@ngocsangairvds/vsaf 4.1.8 → 4.1.9

package/skills/vds-skill/vds-scripts/vds_agent_core/tests/unit/llm/test_embedding_subclass.py

@@ -1,49 +0,0 @@
-"""Subclass discipline (NFR-225.6 LSP).
-
-Audit / memory packages must be able to subclass `EmbeddingSettings` with
-their own env_prefix and have everything still work.
-"""
-
-from __future__ import annotations
-
-import pytest
-from pydantic_settings import SettingsConfigDict
-from vds_agent_core.config import VDS_BASE_SETTINGS_CONFIG
-from vds_agent_core.llm.embedding import EmbeddingSettings, OllamaEmbeddingClient
-
-
-class FakeAuditEmbedSettings(EmbeddingSettings):
-    """Audit-flavored subclass with its own env namespace."""
-
-    model_config = SettingsConfigDict(  # type: ignore[typeddict-unknown-key]
-        env_prefix="VDS_AUDIT_EMBED__",
-        **VDS_BASE_SETTINGS_CONFIG,
-    )
-
-
-@pytest.fixture(autouse=True)
-def _clear_env(monkeypatch: pytest.MonkeyPatch) -> None:
-    for key in [
-        "VDS_AGENT_CORE_EMBED__PROVIDER",
-        "VDS_AGENT_CORE_EMBED__BASE_URL",
-        "VDS_AUDIT_EMBED__PROVIDER",
-        "VDS_AUDIT_EMBED__BASE_URL",
-        "VDS_AUDIT_EMBED__MODEL_STANDARD",
-        "VDS_AUDIT_EMBED__DIMENSION",
-    ]:
-        monkeypatch.delenv(key, raising=False)
-
-
-def test_subclass_reads_its_own_env_prefix(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setenv("VDS_AUDIT_EMBED__BASE_URL", "https://audit.example.com")
-    s = FakeAuditEmbedSettings()
-    assert s.base_url == "https://audit.example.com"
-
-
-def test_subclass_build_client_works(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setenv("VDS_AUDIT_EMBED__PROVIDER", "ollama")
-    monkeypatch.setenv("VDS_AUDIT_EMBED__BASE_URL", "http://test.local:11434")
-    monkeypatch.setenv("VDS_AUDIT_EMBED__MODEL_STANDARD", "bge-m3")
-    s = FakeAuditEmbedSettings()
-    client = s.build_client()
-    assert isinstance(client, OllamaEmbeddingClient)

package/skills/vds-skill/vds-scripts/vds_agent_core/tests/unit/llm/test_no_provider_leakage_in_env.py

@@ -1,34 +0,0 @@
-"""No per-provider env vars leak into the namespace (NFR-225.8).
-
-The embedding namespace must remain provider-agnostic — no
-`VDS_AGENT_CORE_EMBED__OLLAMA_*` / `_OPENAI_*` keys.
-"""
-
-from __future__ import annotations
-
-import re
-from pathlib import Path
-
-import vds_agent_core.llm.embedding as embedding_module
-
-
-def _load_source() -> str:
-    return Path(embedding_module.__file__).read_text(encoding="utf-8")
-
-
-def test_no_per_provider_env_prefix_in_source() -> None:
-    src = _load_source()
-    matches = re.findall(
-        r'env_prefix\s*=\s*"VDS_AGENT_CORE_EMBED__(?:OLLAMA|OPENAI|COHERE|VOYAGE|MISTRAL|JINA|HUGGINGFACE)',
-        src,
-    )
-    assert matches == [], f"Per-provider env_prefix leak: {matches}"
-
-
-def test_no_per_provider_field_env_in_source() -> None:
-    src = _load_source()
-    matches = re.findall(
-        r'Field\([^)]*"VDS_AGENT_CORE_EMBED__(?:OLLAMA|OPENAI|COHERE|VOYAGE|MISTRAL|JINA|HUGGINGFACE)',
-        src,
-    )
-    assert matches == [], f"Per-provider Field env leak: {matches}"

package/skills/vds-skill/vds-scripts/vds_agent_core/tests/unit/llm/test_provider_auto_route.py

@@ -1,48 +0,0 @@
-"""Provider auto-routing from model prefix (FR-225.19)."""
-
-from __future__ import annotations
-
-import pytest
-from vds_agent_core.llm.embedding import (
-    EmbeddingSettings,
-    HashEmbeddingClient,
-    OllamaEmbeddingClient,
-    OpenAIEmbeddingClient,
-)
-
-
-@pytest.fixture(autouse=True)
-def _clear_env(monkeypatch: pytest.MonkeyPatch) -> None:
-    for key in [
-        "VDS_AGENT_CORE_EMBED__PROVIDER",
-        "VDS_AGENT_CORE_EMBED__BASE_URL",
-        "VDS_AGENT_CORE_EMBED__MODEL_STANDARD",
-        "VDS_AGENT_CORE_EMBED__DIMENSION",
-    ]:
-        monkeypatch.delenv(key, raising=False)
-
-
-@pytest.mark.parametrize(
-    "model_str,dim,expected_class",
-    [
-        ("ollama/bge-m3", 1024, OllamaEmbeddingClient),
-        ("openai/text-embedding-3-small", 1536, OpenAIEmbeddingClient),
-        ("cohere/embed-english-v3.0", 1024, OpenAIEmbeddingClient),
-        ("hash/v1", 1024, HashEmbeddingClient),
-    ],
-)
-def test_auto_route_from_model_prefix(
-    model_str: str, dim: int, expected_class: type
-) -> None:
-    """No explicit provider set — routing comes from the model prefix."""
-    settings = EmbeddingSettings.model_validate(
-        {
-            "base_url": "http://test.local:11434",
-            "model_simple": model_str,
-            "model_standard": model_str,
-            "model_complex": model_str,
-            "dimension": dim,
-        }
-    )
-    client = settings.build_client()
-    assert isinstance(client, expected_class)

package/skills/vds-skill/vds-scripts/vds_agent_core/tests/unit/llm/test_runtime_log_clean.py

@@ -1,111 +0,0 @@
-"""Runtime log cleanliness (NFR-225.10 CRITICAL).
-
-No raw API keys / Bearer tokens in logs or raised exception messages.
-"""
-
-from __future__ import annotations
-
-import logging
-from unittest.mock import AsyncMock, MagicMock, patch
-
-import httpx
-import pytest
-from vds_agent_core.llm.embedding import (
-    EmbeddingProviderError,
-    EmbeddingRuntimeConfig,
-    OpenAIEmbeddingClient,
-)
-
-
-@pytest.fixture(autouse=True)
-def _clear_env(monkeypatch: pytest.MonkeyPatch) -> None:
-    for key in [
-        "VDS_AGENT_CORE_EMBED__PROVIDER",
-        "VDS_AGENT_CORE_EMBED__BASE_URL",
-        "VDS_AGENT_CORE_EMBED__API_KEY",
-        "VDS_AGENT_CORE_EMBED__MODEL_STANDARD",
-    ]:
-        monkeypatch.delenv(key, raising=False)
-
-
-def _build_settings() -> EmbeddingRuntimeConfig:
-    return EmbeddingRuntimeConfig(
-        provider="openai",
-        base_url="https://api.openai.com/v1",
-        api_key="sk-test-CONFIDENTIAL-12345",
-        model_simple="text-embedding-3-small",
-        model_standard="text-embedding-3-small",
-        model_complex="text-embedding-3-small",
-        dimension=1536,
-    )
-
-
-async def test_no_secrets_in_logs_or_exceptions_on_http_error(
-    caplog: pytest.LogCaptureFixture,
-) -> None:
-    cfg = _build_settings()
-
-    # Forge an HTTPStatusError whose string repr leaks the bearer token
-    mock_response = MagicMock()
-    mock_response.status_code = 401
-    mock_response.text = (
-        '{"error":{"message":"invalid bearer token Bearer sk-test-CONFIDENTIAL-12345"}}'
-    )
-
-    leaky_msg = (
-        "401 Unauthorized: Authorization: Bearer sk-test-CONFIDENTIAL-12345 invalid"
-    )
-    err = httpx.HTTPStatusError(leaky_msg, request=MagicMock(), response=mock_response)
-    mock_response.raise_for_status = MagicMock(side_effect=err)
-
-    mock_async_client = AsyncMock()
-    mock_async_client.post = AsyncMock(return_value=mock_response)
-    mock_async_client.aclose = AsyncMock()
-
-    caplog.set_level(logging.DEBUG)
-
-    with patch("httpx.AsyncClient", return_value=mock_async_client):
-        client = OpenAIEmbeddingClient.from_settings(cfg)
-        for _ in range(5):
-            with pytest.raises(EmbeddingProviderError) as ei:
-                await client.embed("hi", model="text-embedding-3-small")
-            # Exception message must not contain raw key
-            assert "sk-test-CONFIDENTIAL" not in str(ei.value)
-            assert "Bearer sk-" not in str(ei.value)
-
-    # All log records sanitized
-    for record in caplog.records:
-        msg = record.getMessage()
-        full = str(record.__dict__)
-        assert "sk-test-CONFIDENTIAL" not in msg
-        assert "sk-test-CONFIDENTIAL" not in full
-        assert "Bearer sk-" not in msg
-
-
-async def test_no_secrets_in_logs_on_connect_error(
-    caplog: pytest.LogCaptureFixture,
-) -> None:
-    cfg = _build_settings()
-
-    leaky_msg = (
-        "Connection refused while authenticating with Bearer sk-test-CONFIDENTIAL-12345"
-    )
-    mock_async_client = AsyncMock()
-    mock_async_client.post = AsyncMock(side_effect=httpx.ConnectError(leaky_msg))
-    mock_async_client.aclose = AsyncMock()
-
-    caplog.set_level(logging.DEBUG)
-
-    with patch("httpx.AsyncClient", return_value=mock_async_client):
-        client = OpenAIEmbeddingClient.from_settings(cfg)
-        for _ in range(5):
-            with pytest.raises(EmbeddingProviderError) as ei:
-                await client.embed("hi", model="text-embedding-3-small")
-            assert "sk-test-CONFIDENTIAL" not in str(ei.value)
-            assert "Bearer sk-" not in str(ei.value)
-
-    for record in caplog.records:
-        msg = record.getMessage()
-        full = str(record.__dict__)
-        assert "sk-test-CONFIDENTIAL" not in msg
-        assert "sk-test-CONFIDENTIAL" not in full

package/skills/vds-skill/vds-scripts/vds_agent_core/tests/unit/llm/test_w7_logic_fixes.py

@@ -1,219 +0,0 @@
-"""W7 v20.6.1 regression tests for the logic-agent BLOCKER + HIGH fixes.
-
-Each test locks one specific fix from the W7 logic walkthrough so a future
-refactor can't silently regress them. All tests mock httpx — no real network.
-"""
-
-from __future__ import annotations
-
-import threading
-from unittest.mock import AsyncMock, MagicMock, patch
-
-import httpx
-import pytest
-from vds_agent_core.llm.embedding import (
-    _PROVIDER_REGISTRY_LOCK,
-    EMBEDDING_PROVIDERS,
-    ConfigError,
-    EmbeddingProviderError,
-    EmbeddingSettings,
-    OllamaEmbeddingClient,
-    _parse_provider_from_model,
-    register_provider,
-)
-
-
-@pytest.fixture(autouse=True)
-def _registry_snapshot():
-    """Save/restore EMBEDDING_PROVIDERS so tests can register fakes safely."""
-    snap = dict(EMBEDDING_PROVIDERS)
-    yield
-    EMBEDDING_PROVIDERS.clear()
-    EMBEDDING_PROVIDERS.update(snap)
-
-
-# ---------------------------------------------------------------------------
-# W7 logic-B-1: empty embeddings array guard
-# ---------------------------------------------------------------------------
-
-
-class TestOllamaEmptyEmbeddingsGuard:
-    """Ollama returning ``{"embeddings": []}`` MUST raise EmbeddingProviderError,
-    NOT IndexError."""
-
-    @pytest.mark.asyncio
-    async def test_embed_empty_array_raises_provider_error(self) -> None:
-        config = MagicMock()
-        config.base_url = "http://localhost:11434"
-        config.timeout_seconds = 30.0
-        client = OllamaEmbeddingClient(config)
-        mock_response = MagicMock()
-        mock_response.raise_for_status = MagicMock()
-        mock_response.json = MagicMock(return_value={"embeddings": []})
-        client._client = MagicMock()
-        client._client.post = AsyncMock(return_value=mock_response)
-        client._client.aclose = AsyncMock()
-        with pytest.raises(EmbeddingProviderError, match="empty embeddings array"):
-            await client.embed("hi", model="bge-m3")
-        await client.aclose()
-
-    @pytest.mark.asyncio
-    async def test_embed_missing_field_raises_provider_error(self) -> None:
-        config = MagicMock()
-        config.base_url = "http://localhost:11434"
-        config.timeout_seconds = 30.0
-        client = OllamaEmbeddingClient(config)
-        mock_response = MagicMock()
-        mock_response.raise_for_status = MagicMock()
-        mock_response.json = MagicMock(return_value={"other": "field"})
-        client._client = MagicMock()
-        client._client.post = AsyncMock(return_value=mock_response)
-        client._client.aclose = AsyncMock()
-        with pytest.raises(EmbeddingProviderError, match="empty embeddings array"):
-            await client.embed("hi", model="bge-m3")
-        await client.aclose()
-
-    @pytest.mark.asyncio
-    async def test_embed_batch_missing_field_raises(self) -> None:
-        config = MagicMock()
-        config.base_url = "http://localhost:11434"
-        config.timeout_seconds = 30.0
-        client = OllamaEmbeddingClient(config)
-        mock_response = MagicMock()
-        mock_response.raise_for_status = MagicMock()
-        mock_response.json = MagicMock(return_value={"data": []})
-        client._client = MagicMock()
-        client._client.post = AsyncMock(return_value=mock_response)
-        client._client.aclose = AsyncMock()
-        with pytest.raises(EmbeddingProviderError, match="missing embeddings field"):
-            await client.embed_batch(["a", "b"], model="bge-m3")
-        await client.aclose()
-
-
-# ---------------------------------------------------------------------------
-# W7 logic-B-3: register_provider lock
-# ---------------------------------------------------------------------------
-
-
-class TestRegisterProviderLock:
-    """Concurrent ``register_provider`` calls must be serialized."""
-
-    def test_lock_exists_and_is_lock_type(self) -> None:
-        # The lock module attribute must exist and be a threading lock.
-        assert _PROVIDER_REGISTRY_LOCK is not None
-        # threading.Lock() returns a _thread.lock; check it has the lock contract.
-        assert hasattr(_PROVIDER_REGISTRY_LOCK, "acquire")
-        assert hasattr(_PROVIDER_REGISTRY_LOCK, "release")
-
-    def test_concurrent_registrations_serialized(self) -> None:
-        """Stress test: 50 threads racing on the same key + force=True."""
-        results: list[bool] = []
-
-        def factory(_c: object) -> object:
-            return MagicMock()
-
-        def worker() -> None:
-            try:
-                register_provider("racer", factory, force=True)
-                results.append(True)
-            except Exception:
-                results.append(False)
-
-        threads = [threading.Thread(target=worker) for _ in range(50)]
-        for t in threads:
-            t.start()
-        for t in threads:
-            t.join()
-        # All 50 should succeed (force=True). The key point is no
-        # data-race-induced exceptions or partial state corruption.
-        assert all(results)
-        assert "racer" in EMBEDDING_PROVIDERS
-
-    def test_collision_without_force_raises(self) -> None:
-        register_provider("dup_key", lambda c: MagicMock(), force=True)
-        with pytest.raises(ConfigError, match="already registered"):
-            register_provider("dup_key", lambda c: MagicMock(), force=False)
-
-
-# ---------------------------------------------------------------------------
-# W7 logic-HIGH-2: leading-slash provider parse
-# ---------------------------------------------------------------------------
-
-
-class TestLeadingSlashProviderParse:
-    """Leading slash typos must still resolve to the provider prefix."""
-
-    @pytest.mark.parametrize(
-        ("input_str", "expected"),
-        [
-            ("openai/text-embedding-3-small", "openai"),
-            ("/openai/text-embedding-3-small", "openai"),  # W7 fix
-            ("//openai/text-embedding-3-small", "openai"),  # double-slash also tolerated
-            ("ollama/bge-m3", "ollama"),
-            ("/ollama/bge-m3", "ollama"),  # W7 fix
-            ("nokey", None),
-            ("", None),
-            ("/", None),
-            ("//", None),
-        ],
-    )
-    def test_parse_provider(self, input_str: str, expected: str | None) -> None:
-        assert _parse_provider_from_model(input_str) == expected
-
-
-# ---------------------------------------------------------------------------
-# W7 logic-B-2: response body sanitization in OpenAI client
-# ---------------------------------------------------------------------------
-
-
-class TestOpenAIResponseBodySanitization:
-    """When OpenAI returns 401 with the token echoed in JSON body, sanitize it."""
-
-    @pytest.mark.asyncio
-    async def test_response_body_token_redacted_in_error(self) -> None:
-        from vds_agent_core.llm.embedding import OpenAIEmbeddingClient
-
-        config = MagicMock()
-        config.base_url = "https://api.openai.com/v1"
-        config.timeout_seconds = 30.0
-        config.api_key = "sk-test-CONFIDENTIAL-12345"
-        config.dimension = 1536
-        client = OpenAIEmbeddingClient(config, provider_name="openai")
-
-        # Build a fake HTTPStatusError whose response.text contains the token.
-        fake_request = httpx.Request("POST", "https://api.openai.com/v1/embeddings")
-        fake_response = httpx.Response(
-            401,
-            request=fake_request,
-            content=b'{"error": {"message": "Invalid API key sk-test-CONFIDENTIAL-12345"}}',
-        )
-        exc = httpx.HTTPStatusError("401 Unauthorized", request=fake_request, response=fake_response)
-
-        client._client = MagicMock()
-        client._client.post = AsyncMock(side_effect=exc)
-        client._client.aclose = AsyncMock()
-
-        with pytest.raises(EmbeddingProviderError) as exc_info:
-            await client.embed("hello", model="text-embedding-3-small")
-        # Token MUST NOT appear in the sanitized error message.
-        assert "sk-test-CONFIDENTIAL-12345" not in exc_info.value.message
-        assert "[REDACTED]" in exc_info.value.message
-        await client.aclose()
-
-
-# ---------------------------------------------------------------------------
-# W7 dedup-D-3: OpenAI-compat factory dispatch
-# ---------------------------------------------------------------------------
-
-
-class TestOpenAICompatFactories:
-    """Each OpenAI-compat provider key must dispatch to OpenAIEmbeddingClient
-    with the correct ``provider_name`` discriminator."""
-
-    @pytest.mark.parametrize("provider", ["cohere", "voyage", "mistral", "jina"])
-    def test_factory_dispatch(self, provider: str, monkeypatch) -> None:
-        # Use dimension that bypasses the matryoshka + first-deploy validators.
-        # cohere/voyage/mistral/jina all have dimension=1024 in PROVIDER_DEFAULTS.
-        settings = EmbeddingSettings(provider=provider, model_standard=f"{provider}/foo", dimension=1024)
-        client = settings.build_client()
-        assert client.provider_name == provider

package/skills/vds-skill/vds-scripts/vds_agent_core/tests/unit/profiles/test_embedding_block_parser.py

@@ -1,194 +0,0 @@
-"""Phase 225 W3 — FR-226.13: model.embedding YAML block parser.
-
-Verifies opt-in embedding-block parsing (parse_embedding=True) plus the
-EMBEDDING_PROVIDERS registry validator. Default behavior (parse_embedding=False)
-must remain unchanged for FR-225.22 back-compat.
-"""
-
-from __future__ import annotations
-
-import os
-import textwrap
-from pathlib import Path
-
-import pytest
-from vds_agent_core.profiles import (
-    ProfileValidationError,
-    apply_runtime_profile,
-    build_embedding_settings_for_profile,
-)
-
-
-def _write_profile(tmp_path: Path, body: str) -> Path:
-    yaml_file = tmp_path / "profiles.yaml"
-    yaml_file.write_text(textwrap.dedent(body), encoding="utf-8")
-    return yaml_file
-
-
-def _scrub_embed_env(monkeypatch: pytest.MonkeyPatch) -> None:
-    for key in list(os.environ):
-        if key.startswith("VDS_AGENT_CORE_EMBED__") or key.startswith("VDS_AUDIT_EMBEDDING__"):
-            monkeypatch.delenv(key, raising=False)
-
-
-def test_parse_embedding_default_false_no_env_change(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    """parse_embedding default False => no VDS_AGENT_CORE_EMBED__ env vars set."""
-    _scrub_embed_env(monkeypatch)
-    yaml_file = _write_profile(
-        tmp_path,
-        """
-        profiles:
-          test:
-            model:
-              embedding:
-                base_url: http://localhost:11434
-        """,
-    )
-    monkeypatch.setenv("VDS_AUDIT_RUNTIME_PROFILES_FILE", str(yaml_file))
-    apply_runtime_profile("test", force_override=True)  # parse_embedding default False
-    assert "VDS_AGENT_CORE_EMBED__PROVIDER" not in os.environ
-    assert "VDS_AGENT_CORE_EMBED__DIMENSION" not in os.environ
-
-
-def test_parse_embedding_true_sets_provider_env(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    """parse_embedding=True with type=ollama sets VDS_AGENT_CORE_EMBED__PROVIDER."""
-    _scrub_embed_env(monkeypatch)
-    yaml_file = _write_profile(
-        tmp_path,
-        """
-        profiles:
-          test:
-            model:
-              embedding:
-                type: ollama
-                model: bge-m3
-                dimension: 1024
-        """,
-    )
-    monkeypatch.setenv("VDS_AUDIT_RUNTIME_PROFILES_FILE", str(yaml_file))
-    apply_runtime_profile("test", force_override=True, parse_embedding=True)
-    assert os.environ["VDS_AGENT_CORE_EMBED__PROVIDER"] == "ollama"
-    assert os.environ["VDS_AGENT_CORE_EMBED__MODEL_STANDARD"] == "bge-m3"
-    assert os.environ["VDS_AGENT_CORE_EMBED__DIMENSION"] == "1024"
-
-
-def test_parse_embedding_unknown_type_raises(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    """Unknown embedding type raises ProfileValidationError naming the registry."""
-    _scrub_embed_env(monkeypatch)
-    yaml_file = _write_profile(
-        tmp_path,
-        """
-        profiles:
-          test:
-            model:
-              embedding:
-                type: bad_provider
-                model: foo
-                dimension: 1024
-        """,
-    )
-    monkeypatch.setenv("VDS_AUDIT_RUNTIME_PROFILES_FILE", str(yaml_file))
-    with pytest.raises(
-        ProfileValidationError,
-        match=r"Unknown embedding type 'bad_provider'.*registered:",
-    ):
-        apply_runtime_profile("test", force_override=True, parse_embedding=True)
-
-
-def test_parse_embedding_invalid_dimension_raises(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    """Negative dimension raises ProfileValidationError."""
-    _scrub_embed_env(monkeypatch)
-    yaml_file = _write_profile(
-        tmp_path,
-        """
-        profiles:
-          test:
-            model:
-              embedding:
-                type: ollama
-                dimension: -1
-        """,
-    )
-    monkeypatch.setenv("VDS_AUDIT_RUNTIME_PROFILES_FILE", str(yaml_file))
-    with pytest.raises(ProfileValidationError, match=r"invalid model.embedding.dimension"):
-        apply_runtime_profile("test", force_override=True, parse_embedding=True)
-
-
-def test_build_embedding_settings_for_profile_round_trip(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    """Round-trip: profile YAML -> env vars -> EmbeddingSettings instance."""
-    _scrub_embed_env(monkeypatch)
-    # ollama defaults: dim 1024, model bge-m3, base_url host.docker.internal:11434
-    yaml_file = _write_profile(
-        tmp_path,
-        """
-        profiles:
-          rt-test:
-            model:
-              embedding:
-                type: ollama
-                model: bge-m3
-                dimension: 1024
-                base_url: http://localhost:11434
-        """,
-    )
-    monkeypatch.setenv("VDS_AUDIT_RUNTIME_PROFILES_FILE", str(yaml_file))
-    settings = build_embedding_settings_for_profile("rt-test")
-    assert settings.provider == "ollama"
-    assert settings.model_standard == "bge-m3"
-    assert settings.dimension == 1024
-    assert settings.base_url == "http://localhost:11434"
-
-
-def test_build_embedding_settings_no_block_uses_defaults(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    """Profile without embedding block falls through to EmbeddingSettings() defaults."""
-    _scrub_embed_env(monkeypatch)
-    yaml_file = _write_profile(
-        tmp_path,
-        """
-        profiles:
-          plain:
-            env:
-              FOO: bar
-        """,
-    )
-    monkeypatch.setenv("VDS_AUDIT_RUNTIME_PROFILES_FILE", str(yaml_file))
-    settings = build_embedding_settings_for_profile("plain")
-    # Defaults from EmbeddingRuntimeConfig
-    assert settings.provider == "ollama"
-    assert settings.model_standard == "bge-m3"
-    assert settings.dimension == 1024
-
-
-def test_parse_embedding_legacy_keys_still_work(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    """Legacy base_url/model/api_key keys still set VDS_AUDIT_EMBEDDING__* (back-compat)."""
-    _scrub_embed_env(monkeypatch)
-    yaml_file = _write_profile(
-        tmp_path,
-        """
-        profiles:
-          legacy:
-            model:
-              embedding:
-                base_url: http://localhost:11434
-                model: bge-m3
-        """,
-    )
-    monkeypatch.setenv("VDS_AUDIT_RUNTIME_PROFILES_FILE", str(yaml_file))
-    apply_runtime_profile("legacy", force_override=True)
-    # Legacy env vars remain populated regardless of parse_embedding flag.
-    assert os.environ.get("VDS_AUDIT_EMBEDDING__BASE_URL") == "http://localhost:11434"
-    assert os.environ.get("VDS_AUDIT_EMBEDDING__MODEL") == "bge-m3"