@principles/pd-cli 1.100.0 → 1.102.0

package/tests/commands/diagnose.test.ts

@@ -41,6 +41,23 @@ const { MockPrincipleTreeLedgerAdapter } = vi.hoisted(() => {
   return { MockPrincipleTreeLedgerAdapter };
 });
 
+const { mockResolveRuntimeFromPdConfig } = vi.hoisted(() => {
+  const mockResolveRuntimeFromPdConfig = vi.fn().mockReturnValue({
+    result: {
+      runtimeKind: 'pi-ai',
+      provider: 'test-provider',
+      model: 'test-model',
+      apiKeyEnv: 'TEST_KEY',
+      timeoutMs: 300000,
+      agentId: 'main',
+    },
+    legacyWarnings: [],
+    configSource: '.pd/config.yaml',
+    configLoadResult: { ok: true, effective: {}, defaults: {}, legacyFilesDetected: [] },
+  });
+  return { mockResolveRuntimeFromPdConfig };
+});
+
 vi.mock('../../src/resolve-workspace.js', () => ({
   resolveWorkspaceDir: vi.fn().mockReturnValue('/tmp/fake-workspace'),
 }));
@@ -122,6 +139,10 @@ vi.mock('../../src/services/pd-config-loader.js', () => ({
   computeFlagsFromLoadResult: vi.fn().mockReturnValue({}),
 }));
 
+vi.mock('../../src/services/resolve-runtime-from-pd-config.js', () => ({
+  resolveRuntimeFromPdConfig: mockResolveRuntimeFromPdConfig,
+}));
+
 import { handleDiagnoseRun, handleDiagnoseStatus, type DiagnoseRunOptions } from '../../src/commands/diagnose.js';
 
 const SUCCEEDED_RESULT = {
@@ -177,14 +198,18 @@ describe('pd diagnose run --runtime routing', () => {
     exitSpy.mockRestore();
   });
 
-  it('HG-03: --runtime openclaw-cli without mode (no file config) fails via resolveRuntimeConfig', async () => {
-    mockResolveRuntimeConfig.mockReturnValueOnce({
-      ok: false,
-      reason: 'missing_openclaw_mode',
-      message: 'runtimeKind is openclaw-cli but no mode specified',
-      nextAction: 'Provide exactly one mode',
+  it('HG-03: --runtime openclaw-cli without mode (no file config) fails via resolveRuntimeFromPdConfig', async () => {
+    mockResolveRuntimeFromPdConfig.mockReturnValueOnce({
+      result: {
+        ok: false,
+        reason: 'missing_openclaw_mode',
+        message: 'runtimeKind is openclaw-cli but no mode specified',
+        nextAction: 'Provide exactly one mode',
+      },
+      legacyWarnings: [],
+      configSource: '.pd/config.yaml',
+      configLoadResult: { ok: true, effective: {}, defaults: {}, legacyFilesDetected: [] },
     });
-    mockIsRuntimeConfigError.mockReturnValueOnce(true);
 
     const consoleErrorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
     const exitSpy = vi.spyOn(process, 'exit').mockImplementation((() => undefined) as () => never);
@@ -196,7 +221,7 @@ describe('pd diagnose run --runtime routing', () => {
       json: false,
     } as DiagnoseRunOptions);
 
-    expect(consoleErrorSpy).toHaveBeenCalledWith(expect.stringContaining('no mode specified'));
+    expect(consoleErrorSpy).toHaveBeenCalledWith(expect.stringContaining('no mode resolved'));
     expect(exitSpy).toHaveBeenCalledWith(1);
 
     consoleErrorSpy.mockRestore();
@@ -226,13 +251,17 @@ describe('pd diagnose run --runtime routing', () => {
   });
 
   it('DPB-09: openclaw-cli with file config openclawMode succeeds without CLI flag', async () => {
-    mockResolveRuntimeConfig.mockReturnValueOnce({
-      runtimeKind: 'openclaw-cli',
-      openclawMode: 'local',
-      timeoutMs: 300000,
-      agentId: 'main',
+    mockResolveRuntimeFromPdConfig.mockReturnValueOnce({
+      result: {
+        runtimeKind: 'openclaw-cli',
+        openclawMode: 'local',
+        timeoutMs: 300000,
+        agentId: 'main',
+      },
+      legacyWarnings: [],
+      configSource: '.pd/config.yaml',
+      configLoadResult: { ok: true, effective: {}, defaults: {}, legacyFilesDetected: [] },
     });
-    mockIsRuntimeConfigError.mockReturnValueOnce(false);
 
     const consoleSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
     const exitSpy = vi.spyOn(process, 'exit').mockImplementation((() => undefined) as () => never);
@@ -250,14 +279,18 @@ describe('pd diagnose run --runtime routing', () => {
     exitSpy.mockRestore();
   });
 
-  it('DPB-09: openclaw-cli flag overrides file config mode', async () => {
-    mockResolveRuntimeConfig.mockReturnValueOnce({
-      runtimeKind: 'openclaw-cli',
-      openclawMode: 'gateway',
-      timeoutMs: 300000,
-      agentId: 'main',
+  it('DPB-09: openclaw-cli flag overrides file config mode (config=gateway, flag=local → runtimeMode=local)', async () => {
+    mockResolveRuntimeFromPdConfig.mockReturnValueOnce({
+      result: {
+        runtimeKind: 'openclaw-cli',
+        openclawMode: 'gateway',
+        timeoutMs: 300000,
+        agentId: 'main',
+      },
+      legacyWarnings: [],
+      configSource: '.pd/config.yaml',
+      configLoadResult: { ok: true, effective: {}, defaults: {}, legacyFilesDetected: [] },
     });
-    mockIsRuntimeConfigError.mockReturnValueOnce(false);
 
     const consoleSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
     const exitSpy = vi.spyOn(process, 'exit').mockImplementation((() => undefined) as () => never);
@@ -270,6 +303,13 @@ describe('pd diagnose run --runtime routing', () => {
       json: false,
     } as DiagnoseRunOptions);
 
+    // Flag override: config says gateway, flag says local → adapter gets local
+    const OpenClawCliMock = vi.mocked(
+      await import('@principles/core/runtime-v2').then(m => m.OpenClawCliRuntimeAdapter),
+    );
+    expect(OpenClawCliMock).toHaveBeenCalledWith(
+      expect.objectContaining({ runtimeMode: 'local' }),
+    );
     expect(exitSpy).not.toHaveBeenCalledWith(1);
 
     consoleSpy.mockRestore();
@@ -277,13 +317,17 @@ describe('pd diagnose run --runtime routing', () => {
   });
 
   it('DPB-09: openclaw-cli missing mode (--json) outputs JSON error', async () => {
-    mockResolveRuntimeConfig.mockReturnValueOnce({
-      ok: false,
-      reason: 'missing_openclaw_mode',
-      message: 'runtimeKind is openclaw-cli but no mode specified',
-      nextAction: 'Provide exactly one mode',
+    mockResolveRuntimeFromPdConfig.mockReturnValueOnce({
+      result: {
+        runtimeKind: 'openclaw-cli',
+        openclawMode: undefined,
+        timeoutMs: 300000,
+        agentId: 'main',
+      },
+      legacyWarnings: [],
+      configSource: '.pd/config.yaml',
+      configLoadResult: { ok: true, effective: {}, defaults: {}, legacyFilesDetected: [] },
     });
-    mockIsRuntimeConfigError.mockReturnValueOnce(true);
 
     const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
     const exitSpy = vi.spyOn(process, 'exit').mockImplementation((() => undefined) as () => never);
@@ -323,13 +367,17 @@ describe('pd diagnose run --runtime routing', () => {
   });
 
   it('DPB-09: openclaw-cli --openclaw-gateway constructs adapter with runtimeMode=gateway', async () => {
-    mockResolveRuntimeConfig.mockReturnValueOnce({
-      runtimeKind: 'openclaw-cli',
-      openclawMode: 'gateway',
-      timeoutMs: 300000,
-      agentId: 'main',
+    mockResolveRuntimeFromPdConfig.mockReturnValueOnce({
+      result: {
+        runtimeKind: 'openclaw-cli',
+        openclawMode: 'gateway',
+        timeoutMs: 300000,
+        agentId: 'main',
+      },
+      legacyWarnings: [],
+      configSource: '.pd/config.yaml',
+      configLoadResult: { ok: true, effective: {}, defaults: {}, legacyFilesDetected: [] },
     });
-    mockIsRuntimeConfigError.mockReturnValueOnce(false);
 
     const consoleSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
     const exitSpy = vi.spyOn(process, 'exit').mockImplementation((() => undefined) as () => never);
@@ -355,13 +403,17 @@ describe('pd diagnose run --runtime routing', () => {
   });
 
   it('DPB-09: openclaw-cli --openclaw-local constructs adapter with runtimeMode=local', async () => {
-    mockResolveRuntimeConfig.mockReturnValueOnce({
-      runtimeKind: 'openclaw-cli',
-      openclawMode: 'local',
-      timeoutMs: 300000,
-      agentId: 'main',
+    mockResolveRuntimeFromPdConfig.mockReturnValueOnce({
+      result: {
+        runtimeKind: 'openclaw-cli',
+        openclawMode: 'local',
+        timeoutMs: 300000,
+        agentId: 'main',
+      },
+      legacyWarnings: [],
+      configSource: '.pd/config.yaml',
+      configLoadResult: { ok: true, effective: {}, defaults: {}, legacyFilesDetected: [] },
     });
-    mockIsRuntimeConfigError.mockReturnValueOnce(false);
 
     const consoleSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
     const exitSpy = vi.spyOn(process, 'exit').mockImplementation((() => undefined) as () => never);

package/tests/commands/pain-retry.test.ts

@@ -55,7 +55,7 @@ const { MockPrincipleTreeLedgerAdapter } = vi.hoisted(() => {
   return { MockPrincipleTreeLedgerAdapter };
 });
 
-const { mockRun, mockResolveRuntimeConfig } = vi.hoisted(() => {
+const { mockRun, mockResolveRuntimeConfig, mockResolveRuntimeFromPdConfig } = vi.hoisted(() => {
   const mockRun = vi.fn().mockResolvedValue({
     status: 'succeeded',
     taskId: 'diagnosis_test-pain-1',
@@ -70,7 +70,20 @@ const { mockRun, mockResolveRuntimeConfig } = vi.hoisted(() => {
     timeoutMs: 300000,
     agentId: 'main',
   });
-  return { mockRun, mockResolveRuntimeConfig };
+  const mockResolveRuntimeFromPdConfig = vi.fn().mockReturnValue({
+    result: {
+      runtimeKind: 'pi-ai',
+      provider: 'test-provider',
+      model: 'test-model',
+      apiKeyEnv: 'TEST_KEY',
+      timeoutMs: 300000,
+      agentId: 'main',
+    },
+    legacyWarnings: [],
+    configSource: '.pd/config.yaml',
+    configLoadResult: { ok: true, effective: {}, defaults: {}, legacyFilesDetected: [] },
+  });
+  return { mockRun, mockResolveRuntimeConfig, mockResolveRuntimeFromPdConfig };
 });
 
 vi.mock('../../src/resolve-workspace.js', () => ({
@@ -128,6 +141,10 @@ vi.mock('../../src/config-reader.js', () => ({
   readOutputLanguageFromWorkspace: vi.fn().mockReturnValue({ outputLanguage: 'zh-CN' }),
 }));
 
+vi.mock('../../src/services/resolve-runtime-from-pd-config.js', () => ({
+  resolveRuntimeFromPdConfig: mockResolveRuntimeFromPdConfig,
+}));
+
 import { handlePainRetry } from '../../src/commands/pain-retry.js';
 
 // ── Test Data ──────────────────────────────────────────────────────────────────
@@ -201,6 +218,19 @@ describe('pd pain retry — validation and error paths', () => {
       timeoutMs: 300000,
       agentId: 'main',
     });
+    mockResolveRuntimeFromPdConfig.mockReturnValue({
+      result: {
+        runtimeKind: 'pi-ai',
+        provider: 'test-provider',
+        model: 'test-model',
+        apiKeyEnv: 'TEST_KEY',
+        timeoutMs: 300000,
+        agentId: 'main',
+      },
+      legacyWarnings: [],
+      configSource: '.pd/config.yaml',
+      configLoadResult: { ok: true, effective: {}, defaults: {}, legacyFilesDetected: [] },
+    });
     mockGetTask.mockResolvedValue(null);
     mockGetCandidatesByTaskId.mockResolvedValue([]);
     mockUpdateCandidateStatus.mockResolvedValue(undefined);
@@ -342,11 +372,16 @@ describe('pd pain retry — validation and error paths', () => {
 
   it('RETRY-05a: missing --runtime and no config — refused with reason + nextAction (JSON)', async () => {
     mockGetTask.mockResolvedValue(RETRY_WAIT_TASK);
-    // Make resolveRuntimeConfig return an error so no runtime is resolved from config
-    mockResolveRuntimeConfig.mockReturnValueOnce({
-      reason: 'config_not_found',
-      message: 'No workflows.yaml found',
-      nextAction: 'Create workflows.yaml or pass --runtime',
+    // PRI-393: resolveRuntimeFromPdConfig returns error → no runtime resolved
+    mockResolveRuntimeFromPdConfig.mockReturnValueOnce({
+      result: {
+        reason: 'config_not_found',
+        message: 'No .pd/config.yaml found',
+        nextAction: 'Create .pd/config.yaml or pass --runtime',
+      },
+      legacyWarnings: [],
+      configSource: '.pd/config.yaml',
+      configLoadResult: { ok: false, effective: {}, defaults: {}, legacyFilesDetected: [] },
     });
 
     const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
@@ -404,14 +439,19 @@ describe('pd pain retry — validation and error paths', () => {
 
   it('RETRY-05c: blank provider/model/apiKeyEnv — refused with missing_required_config', async () => {
     mockGetTask.mockResolvedValue(RETRY_WAIT_TASK);
-    // Config returns blank strings for provider/model/apiKeyEnv
-    mockResolveRuntimeConfig.mockReturnValueOnce({
-      runtimeKind: 'pi-ai',
-      provider: '',
-      model: '   ',
-      apiKeyEnv: '',
-      timeoutMs: 300000,
-      agentId: 'main',
+    // PRI-393: resolveRuntimeFromPdConfig returns config with blank strings
+    mockResolveRuntimeFromPdConfig.mockReturnValueOnce({
+      result: {
+        runtimeKind: 'pi-ai',
+        provider: '',
+        model: '   ',
+        apiKeyEnv: '',
+        timeoutMs: 300000,
+        agentId: 'main',
+      },
+      legacyWarnings: [],
+      configSource: '.pd/config.yaml',
+      configLoadResult: { ok: true, effective: {}, defaults: {}, legacyFilesDetected: [] },
     });
 
     const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
@@ -440,6 +480,81 @@ describe('pd pain retry — validation and error paths', () => {
     logSpy.mockRestore();
     exitSpy.mockRestore();
   });
+
+  it('DPB-09: openclaw-cli flag overrides file config mode (config=gateway, flag=local → runtimeMode=local)', async () => {
+    mockGetTask.mockResolvedValue(RETRY_WAIT_TASK);
+    mockResolveRuntimeFromPdConfig.mockReturnValueOnce({
+      result: {
+        runtimeKind: 'openclaw-cli',
+        openclawMode: 'gateway',
+        timeoutMs: 300000,
+        agentId: 'main',
+      },
+      legacyWarnings: [],
+      configSource: '.pd/config.yaml',
+      configLoadResult: { ok: true, effective: {}, defaults: {}, legacyFilesDetected: [] },
+    });
+
+    const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+    const exitSpy = vi.spyOn(process, 'exit').mockImplementation((() => undefined) as () => never);
+
+    await handlePainRetry({
+      painId: 'test-pain-1',
+      workspace: '/tmp/fake-workspace',
+      runtime: 'openclaw-cli',
+      openclawLocal: true,
+      json: true,
+    });
+
+    // Flag override: config says gateway, flag says local → adapter gets local
+    const OpenClawCliMock = vi.mocked(
+      await import('@principles/core/runtime-v2').then(m => m.OpenClawCliRuntimeAdapter),
+    );
+    expect(OpenClawCliMock).toHaveBeenCalledWith(
+      expect.objectContaining({ runtimeMode: 'local' }),
+    );
+    expect(exitSpy).not.toHaveBeenCalledWith(1);
+
+    logSpy.mockRestore();
+    exitSpy.mockRestore();
+  });
+
+  it('DPB-09: openclaw-cli flag overrides file config mode (config=local, flag=gateway → runtimeMode=gateway)', async () => {
+    mockGetTask.mockResolvedValue(RETRY_WAIT_TASK);
+    mockResolveRuntimeFromPdConfig.mockReturnValueOnce({
+      result: {
+        runtimeKind: 'openclaw-cli',
+        openclawMode: 'local',
+        timeoutMs: 300000,
+        agentId: 'main',
+      },
+      legacyWarnings: [],
+      configSource: '.pd/config.yaml',
+      configLoadResult: { ok: true, effective: {}, defaults: {}, legacyFilesDetected: [] },
+    });
+
+    const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+    const exitSpy = vi.spyOn(process, 'exit').mockImplementation((() => undefined) as () => never);
+
+    await handlePainRetry({
+      painId: 'test-pain-1',
+      workspace: '/tmp/fake-workspace',
+      runtime: 'openclaw-cli',
+      openclawGateway: true,
+      json: true,
+    });
+
+    const OpenClawCliMock = vi.mocked(
+      await import('@principles/core/runtime-v2').then(m => m.OpenClawCliRuntimeAdapter),
+    );
+    expect(OpenClawCliMock).toHaveBeenCalledWith(
+      expect.objectContaining({ runtimeMode: 'gateway' }),
+    );
+    expect(exitSpy).not.toHaveBeenCalledWith(1);
+
+    logSpy.mockRestore();
+    exitSpy.mockRestore();
+  });
 });
 
 describe('pd pain retry — success paths', () => {

package/tests/commands/pri-393-runtime-config-unification.test.ts

@@ -0,0 +1,284 @@
+/**
+ * PRI-393: Runtime config unification tests
+ *
+ * Validates that all MVP mainline execution paths (probe, run-once, diagnose,
+ * pain-retry) read from .pd/config.yaml, NOT from .state/workflows.yaml.
+ *
+ * ERR refs:
+ * - EP-02: production path wiring — tests exercise real production entry points
+ * - EP-03: fail loud — no silent fallback
+ * - EP-07: runtime state source alignment — doctor/probe/run-once agree
+ * - EP-09: test reality gap — production schema fixtures
+ */
+
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import * as yaml from 'js-yaml';
+import {
+  assertMainlineContract,
+  type MainlineSnapshot,
+} from '@principles/core/runtime-v2';
+
+// ── Helpers ────────────────────────────────────────────────────────────────
+
+function mkTmpDir(prefix = 'pri-393-'): string {
+  return fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+}
+
+function rmTmpDir(dir: string): void {
+  try { fs.rmSync(dir, { recursive: true, force: true }); } catch { /* ignore */ }
+}
+
+function writeConfigYaml(workspaceDir: string, content: object): void {
+  const pdDir = path.join(workspaceDir, '.pd');
+  fs.mkdirSync(pdDir, { recursive: true });
+  fs.writeFileSync(
+    path.join(pdDir, 'config.yaml'),
+    yaml.dump(content, { lineWidth: -1 }),
+    'utf8',
+  );
+}
+
+function writeLegacyWorkflowsYaml(workspaceDir: string, content: string): void {
+  const stateDir = path.join(workspaceDir, '.state');
+  fs.mkdirSync(stateDir, { recursive: true });
+  fs.writeFileSync(path.join(stateDir, 'workflows.yaml'), content, 'utf8');
+}
+
+/** Minimal valid .pd/config.yaml with a pi-ai runtime profile for diagnostician. */
+function makeValidConfigYaml(overrides?: { provider?: string; model?: string }): object {
+  return {
+    version: 1,
+    features: {
+      prompt: { enabled: true, category: 'core' },
+      correction_observer: { enabled: false, category: 'quiet' },
+    },
+    runtimeProfiles: {
+      lmstudio: {
+        type: 'pi-ai',
+        provider: overrides?.provider ?? 'lmstudio',
+        model: overrides?.model ?? 'local-model',
+        apiKeyEnv: 'LMSTUDIO_API_KEY',
+        baseUrl: 'http://localhost:1234/v1',
+      },
+    },
+    internalAgents: {
+      defaultRuntime: 'lmstudio',
+      agents: {
+        diagnostician: {
+          enabled: true,
+          runtimeProfile: 'lmstudio',
+        },
+      },
+    },
+  };
+}
+
+// ── Tests ──────────────────────────────────────────────────────────────────
+
+describe('PRI-393: runtime config unification', () => {
+  let tmpDir: string;
+
+  beforeEach(() => {
+    tmpDir = mkTmpDir();
+  });
+
+  afterEach(() => {
+    rmTmpDir(tmpDir);
+  });
+
+  describe('Guard: legacy resolveRuntimeConfig not imported by production commands', () => {
+    it('production command source files do NOT import legacy resolveRuntimeConfig', () => {
+      // Read the source of each production command and verify the import
+      const commandFiles = [
+        'packages/pd-cli/src/commands/runtime.ts',
+        'packages/pd-cli/src/commands/runtime-internalization-run-once.ts',
+        'packages/pd-cli/src/commands/diagnose.ts',
+        'packages/pd-cli/src/commands/pain-retry.ts',
+      ];
+
+      for (const file of commandFiles) {
+        const fullPath = path.resolve(file);
+        if (!fs.existsSync(fullPath)) continue;
+        const source = fs.readFileSync(fullPath, 'utf8');
+
+        // Check that resolveRuntimeConfig is NOT imported from @principles/core/runtime-v2
+        // (it may appear in comments or as resolveRuntimeConfigFromPdConfig)
+        // Match the full import block (handles multi-line imports)
+        const importPattern = /import\s*[\s\S]*?@principles\/core\/runtime-v2['";]/g;
+        const importBlocks: string[] = [];
+        let match;
+        while ((match = importPattern.exec(source)) !== null) {
+          importBlocks.push(match[0]);
+        }
+
+        for (const block of importBlocks) {
+          // Allow resolveRuntimeConfigFromPdConfig but NOT bare resolveRuntimeConfig
+          if (block.includes('resolveRuntimeConfig') && !block.includes('resolveRuntimeConfigFromPdConfig')) {
+            // This is the legacy import — fail
+            expect.fail(
+              `${file} still imports legacy resolveRuntimeConfig from @principles/core/runtime-v2. ` +
+              `Use resolveRuntimeFromPdConfig() from services/resolve-runtime-from-pd-config.ts instead.`,
+            );
+          }
+        }
+      }
+    });
+  });
+
+  describe('Config source alignment via mainline contract', () => {
+    function makeBaseSnapshot(readiness: Partial<MainlineSnapshot['readiness']>): MainlineSnapshot {
+      return {
+        readiness: {
+          configDoctorProfile: null,
+          runtimeProbeProfile: null,
+          configSource: '.pd/config.yaml',
+          probeConfigSource: '.pd/config.yaml',
+          diagnosticianReady: true,
+          ...readiness,
+        },
+        chain: {
+          painId: null,
+          diagnosisTask: null,
+          diagnosticianArtifact: null,
+          candidate: null,
+          dreamerTask: null,
+          dreamerContext: null,
+          successor: null,
+          principle: null,
+        },
+      };
+    }
+
+    it('violation: doctor and probe use different config sources (drift)', () => {
+      const snapshot = makeBaseSnapshot({
+        configDoctorProfile: 'pi-ai.lmstudio',
+        runtimeProbeProfile: 'pi-ai.sensenova-cn',
+        configSource: '.pd/config.yaml',
+        probeConfigSource: '.state/workflows.yaml',
+      });
+
+      const verdict = assertMainlineContract(snapshot);
+      const alignmentStage = verdict.stages.find((s) => s.stage === 'config_source_alignment');
+
+      expect(alignmentStage).toBeDefined();
+      expect(alignmentStage!.status).toBe('violation');
+      expect(alignmentStage!.reason).toContain('drift');
+      expect(alignmentStage!.nextAction).toContain('.pd/config.yaml');
+    });
+
+    it('violation: profiles match but probe reads from workflows.yaml (coincidental)', () => {
+      const snapshot = makeBaseSnapshot({
+        configDoctorProfile: 'pi-ai.lmstudio',
+        runtimeProbeProfile: 'pi-ai.lmstudio',
+        configSource: '.pd/config.yaml',
+        probeConfigSource: '.state/workflows.yaml',
+      });
+
+      const verdict = assertMainlineContract(snapshot);
+      const alignmentStage = verdict.stages.find((s) => s.stage === 'config_source_alignment');
+
+      expect(alignmentStage).toBeDefined();
+      expect(alignmentStage!.status).toBe('violation');
+      expect(alignmentStage!.reason).toContain('coincidental');
+    });
+
+    it('ok: doctor and probe agree on same profile from .pd/config.yaml', () => {
+      const snapshot = makeBaseSnapshot({
+        configDoctorProfile: 'pi-ai.lmstudio',
+        runtimeProbeProfile: 'pi-ai.lmstudio',
+        configSource: '.pd/config.yaml',
+        probeConfigSource: '.pd/config.yaml',
+      });
+
+      const verdict = assertMainlineContract(snapshot);
+      const alignmentStage = verdict.stages.find((s) => s.stage === 'config_source_alignment');
+
+      expect(alignmentStage).toBeDefined();
+      expect(alignmentStage!.status).toBe('ok');
+      expect(alignmentStage!.reason).toContain('.pd/config.yaml');
+    });
+  });
+
+  describe('resolveRuntimeFromPdConfig reads .pd/config.yaml', () => {
+    it('resolves pi-ai config from .pd/config.yaml', async () => {
+      writeConfigYaml(tmpDir, makeValidConfigYaml());
+
+      // Dynamically import to avoid module resolution issues
+      const { resolveRuntimeFromPdConfig } = await import('../../src/services/resolve-runtime-from-pd-config.js');
+      const resolved = resolveRuntimeFromPdConfig(tmpDir, () => 'test-key');
+
+      expect(resolved.configSource).toBe('.pd/config.yaml');
+      expect(resolved.result).toBeDefined();
+      // Should not be an error when config is valid
+      const { isRuntimeConfigError: isErr } = await import('@principles/core/runtime-v2');
+      expect(isErr(resolved.result)).toBe(false);
+    });
+
+    it('ignores conflicting .state/workflows.yaml when .pd/config.yaml exists', async () => {
+      // Write .pd/config.yaml with lmstudio
+      writeConfigYaml(tmpDir, makeValidConfigYaml({ provider: 'lmstudio', model: 'local-model' }));
+
+      // Write conflicting .state/workflows.yaml
+      writeLegacyWorkflowsYaml(tmpDir, `version: '1'
+funnels:
+  - workflowId: pd-runtime-v2-diagnosis
+    stages: []
+    policy:
+      runtimeKind: pi-ai
+      provider: sensenova-cn
+      model: deepseek-v4-flash
+      apiKeyEnv: SENSENOVA_API_KEY
+`);
+
+      const { resolveRuntimeFromPdConfig } = await import('../../src/services/resolve-runtime-from-pd-config.js');
+      const resolved = resolveRuntimeFromPdConfig(tmpDir, () => 'test-key');
+
+      // Should have legacy warning
+      expect(resolved.legacyWarnings.length).toBeGreaterThan(0);
+      expect(resolved.legacyWarnings[0]).toContain('workflows.yaml');
+
+      // Should resolve from .pd/config.yaml, NOT workflows.yaml
+      const { isRuntimeConfigError: isErr } = await import('@principles/core/runtime-v2');
+      if (!isErr(resolved.result)) {
+        expect(resolved.result.provider).not.toBe('sensenova-cn');
+      }
+      expect(resolved.configSource).toBe('.pd/config.yaml');
+    });
+
+    it('fail loud when .pd/config.yaml is malformed', async () => {
+      const pdDir = path.join(tmpDir, '.pd');
+      fs.mkdirSync(pdDir, { recursive: true });
+      fs.writeFileSync(path.join(pdDir, 'config.yaml'), 'version: [unterminated', 'utf8');
+
+      const { resolveRuntimeFromPdConfig } = await import('../../src/services/resolve-runtime-from-pd-config.js');
+      const { isRuntimeConfigError: isErr } = await import('@principles/core/runtime-v2');
+      const resolved = resolveRuntimeFromPdConfig(tmpDir, () => 'test-key');
+
+      // Malformed config must produce a RuntimeConfigError — never fall back to defaults
+      expect(resolved.configLoadResult.ok).toBe(false);
+      expect(resolved.configSource).toBe('.pd/config.yaml');
+      expect(isErr(resolved.result)).toBe(true);
+      if (isErr(resolved.result)) {
+        expect(resolved.result.reason).toContain('config_malformed');
+        expect(resolved.result.nextAction).toBeTruthy();
+      }
+    });
+  });
+
+  describe('JSON output purity', () => {
+    it('resolveRuntimeFromPdConfig result serializes to valid JSON', async () => {
+      writeConfigYaml(tmpDir, makeValidConfigYaml());
+
+      const { resolveRuntimeFromPdConfig } = await import('../../src/services/resolve-runtime-from-pd-config.js');
+      const resolved = resolveRuntimeFromPdConfig(tmpDir, () => 'test-key');
+
+      const jsonStr = JSON.stringify(resolved.result);
+      const parsed = JSON.parse(jsonStr);
+      expect(parsed).toBeDefined();
+      expect(typeof parsed).toBe('object');
+    });
+  });
+});