补齐 Validator 模式与权限隔离测试

tests/test_agent_mode.py

@@ -70,6 +70,8 @@ class AgentModePolicyTest(unittest.IsolatedAsyncioTestCase):
                 "AGENT_MODE": "legacy",
                 "AGENT_MAX_TOTAL_AGENTS": "not-a-number",
                 "AGENT_RESOURCE_BUDGET_ENABLED": "not-a-boolean",
+                "AGENT_MAX_VALIDATION_TOOL_CALLS": "not-a-number",
+                "AGENT_VALIDATOR_SEARCH_PROVIDER": "unsupported",
             },
             clear=False,
         ):
@@ -77,6 +79,19 @@ class AgentModePolicyTest(unittest.IsolatedAsyncioTestCase):
         self.assertEqual("legacy", trace.context["agent_mode"])
         self.assertNotIn("resource_budget", trace.context)
 
+    async def test_recursive_rejects_invalid_validator_provider_before_trace(self):
+        with patch.dict(
+            os.environ,
+            {
+                "AGENT_MODE": "recursive",
+                "AGENT_VALIDATOR_SEARCH_PROVIDER": "unsupported",
+            },
+            clear=False,
+        ):
+            with self.assertRaisesRegex(ValueError, "search_provider"):
+                await self._prepare_new("recursive")
+        self.assertEqual([], await self.store.list_traces(limit=10))
+
     async def test_invalid_mode_does_not_create_trace(self):
         with self.assertRaisesRegex(ValueError, "Invalid AGENT_MODE"):
             await self._prepare_new("unsupported")

tests/test_recursive_tool_capabilities.py

@@ -239,13 +239,25 @@ class RecursiveRuntimeDispatchTest(unittest.IsolatedAsyncioTestCase):
                 async def fake_llm(**kwargs):
                     nonlocal llm_calls
                     llm_calls += 1
-                    if kwargs.get("tools") == []:
+                    messages = kwargs.get("messages") or []
+                    if messages and "recursive_validation_protocol" in messages[0]["content"]:
+                        packet = json.loads(messages[1]["content"])
+                        scope = packet["validation_scope"]
                         return {
                             "content": json.dumps({
                                 "outcome": "passed",
-                                "scope": "root",
+                                "scope": scope,
+                                "checks": [
+                                    {
+                                        "check_id": item["check_id"],
+                                        "status": "passed",
+                                        "evidence_refs": [],
+                                        "issue": None,
+                                    }
+                                    for item in packet["validation_plan"]["checks"]
+                                    if item["scope"] == scope
+                                ],
                                 "reason": "unauthorized tools were not executed",
-                                "issues": [],
                                 "retry_from": None,
                             }),
                             "tool_calls": [],