@ngocsangairvds/vsaf 4.0.6 → 4.0.7

package/skills/vds-skill/vds-scripts/vds_agent_core/tests/unit/llm/test_embedding_subclass.py

@@ -0,0 +1,49 @@
+"""Subclass discipline (NFR-225.6 LSP).
+
+Audit / memory packages must be able to subclass `EmbeddingSettings` with
+their own env_prefix and have everything still work.
+"""
+
+from __future__ import annotations
+
+import pytest
+from pydantic_settings import SettingsConfigDict
+from vds_agent_core.config import VDS_BASE_SETTINGS_CONFIG
+from vds_agent_core.llm.embedding import EmbeddingSettings, OllamaEmbeddingClient
+
+
+class FakeAuditEmbedSettings(EmbeddingSettings):
+    """Audit-flavored subclass with its own env namespace."""
+
+    model_config = SettingsConfigDict(  # type: ignore[typeddict-unknown-key]
+        env_prefix="VDS_AUDIT_EMBED__",
+        **VDS_BASE_SETTINGS_CONFIG,
+    )
+
+
+@pytest.fixture(autouse=True)
+def _clear_env(monkeypatch: pytest.MonkeyPatch) -> None:
+    for key in [
+        "VDS_AGENT_CORE_EMBED__PROVIDER",
+        "VDS_AGENT_CORE_EMBED__BASE_URL",
+        "VDS_AUDIT_EMBED__PROVIDER",
+        "VDS_AUDIT_EMBED__BASE_URL",
+        "VDS_AUDIT_EMBED__MODEL_STANDARD",
+        "VDS_AUDIT_EMBED__DIMENSION",
+    ]:
+        monkeypatch.delenv(key, raising=False)
+
+
+def test_subclass_reads_its_own_env_prefix(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv("VDS_AUDIT_EMBED__BASE_URL", "https://audit.example.com")
+    s = FakeAuditEmbedSettings()
+    assert s.base_url == "https://audit.example.com"
+
+
+def test_subclass_build_client_works(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv("VDS_AUDIT_EMBED__PROVIDER", "ollama")
+    monkeypatch.setenv("VDS_AUDIT_EMBED__BASE_URL", "http://test.local:11434")
+    monkeypatch.setenv("VDS_AUDIT_EMBED__MODEL_STANDARD", "bge-m3")
+    s = FakeAuditEmbedSettings()
+    client = s.build_client()
+    assert isinstance(client, OllamaEmbeddingClient)

package/skills/vds-skill/vds-scripts/vds_agent_core/tests/unit/llm/test_no_provider_leakage_in_env.py

@@ -0,0 +1,34 @@
+"""No per-provider env vars leak into the namespace (NFR-225.8).
+
+The embedding namespace must remain provider-agnostic — no
+`VDS_AGENT_CORE_EMBED__OLLAMA_*` / `_OPENAI_*` keys.
+"""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+import vds_agent_core.llm.embedding as embedding_module
+
+
+def _load_source() -> str:
+    return Path(embedding_module.__file__).read_text(encoding="utf-8")
+
+
+def test_no_per_provider_env_prefix_in_source() -> None:
+    src = _load_source()
+    matches = re.findall(
+        r'env_prefix\s*=\s*"VDS_AGENT_CORE_EMBED__(?:OLLAMA|OPENAI|COHERE|VOYAGE|MISTRAL|JINA|HUGGINGFACE)',
+        src,
+    )
+    assert matches == [], f"Per-provider env_prefix leak: {matches}"
+
+
+def test_no_per_provider_field_env_in_source() -> None:
+    src = _load_source()
+    matches = re.findall(
+        r'Field\([^)]*"VDS_AGENT_CORE_EMBED__(?:OLLAMA|OPENAI|COHERE|VOYAGE|MISTRAL|JINA|HUGGINGFACE)',
+        src,
+    )
+    assert matches == [], f"Per-provider Field env leak: {matches}"

package/skills/vds-skill/vds-scripts/vds_agent_core/tests/unit/llm/test_provider_auto_route.py

@@ -0,0 +1,48 @@
+"""Provider auto-routing from model prefix (FR-225.19)."""
+
+from __future__ import annotations
+
+import pytest
+from vds_agent_core.llm.embedding import (
+    EmbeddingSettings,
+    HashEmbeddingClient,
+    OllamaEmbeddingClient,
+    OpenAIEmbeddingClient,
+)
+
+
+@pytest.fixture(autouse=True)
+def _clear_env(monkeypatch: pytest.MonkeyPatch) -> None:
+    for key in [
+        "VDS_AGENT_CORE_EMBED__PROVIDER",
+        "VDS_AGENT_CORE_EMBED__BASE_URL",
+        "VDS_AGENT_CORE_EMBED__MODEL_STANDARD",
+        "VDS_AGENT_CORE_EMBED__DIMENSION",
+    ]:
+        monkeypatch.delenv(key, raising=False)
+
+
+@pytest.mark.parametrize(
+    "model_str,dim,expected_class",
+    [
+        ("ollama/bge-m3", 1024, OllamaEmbeddingClient),
+        ("openai/text-embedding-3-small", 1536, OpenAIEmbeddingClient),
+        ("cohere/embed-english-v3.0", 1024, OpenAIEmbeddingClient),
+        ("hash/v1", 1024, HashEmbeddingClient),
+    ],
+)
+def test_auto_route_from_model_prefix(
+    model_str: str, dim: int, expected_class: type
+) -> None:
+    """No explicit provider set — routing comes from the model prefix."""
+    settings = EmbeddingSettings.model_validate(
+        {
+            "base_url": "http://test.local:11434",
+            "model_simple": model_str,
+            "model_standard": model_str,
+            "model_complex": model_str,
+            "dimension": dim,
+        }
+    )
+    client = settings.build_client()
+    assert isinstance(client, expected_class)

package/skills/vds-skill/vds-scripts/vds_agent_core/tests/unit/llm/test_runtime_log_clean.py

@@ -0,0 +1,111 @@
+"""Runtime log cleanliness (NFR-225.10 CRITICAL).
+
+No raw API keys / Bearer tokens in logs or raised exception messages.
+"""
+
+from __future__ import annotations
+
+import logging
+from unittest.mock import AsyncMock, MagicMock, patch
+
+import httpx
+import pytest
+from vds_agent_core.llm.embedding import (
+    EmbeddingProviderError,
+    EmbeddingRuntimeConfig,
+    OpenAIEmbeddingClient,
+)
+
+
+@pytest.fixture(autouse=True)
+def _clear_env(monkeypatch: pytest.MonkeyPatch) -> None:
+    for key in [
+        "VDS_AGENT_CORE_EMBED__PROVIDER",
+        "VDS_AGENT_CORE_EMBED__BASE_URL",
+        "VDS_AGENT_CORE_EMBED__API_KEY",
+        "VDS_AGENT_CORE_EMBED__MODEL_STANDARD",
+    ]:
+        monkeypatch.delenv(key, raising=False)
+
+
+def _build_settings() -> EmbeddingRuntimeConfig:
+    return EmbeddingRuntimeConfig(
+        provider="openai",
+        base_url="https://api.openai.com/v1",
+        api_key="sk-test-CONFIDENTIAL-12345",
+        model_simple="text-embedding-3-small",
+        model_standard="text-embedding-3-small",
+        model_complex="text-embedding-3-small",
+        dimension=1536,
+    )
+
+
+async def test_no_secrets_in_logs_or_exceptions_on_http_error(
+    caplog: pytest.LogCaptureFixture,
+) -> None:
+    cfg = _build_settings()
+
+    # Forge an HTTPStatusError whose string repr leaks the bearer token
+    mock_response = MagicMock()
+    mock_response.status_code = 401
+    mock_response.text = (
+        '{"error":{"message":"invalid bearer token Bearer sk-test-CONFIDENTIAL-12345"}}'
+    )
+
+    leaky_msg = (
+        "401 Unauthorized: Authorization: Bearer sk-test-CONFIDENTIAL-12345 invalid"
+    )
+    err = httpx.HTTPStatusError(leaky_msg, request=MagicMock(), response=mock_response)
+    mock_response.raise_for_status = MagicMock(side_effect=err)
+
+    mock_async_client = AsyncMock()
+    mock_async_client.post = AsyncMock(return_value=mock_response)
+    mock_async_client.aclose = AsyncMock()
+
+    caplog.set_level(logging.DEBUG)
+
+    with patch("httpx.AsyncClient", return_value=mock_async_client):
+        client = OpenAIEmbeddingClient.from_settings(cfg)
+        for _ in range(5):
+            with pytest.raises(EmbeddingProviderError) as ei:
+                await client.embed("hi", model="text-embedding-3-small")
+            # Exception message must not contain raw key
+            assert "sk-test-CONFIDENTIAL" not in str(ei.value)
+            assert "Bearer sk-" not in str(ei.value)
+
+    # All log records sanitized
+    for record in caplog.records:
+        msg = record.getMessage()
+        full = str(record.__dict__)
+        assert "sk-test-CONFIDENTIAL" not in msg
+        assert "sk-test-CONFIDENTIAL" not in full
+        assert "Bearer sk-" not in msg
+
+
+async def test_no_secrets_in_logs_on_connect_error(
+    caplog: pytest.LogCaptureFixture,
+) -> None:
+    cfg = _build_settings()
+
+    leaky_msg = (
+        "Connection refused while authenticating with Bearer sk-test-CONFIDENTIAL-12345"
+    )
+    mock_async_client = AsyncMock()
+    mock_async_client.post = AsyncMock(side_effect=httpx.ConnectError(leaky_msg))
+    mock_async_client.aclose = AsyncMock()
+
+    caplog.set_level(logging.DEBUG)
+
+    with patch("httpx.AsyncClient", return_value=mock_async_client):
+        client = OpenAIEmbeddingClient.from_settings(cfg)
+        for _ in range(5):
+            with pytest.raises(EmbeddingProviderError) as ei:
+                await client.embed("hi", model="text-embedding-3-small")
+            assert "sk-test-CONFIDENTIAL" not in str(ei.value)
+            assert "Bearer sk-" not in str(ei.value)
+
+    for record in caplog.records:
+        msg = record.getMessage()
+        full = str(record.__dict__)
+        assert "sk-test-CONFIDENTIAL" not in msg
+        assert "sk-test-CONFIDENTIAL" not in full

package/skills/vds-skill/vds-scripts/vds_agent_core/tests/unit/llm/test_w7_logic_fixes.py

@@ -0,0 +1,219 @@
+"""W7 v20.6.1 regression tests for the logic-agent BLOCKER + HIGH fixes.
+
+Each test locks one specific fix from the W7 logic walkthrough so a future
+refactor can't silently regress them. All tests mock httpx — no real network.
+"""
+
+from __future__ import annotations
+
+import threading
+from unittest.mock import AsyncMock, MagicMock, patch
+
+import httpx
+import pytest
+from vds_agent_core.llm.embedding import (
+    _PROVIDER_REGISTRY_LOCK,
+    EMBEDDING_PROVIDERS,
+    ConfigError,
+    EmbeddingProviderError,
+    EmbeddingSettings,
+    OllamaEmbeddingClient,
+    _parse_provider_from_model,
+    register_provider,
+)
+
+
+@pytest.fixture(autouse=True)
+def _registry_snapshot():
+    """Save/restore EMBEDDING_PROVIDERS so tests can register fakes safely."""
+    snap = dict(EMBEDDING_PROVIDERS)
+    yield
+    EMBEDDING_PROVIDERS.clear()
+    EMBEDDING_PROVIDERS.update(snap)
+
+
+# ---------------------------------------------------------------------------
+# W7 logic-B-1: empty embeddings array guard
+# ---------------------------------------------------------------------------
+
+
+class TestOllamaEmptyEmbeddingsGuard:
+    """Ollama returning ``{"embeddings": []}`` MUST raise EmbeddingProviderError,
+    NOT IndexError."""
+
+    @pytest.mark.asyncio
+    async def test_embed_empty_array_raises_provider_error(self) -> None:
+        config = MagicMock()
+        config.base_url = "http://localhost:11434"
+        config.timeout_seconds = 30.0
+        client = OllamaEmbeddingClient(config)
+        mock_response = MagicMock()
+        mock_response.raise_for_status = MagicMock()
+        mock_response.json = MagicMock(return_value={"embeddings": []})
+        client._client = MagicMock()
+        client._client.post = AsyncMock(return_value=mock_response)
+        client._client.aclose = AsyncMock()
+        with pytest.raises(EmbeddingProviderError, match="empty embeddings array"):
+            await client.embed("hi", model="bge-m3")
+        await client.aclose()
+
+    @pytest.mark.asyncio
+    async def test_embed_missing_field_raises_provider_error(self) -> None:
+        config = MagicMock()
+        config.base_url = "http://localhost:11434"
+        config.timeout_seconds = 30.0
+        client = OllamaEmbeddingClient(config)
+        mock_response = MagicMock()
+        mock_response.raise_for_status = MagicMock()
+        mock_response.json = MagicMock(return_value={"other": "field"})
+        client._client = MagicMock()
+        client._client.post = AsyncMock(return_value=mock_response)
+        client._client.aclose = AsyncMock()
+        with pytest.raises(EmbeddingProviderError, match="empty embeddings array"):
+            await client.embed("hi", model="bge-m3")
+        await client.aclose()
+
+    @pytest.mark.asyncio
+    async def test_embed_batch_missing_field_raises(self) -> None:
+        config = MagicMock()
+        config.base_url = "http://localhost:11434"
+        config.timeout_seconds = 30.0
+        client = OllamaEmbeddingClient(config)
+        mock_response = MagicMock()
+        mock_response.raise_for_status = MagicMock()
+        mock_response.json = MagicMock(return_value={"data": []})
+        client._client = MagicMock()
+        client._client.post = AsyncMock(return_value=mock_response)
+        client._client.aclose = AsyncMock()
+        with pytest.raises(EmbeddingProviderError, match="missing embeddings field"):
+            await client.embed_batch(["a", "b"], model="bge-m3")
+        await client.aclose()
+
+
+# ---------------------------------------------------------------------------
+# W7 logic-B-3: register_provider lock
+# ---------------------------------------------------------------------------
+
+
+class TestRegisterProviderLock:
+    """Concurrent ``register_provider`` calls must be serialized."""
+
+    def test_lock_exists_and_is_lock_type(self) -> None:
+        # The lock module attribute must exist and be a threading lock.
+        assert _PROVIDER_REGISTRY_LOCK is not None
+        # threading.Lock() returns a _thread.lock; check it has the lock contract.
+        assert hasattr(_PROVIDER_REGISTRY_LOCK, "acquire")
+        assert hasattr(_PROVIDER_REGISTRY_LOCK, "release")
+
+    def test_concurrent_registrations_serialized(self) -> None:
+        """Stress test: 50 threads racing on the same key + force=True."""
+        results: list[bool] = []
+
+        def factory(_c: object) -> object:
+            return MagicMock()
+
+        def worker() -> None:
+            try:
+                register_provider("racer", factory, force=True)
+                results.append(True)
+            except Exception:
+                results.append(False)
+
+        threads = [threading.Thread(target=worker) for _ in range(50)]
+        for t in threads:
+            t.start()
+        for t in threads:
+            t.join()
+        # All 50 should succeed (force=True). The key point is no
+        # data-race-induced exceptions or partial state corruption.
+        assert all(results)
+        assert "racer" in EMBEDDING_PROVIDERS
+
+    def test_collision_without_force_raises(self) -> None:
+        register_provider("dup_key", lambda c: MagicMock(), force=True)
+        with pytest.raises(ConfigError, match="already registered"):
+            register_provider("dup_key", lambda c: MagicMock(), force=False)
+
+
+# ---------------------------------------------------------------------------
+# W7 logic-HIGH-2: leading-slash provider parse
+# ---------------------------------------------------------------------------
+
+
+class TestLeadingSlashProviderParse:
+    """Leading slash typos must still resolve to the provider prefix."""
+
+    @pytest.mark.parametrize(
+        ("input_str", "expected"),
+        [
+            ("openai/text-embedding-3-small", "openai"),
+            ("/openai/text-embedding-3-small", "openai"),  # W7 fix
+            ("//openai/text-embedding-3-small", "openai"),  # double-slash also tolerated
+            ("ollama/bge-m3", "ollama"),
+            ("/ollama/bge-m3", "ollama"),  # W7 fix
+            ("nokey", None),
+            ("", None),
+            ("/", None),
+            ("//", None),
+        ],
+    )
+    def test_parse_provider(self, input_str: str, expected: str | None) -> None:
+        assert _parse_provider_from_model(input_str) == expected
+
+
+# ---------------------------------------------------------------------------
+# W7 logic-B-2: response body sanitization in OpenAI client
+# ---------------------------------------------------------------------------
+
+
+class TestOpenAIResponseBodySanitization:
+    """When OpenAI returns 401 with the token echoed in JSON body, sanitize it."""
+
+    @pytest.mark.asyncio
+    async def test_response_body_token_redacted_in_error(self) -> None:
+        from vds_agent_core.llm.embedding import OpenAIEmbeddingClient
+
+        config = MagicMock()
+        config.base_url = "https://api.openai.com/v1"
+        config.timeout_seconds = 30.0
+        config.api_key = "sk-test-CONFIDENTIAL-12345"
+        config.dimension = 1536
+        client = OpenAIEmbeddingClient(config, provider_name="openai")
+
+        # Build a fake HTTPStatusError whose response.text contains the token.
+        fake_request = httpx.Request("POST", "https://api.openai.com/v1/embeddings")
+        fake_response = httpx.Response(
+            401,
+            request=fake_request,
+            content=b'{"error": {"message": "Invalid API key sk-test-CONFIDENTIAL-12345"}}',
+        )
+        exc = httpx.HTTPStatusError("401 Unauthorized", request=fake_request, response=fake_response)
+
+        client._client = MagicMock()
+        client._client.post = AsyncMock(side_effect=exc)
+        client._client.aclose = AsyncMock()
+
+        with pytest.raises(EmbeddingProviderError) as exc_info:
+            await client.embed("hello", model="text-embedding-3-small")
+        # Token MUST NOT appear in the sanitized error message.
+        assert "sk-test-CONFIDENTIAL-12345" not in exc_info.value.message
+        assert "[REDACTED]" in exc_info.value.message
+        await client.aclose()
+
+
+# ---------------------------------------------------------------------------
+# W7 dedup-D-3: OpenAI-compat factory dispatch
+# ---------------------------------------------------------------------------
+
+
+class TestOpenAICompatFactories:
+    """Each OpenAI-compat provider key must dispatch to OpenAIEmbeddingClient
+    with the correct ``provider_name`` discriminator."""
+
+    @pytest.mark.parametrize("provider", ["cohere", "voyage", "mistral", "jina"])
+    def test_factory_dispatch(self, provider: str, monkeypatch) -> None:
+        # Use dimension that bypasses the matryoshka + first-deploy validators.
+        # cohere/voyage/mistral/jina all have dimension=1024 in PROVIDER_DEFAULTS.
+        settings = EmbeddingSettings(provider=provider, model_standard=f"{provider}/foo", dimension=1024)
+        client = settings.build_client()
+        assert client.provider_name == provider

package/skills/vds-skill/vds-scripts/vds_agent_core/tests/unit/profiles/test_embedding_block_parser.py

@@ -0,0 +1,194 @@
+"""Phase 225 W3 — FR-226.13: model.embedding YAML block parser.
+
+Verifies opt-in embedding-block parsing (parse_embedding=True) plus the
+EMBEDDING_PROVIDERS registry validator. Default behavior (parse_embedding=False)
+must remain unchanged for FR-225.22 back-compat.
+"""
+
+from __future__ import annotations
+
+import os
+import textwrap
+from pathlib import Path
+
+import pytest
+from vds_agent_core.profiles import (
+    ProfileValidationError,
+    apply_runtime_profile,
+    build_embedding_settings_for_profile,
+)
+
+
+def _write_profile(tmp_path: Path, body: str) -> Path:
+    yaml_file = tmp_path / "profiles.yaml"
+    yaml_file.write_text(textwrap.dedent(body), encoding="utf-8")
+    return yaml_file
+
+
+def _scrub_embed_env(monkeypatch: pytest.MonkeyPatch) -> None:
+    for key in list(os.environ):
+        if key.startswith("VDS_AGENT_CORE_EMBED__") or key.startswith("VDS_AUDIT_EMBEDDING__"):
+            monkeypatch.delenv(key, raising=False)
+
+
+def test_parse_embedding_default_false_no_env_change(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """parse_embedding default False => no VDS_AGENT_CORE_EMBED__ env vars set."""
+    _scrub_embed_env(monkeypatch)
+    yaml_file = _write_profile(
+        tmp_path,
+        """
+        profiles:
+          test:
+            model:
+              embedding:
+                base_url: http://localhost:11434
+        """,
+    )
+    monkeypatch.setenv("VDS_AUDIT_RUNTIME_PROFILES_FILE", str(yaml_file))
+    apply_runtime_profile("test", force_override=True)  # parse_embedding default False
+    assert "VDS_AGENT_CORE_EMBED__PROVIDER" not in os.environ
+    assert "VDS_AGENT_CORE_EMBED__DIMENSION" not in os.environ
+
+
+def test_parse_embedding_true_sets_provider_env(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """parse_embedding=True with type=ollama sets VDS_AGENT_CORE_EMBED__PROVIDER."""
+    _scrub_embed_env(monkeypatch)
+    yaml_file = _write_profile(
+        tmp_path,
+        """
+        profiles:
+          test:
+            model:
+              embedding:
+                type: ollama
+                model: bge-m3
+                dimension: 1024
+        """,
+    )
+    monkeypatch.setenv("VDS_AUDIT_RUNTIME_PROFILES_FILE", str(yaml_file))
+    apply_runtime_profile("test", force_override=True, parse_embedding=True)
+    assert os.environ["VDS_AGENT_CORE_EMBED__PROVIDER"] == "ollama"
+    assert os.environ["VDS_AGENT_CORE_EMBED__MODEL_STANDARD"] == "bge-m3"
+    assert os.environ["VDS_AGENT_CORE_EMBED__DIMENSION"] == "1024"
+
+
+def test_parse_embedding_unknown_type_raises(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """Unknown embedding type raises ProfileValidationError naming the registry."""
+    _scrub_embed_env(monkeypatch)
+    yaml_file = _write_profile(
+        tmp_path,
+        """
+        profiles:
+          test:
+            model:
+              embedding:
+                type: bad_provider
+                model: foo
+                dimension: 1024
+        """,
+    )
+    monkeypatch.setenv("VDS_AUDIT_RUNTIME_PROFILES_FILE", str(yaml_file))
+    with pytest.raises(
+        ProfileValidationError,
+        match=r"Unknown embedding type 'bad_provider'.*registered:",
+    ):
+        apply_runtime_profile("test", force_override=True, parse_embedding=True)
+
+
+def test_parse_embedding_invalid_dimension_raises(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """Negative dimension raises ProfileValidationError."""
+    _scrub_embed_env(monkeypatch)
+    yaml_file = _write_profile(
+        tmp_path,
+        """
+        profiles:
+          test:
+            model:
+              embedding:
+                type: ollama
+                dimension: -1
+        """,
+    )
+    monkeypatch.setenv("VDS_AUDIT_RUNTIME_PROFILES_FILE", str(yaml_file))
+    with pytest.raises(ProfileValidationError, match=r"invalid model.embedding.dimension"):
+        apply_runtime_profile("test", force_override=True, parse_embedding=True)
+
+
+def test_build_embedding_settings_for_profile_round_trip(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """Round-trip: profile YAML -> env vars -> EmbeddingSettings instance."""
+    _scrub_embed_env(monkeypatch)
+    # ollama defaults: dim 1024, model bge-m3, base_url host.docker.internal:11434
+    yaml_file = _write_profile(
+        tmp_path,
+        """
+        profiles:
+          rt-test:
+            model:
+              embedding:
+                type: ollama
+                model: bge-m3
+                dimension: 1024
+                base_url: http://localhost:11434
+        """,
+    )
+    monkeypatch.setenv("VDS_AUDIT_RUNTIME_PROFILES_FILE", str(yaml_file))
+    settings = build_embedding_settings_for_profile("rt-test")
+    assert settings.provider == "ollama"
+    assert settings.model_standard == "bge-m3"
+    assert settings.dimension == 1024
+    assert settings.base_url == "http://localhost:11434"
+
+
+def test_build_embedding_settings_no_block_uses_defaults(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """Profile without embedding block falls through to EmbeddingSettings() defaults."""
+    _scrub_embed_env(monkeypatch)
+    yaml_file = _write_profile(
+        tmp_path,
+        """
+        profiles:
+          plain:
+            env:
+              FOO: bar
+        """,
+    )
+    monkeypatch.setenv("VDS_AUDIT_RUNTIME_PROFILES_FILE", str(yaml_file))
+    settings = build_embedding_settings_for_profile("plain")
+    # Defaults from EmbeddingRuntimeConfig
+    assert settings.provider == "ollama"
+    assert settings.model_standard == "bge-m3"
+    assert settings.dimension == 1024
+
+
+def test_parse_embedding_legacy_keys_still_work(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """Legacy base_url/model/api_key keys still set VDS_AUDIT_EMBEDDING__* (back-compat)."""
+    _scrub_embed_env(monkeypatch)
+    yaml_file = _write_profile(
+        tmp_path,
+        """
+        profiles:
+          legacy:
+            model:
+              embedding:
+                base_url: http://localhost:11434
+                model: bge-m3
+        """,
+    )
+    monkeypatch.setenv("VDS_AUDIT_RUNTIME_PROFILES_FILE", str(yaml_file))
+    apply_runtime_profile("legacy", force_override=True)
+    # Legacy env vars remain populated regardless of parse_embedding flag.
+    assert os.environ.get("VDS_AUDIT_EMBEDDING__BASE_URL") == "http://localhost:11434"
+    assert os.environ.get("VDS_AUDIT_EMBEDDING__MODEL") == "bge-m3"