ski-model-deploy 3.1.0a2__tar.gz → 3.2.0__tar.gz

{ski_model_deploy-3.1.0a2 → ski_model_deploy-3.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ski-model-deploy
-Version: 3.1.0a2
+Version: 3.2.0
 Summary: Deploy and verify signed Knowledge Graphs against a SKI Model runtime.
 Author-email: KpiFinity <hello@kpifinity.com>
 License-Expression: Apache-2.0
@@ -15,16 +15,19 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
+Requires-Dist: ski-schemas<4,>=3.2.0
 Requires-Dist: click<9,>=8.1.7
 Requires-Dist: pydantic<3,>=2.13.4
 Requires-Dist: python-dotenv<2,>=1.2.2
 Requires-Dist: pyyaml<7,>=6.0.1
 Requires-Dist: jinja2<4,>=3.1.6
 Requires-Dist: httpx<0.29,>=0.27
-Requires-Dist: cryptography<48,>=46
+Requires-Dist: cryptography<52,>=46
 Requires-Dist: docker<8,>=7
 Requires-Dist: psycopg[binary]<4,>=3.1.18
 

{ski_model_deploy-3.1.0a2 → ski_model_deploy-3.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ski-model-deploy"
-version = "3.1.0a2"
+version = "3.2.0"
 description = "Deploy and verify signed Knowledge Graphs against a SKI Model runtime."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -19,16 +19,19 @@ classifiers = [
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
     "Topic :: Software Development :: Libraries :: Python Modules",
 ]
 dependencies = [
+    "ski-schemas>=3.2.0,<4",
     "click>=8.1.7,<9",
     "pydantic>=2.13.4,<3",
     "python-dotenv>=1.2.2,<2",
     "pyyaml>=6.0.1,<7",
     "jinja2>=3.1.6,<4",
     "httpx>=0.27,<0.29",
-    "cryptography>=46,<48",
+    "cryptography>=46,<52",
     "docker>=7,<8",
     "psycopg[binary]>=3.1.18,<4",
 ]

{ski_model_deploy-3.1.0a2 → ski_model_deploy-3.2.0}/src/ski_model_deploy/__init__.py

@@ -3,7 +3,7 @@
 from .deployer import Deployer, UnsignedKGError
 from .models import DeploymentConfig, DeploymentStatus
 
-__version__ = "3.1.0a2"
+__version__ = "3.2.0"
 __author__ = "KpiFinity"
 
 __all__ = ["Deployer", "DeploymentConfig", "DeploymentStatus", "UnsignedKGError"]

{ski_model_deploy-3.1.0a2 → ski_model_deploy-3.2.0}/src/ski_model_deploy/cli.py

@@ -3,10 +3,12 @@
 from __future__ import annotations
 
 import json
+from pathlib import Path
+from typing import Optional
 
 import click
 
-from .deployer import Deployer, UnsignedKGError
+from .deployer import Deployer, UnsignedKGError, sign_kg
 from .utils import load_config, save_config
 
 
@@ -37,10 +39,36 @@ def init(name: str, sector: str, mode: str, output: str) -> None:
     click.echo(f"  3. Start the stack:  ski-model-deploy start --config {output}")
 
 
+@main.command()
+@click.option("--kg", "-k", required=True, help="Knowledge Graph JSON file to sign")
+@click.option("--key", required=True, help="Ed25519 private key (PEM, unencrypted) of the KG signer")
+@click.option("--output", "-o", required=True, help="Where to write the signed KG")
+def sign(kg: str, key: str, output: str) -> None:
+    """Sign a Knowledge Graph with an Ed25519 key (spec §3.5).
+
+    The runtime loads the result only if this key's public half is one of
+    its trust anchors (SKI_KG_TRUST_ANCHORS).
+    """
+    try:
+        kg_data = json.loads(Path(kg).read_text(encoding="utf-8"))
+        signed = sign_kg(kg_data, Path(key).read_bytes())
+        Path(output).write_text(json.dumps(signed, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
+        click.echo(f"✓ Signed {kg} -> {output}")
+    except Exception as exc:
+        click.echo(f"Error: {exc}", err=True)
+        raise SystemExit(1)
+
+
 @main.command(name="load-kg")
 @click.option("--config", "-c", required=True, help="Deployment configuration file")
 @click.option("--kg", "-k", required=True, help="Knowledge Graph JSON file (MUST be signed)")
-def load_kg(config: str, kg: str) -> None:
+@click.option(
+    "--trust-anchors",
+    envvar="SKI_KG_TRUST_ANCHORS",
+    default=None,
+    help="PEM bundle of Ed25519 public keys allowed to sign the KG (default: $SKI_KG_TRUST_ANCHORS).",
+)
+def load_kg(config: str, kg: str, trust_anchors: Optional[str]) -> None:
     """Verify a signed Knowledge Graph and register it with a deployment.
 
     Signature verification is MANDATORY. There is no override flag here.
@@ -52,7 +80,7 @@ def load_kg(config: str, kg: str) -> None:
         deployer = Deployer(config)
         if not deployer.config:
             deployer.config = load_config(config)
-        deployer.load_knowledge_graph(kg_path=kg)
+        deployer.load_knowledge_graph(kg_path=kg, trust_anchors=trust_anchors)
         save_config(deployer.config, config)
         click.echo("✓ Knowledge Graph signature verified and registered.")
         click.echo(f"  Version: {deployer.config.knowledge_graph.version}")

{ski_model_deploy-3.1.0a2 → ski_model_deploy-3.2.0}/src/ski_model_deploy/deployer.py

@@ -17,7 +17,10 @@ import os
 import subprocess
 import time
 from pathlib import Path
-from typing import Dict, Optional
+from typing import Any, Dict, Optional
+
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
 
 from .models import DeploymentConfig, DeploymentMode, DeploymentStatus, HealthCheck
 from .utils import generate_docker_compose, load_config, save_config
@@ -29,17 +32,51 @@ try:
 
     sys.path.insert(
         0,
-        str(Path(__file__).resolve().parents[5] / "reference-implementation" / "src"),
+        str(Path(__file__).resolve().parents[4] / "reference-implementation" / "src"),
+    )
+    from ski_model.kg_loader import (  # type: ignore
+        KGTrustPolicy,
+        KnowledgeGraph,
+        load_trust_anchors,
+        signing_bytes,
     )
-    from ski_model.kg_loader import KnowledgeGraph  # type: ignore
 except Exception:  # pragma: no cover — fall back when run as installed package
     KnowledgeGraph = None  # type: ignore
+    KGTrustPolicy = None  # type: ignore
+    load_trust_anchors = None  # type: ignore
+    signing_bytes = None  # type: ignore
 
 
 class UnsignedKGError(RuntimeError):
     """Raised if signature verification fails or is missing."""
 
 
+def sign_kg(kg_data: Dict[str, Any], private_key_pem: bytes) -> Dict[str, Any]:
+    """Return ``kg_data`` with an Ed25519 ``signature`` block over its signing bytes.
+
+    Any existing signature is replaced. The bytes are the runtime's own
+    :func:`ski_model.kg_loader.signing_bytes` (spec §3.5), so what this signs
+    is exactly what the runtime verifies.
+    """
+    if signing_bytes is None:
+        raise RuntimeError("The runtime KG loader is unavailable; cannot compute the KG signing bytes.")
+    key = serialization.load_pem_private_key(private_key_pem, password=None)
+    if not isinstance(key, Ed25519PrivateKey):
+        raise ValueError("The signing key must be an Ed25519 private key (PEM, unencrypted).")
+    unsigned = {k: v for k, v in kg_data.items() if k != "signature"}
+    public_pem = key.public_key().public_bytes(
+        serialization.Encoding.PEM, serialization.PublicFormat.SubjectPublicKeyInfo
+    )
+    return {
+        **unsigned,
+        "signature": {
+            "algorithm": "ed25519",
+            "public_key_pem": public_pem.decode("ascii"),
+            "value_hex": key.sign(signing_bytes(unsigned)).hex(),
+        },
+    }
+
+
 class Deployer:
     """Deploy and manage the SKI Model runtime."""
 
@@ -68,11 +105,18 @@ class Deployer:
     # KG loading — signature verification is MANDATORY.
     # ------------------------------------------------------------------
 
-    def load_knowledge_graph(self, kg_path: str) -> bool:
+    def load_knowledge_graph(self, kg_path: str, trust_anchors: Optional[str] = None) -> bool:
         """Verify a Knowledge Graph signature and register it with the deployment.
 
         Raises UnsignedKGError if the KG has no signature or the signature
         does not verify. There is no flag to bypass this.
+
+        Framework v3.2.0: the signature must verify against an operator
+        trust anchor, exactly as the runtime checks it. ``trust_anchors`` is
+        the path of a PEM bundle of Ed25519 public keys; when omitted the
+        runtime's own configuration applies (``SKI_KG_TRUST_ANCHORS``, or
+        the dev-only ``SKI_KG_ALLOW_UNANCHORED=true``), and with neither the
+        KG is refused.
         """
         if not os.path.exists(kg_path):
             raise FileNotFoundError(f"Knowledge Graph not found: {kg_path}")
@@ -96,7 +140,8 @@ class Deployer:
             )
 
         try:
-            kg = KnowledgeGraph.from_dict(kg_data, require_signature=True)
+            trust = KGTrustPolicy(anchors=load_trust_anchors(Path(trust_anchors))) if trust_anchors else None
+            kg = KnowledgeGraph.from_dict(kg_data, require_signature=True, trust=trust)
         except Exception as exc:
             raise UnsignedKGError(f"Signature verification failed for {kg_path}: {exc}") from exc
 
@@ -106,7 +151,9 @@ class Deployer:
             self.config.knowledge_graph = KnowledgeGraphConfig(
                 path=kg_path,
                 version=kg.version,
-                signature_verified=True,
+                # True only when verified against a trust anchor; an
+                # unanchored (SKI_KG_ALLOW_UNANCHORED) load is not "verified".
+                signature_verified=kg.signature_verified,
             )
         return True
 

{ski_model_deploy-3.1.0a2 → ski_model_deploy-3.2.0}/src/ski_model_deploy/utils.py

@@ -25,7 +25,7 @@ def load_config(config_path: str) -> DeploymentConfig:
 
 
 def save_config(config: DeploymentConfig, output_path: str) -> None:
-    data = config.model_dump()
+    data = config.model_dump(mode="json")
     if output_path.endswith((".yaml", ".yml")):
         with open(output_path, "w") as f:
             yaml.dump(data, f, default_flow_style=False, sort_keys=True)
@@ -38,16 +38,17 @@ def save_config(config: DeploymentConfig, output_path: str) -> None:
 # Docker compose template
 # ---------------------------------------------------------------------------
 #
-# Sovereign-by-default: no ANTHROPIC_API_KEY anywhere. Ollama is the
-# inference backend. Operators who want the non-conformant demo backend
-# can override SKI_INFERENCE_BACKEND=anthropic and supply the key out of
-# band, with the caveat that doing so disqualifies the deployment.
+# Sovereign-by-default: no cloud API key anywhere. Ollama is the
+# inference backend; the runtime has no cloud backend. SKI_V3_LLM_BACKEND is
+# the variable the runtime reads (v3.2.0; SKI_INFERENCE_BACKEND is only an
+# alias). Ollama >= 0.5 is required for the JSON-schema `format` the runtime
+# sends; keep the tag in step with reference-implementation/docker-compose.yml.
 
 DOCKER_COMPOSE_TEMPLATE = """version: '3.8'
 
 services:
   ollama:
-    image: ollama/ollama:0.3.12
+    image: ollama/ollama:0.40.5@sha256:5d3a2f25f9825628daba94dc0b1d421c7d57d6c03ae5faa9ba050e058bab8241
     container_name: ollama-{{ name }}
     volumes:
       - ollama-models:/root/.ollama
@@ -61,7 +62,7 @@ services:
     ports:
       - "8000:8000"
     environment:
-      SKI_INFERENCE_BACKEND: {{ ski_model.backend }}
+      SKI_V3_LLM_BACKEND: {{ ski_model.backend }}
       SKI_MODEL_NAME: {{ ski_model.model }}
       SKI_MODEL_TEMPERATURE: "{{ ski_model.temperature }}"
       SKI_MODEL_SEED: "{{ ski_model.seed }}"

{ski_model_deploy-3.1.0a2 → ski_model_deploy-3.2.0}/src/ski_model_deploy.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ski-model-deploy
-Version: 3.1.0a2
+Version: 3.2.0
 Summary: Deploy and verify signed Knowledge Graphs against a SKI Model runtime.
 Author-email: KpiFinity <hello@kpifinity.com>
 License-Expression: Apache-2.0
@@ -15,16 +15,19 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
+Requires-Dist: ski-schemas<4,>=3.2.0
 Requires-Dist: click<9,>=8.1.7
 Requires-Dist: pydantic<3,>=2.13.4
 Requires-Dist: python-dotenv<2,>=1.2.2
 Requires-Dist: pyyaml<7,>=6.0.1
 Requires-Dist: jinja2<4,>=3.1.6
 Requires-Dist: httpx<0.29,>=0.27
-Requires-Dist: cryptography<48,>=46
+Requires-Dist: cryptography<52,>=46
 Requires-Dist: docker<8,>=7
 Requires-Dist: psycopg[binary]<4,>=3.1.18
 

{ski_model_deploy-3.1.0a2 → ski_model_deploy-3.2.0}/src/ski_model_deploy.egg-info/requires.txt

@@ -1,9 +1,10 @@
+ski-schemas<4,>=3.2.0
 click<9,>=8.1.7
 pydantic<3,>=2.13.4
 python-dotenv<2,>=1.2.2
 pyyaml<7,>=6.0.1
 jinja2<4,>=3.1.6
 httpx<0.29,>=0.27
-cryptography<48,>=46
+cryptography<52,>=46
 docker<8,>=7
 psycopg[binary]<4,>=3.1.18

ski_model_deploy-3.2.0/tests/test_deployer.py

@@ -0,0 +1,183 @@
+"""Tests for the ski-model-deploy deployer."""
+
+import json
+from pathlib import Path
+from typing import Tuple
+
+import pytest
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+from ski_model_deploy import Deployer
+from ski_model_deploy.deployer import UnsignedKGError
+from ski_model_deploy.models import DeploymentConfig, DeploymentMode
+
+
+class TestDeployer:
+    def test_initialize_deployment(self) -> None:
+        deployer = Deployer()
+        config = deployer.initialize(name="test-system", sector="energy", mode="docker")
+        assert config.name == "test-system"
+        assert config.sector == "energy"
+        assert config.mode == DeploymentMode.DOCKER
+
+    def test_deployer_config_persistence(self) -> None:
+        deployer = Deployer()
+        deployer.initialize(name="test-system", sector="finance")
+        assert deployer.config is not None
+        assert deployer.config.name == "test-system"
+
+
+class TestDeploymentConfig:
+    def test_config_defaults_are_sovereign(self) -> None:
+        config = DeploymentConfig(name="test", sector="energy")
+        # Sovereign-by-default: local Ollama backend, temperature=0, mandatory TLS + API key.
+        assert config.ski_model.backend == "ollama"
+        assert config.ski_model.temperature == 0.0
+        assert config.ski_model.model == "qwen2.5:7b-instruct"
+        assert config.security.tls_enabled is True
+        assert config.security.api_key_required is True
+        assert config.monitoring.enabled is True
+        assert config.ledger.backend == "postgresql"
+
+    def test_config_sidecar_defaults_to_file_source(self) -> None:
+        config = DeploymentConfig(name="test", sector="energy")
+        assert config.sidecar.enabled is True
+        # Default telemetry source is "file" — Kafka is opt-in via compose profile.
+        assert config.sidecar.telemetry_source == "file"
+
+
+def _write_signed_kg(tmp_path: Path, key: Ed25519PrivateKey) -> Tuple[Path, str]:
+    metadata = {"version": "deploy-test-1"}
+    rules = [{"id": "r1", "metric": "so2_ppm", "predicate": "must_not_exceed", "value": 100}]
+    tags = {"emissions": "r1"}
+    canonical = json.dumps(
+        {"metadata": metadata, "rules": rules, "tag_registry": tags},
+        sort_keys=True,
+        separators=(",", ":"),
+        ensure_ascii=False,
+    ).encode("utf-8")
+    pem = (
+        key.public_key()
+        .public_bytes(serialization.Encoding.PEM, serialization.PublicFormat.SubjectPublicKeyInfo)
+        .decode("ascii")
+    )
+    kg_path = tmp_path / "kg.json"
+    kg_path.write_text(
+        json.dumps(
+            {
+                "metadata": metadata,
+                "rules": rules,
+                "tag_registry": tags,
+                "signature": {
+                    "algorithm": "ed25519",
+                    "public_key_pem": pem,
+                    "value_hex": key.sign(canonical).hex(),
+                },
+            }
+        )
+    )
+    return kg_path, pem
+
+
+class TestLoadKnowledgeGraphTrustAnchors:
+    """Framework v3.2.0: the deployer verifies against trust anchors like the runtime."""
+
+    @pytest.fixture(autouse=True)
+    def _no_env_trust(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        monkeypatch.delenv("SKI_KG_TRUST_ANCHORS", raising=False)
+        monkeypatch.delenv("SKI_KG_ALLOW_UNANCHORED", raising=False)
+
+    def test_anchored_kg_is_registered_as_verified(self, tmp_path: Path) -> None:
+        key = Ed25519PrivateKey.generate()
+        kg_path, pem = _write_signed_kg(tmp_path, key)
+        anchors = tmp_path / "anchors.pem"
+        anchors.write_text(pem)
+        deployer = Deployer()
+        deployer.initialize(name="t", sector="energy")
+        assert deployer.load_knowledge_graph(str(kg_path), trust_anchors=str(anchors))
+        assert deployer.config is not None and deployer.config.knowledge_graph is not None
+        assert deployer.config.knowledge_graph.signature_verified is True
+
+    def test_kg_signed_by_non_anchor_is_refused(self, tmp_path: Path) -> None:
+        kg_path, _ = _write_signed_kg(tmp_path, Ed25519PrivateKey.generate())
+        other = Ed25519PrivateKey.generate().public_key()
+        anchors = tmp_path / "anchors.pem"
+        anchors.write_bytes(
+            other.public_bytes(serialization.Encoding.PEM, serialization.PublicFormat.SubjectPublicKeyInfo)
+        )
+        deployer = Deployer()
+        deployer.initialize(name="t", sector="energy")
+        with pytest.raises(UnsignedKGError, match="not a configured trust anchor"):
+            deployer.load_knowledge_graph(str(kg_path), trust_anchors=str(anchors))
+
+    def test_no_anchors_configured_is_refused(self, tmp_path: Path) -> None:
+        kg_path, _ = _write_signed_kg(tmp_path, Ed25519PrivateKey.generate())
+        deployer = Deployer()
+        deployer.initialize(name="t", sector="energy")
+        with pytest.raises(UnsignedKGError, match="No KG trust anchors configured"):
+            deployer.load_knowledge_graph(str(kg_path))
+
+
+class TestSignKnowledgeGraph:
+    """`ski-model-deploy sign` produces a KG the runtime and `load-kg` accept."""
+
+    @pytest.fixture(autouse=True)
+    def _no_env_trust(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        monkeypatch.delenv("SKI_KG_TRUST_ANCHORS", raising=False)
+        monkeypatch.delenv("SKI_KG_ALLOW_UNANCHORED", raising=False)
+
+    def test_signed_demo_graph_round_trips_through_load_kg(self, tmp_path: Path) -> None:
+        from click.testing import CliRunner
+        from ski_model_deploy.cli import main
+
+        key = Ed25519PrivateKey.generate()
+        key_path = tmp_path / "kg.key"
+        key_path.write_bytes(
+            key.private_bytes(
+                serialization.Encoding.PEM, serialization.PrivateFormat.PKCS8, serialization.NoEncryption()
+            )
+        )
+        anchors = tmp_path / "anchors.pem"
+        anchors.write_bytes(
+            key.public_key().public_bytes(
+                serialization.Encoding.PEM, serialization.PublicFormat.SubjectPublicKeyInfo
+            )
+        )
+        demo = Path(__file__).resolve().parents[3] / "examples/energy/knowledge-graphs/kg-energy-v3-demo.json"
+        signed = tmp_path / "signed.json"
+        config = tmp_path / "deployment.yaml"
+        runner = CliRunner()
+
+        result = runner.invoke(main, ["sign", "--kg", str(demo), "--key", str(key_path), "-o", str(signed)])
+        assert result.exit_code == 0, result.output
+        assert runner.invoke(main, ["init", "-n", "t", "-s", "energy", "-o", str(config)]).exit_code == 0
+        result = runner.invoke(
+            main, ["load-kg", "-c", str(config), "-k", str(signed), "--trust-anchors", str(anchors)]
+        )
+        assert result.exit_code == 0, result.output
+        assert "signature verified" in result.output
+
+    def test_sign_refuses_a_non_ed25519_key(self, tmp_path: Path) -> None:
+        from cryptography.hazmat.primitives.asymmetric import ec
+        from ski_model_deploy.deployer import sign_kg
+
+        other = ec.generate_private_key(ec.SECP256R1()).private_bytes(
+            serialization.Encoding.PEM, serialization.PrivateFormat.PKCS8, serialization.NoEncryption()
+        )
+        with pytest.raises(ValueError, match="Ed25519"):
+            sign_kg({"metadata": {}, "nodes": {}, "edges": []}, other)
+
+    def test_deployer_finds_the_runtime_loader_without_help(self) -> None:
+        # The deployer resolves reference-implementation/src itself (the CLI
+        # has no pytest path setup); a wrong path left KnowledgeGraph = None.
+        import subprocess
+        import sys
+
+        code = (
+            "import ski_model_deploy.deployer as d; assert d.KnowledgeGraph is not None and d.signing_bytes"
+        )
+        subprocess.run([sys.executable, "-I", "-c", code], check=True)
+
+
+if __name__ == "__main__":  # pragma: no cover
+    pytest.main([__file__])

ski_model_deploy-3.1.0a2/tests/test_deployer.py

@@ -1,43 +0,0 @@
-"""Tests for the ski-model-deploy deployer."""
-
-import pytest
-from ski_model_deploy import Deployer
-from ski_model_deploy.models import DeploymentConfig, DeploymentMode
-
-
-class TestDeployer:
-    def test_initialize_deployment(self) -> None:
-        deployer = Deployer()
-        config = deployer.initialize(name="test-system", sector="energy", mode="docker")
-        assert config.name == "test-system"
-        assert config.sector == "energy"
-        assert config.mode == DeploymentMode.DOCKER
-
-    def test_deployer_config_persistence(self) -> None:
-        deployer = Deployer()
-        deployer.initialize(name="test-system", sector="finance")
-        assert deployer.config is not None
-        assert deployer.config.name == "test-system"
-
-
-class TestDeploymentConfig:
-    def test_config_defaults_are_sovereign(self) -> None:
-        config = DeploymentConfig(name="test", sector="energy")
-        # Sovereign-by-default: local Ollama backend, temperature=0, mandatory TLS + API key.
-        assert config.ski_model.backend == "ollama"
-        assert config.ski_model.temperature == 0.0
-        assert config.ski_model.model == "qwen2.5:7b-instruct"
-        assert config.security.tls_enabled is True
-        assert config.security.api_key_required is True
-        assert config.monitoring.enabled is True
-        assert config.ledger.backend == "postgresql"
-
-    def test_config_sidecar_defaults_to_file_source(self) -> None:
-        config = DeploymentConfig(name="test", sector="energy")
-        assert config.sidecar.enabled is True
-        # Default telemetry source is "file" — Kafka is opt-in via compose profile.
-        assert config.sidecar.telemetry_source == "file"
-
-
-if __name__ == "__main__":  # pragma: no cover
-    pytest.main([__file__])