solpbc.org
personal memory agent
1# SPDX-License-Identifier: AGPL-3.0-only
2# Copyright (c) 2026 sol pbc
3
4"""prepare_config pins security-relevant fields against request override.
5
6access_tier selects tool capability and type steers provider/model
7resolution; neither may be overridden by a request body (the same rule the
8cwd guard already enforces). The `partner` talent is type=cogitate with
9access_tier=synthesis, so a request tier of "normal" is a privilege
10escalation that must be refused.
11"""
12
13import pytest
14
15from solstone.think.talents import prepare_config
16
17
18def test_request_cannot_override_access_tier():
19 with pytest.raises(ValueError, match="access_tier"):
20 prepare_config({"name": "partner", "access_tier": "normal"})
21
22
23def test_request_cannot_override_type():
24 with pytest.raises(ValueError, match="type"):
25 prepare_config({"name": "partner", "type": "generate"})
26
27
28def test_matching_access_tier_is_a_noop():
29 config = prepare_config({"name": "partner", "access_tier": "synthesis"})
30 assert config["access_tier"] == "synthesis"
31
32
33def test_no_override_leaves_definition_values():
34 config = prepare_config({"name": "partner"})
35 assert config["access_tier"] == "synthesis"
36 assert config["type"] == "cogitate"