agentforge-core 0.2.4__tar.gz → 0.3.0__tar.gz

{agentforge_core-0.2.4 → agentforge_core-0.3.0}/.gitignore

@@ -47,3 +47,13 @@ Thumbs.db
 # Project-local
 *.local
 .agentforge-state/.session-cache
+
+# AI-assistant working state — local session tracking, not part of
+# the published project. The process docs under .claude/ (standards,
+# checklists, CLAUDE.md) are intentionally kept tracked; only the
+# churny per-session state files are ignored.
+.claude/state/
+
+# Launch / go-to-market drafts — local-only marketing material,
+# never published to the repo.
+launch/

{agentforge_core-0.2.4 → agentforge_core-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentforge-core
-Version: 0.2.4
+Version: 0.3.0
 Summary: AgentForge core — stable contracts (ABCs, value types) for the agentic framework
 Project-URL: Homepage, https://github.com/Scaffoldic/agentforge-py
 Project-URL: Repository, https://github.com/Scaffoldic/agentforge-py

{agentforge_core-0.2.4 → agentforge_core-0.3.0}/pyproject.toml

@@ -9,7 +9,7 @@
 
 [project]
 name = "agentforge-core"
-version = "0.2.4"
+version = "0.3.0"
 description = "AgentForge core — stable contracts (ABCs, value types) for the agentic framework"
 readme = "README.md"
 requires-python = ">=3.13"

{agentforge_core-0.2.4 → agentforge_core-0.3.0}/src/agentforge_core/config/__init__.py

@@ -20,6 +20,10 @@ bump; removing or renaming requires a major bump.
 
 from __future__ import annotations
 
+from agentforge_core.config.app_sections import (
+    discover_app_sections,
+    validate_app_config,
+)
 from agentforge_core.config.loader import load_config, parse_overrides
 from agentforge_core.config.module_schemas import validate_module_configs
 from agentforge_core.config.schema import (
@@ -56,7 +60,9 @@ __all__ = [
     "RerankerEntry",
     "RetrievalConfig",
     "RetrieverModuleConfig",
+    "discover_app_sections",
     "load_config",
     "parse_overrides",
+    "validate_app_config",
     "validate_module_configs",
 ]

agentforge_core-0.3.0/src/agentforge_core/config/app_sections.py

@@ -0,0 +1,124 @@
+"""Registered app-config section validation (feat-026 Phase 2).
+
+Phase 1 (enh-002) added the reserved ``app:`` namespace and the
+``app_as`` accessor: the framework stored the subtree but validated
+nothing inside it — a derived agent owned validation entirely. Phase 2
+closes the parity gap with *module* config. A derived agent or plugin
+registers a Pydantic schema per ``app.<section>`` through a new
+entry-point group, exactly mirroring how modules register their classes
+(ADR-0004)::
+
+    [project.entry-points."agentforge.config_sections"]
+    graph = "agentforge_graph.config:GraphConfig"
+
+``agentforge config validate`` then validates each registered section
+the same way :func:`validate_module_configs` validates ``modules.*``:
+
+- A section present in ``app:`` **and** registered → validated strictly
+  against its schema; a typo or bad value fails the command.
+- A section present in ``app:`` but **not** registered → left untouched
+  (free-form, like an undocumented ``[tool.x]`` in ``pyproject.toml``).
+- A registered section **absent** from ``app:`` → nothing to validate.
+- A section whose package isn't installed → simply never discovered, so
+  validation degrades gracefully with no special-casing (the lenient
+  behaviour ``validate_module_configs`` gets from ``strict=False``).
+
+This keeps the single ``app:`` boundary (feat-026 §8): registration maps
+names *under* ``app:`` to schemas; it never opens new top-level keys.
+"""
+
+from __future__ import annotations
+
+import logging
+from importlib.metadata import entry_points
+from typing import TYPE_CHECKING
+
+from pydantic import BaseModel, ValidationError
+
+from agentforge_core.production.exceptions import ModuleError
+
+if TYPE_CHECKING:
+    from collections.abc import Mapping
+
+    from agentforge_core.config.schema import AgentForgeConfig
+
+_log = logging.getLogger("agentforge.config")
+
+#: Entry-point group mapping an ``app.<section>`` name to a Pydantic
+#: schema. Parallel to the ``agentforge.<category>`` groups the resolver
+#: scans, but consumed here rather than by the runtime resolver (the
+#: resolver skips this group — see ``resolver.discover``).
+SECTIONS_GROUP = "agentforge.config_sections"
+
+
+def discover_app_sections() -> dict[str, type[BaseModel]]:
+    """Scan the ``agentforge.config_sections`` entry-point group.
+
+    Returns a mapping of section name → Pydantic model class. Entries
+    that fail to import, or whose target is not a ``BaseModel`` subclass,
+    are skipped with a warning. On a duplicate name across distributions
+    the first registration wins (matches the resolver's §8 conflict
+    rule).
+    """
+    sections: dict[str, type[BaseModel]] = {}
+    for ep in entry_points(group=SECTIONS_GROUP):
+        if ep.name in sections:
+            _log.warning(
+                "duplicate app-config section %r ignored (first registration wins)",
+                ep.name,
+            )
+            continue
+        try:
+            model = ep.load()
+        except Exception as exc:
+            _log.warning(
+                "skipping app-config section %r: load failed (%s: %s)",
+                ep.name,
+                type(exc).__name__,
+                exc,
+            )
+            continue
+        if not (isinstance(model, type) and issubclass(model, BaseModel)):
+            _log.warning(
+                "skipping app-config section %r: %r is not a pydantic BaseModel subclass",
+                ep.name,
+                model,
+            )
+            continue
+        sections[ep.name] = model
+    return sections
+
+
+def validate_app_config(
+    cfg: AgentForgeConfig,
+    *,
+    sections: Mapping[str, type[BaseModel]] | None = None,
+) -> None:
+    """Validate each registered ``app.<section>`` against its schema.
+
+    Mirrors :func:`validate_module_configs`. Only sections that are both
+    present in ``cfg.app`` and registered via an entry point are checked;
+    unregistered sections are left untouched (free-form). A registered
+    section that fails its schema always raises :class:`ModuleError` —
+    validation failures are fatal, the same as for module config.
+
+    Args:
+        cfg: a loaded :class:`AgentForgeConfig` (post-``load_config``).
+        sections: pre-discovered section map. Defaults to
+            :func:`discover_app_sections`; injectable so tests (and
+            future callers with a cached registry) can supply their own.
+
+    Raises:
+        ModuleError: a registered ``app.<section>`` subtree fails its
+            schema.
+    """
+    registry = sections if sections is not None else discover_app_sections()
+    for name, model in registry.items():
+        if name not in cfg.app:
+            continue
+        try:
+            model.model_validate(cfg.app[name])
+        except ValidationError as exc:
+            raise ModuleError(
+                f"app.{name} failed validation: {exc.errors(include_url=False)}"
+            ) from exc

{agentforge_core-0.2.4 → agentforge_core-0.3.0}/src/agentforge_core/config/loader.py

@@ -3,11 +3,13 @@
 Resolution order (last wins) per spec §4.3:
 
     1. Defaults from each Pydantic model.
-    2. agentforge.yaml on disk (if present).
-    3. agentforge.<env>.yaml (if AGENTFORGE_ENV set).
-    4. Env-var interpolation inside YAML values.
-    5. CLI / loader-API `--override agent.budget.usd=10` arguments.
-    6. Constructor kwargs to Agent (handled in `agentforge.agent`).
+    2. Files pulled in via an `imports:` directive (feat-026 Phase 3),
+       lower precedence than the file that imports them.
+    3. agentforge.yaml on disk (if present).
+    4. agentforge.<env>.yaml (if AGENTFORGE_ENV set).
+    5. Env-var interpolation inside YAML values.
+    6. CLI / loader-API `--override agent.budget.usd=10` arguments.
+    7. Constructor kwargs to Agent (handled in `agentforge.agent`).
 
 Env-var interpolation syntax (feat-001):
 - `${VAR}` — required; raises at load if missing.
@@ -155,6 +157,65 @@ def _read_yaml(path: Path) -> dict[str, Any]:
     return raw
 
 
+#: Reserved top-level loader directive (feat-026 Phase 3): a list of
+#: paths to other config files to pull in. Consumed by the loader
+#: (popped before validation), so it never reaches `AgentForgeConfig`.
+_IMPORTS_KEY = "imports"
+
+
+def _load_file_with_imports(path: Path, *, _visiting: tuple[Path, ...] = ()) -> dict[str, Any]:
+    """Read a config file and resolve its ``imports:`` directive (feat-026
+    Phase 3 — pluggable config *sources*).
+
+    ``imports:`` is a top-level list of paths to other config files,
+    resolved **relative to this file's directory** (absolute paths are
+    honoured as-is). Import path strings get ``${ENV}`` interpolation so
+    ``imports: ["${EXTRA_CONFIG}"]`` works.
+
+    Precedence follows Spring Boot's ``spring.config.import``: an imported
+    file is **lower precedence than the file that imports it** — you
+    import shared defaults and override them locally. Within one
+    ``imports:`` list, later entries beat earlier ones. Imports compose
+    transitively (an imported file may itself import); cycles raise
+    ``ModuleError``.
+
+    The directive is consumed here — the returned mapping never contains
+    an ``imports`` key, so it doesn't collide with the root model's
+    ``extra="forbid"`` and ``config show --resolved`` shows the merged
+    result, not the directive.
+    """
+    resolved = path.resolve()
+    if resolved in _visiting:
+        chain = " -> ".join(str(p) for p in (*_visiting, resolved))
+        raise ModuleError(f"Circular config import detected: {chain}")
+
+    raw = _read_yaml(path)
+    imports = raw.pop(_IMPORTS_KEY, None)
+    if imports is None:
+        return raw
+    if not isinstance(imports, list):
+        raise ModuleError(
+            f"`imports:` in {path} must be a list of file paths; got {type(imports).__name__}."
+        )
+
+    merged: dict[str, Any] = {}
+    for entry in imports:
+        if not isinstance(entry, str):
+            raise ModuleError(f"`imports:` entries in {path} must be strings; got {entry!r}.")
+        import_path = Path(_interp(entry))
+        if not import_path.is_absolute():
+            import_path = path.parent / import_path
+        if not import_path.exists():
+            raise ModuleError(
+                f"Imported config file not found: {import_path} (imported by {path})."
+            )
+        imported = _load_file_with_imports(import_path, _visiting=(*_visiting, resolved))
+        merged = _deep_merge(merged, imported)
+
+    # The importing file's own keys win over everything it imports.
+    return _deep_merge(merged, raw)
+
+
 def _env_overlay_path(base: Path, env: str) -> Path:
     """Compute the overlay path next to `base`: foo.yaml → foo.<env>.yaml."""
     return base.with_suffix(f".{env}{base.suffix}")
@@ -191,14 +252,15 @@ def load_config(
     if resolved_path is None or not resolved_path.exists():
         merged: dict[str, Any] = {}
     else:
-        merged = _read_yaml(resolved_path)
+        merged = _load_file_with_imports(resolved_path)
         # Layered env file overlays the base. Missing overlay is fine
-        # (env-without-file is just "use base").
+        # (env-without-file is just "use base"). The overlay is itself
+        # import-aware, so an `agentforge.<env>.yaml` may pull in files too.
         resolved_env = env if env is not None else os.environ.get("AGENTFORGE_ENV")
         if resolved_env:
             overlay_path = _env_overlay_path(resolved_path, resolved_env)
             if overlay_path.exists():
-                merged = _deep_merge(merged, _read_yaml(overlay_path))
+                merged = _deep_merge(merged, _load_file_with_imports(overlay_path))
 
     interpolated = _walk(merged)
     if overrides:

{agentforge_core-0.2.4 → agentforge_core-0.3.0}/src/agentforge_core/config/schema.py

@@ -15,10 +15,12 @@ is the data-side representation.
 from __future__ import annotations
 
 from pathlib import Path
-from typing import Any, Literal
+from typing import Any, Literal, TypeVar
 
 from pydantic import BaseModel, ConfigDict, Field, field_validator, model_validator
 
+_AppModelT = TypeVar("_AppModelT", bound=BaseModel)
+
 
 def _normalise_named_entry(value: Any) -> Any:
     """Normalise the terse YAML sugar for `name + config` entries into the
@@ -470,3 +472,34 @@ class AgentForgeConfig(BaseModel):
     logging: LoggingConfig = Field(default_factory=LoggingConfig)
     output: OutputConfig = Field(default_factory=OutputConfig)
     guardrail_policy: GuardrailPolicy = Field(default_factory=GuardrailPolicy)
+    app: dict[str, Any] = Field(default_factory=dict)
+    """Reserved namespace for **application** config (enh-002, feat-026
+    Phase 1). The framework accepts this subtree but does not interpret
+    it: a consuming agent puts its own config here and validates it with
+    its own Pydantic model via :meth:`app_as`. Every other top-level key
+    stays strict (`extra="forbid"`), so framework-key typos are still
+    caught. Values inside `app:` get `${ENV}` interpolation, env-file
+    layering, dotted-path overrides, and `config show --resolved` for
+    free — they ride the same loader passes as framework keys. The
+    framework performs no *registered-schema* validation inside `app:`
+    in Phase 1; that arrives in feat-026 Phase 2."""
+
+    def app_as(self, model: type[_AppModelT], key: str | None = None) -> _AppModelT:
+        """Validate and return an application-config subtree.
+
+        `key=None` validates the whole `app:` mapping; otherwise the
+        `app[key]` subtree (missing key → empty mapping, so the caller's
+        model supplies its own defaults). The caller's model owns its own
+        strictness, so app-key typos surface here — strictness is
+        delegated into `app:`, not lost.
+
+        Example::
+
+            class GraphConfig(BaseModel):
+                store: StoreConfig
+
+
+            graph_cfg = cfg.app_as(GraphConfig, "graph")
+        """
+        raw = self.app if key is None else self.app.get(key, {})
+        return model.model_validate(raw)

{agentforge_core-0.2.4 → agentforge_core-0.3.0}/src/agentforge_core/resolver/discover.py

@@ -34,6 +34,12 @@ _log = logging.getLogger("agentforge.resolver")
 
 _GROUP_PREFIX = "agentforge."
 
+# Groups under `agentforge.*` that are NOT runtime-resolver categories.
+# `config_sections` maps app-config section names to pydantic schemas
+# (feat-026 Phase 2); it is consumed by `config.app_sections`, not the
+# resolver, so skip it here to keep schemas out of the module registry.
+_NON_RESOLVER_GROUPS = frozenset({"config_sections"})
+
 # Module-level state held on a mutable list to avoid `global` (PLW0603).
 _discovered: list[bool] = [False]
 # Cache of resolved ModuleInfo per registered entry — keyed by
@@ -75,6 +81,8 @@ def discover_entry_points(resolver: Resolver, *, force: bool = False) -> int:
         if not ep.group.startswith(_GROUP_PREFIX):
             continue
         category = ep.group[len(_GROUP_PREFIX) :]
+        if category in _NON_RESOLVER_GROUPS:
+            continue
         try:
             cls = ep.load()
         except Exception as exc:

agentforge_core-0.3.0/tests/integration/test_app_sections_real_discovery.py

@@ -0,0 +1,170 @@
+"""Real end-to-end discovery test for feat-026 Phase 2 — *no* mocking.
+
+`test_config_app_sections.py` (unit) injects a section map or
+monkeypatches `entry_points`. This test goes the whole way: it drops a
+**real installed distribution** on `sys.path` — a real `.dist-info` with
+a real `entry_points.txt` declaring the `agentforge.config_sections`
+group, plus a real importable module exposing the schema class — and
+exercises the actual `importlib.metadata` discovery path:
+
+- `discover_app_sections()` finds the section via real entry-point
+  resolution and `ep.load()` imports the real schema class.
+- `validate_app_config()` validates a real `app.<section>` subtree
+  against that freshly-imported schema, and rejects a typo.
+
+This is the proof the monkeypatched tests can't give: that a derived
+agent declaring `[project.entry-points."agentforge.config_sections"]` in
+its own `pyproject.toml` is actually discovered and validated.
+"""
+
+from __future__ import annotations
+
+import importlib
+import os
+import shutil
+import subprocess  # nosec B404 — fixed argv, no shell
+import sys
+import textwrap
+from pathlib import Path
+
+import pytest
+from agentforge_core.config import (
+    AgentForgeConfig,
+    discover_app_sections,
+    validate_app_config,
+)
+from agentforge_core.production.exceptions import ModuleError
+
+_MODULE = "af_fake_section_pkg"
+_DIST = "af-fake-section"
+_SECTION = "graph"
+_ATTR = "GraphConfig"
+
+
+def _install_fake_dist(site: Path) -> None:
+    """Lay down a real importable module + a real `.dist-info` whose
+    `entry_points.txt` registers our section — the on-disk shape pip / uv
+    produce when a package declares the entry point."""
+    (site / f"{_MODULE}.py").write_text(
+        textwrap.dedent(
+            f"""
+            from pydantic import BaseModel, ConfigDict
+
+            class _Store(BaseModel):
+                model_config = ConfigDict(strict=True, extra="forbid")
+                path: str
+
+            class {_ATTR}(BaseModel):
+                model_config = ConfigDict(strict=True, extra="forbid")
+                store: _Store
+                max_hops: int = 3
+            """
+        )
+    )
+    dist_info = site / f"{_DIST.replace('-', '_')}-1.0.0.dist-info"
+    dist_info.mkdir()
+    (dist_info / "METADATA").write_text(f"Metadata-Version: 2.1\nName: {_DIST}\nVersion: 1.0.0\n")
+    (dist_info / "entry_points.txt").write_text(
+        f"[agentforge.config_sections]\n{_SECTION} = {_MODULE}:{_ATTR}\n"
+    )
+
+
+@pytest.fixture
+def fake_section(tmp_path: Path, monkeypatch: pytest.MonkeyPatch):
+    """Install the fake distribution on a throwaway site dir, put it on
+    `sys.path`, and tear it all down afterwards."""
+    site = tmp_path / "site-packages"
+    site.mkdir()
+    _install_fake_dist(site)
+    monkeypatch.syspath_prepend(str(site))
+    importlib.invalidate_caches()
+    try:
+        yield
+    finally:
+        sys.modules.pop(_MODULE, None)
+
+
+def test_real_entry_point_is_discovered(fake_section: None) -> None:
+    found = discover_app_sections()
+    assert _SECTION in found, "real entry point was not discovered via importlib.metadata"
+    assert found[_SECTION].__name__ == _ATTR
+
+
+def test_real_section_validates_ok(fake_section: None) -> None:
+    cfg = AgentForgeConfig.model_validate(
+        {"app": {_SECTION: {"store": {"path": ".ckg"}, "max_hops": 4}}}
+    )
+    # Real discovery + real schema, no injected registry → must not raise.
+    validate_app_config(cfg)
+
+
+def test_real_section_typo_is_rejected(fake_section: None) -> None:
+    cfg = AgentForgeConfig.model_validate(
+        {"app": {_SECTION: {"store": {"path": ".ckg"}, "max_hopz": 4}}}
+    )
+    with pytest.raises(ModuleError) as exc:
+        validate_app_config(cfg)
+    assert f"app.{_SECTION}" in str(exc.value)
+
+
+def test_unregistered_section_untouched_with_real_discovery(fake_section: None) -> None:
+    """Even with a real registered `graph` section discovered, an
+    *unregistered* sibling section stays free-form."""
+    cfg = AgentForgeConfig.model_validate(
+        {"app": {"telemetry": {"whatever": "is fine", "deeply": {"nested": 1}}}}
+    )
+    validate_app_config(cfg)  # graph not present; telemetry unregistered → no raise
+
+
+# --- full CLI subprocess e2e: the real `agentforge` binary --------
+
+
+def _agentforge_bin() -> str | None:
+    """The installed `agentforge` console script next to this interpreter."""
+    candidate = Path(sys.executable).parent / "agentforge"
+    if candidate.exists():
+        return str(candidate)
+    return shutil.which("agentforge")
+
+
+def _run_validate(site: Path, yaml_path: Path) -> subprocess.CompletedProcess[str]:
+    """Run `agentforge config validate` in a real subprocess with the
+    fake distribution discoverable via PYTHONPATH (so the child's own
+    `importlib.metadata` finds the entry point — no in-process state)."""
+    env = dict(os.environ)
+    env["PYTHONPATH"] = os.pathsep.join([str(site), *([p] if (p := env.get("PYTHONPATH")) else [])])
+    return subprocess.run(  # nosec B603 — fixed argv, no shell
+        [_agentforge_bin() or "agentforge", "config", "validate", "--path", str(yaml_path)],
+        capture_output=True,
+        text=True,
+        env=env,
+        check=False,
+    )
+
+
+@pytest.mark.skipif(_agentforge_bin() is None, reason="agentforge console script not installed")
+def test_cli_subprocess_validates_registered_section(tmp_path: Path) -> None:
+    """End-to-end: the real `agentforge` binary discovers a real installed
+    `agentforge.config_sections` entry point and validates `app.graph`."""
+    site = tmp_path / "site-packages"
+    site.mkdir()
+    _install_fake_dist(site)
+    yaml_path = tmp_path / "agentforge.yaml"
+    yaml_path.write_text("app:\n  graph:\n    store:\n      path: .ckg\n    max_hops: 4\n")
+
+    result = _run_validate(site, yaml_path)
+    assert result.returncode == 0, f"stderr: {result.stderr}"
+    assert "OK" in result.stdout
+
+
+@pytest.mark.skipif(_agentforge_bin() is None, reason="agentforge console script not installed")
+def test_cli_subprocess_rejects_section_typo(tmp_path: Path) -> None:
+    site = tmp_path / "site-packages"
+    site.mkdir()
+    _install_fake_dist(site)
+    yaml_path = tmp_path / "agentforge.yaml"
+    yaml_path.write_text("app:\n  graph:\n    store:\n      path: .ckg\n    max_hopz: 4\n")
+
+    result = _run_validate(site, yaml_path)
+    assert result.returncode == 1
+    assert "app.graph" in result.stderr

agentforge_core-0.3.0/tests/integration/test_config_imports_cli.py

@@ -0,0 +1,86 @@
+"""Full CLI subprocess e2e for the `imports:` directive (feat-026
+Phase 3).
+
+The unit tests in `tests/unit/test_config_imports.py` load real files
+through the loader API. These go one level further: they run the real
+`agentforge config {show,validate}` binary in a subprocess against a
+multi-file config, proving the directive works end-to-end through the
+CLI exactly as a user invokes it.
+"""
+
+from __future__ import annotations
+
+import os
+import shutil
+import subprocess  # nosec B404 — fixed argv, no shell
+import sys
+from pathlib import Path
+
+import pytest
+import yaml
+
+
+def _agentforge_bin() -> str | None:
+    candidate = Path(sys.executable).parent / "agentforge"
+    if candidate.exists():
+        return str(candidate)
+    return shutil.which("agentforge")
+
+
+def _run(args: list[str], cwd: Path) -> subprocess.CompletedProcess[str]:
+    return subprocess.run(  # nosec B603 — fixed argv, no shell
+        [_agentforge_bin() or "agentforge", *args],
+        cwd=cwd,
+        capture_output=True,
+        text=True,
+        env=dict(os.environ),
+        check=False,
+    )
+
+
+pytestmark = pytest.mark.skipif(
+    _agentforge_bin() is None, reason="agentforge console script not installed"
+)
+
+
+def test_cli_show_resolved_merges_imports(tmp_path: Path) -> None:
+    (tmp_path / "shared.yaml").write_text("agent:\n  model: shared-model\n  max_iterations: 9\n")
+    (tmp_path / "agentforge.yaml").write_text(
+        "imports:\n  - shared.yaml\nagent:\n  name: local-agent\n"
+    )
+
+    result = _run(["config", "show", "--resolved", "--path", "agentforge.yaml"], cwd=tmp_path)
+    assert result.returncode == 0, f"stderr: {result.stderr}"
+    parsed = yaml.safe_load(result.stdout)
+    # Imported value present, local value present, directive consumed.
+    assert parsed["agent"]["model"] == "shared-model"
+    assert parsed["agent"]["max_iterations"] == 9
+    assert parsed["agent"]["name"] == "local-agent"
+    assert "imports" not in parsed
+
+
+def test_cli_validate_passes_with_imports(tmp_path: Path) -> None:
+    (tmp_path / "shared.yaml").write_text("agent:\n  budget:\n    usd: 3.0\n")
+    (tmp_path / "agentforge.yaml").write_text("imports:\n  - shared.yaml\n")
+
+    result = _run(["config", "validate", "--path", "agentforge.yaml"], cwd=tmp_path)
+    assert result.returncode == 0, f"stderr: {result.stderr}"
+    assert "OK" in result.stdout
+
+
+def test_cli_validate_fails_on_bad_imported_value(tmp_path: Path) -> None:
+    """A schema violation that lives in an imported file is caught the
+    same as one in the base file — imports are fully validated."""
+    (tmp_path / "shared.yaml").write_text("agent:\n  budget:\n    usd: -5\n")  # negative
+    (tmp_path / "agentforge.yaml").write_text("imports:\n  - shared.yaml\n")
+
+    result = _run(["config", "validate", "--path", "agentforge.yaml"], cwd=tmp_path)
+    assert result.returncode == 1
+    assert "agent.budget.usd" in result.stderr
+
+
+def test_cli_validate_reports_missing_import(tmp_path: Path) -> None:
+    (tmp_path / "agentforge.yaml").write_text("imports:\n  - nope.yaml\n")
+    result = _run(["config", "validate", "--path", "agentforge.yaml"], cwd=tmp_path)
+    assert result.returncode == 1
+    assert "not found" in result.stderr