    """Tests that verify policy application helpers are exercised via real profiles."""
-
-    def _apply_and_restore(self, profile_name: str) -> dict:
-        """Apply profile, capture env changes, restore env."""
-        import os
-
-        from vds_agent_core.profiles import apply_runtime_profile
-
-        saved = {k: v for k, v in os.environ.items() if k.startswith("VDS_AUDIT_")}
-        try:
-            apply_runtime_profile(profile_name)
-            applied = {k: v for k, v in os.environ.items() if k.startswith("VDS_AUDIT_")}
-            return applied
-        finally:
-            for k in list(os.environ.keys()):
-                if k.startswith("VDS_AUDIT_") and k not in saved:
-                    del os.environ[k]
-            for k, v in saved.items():
-                os.environ[k] = v
-
-    def test_model_policy_sets_llm_enabled(self) -> None:
-        """Profile with env.VDS_AUDIT_LLM_ENABLED should set it."""
-        applied = self._apply_and_restore("omniroute-dlg1-gpt-openai")
-        assert applied.get("VDS_AUDIT_LLM_ENABLED") == "true"
-
-    def test_model_policy_sets_api_key_env(self) -> None:
-        """Profile with env.VDS_AUDIT_LLM__API_KEY should set it."""
-        applied = self._apply_and_restore("omniroute-dlg1-gpt-openai")
-        # Key may be set to the literal ${OMNIROUTE_API_KEY} or resolved value
-        assert "VDS_AUDIT_LLM__API_KEY" in applied or "VDS_AUDIT_LLM_ENABLED" in applied
-
-    def test_model_policy_sets_max_tokens(self) -> None:
-        """Profile env.VDS_AUDIT_LLM__MAX_TOKENS_PER_REQUEST should be applied."""
-        applied = self._apply_and_restore("omniroute-dlg1-gpt-openai")
-        assert applied.get("VDS_AUDIT_LLM__MAX_TOKENS_PER_REQUEST") == "24000"
-
-    def test_model_policy_sets_agent_retries(self) -> None:
-        """Profile env.VDS_AUDIT_LLM__AGENT_RETRIES should be applied."""
-        applied = self._apply_and_restore("omniroute-dlg1-gpt-openai")
-        assert applied.get("VDS_AUDIT_LLM__AGENT_RETRIES") == "2"
-
-    def test_model_policy_sets_skills_toolset(self) -> None:
-        """Profile env.VDS_AUDIT_LLM__SKILLS_TOOLSET_ENABLED should be applied."""
-        applied = self._apply_and_restore("omniroute-dlg1-gpt-openai")
-        assert applied.get("VDS_AUDIT_LLM__SKILLS_TOOLSET_ENABLED") == "true"
-
-    def test_active_profile_env_var_set(self) -> None:
-        """VDS_AUDIT_ACTIVE_PROFILE should be set to the applied profile name."""
-        applied = self._apply_and_restore("omniroute-dlg1-gpt-openai")
-        assert applied.get("VDS_AUDIT_ACTIVE_PROFILE") == "omniroute-dlg1-gpt-openai"
-
-    def test_build_llm_settings_for_profile(self) -> None:
-        """build_llm_settings_for_profile should not raise for a valid profile."""
-        from vds_agent_core.profiles import build_llm_settings_for_profile
-
-        # May return None if no settings_factory is provided — just verify no exception
-        try:
-            build_llm_settings_for_profile("omniroute-dlg1-gpt-openai")
-        except Exception as e:
-            # Only fail if it's not a missing-factory type error
-            if "settings_factory" not in str(e) and "factory" not in str(e).lower():
-                raise
-
-    def test_inherit_runtime_llm_policy(self) -> None:
-        """inherit_runtime_llm_policy should not raise for a valid profile."""
-        import os
-
-        from vds_agent_core.profiles import inherit_runtime_llm_policy
-
-        saved = {k: v for k, v in os.environ.items() if k.startswith("VDS_AUDIT_")}
-        try:
-            # inherit_runtime_llm_policy requires profile_name as first arg
-            try:
-                inherit_runtime_llm_policy("omniroute-dlg1-gpt-openai")
-            except Exception as e:
-                # Only fail if it is not a missing-factory type error
-                if "settings_factory" not in str(e) and "factory" not in str(e).lower():
-                    raise
-        finally:
-            for k in list(os.environ.keys()):
-                if k.startswith("VDS_AUDIT_") and k not in saved:
-                    del os.environ[k]
-            for k, v in saved.items():
-                os.environ[k] = v
-
-
-class TestResolveDefaultFailoverProfiles:
-    """resolve_default_failover_profiles returns other profiles excluding active."""
-
-    def test_excludes_active_profile(self) -> None:
-        from vds_agent_core.profiles import resolve_default_failover_profiles
-
-        all_profiles = ["profile-a", "profile-b", "profile-c"]
-        result = resolve_default_failover_profiles("profile-a", all_profiles=all_profiles)
-        assert "profile-a" not in result
-        assert "profile-b" in result
-        assert "profile-c" in result
-
-    def test_none_active_returns_all(self) -> None:
-        from vds_agent_core.profiles import resolve_default_failover_profiles
-
-        all_profiles = ["profile-a", "profile-b"]
-        result = resolve_default_failover_profiles(None, all_profiles=all_profiles)
-        assert result == ["profile-a", "profile-b"]
-
-    def test_empty_all_profiles_returns_empty(self) -> None:
-        from vds_agent_core.profiles import resolve_default_failover_profiles
-
-        result = resolve_default_failover_profiles("profile-a", all_profiles=[])
-        assert result == []
-
-    def test_deduplicates_profiles(self) -> None:
-        from vds_agent_core.profiles import resolve_default_failover_profiles
-
-        all_profiles = ["profile-a", "profile-b", "profile-b", "profile-c"]
-        result = resolve_default_failover_profiles("profile-a", all_profiles=all_profiles)
-        assert result.count("profile-b") == 1
-
-
-class TestListRuntimeProfileNames:
-    """list_runtime_profile_names returns names from YAML."""
-
-    def test_returns_list_from_yaml(self, tmp_path: Path) -> None:
-        import textwrap
-        from unittest.mock import patch
-
-        from vds_agent_core.profiles import list_runtime_profile_names
-
-        yaml_content = textwrap.dedent("""
-            profiles:
-              alpha:
-                env:
-                  KEY_A: val
-              beta:
-                env:
-                  KEY_B: val
-        """)
-        yaml_file = tmp_path / "profiles.yaml"
-        yaml_file.write_text(yaml_content, encoding="utf-8")
-
-        with patch.dict(os.environ, {"VDS_AUDIT_RUNTIME_PROFILES_FILE": str(yaml_file)}, clear=False):
-            names = list_runtime_profile_names()
-
-        assert "alpha" in names
-        assert "beta" in names
-
-    def test_missing_file_returns_empty(self, tmp_path: Path) -> None:
-        from unittest.mock import patch
-
-        from vds_agent_core.profiles import list_runtime_profile_names
-
-        missing = tmp_path / "nonexistent.yaml"
-        with patch.dict(os.environ, {"VDS_AUDIT_RUNTIME_PROFILES_FILE": str(missing)}, clear=False):
-            names = list_runtime_profile_names()
-
-        assert names == []
-
-
-class TestEnvMapsCustomPrefix:
-    """_EnvMaps with non-default prefix replaces VDS_AUDIT_ correctly."""
-
-    def test_model_dspy_prefix_replaced(self) -> None:
-        from vds_agent_core.profiles import _EnvMaps
-
-        maps = _EnvMaps("VDS_PROGRESS_")
-        assert maps.model_dspy["model"] == "VDS_PROGRESS_DSPY_MODEL"
-        assert maps.model_dspy["api_key"] == "VDS_PROGRESS_DSPY_API_KEY"
-
-    def test_timeout_prefix_replaced(self) -> None:
-        from vds_agent_core.profiles import _EnvMaps
-
-        maps = _EnvMaps("VDS_PROGRESS_")
-        assert maps.timeout["agent_timeout_seconds"] == "VDS_PROGRESS_LLM__AGENT_TIMEOUT_SECONDS"
-
-    def test_agentic_tool_first_prefix_replaced(self) -> None:
-        from vds_agent_core.profiles import _EnvMaps
-
-        maps = _EnvMaps("VDS_PROGRESS_")
-        assert maps.agentic_tool_first["tool_first_max_steps"] == "VDS_PROGRESS_AGENTIC_TOOL_FIRST_MAX_STEPS"
-
-
-class TestModelPolicyViaYaml:
-    """Tests for model policy helpers exercised via apply_runtime_profile with crafted YAML."""
-
-    def _apply(self, tmp_path: Path, yaml_content: str, profile: str = "test-profile", **kwargs: Any) -> Any:
-        from vds_agent_core.profiles import apply_runtime_profile
-
-        yaml_file = tmp_path / "profiles.yaml"
-        yaml_file.write_text(textwrap.dedent(yaml_content), encoding="utf-8")
-        with patch.dict(os.environ, {"VDS_AUDIT_RUNTIME_PROFILES_FILE": str(yaml_file)}, clear=False):
-            # Clear any pre-existing VDS_AUDIT_ keys that might interfere
-            saved = {k: v for k, v in os.environ.items() if k.startswith("VDS_AUDIT_")}
-            for k in list(saved):
-                if k != "VDS_AUDIT_RUNTIME_PROFILES_FILE":
-                    os.environ.pop(k, None)
-            try:
-                return apply_runtime_profile(profile, force_override=True, **kwargs)
-            finally:
-                for k in list(os.environ.keys()):
-                    if k.startswith("VDS_AUDIT_") and k not in saved:
-                        os.environ.pop(k, None)
-                for k, v in saved.items():
-                    os.environ[k] = v
-
-    def test_model_llm_type_applied(self, tmp_path: Path) -> None:
-        """model.llm.type sets VDS_AUDIT_LLM_PROTOCOL."""
-        result = self._apply(
-            tmp_path,
-            """
-            profiles:
-              test-profile:
-                model:
-                  llm:
-                    type: openai
-                    base_url: http://localhost:4000
-                    api_key: sk-test
-        """,
-        )
-        assert result.profile_name == "test-profile"
-        assert "VDS_AUDIT_LLM_PROTOCOL" in result.applied_env_keys
-
-    def test_model_llm_stream_applied(self, tmp_path: Path) -> None:
-        """model.llm.stream sets VDS_AUDIT_LLM__STREAM."""
-        result = self._apply(
-            tmp_path,
-            """
-            profiles:
-              test-profile:
-                model:
-                  llm:
-                    type: openai
-                    base_url: http://localhost:4000
-                    api_key: sk-test
-                    stream: true
-        """,
-        )
-        assert "VDS_AUDIT_LLM__STREAM" in result.applied_env_keys
-
-    def test_model_llm_invalid_type_raises(self, tmp_path: Path) -> None:
-        """model.llm.type with unsupported protocol raises ValueError."""
-        from vds_agent_core.profiles import apply_runtime_profile
-
-        yaml_content = textwrap.dedent("""
-            profiles:
-              test-profile:
-                model:
-                  llm:
-                    type: unsupported-protocol
-                    base_url: http://localhost:4000
-                    api_key: sk-test
-        """)
-        yaml_file = tmp_path / "profiles.yaml"
-        yaml_file.write_text(yaml_content, encoding="utf-8")
-        with patch.dict(os.environ, {"VDS_AUDIT_RUNTIME_PROFILES_FILE": str(yaml_file)}, clear=False):
-            with pytest.raises(ValueError, match=r"invalid model\.llm\.type"):
-                apply_runtime_profile("test-profile", force_override=True)
-
-    def test_model_llm_reasoning_effort_applied(self, tmp_path: Path) -> None:
-        """model.llm.reasoning_effort sets VDS_AUDIT_LLM__REASONING_EFFORT."""
-        result = self._apply(
-            tmp_path,
-            """
-            profiles:
-              test-profile:
-                model:
-                  llm:
-                    type: openai
-                    base_url: http://localhost:4000
-                    api_key: sk-test
-                    reasoning_effort: high
-        """,
-        )
-        assert "VDS_AUDIT_LLM__REASONING_EFFORT" in result.applied_env_keys
-
-    def test_model_llm_invalid_reasoning_effort_raises(self, tmp_path: Path) -> None:
-        """model.llm.reasoning_effort with invalid value raises ValueError."""
-        from vds_agent_core.profiles import apply_runtime_profile
-
-        yaml_content = textwrap.dedent("""
-            profiles:
-              test-profile:
-                model:
-                  llm:
-                    type: openai
-                    base_url: http://localhost:4000
-                    api_key: sk-test
-                    reasoning_effort: ultra
-        """)
-        yaml_file = tmp_path / "profiles.yaml"
-        yaml_file.write_text(yaml_content, encoding="utf-8")
-        with patch.dict(os.environ, {"VDS_AUDIT_RUNTIME_PROFILES_FILE": str(yaml_file)}, clear=False):
-            with pytest.raises(ValueError, match="reasoning_effort"):
-                apply_runtime_profile("test-profile", force_override=True)
-
-    def test_model_llm_row_failover_profiles_string(self, tmp_path: Path) -> None:
-        """model.llm.row_failover_profiles as comma-string sets env var."""
-        # Note: list form is not used here because the generic tier loop in
-        # _apply_profile_model_policy also processes row_failover_profiles as a
-        # string field — using a string value avoids the conflict.
-        result = self._apply(
-            tmp_path,
-            """
-            profiles:
-              test-profile:
-                model:
-                  llm:
-                    type: openai
-                    base_url: http://localhost:4000
-                    api_key: sk-test
-                    row_failover_profiles: "profile-b,profile-c"
-        """,
-        )
-        assert "VDS_AUDIT_LLM__ROW_FAILOVER_PROFILES" in result.applied_env_keys
-
-    def test_model_llm_model_shorthand_sets_all_tiers(self, tmp_path: Path) -> None:
-        """model.llm.model shorthand sets simple/standard/complex tiers."""
-        result = self._apply(
-            tmp_path,
-            """
-            profiles:
-              test-profile:
-                model:
-                  llm:
-                    type: openai
-                    base_url: http://localhost:4000
-                    api_key: sk-test
-                    model: gpt-4o
-        """,
-        )
-        assert "VDS_AUDIT_LLM__MODEL_STANDARD" in result.applied_env_keys
-        assert "VDS_AUDIT_LLM__MODEL_SIMPLE" in result.applied_env_keys
-        assert "VDS_AUDIT_LLM__MODEL_COMPLEX" in result.applied_env_keys
-
-    def test_model_dspy_type_and_model_applied(self, tmp_path: Path) -> None:
-        """model.dspy.type and model set DSPy env vars."""
-        result = self._apply(
-            tmp_path,
-            """
-            profiles:
-              test-profile:
-                model:
-                  llm:
-                    type: openai
-                    base_url: http://localhost:4000
-                    api_key: sk-test
-                  dspy:
-                    type: openai
-                    model: openai/gpt-4o
-                    api_key: sk-dspy
-        """,
-        )
-        assert "VDS_AUDIT_DSPY_PROTOCOL" in result.applied_env_keys
-        assert "VDS_AUDIT_DSPY_MODEL" in result.applied_env_keys
-
-    def test_model_dspy_invalid_type_raises(self, tmp_path: Path) -> None:
-        """model.dspy.type with unsupported protocol raises ValueError."""
-        from vds_agent_core.profiles import apply_runtime_profile
-
-        yaml_content = textwrap.dedent("""
-            profiles:
-              test-profile:
-                model:
-                  dspy:
-                    type: bad-protocol
-                    model: gpt-4o
-        """)
-        yaml_file = tmp_path / "profiles.yaml"
-        yaml_file.write_text(yaml_content, encoding="utf-8")
-        with patch.dict(os.environ, {"VDS_AUDIT_RUNTIME_PROFILES_FILE": str(yaml_file)}, clear=False):
-            with pytest.raises(ValueError, match=r"invalid model\.dspy\.type"):
-                apply_runtime_profile("test-profile", force_override=True)
-
-    def test_model_embedding_applied(self, tmp_path: Path) -> None:
-        """model.embedding fields set embedding env vars."""
-        result = self._apply(
-            tmp_path,
-            """
-            profiles:
-              test-profile:
-                model:
-                  embedding:
-                    base_url: http://localhost:11434
-                    model: bge-m3
-                    api_key: sk-embed
-        """,
-        )
-        assert "VDS_AUDIT_EMBEDDING__BASE_URL" in result.applied_env_keys
-        assert "VDS_AUDIT_EMBEDDING__MODEL" in result.applied_env_keys
-
-    def test_model_llm_unknown_key_raises(self, tmp_path: Path) -> None:
-        """model.llm with unknown key raises ValueError."""
-        from vds_agent_core.profiles import apply_runtime_profile
-
-        yaml_content = textwrap.dedent("""
-            profiles:
-              test-profile:
-                model:
-                  llm:
-                    type: openai
-                    unknown_field: bad
-        """)
-        yaml_file = tmp_path / "profiles.yaml"
-        yaml_file.write_text(yaml_content, encoding="utf-8")
-        with patch.dict(os.environ, {"VDS_AUDIT_RUNTIME_PROFILES_FILE": str(yaml_file)}, clear=False):
-            with pytest.raises(ValueError, match=r"invalid model\.llm keys"):
-                apply_runtime_profile("test-profile", force_override=True)
-
-
-class TestSkillPolicyViaYaml:
-    """Tests for skill_policy helpers exercised via apply_runtime_profile."""
-
-    def _apply(self, tmp_path: Path, yaml_content: str) -> Any:
-        from vds_agent_core.profiles import apply_runtime_profile
-
-        yaml_file = tmp_path / "profiles.yaml"
-        yaml_file.write_text(textwrap.dedent(yaml_content), encoding="utf-8")
-        saved = {k: v for k, v in os.environ.items() if k.startswith("VDS_AUDIT_")}
-        with patch.dict(os.environ, {"VDS_AUDIT_RUNTIME_PROFILES_FILE": str(yaml_file)}, clear=False):
-            for k in list(saved):
-                if k != "VDS_AUDIT_RUNTIME_PROFILES_FILE":
-                    os.environ.pop(k, None)
-            try:
-                return apply_runtime_profile("test-profile", force_override=True)
-            finally:
-                for k in list(os.environ.keys()):
-                    if k.startswith("VDS_AUDIT_") and k not in saved:
-                        os.environ.pop(k, None)
-                for k, v in saved.items():
-                    os.environ[k] = v
-
-    def test_skill_policy_enabled_applied(self, tmp_path: Path) -> None:
-        """skill_policy.enabled sets VDS_AUDIT_LLM__SKILLS_TOOLSET_ENABLED."""
-        result = self._apply(
-            tmp_path,
-            """
-            profiles:
-              test-profile:
-                skill_policy:
-                  enabled: true
-        """,
-        )
-        assert "VDS_AUDIT_LLM__SKILLS_TOOLSET_ENABLED" in result.applied_env_keys
-
-    def test_skill_policy_allow_script_execution(self, tmp_path: Path) -> None:
-        """skill_policy.allow_script_execution sets env var."""
-        result = self._apply(
-            tmp_path,
-            """
-            profiles:
-              test-profile:
-                skill_policy:
-                  allow_script_execution: false
-        """,
-        )
-        assert "VDS_AUDIT_LLM__SKILLS_ALLOW_SCRIPT_EXECUTION" in result.applied_env_keys
-
-    def test_skill_policy_default_trust_tier(self, tmp_path: Path) -> None:
-        """skill_policy.default_trust_tier sets env var."""
-        result = self._apply(
-            tmp_path,
-            """
-            profiles:
-              test-profile:
-                skill_policy:
-                  default_trust_tier: internal
-        """,
-        )
-        assert "VDS_AUDIT_LLM__SKILLS_DEFAULT_TRUST_TIER" in result.applied_env_keys
-
-    def test_skill_policy_invalid_trust_tier_raises(self, tmp_path: Path) -> None:
-        """skill_policy.default_trust_tier with invalid value raises ValueError."""
-        from vds_agent_core.profiles import apply_runtime_profile
-
-        yaml_content = textwrap.dedent("""
-            profiles:
-              test-profile:
-                skill_policy:
-                  default_trust_tier: super-trusted
-        """)
-        yaml_file = tmp_path / "profiles.yaml"
-        yaml_file.write_text(yaml_content, encoding="utf-8")
-        with patch.dict(os.environ, {"VDS_AUDIT_RUNTIME_PROFILES_FILE": str(yaml_file)}, clear=False):
-            with pytest.raises(ValueError):
-                apply_runtime_profile("test-profile", force_override=True)
-
-    def test_skill_policy_allowlist_applied(self, tmp_path: Path) -> None:
-        """skill_policy.allowlist sets VDS_AUDIT_LLM__SKILLS_ALLOWLIST."""
-        result = self._apply(
-            tmp_path,
-            """
-            profiles:
-              test-profile:
-                skill_policy:
-                  allowlist:
-                    - research-skill
-                    - grepai-skill
-        """,
-        )
-        assert "VDS_AUDIT_LLM__SKILLS_ALLOWLIST" in result.applied_env_keys
-
-    def test_skill_policy_allowed_trust_tiers_applied(self, tmp_path: Path) -> None:
-        """skill_policy.allowed_trust_tiers sets env var."""
-        result = self._apply(
-            tmp_path,
-            """
-            profiles:
-              test-profile:
-                skill_policy:
-                  allowed_trust_tiers:
-                    - internal
-                    - external-verified
-        """,
-        )
-        assert "VDS_AUDIT_LLM__SKILLS_ALLOWED_TRUST_TIERS" in result.applied_env_keys
-
-    def test_skill_policy_trust_tiers_map_applied(self, tmp_path: Path) -> None:
-        """skill_policy.trust_tiers map sets env var."""
-        result = self._apply(
-            tmp_path,
-            """
-            profiles:
-              test-profile:
-                skill_policy:
-                  trust_tiers:
-                    research-skill: internal
-                    grepai-skill: external-verified
-        """,
-        )
-        assert "VDS_AUDIT_LLM__SKILLS_TRUST_TIERS" in result.applied_env_keys
-
-    def test_skill_policy_strict_require_effective_skill(self, tmp_path: Path) -> None:
-        """skill_policy.strict_require_effective_skill sets env var."""
-        result = self._apply(
-            tmp_path,
-            """
-            profiles:
-              test-profile:
-                skill_policy:
-                  strict_require_effective_skill: true
-        """,
-        )
-        assert "VDS_AUDIT_AGENTIC_STRICT_REQUIRE_EFFECTIVE_SKILL" in result.applied_env_keys
-
-
-class TestBackendPolicyViaYaml:
-    """Tests for backend_policy helpers exercised via apply_runtime_profile."""
-
-    def _apply(self, tmp_path: Path, yaml_content: str, extra_env: dict | None = None) -> Any:
-        from vds_agent_core.profiles import apply_runtime_profile
-
-        yaml_file = tmp_path / "profiles.yaml"
-        yaml_file.write_text(textwrap.dedent(yaml_content), encoding="utf-8")
-        env_patch = {"VDS_AUDIT_RUNTIME_PROFILES_FILE": str(yaml_file)}
-        if extra_env:
-            env_patch.update(extra_env)
-        saved = {k: v for k, v in os.environ.items() if k.startswith("VDS_AUDIT_")}
-        with patch.dict(os.environ, env_patch, clear=False):
-            for k in list(saved):
-                if k not in ("VDS_AUDIT_RUNTIME_PROFILES_FILE",) and k not in (extra_env or {}):
-                    os.environ.pop(k, None)
-            try:
-                return apply_runtime_profile("test-profile", force_override=True)
-            finally:
-                for k in list(os.environ.keys()):
-                    if k.startswith("VDS_AUDIT_") and k not in saved:
-                        os.environ.pop(k, None)
-                for k, v in saved.items():
-                    os.environ[k] = v
-
-    def test_backend_policy_prompt_evaluator(self, tmp_path: Path) -> None:
-        """backend_policy.backend=prompt_evaluator sets env var."""
-        result = self._apply(
-            tmp_path,
-            """
-            profiles:
-              test-profile:
-                backend_policy:
-                  backend: prompt_evaluator
-        """,
-        )
-        assert "VDS_AUDIT_LLM__ROW_EVALUATION_BACKEND" in result.applied_env_keys
-
-    def test_backend_policy_dspy(self, tmp_path: Path) -> None:
-        """backend_policy.backend=dspy sets env var."""
-        result = self._apply(
-            tmp_path,
-            """
-            profiles:
-              test-profile:
-                backend_policy:
-                  backend: dspy
-        """,
-        )
-        assert "VDS_AUDIT_LLM__ROW_EVALUATION_BACKEND" in result.applied_env_keys
-
-    def test_backend_policy_invalid_backend_raises(self, tmp_path: Path) -> None:
-        """backend_policy.backend with invalid value raises ValueError."""
-        from vds_agent_core.profiles import apply_runtime_profile
-
-        yaml_content = textwrap.dedent("""
-            profiles:
-              test-profile:
-                backend_policy:
-                  backend: unknown-backend
-        """)
-        yaml_file = tmp_path / "profiles.yaml"
-        yaml_file.write_text(yaml_content, encoding="utf-8")
-        with patch.dict(os.environ, {"VDS_AUDIT_RUNTIME_PROFILES_FILE": str(yaml_file)}, clear=False):
-            with pytest.raises(ValueError):
-                apply_runtime_profile("test-profile", force_override=True)
-
-    def test_backend_policy_locked_and_allow_override_raises(self, tmp_path: Path) -> None:
-        """backend_policy locked=true + allow_override=true raises ValueError."""
-        from vds_agent_core.profiles import apply_runtime_profile
-
-        yaml_content = textwrap.dedent("""
-            profiles:
-              test-profile:
-                backend_policy:
-                  backend: prompt_evaluator
-                  locked: true
-                  allow_override: true
-        """)
-        yaml_file = tmp_path / "profiles.yaml"
-        yaml_file.write_text(yaml_content, encoding="utf-8")
-        with patch.dict(os.environ, {"VDS_AUDIT_RUNTIME_PROFILES_FILE": str(yaml_file)}, clear=False):
-            with pytest.raises(ValueError, match="locked=true cannot be combined"):
-                apply_runtime_profile("test-profile", force_override=True)
-
-
-class TestAgenticPolicyViaYaml:
-    """Tests for agentic policy helpers exercised via apply_runtime_profile."""
-
-    def _apply(self, tmp_path: Path, yaml_content: str) -> Any:
-        from vds_agent_core.profiles import apply_runtime_profile
-
-        yaml_file = tmp_path / "profiles.yaml"
-        yaml_file.write_text(textwrap.dedent(yaml_content), encoding="utf-8")
-        saved = {k: v for k, v in os.environ.items() if k.startswith("VDS_AUDIT_")}
-        with patch.dict(os.environ, {"VDS_AUDIT_RUNTIME_PROFILES_FILE": str(yaml_file)}, clear=False):
-            for k in list(saved):
-                if k != "VDS_AUDIT_RUNTIME_PROFILES_FILE":
-                    os.environ.pop(k, None)
-            try:
-                return apply_runtime_profile("test-profile", force_override=True)
-            finally:
-                for k in list(os.environ.keys()):
-                    if k.startswith("VDS_AUDIT_") and k not in saved:
-                        os.environ.pop(k, None)
-                for k, v in saved.items():
-                    os.environ[k] = v
-
-    def test_agentic_non_progress_preset_applied(self, tmp_path: Path) -> None:
-        """agentic.non_progress_preset sets env var."""
-        result = self._apply(
-            tmp_path,
-            """
-            profiles:
-              test-profile:
-                agentic:
-                  non_progress_preset: strict
-        """,
-        )
-        assert "VDS_AUDIT_AGENTIC_NON_PROGRESS_PRESET" in result.applied_env_keys
-
-    def test_agentic_invalid_preset_raises(self, tmp_path: Path) -> None:
-        """agentic.non_progress_preset with invalid value raises ValueError."""
-        from vds_agent_core.profiles import apply_runtime_profile
-
-        yaml_content = textwrap.dedent("""
-            profiles:
-              test-profile:
-                agentic:
-                  non_progress_preset: invalid-preset
-        """)
-        yaml_file = tmp_path / "profiles.yaml"
-        yaml_file.write_text(yaml_content, encoding="utf-8")
-        with patch.dict(os.environ, {"VDS_AUDIT_RUNTIME_PROFILES_FILE": str(yaml_file)}, clear=False):
-            with pytest.raises(ValueError):
-                apply_runtime_profile("test-profile", force_override=True)
-
-    def test_agentic_strict_no_fallback_applied(self, tmp_path: Path) -> None:
-        """agentic.strict_no_fallback sets env var."""
-        result = self._apply(
-            tmp_path,
-            """
-            profiles:
-              test-profile:
-                agentic:
-                  strict_no_fallback: true
-        """,
-        )
-        assert "VDS_AUDIT_AGENTIC_STRICT_NO_FALLBACK" in result.applied_env_keys
-
-    def test_agentic_tool_first_max_steps_applied(self, tmp_path: Path) -> None:
-        """agentic.tool_first_max_steps sets env var."""
-        result = self._apply(
-            tmp_path,
-            """
-            profiles:
-              test-profile:
-                agentic:
-                  tool_first_max_steps: 10
-        """,
-        )
-        assert "VDS_AUDIT_AGENTIC_TOOL_FIRST_MAX_STEPS" in result.applied_env_keys
-
-
-class TestEnvReferenceResolution:
-    """Tests for ${ENV_VAR} and ${codex:...} reference resolution."""
-
-    def test_env_ref_resolved_when_set(self, tmp_path: Path) -> None:
-        """${ENV_VAR} in profile value is resolved from environment."""
-        from vds_agent_core.profiles import apply_runtime_profile
-
-        yaml_content = textwrap.dedent("""
-            profiles:
-              test-profile:
-                env:
-                  MY_RESOLVED_KEY: "${MY_SOURCE_VAR}"
-        """)
-        yaml_file = tmp_path / "profiles.yaml"
-        yaml_file.write_text(yaml_content, encoding="utf-8")
-        with patch.dict(
-            os.environ,
-            {
-                "VDS_AUDIT_RUNTIME_PROFILES_FILE": str(yaml_file),
-                "MY_SOURCE_VAR": "resolved-value",
-            },
-            clear=False,
-        ):
-            os.environ.pop("MY_RESOLVED_KEY", None)
-            _result = apply_runtime_profile("test-profile", force_override=True)
-            assert os.environ.get("MY_RESOLVED_KEY") == "resolved-value"
-
-    def test_env_ref_raises_when_not_set(self, tmp_path: Path) -> None:
-        """${ENV_VAR} raises ValueError when the referenced var is not set."""
-        from vds_agent_core.profiles import apply_runtime_profile
-
-        yaml_content = textwrap.dedent("""
-            profiles:
-              test-profile:
-                env:
-                  MY_KEY: "${NONEXISTENT_VAR_XYZ_12345}"
-        """)
-        yaml_file = tmp_path / "profiles.yaml"
-        yaml_file.write_text(yaml_content, encoding="utf-8")
-        with patch.dict(os.environ, {"VDS_AUDIT_RUNTIME_PROFILES_FILE": str(yaml_file)}, clear=False):
-            os.environ.pop("NONEXISTENT_VAR_XYZ_12345", None)
-            with pytest.raises(ValueError, match="NONEXISTENT_VAR_XYZ_12345"):
-                apply_runtime_profile("test-profile", force_override=True)
-
-    def test_codex_ref_raises_when_module_unavailable(self, tmp_path: Path) -> None:
-        """${codex:access_token} raises ValueError when codex_oauth not available."""
-        import sys
-
-        from vds_agent_core.profiles import apply_runtime_profile
-
-        yaml_content = textwrap.dedent("""
-            profiles:
-              test-profile:
-                env:
-                  MY_KEY: "${codex:access_token}"
-        """)
-        yaml_file = tmp_path / "profiles.yaml"
-        yaml_file.write_text(yaml_content, encoding="utf-8")
-        with patch.dict(os.environ, {"VDS_AUDIT_RUNTIME_PROFILES_FILE": str(yaml_file)}, clear=False):
-            with patch.dict(sys.modules, {"vds_audit_orchestrator.llm.codex_oauth": None}):
-                with pytest.raises(ValueError, match="codex"):
-                    apply_runtime_profile("test-profile", force_override=True)
-
-    def test_malformed_codex_ref_raises(self, tmp_path: Path) -> None:
-        """Malformed ${codex:...} reference raises ValueError."""
-        from vds_agent_core.profiles import apply_runtime_profile
-
-        yaml_content = textwrap.dedent("""
-            profiles:
-              test-profile:
-                env:
-                  MY_KEY: "${codex:bad field name!}"
-        """)
-        yaml_file = tmp_path / "profiles.yaml"
-        yaml_file.write_text(yaml_content, encoding="utf-8")
-        with patch.dict(os.environ, {"VDS_AUDIT_RUNTIME_PROFILES_FILE": str(yaml_file)}, clear=False):
-            with pytest.raises(ValueError):
-                apply_runtime_profile("test-profile", force_override=True)
-
-
-class TestResolveSkillDirectoryPath:
-    """resolve_skill_directory_path with absolute and relative paths."""
-
-    def test_absolute_path_returned_as_is(self, tmp_path: Path) -> None:
-        from vds_agent_core.profiles import resolve_skill_directory_path
-
-        result = resolve_skill_directory_path(str(tmp_path))
-        assert result == tmp_path.resolve()
-
-    def test_tilde_expanded(self) -> None:
-        from vds_agent_core.profiles import resolve_skill_directory_path
-
-        result = resolve_skill_directory_path("~")
-        assert result == Path.home().resolve()
-
-    def test_relative_path_resolved_against_cwd(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
-        from vds_agent_core.profiles import resolve_skill_directory_path
-
-        monkeypatch.chdir(tmp_path)
-        monkeypatch.delenv("VDS_PROJECT_DIR", raising=False)
-        monkeypatch.delenv("CLAUDE_PROJECT_DIR", raising=False)
-        subdir = tmp_path / "skills"
-        subdir.mkdir()
-        result = resolve_skill_directory_path("skills")
-        assert result == subdir.resolve()
-
-
-class TestInheritRuntimeLlmPolicy:
-    """inherit_runtime_llm_policy copies policy fields from source_llm."""
-
-    def test_source_llm_none_returns_settings(self, tmp_path: Path) -> None:
-        """When source_llm is None, returns the built settings directly."""
-        from vds_agent_core.profiles import inherit_runtime_llm_policy
-
-        yaml_content = textwrap.dedent("""
-            profiles:
-              test-profile:
-                env:
-                  INHERIT_TEST_KEY: value
-        """)
-        yaml_file = tmp_path / "profiles.yaml"
-        yaml_file.write_text(yaml_content, encoding="utf-8")
-        with patch.dict(os.environ, {"VDS_AUDIT_RUNTIME_PROFILES_FILE": str(yaml_file)}, clear=False):
-            result = inherit_runtime_llm_policy("test-profile", source_llm=None)
-        # Returns None because no settings_factory provided
-        assert result is None
-
-    def test_source_llm_fields_copied(self, tmp_path: Path) -> None:
-        """When source_llm provided, policy fields are copied to settings."""
-        from vds_agent_core.profiles import inherit_runtime_llm_policy
-
-        yaml_content = textwrap.dedent("""
-            profiles:
-              test-profile:
-                env:
-                  INHERIT_TEST_KEY: value
-        """)
-        yaml_file = tmp_path / "profiles.yaml"
-        yaml_file.write_text(yaml_content, encoding="utf-8")
-
-        class _FakeSettings:
-            stream = False
-            agent_stream = False
-
-        class _SourceLlm:
-            stream = True
-            agent_stream = True
-
-        with patch.dict(os.environ, {"VDS_AUDIT_RUNTIME_PROFILES_FILE": str(yaml_file)}, clear=False):
-            result = inherit_runtime_llm_policy(
-                "test-profile",
-                source_llm=_SourceLlm(),
-                settings_factory=_FakeSettings,
-            )
-        # stream should be copied from source_llm
-        assert result.stream is True
-
-
-class TestAgentRuntimePolicyViaYaml:
-    """Tests for agent_runtime_policy helpers exercised via apply_runtime_profile."""
-
-    def _apply(self, tmp_path: Path, yaml_content: str) -> Any:
-        from vds_agent_core.profiles import apply_runtime_profile
-
-        yaml_file = tmp_path / "profiles.yaml"
-        yaml_file.write_text(textwrap.dedent(yaml_content), encoding="utf-8")
-        saved = {k: v for k, v in os.environ.items() if k.startswith("VDS_AUDIT_")}
-        with patch.dict(os.environ, {"VDS_AUDIT_RUNTIME_PROFILES_FILE": str(yaml_file)}, clear=False):
-            for k in list(saved):
-                if k != "VDS_AUDIT_RUNTIME_PROFILES_FILE":
-                    os.environ.pop(k, None)
-            try:
-                return apply_runtime_profile("test-profile", force_override=True)
-            finally:
-                for k in list(os.environ.keys()):
-                    if k.startswith("VDS_AUDIT_") and k not in saved:
-                        os.environ.pop(k, None)
-                for k, v in saved.items():
-                    os.environ[k] = v
-
-    def test_agent_runtime_policy_mode_applied(self, tmp_path: Path) -> None:
-        """agent_runtime_policy.mode=pydanticai sets env var."""
-        result = self._apply(
-            tmp_path,
-            """
-            profiles:
-              test-profile:
-                agent_runtime_policy:
-                  mode: pydanticai
-        """,
-        )
-        assert "VDS_AUDIT_LLM__AGENT_RUNTIME_MODE" in result.applied_env_keys
-
-    def test_agent_runtime_policy_invalid_mode_raises(self, tmp_path: Path) -> None:
-        """agent_runtime_policy.mode with invalid value raises ValueError."""
-        from vds_agent_core.profiles import apply_runtime_profile
-
-        yaml_content = textwrap.dedent("""
-            profiles:
-              test-profile:
-                agent_runtime_policy:
-                  mode: invalid-mode
-        """)
-        yaml_file = tmp_path / "profiles.yaml"
-        yaml_file.write_text(yaml_content, encoding="utf-8")
-        with patch.dict(os.environ, {"VDS_AUDIT_RUNTIME_PROFILES_FILE": str(yaml_file)}, clear=False):
-            with pytest.raises(ValueError):
-                apply_runtime_profile("test-profile", force_override=True)
-
-    def test_agent_runtime_policy_tool_allowlists_applied(self, tmp_path: Path) -> None:
-        """agent_runtime_policy.tool_allowlists sets env var."""
-        result = self._apply(
-            tmp_path,
-            """
-            profiles:
-              test-profile:
-                agent_runtime_policy:
-                  mode: pydanticai
-                  tool_allowlists:
-                    evaluator:
-                      - read_file
-                      - search_code
-        """,
-        )
-        assert "VDS_AUDIT_AGENTIC_TOOL_ALLOWLISTS" in result.applied_env_keys
-
-    def test_agent_runtime_policy_non_progress_policy_applied(self, tmp_path: Path) -> None:
-        """agent_runtime_policy.non_progress_policy sets env var."""
-        result = self._apply(
-            tmp_path,
-            """
-            profiles:
-              test-profile:
-                agent_runtime_policy:
-                  mode: pydanticai
-                  non_progress_policy:
-                    max_retries: 3
-        """,
-        )
-        assert "VDS_AUDIT_AGENTIC_NON_PROGRESS_POLICY" in result.applied_env_keys
-
-
-class TestTimeoutPolicyViaYaml:
-    """Tests for timeout_policy helpers exercised via apply_runtime_profile."""
-
-    def _apply(self, tmp_path: Path, yaml_content: str) -> Any:
-        from vds_agent_core.profiles import apply_runtime_profile
-
-        yaml_file = tmp_path / "profiles.yaml"
-        yaml_file.write_text(textwrap.dedent(yaml_content), encoding="utf-8")
-        saved = {k: v for k, v in os.environ.items() if k.startswith("VDS_AUDIT_")}
-        with patch.dict(os.environ, {"VDS_AUDIT_RUNTIME_PROFILES_FILE": str(yaml_file)}, clear=False):
-            for k in list(saved):
-                if k != "VDS_AUDIT_RUNTIME_PROFILES_FILE":
-                    os.environ.pop(k, None)
-            try:
-                return apply_runtime_profile("test-profile", force_override=True)
-            finally:
-                for k in list(os.environ.keys()):
-                    if k.startswith("VDS_AUDIT_") and k not in saved:
-                        os.environ.pop(k, None)
-                for k, v in saved.items():
-                    os.environ[k] = v
-
-    def test_timeout_policy_agent_timeout_applied(self, tmp_path: Path) -> None:
-        """timeout_policy.agent_timeout_seconds sets env var."""
-        result = self._apply(
-            tmp_path,
-            """
-            profiles:
-              test-profile:
-                timeout_policy:
-                  agent_timeout_seconds: 120
-        """,
-        )
-        assert "VDS_AUDIT_LLM__AGENT_TIMEOUT_SECONDS" in result.applied_env_keys
-
-    def test_timeout_policy_row_timeout_applied(self, tmp_path: Path) -> None:
-        """timeout_policy.row_timeout_ms sets env var."""
-        result = self._apply(
-            tmp_path,
-            """
-            profiles:
-              test-profile:
-                timeout_policy:
-                  row_timeout_ms: 60000
-        """,
-        )
-        assert "VDS_AUDIT_ROW_TIMEOUT_MS" in result.applied_env_keys
-
-
-class TestDspyAutoDerivation:
-    """Tests for DSPy auto-derivation and coherence validation."""
-
-    def _apply(self, tmp_path: Path, yaml_content: str) -> Any:
-        from vds_agent_core.profiles import apply_runtime_profile
-
-        yaml_file = tmp_path / "profiles.yaml"
-        yaml_file.write_text(textwrap.dedent(yaml_content), encoding="utf-8")
-        saved = {k: v for k, v in os.environ.items() if k.startswith("VDS_AUDIT_")}
-        with patch.dict(os.environ, {"VDS_AUDIT_RUNTIME_PROFILES_FILE": str(yaml_file)}, clear=False):
-            for k in list(saved):
-                if k != "VDS_AUDIT_RUNTIME_PROFILES_FILE":
-                    os.environ.pop(k, None)
-            try:
-                return apply_runtime_profile("test-profile", force_override=True)
-            finally:
-                for k in list(os.environ.keys()):
-                    if k.startswith("VDS_AUDIT_") and k not in saved:
-                        os.environ.pop(k, None)
-                for k, v in saved.items():
-                    os.environ[k] = v
-
-    def test_dspy_model_auto_derived_from_llm(self, tmp_path: Path) -> None:
-        """DSPy model is auto-derived from LLM standard model when not explicit."""
-        result = self._apply(
-            tmp_path,
-            """
-            profiles:
-              test-profile:
-                model:
-                  llm:
-                    type: openai
-                    base_url: http://localhost:4000
-                    api_key: sk-test
-                    standard: openai/gpt-4o
-        """,
-        )
-        # VDS_AUDIT_DSPY_MODEL should be auto-derived
-        assert "VDS_AUDIT_DSPY_MODEL" in result.applied_env_keys
-
-    def test_dspy_coherence_incoherent_raises(self, tmp_path: Path) -> None:
-        """Incoherent DSPy model/protocol pairing raises ValueError."""
-        from vds_agent_core.profiles import apply_runtime_profile
-
-        yaml_content = textwrap.dedent("""
-            profiles:
-              test-profile:
-                model:
-                  llm:
-                    type: openai
-                    base_url: http://localhost:4000
-                    api_key: sk-test
-                  dspy:
-                    type: anthropic
-                    model: openai/gpt-4o
-        """)
-        yaml_file = tmp_path / "profiles.yaml"
-        yaml_file.write_text(yaml_content, encoding="utf-8")
-        with patch.dict(os.environ, {"VDS_AUDIT_RUNTIME_PROFILES_FILE": str(yaml_file)}, clear=False):
-            with pytest.raises(ValueError, match="incoherent"):
-                apply_runtime_profile("test-profile", force_override=True)
-
-    def test_dspy_temperature_applied(self, tmp_path: Path) -> None:
-        """model.dspy.temperature sets DSPy temperature env var."""
-        result = self._apply(
-            tmp_path,
-            """
-            profiles:
-              test-profile:
-                model:
-                  dspy:
-                    type: openai
-                    model: openai/gpt-4o
-                    temperature: 0.5
-        """,
-        )
-        assert "VDS_AUDIT_DSPY_TEMPERATURE" in result.applied_env_keys
-
-    def test_dspy_max_tokens_applied(self, tmp_path: Path) -> None:
-        """model.dspy.max_tokens sets DSPy max_tokens env var."""
-        result = self._apply(
-            tmp_path,
-            """
-            profiles:
-              test-profile:
-                model:
-                  dspy:
-                    type: openai
-                    model: openai/gpt-4o
-                    max_tokens: 4096
-        """,
-        )
-        assert "VDS_AUDIT_DSPY_MAX_TOKENS" in result.applied_env_keys
-
-    def test_dspy_system_role_compat_applied(self, tmp_path: Path) -> None:
-        """model.dspy.system_role_compat sets DSPy system_role_compat env var."""
-        result = self._apply(
-            tmp_path,
-            """
-            profiles:
-              test-profile:
-                model:
-                  dspy:
-                    type: openai
-                    model: openai/gpt-4o
-                    system_role_compat: true
-        """,
-        )
-        assert "VDS_AUDIT_DSPY_SYSTEM_ROLE_COMPAT" in result.applied_env_keys