feat: establish v0.70 platform milestone

internal/config/config_test.go

@@ -46,6 +46,32 @@ func TestLoadRejectsInvalidDuration(t *testing.T) {
 	}
 }
 
+func TestLoadValidatesProviderMemoryConfiguration(t *testing.T) {
+	t.Setenv("PROVIDER_MEMORY_MODE", "managed_http")
+	t.Setenv("PROVIDER_MEMORY_BASE_URL", "https://memory.example.com")
+	t.Setenv("PROVIDER_MEMORY_API_KEY", strings.Repeat("p", 40))
+	cfg, err := Load("worker")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if cfg.ProviderMemoryMode != "managed_http" || cfg.ProviderMemoryTimeout <= 0 {
+		t.Fatalf("provider memory config=%+v", cfg)
+	}
+	t.Setenv("PROVIDER_MEMORY_BASE_URL", "")
+	if _, err := Load("worker"); err == nil {
+		t.Fatal("managed provider memory should require an endpoint")
+	}
+
+	// The mode is distributed through the shared ConfigMap. Services that never
+	// create a provider-memory client must not require the API/Worker-only key.
+	t.Setenv("PROVIDER_MEMORY_API_KEY", "")
+	t.Setenv("PROVIDER_CALLBACK_SECRET", strings.Repeat("c", 32))
+	t.Setenv("PLATFORM_HEALTH_CALLBACK_SECRET", strings.Repeat("h", 32))
+	if _, err := Load("callbacks"); err != nil {
+		t.Fatalf("callbacks should ignore provider-memory credentials: %v", err)
+	}
+}
+
 func TestLoadReadsSecretsFromAbsoluteFiles(t *testing.T) {
 	secret := strings.Repeat("k", 40)
 	path := filepath.Join(t.TempDir(), "ark-api-key")
@@ -118,12 +144,14 @@ func TestProductionAPIAcceptsHardenedConfiguration(t *testing.T) {
 	cfg.AuthIssuerURL = "https://identity.example.com/realms/voice"
 	cfg.AuthJWKSURL = "https://identity.example.com/realms/voice/certs"
 	cfg.DeviceLocalSecret = strings.Repeat("d", 40)
-	cfg.DeviceSecretDirectory = t.TempDir()
+	cfg.DeviceCredentialMasterKey = strings.Repeat("ab", 32)
 	cfg.RTCTokenSecret = strings.Repeat("t", 40)
 	cfg.RTCTokenIssuer = "volcengine"
 	cfg.RTCAppKey = strings.Repeat("v", 40)
 	cfg.CursorSigningSecret = strings.Repeat("c", 40)
 	cfg.ShareTokenSecret = strings.Repeat("h", 40)
+	cfg.MemoryToolSigningSecret = strings.Repeat("m", 40)
+	cfg.MemoryToolBaseURL = "https://api.example.com/internal/v1/tools/memory-search"
 	cfg.RTCAppID = "661e7ae5543cf00000000000"
 	cfg.ObjectStoreEndpoint = "objects.internal.example.com:9000"
 	cfg.ObjectStorePublic = "objects.example.com"
@@ -151,7 +179,7 @@ func TestProductionRejectsReusedSigningSecrets(t *testing.T) {
 	cfg.AuthIssuerURL = "https://identity.example.com/realms/voice"
 	cfg.AuthJWKSURL = "https://identity.example.com/realms/voice/certs"
 	cfg.DeviceLocalSecret = strings.Repeat("x", 40)
-	cfg.DeviceSecretDirectory = t.TempDir()
+	cfg.DeviceCredentialMasterKey = strings.Repeat("cd", 32)
 	cfg.RTCTokenSecret = strings.Repeat("x", 40)
 	cfg.RTCTokenIssuer = "volcengine"
 	cfg.RTCAppKey = strings.Repeat("v", 40)
@@ -197,6 +225,7 @@ func TestProductionWorkerRequiresRealArkContentGenerator(t *testing.T) {
 	cfg.ObjectStoreSecretKey = strings.Repeat("s", 40)
 	cfg.ObjectStoreSecure = true
 	cfg.ObjectStorePublicSecure = true
+	cfg.MemoryToolSigningSecret = strings.Repeat("m", 40)
 	if err = cfg.Validate(); err == nil || !strings.Contains(err.Error(), "content generation") {
 		t.Fatalf("Validate() error=%v, want local content generator production gate", err)
 	}