Use PromptKit prepared execution for structured model calls

internal/framework/llm/secrets_test.go

@@ -1,38 +1,31 @@
 package llm
 
 import (
-	"reflect"
 	"testing"
 
+	ck "gitea.maximumdirect.net/eric/ConfigKit"
 	"gitea.maximumdirect.net/eric/audita/internal/core/config"
 )
 
-func TestConfiguredSecretsNilConfig(t *testing.T) {
-	if got := ConfiguredSecrets(nil); got != nil {
-		t.Fatalf("expected nil secrets for nil config, got %v", got)
-	}
-}
-
-func TestConfiguredSecretsWithValidationOverride(t *testing.T) {
-	cfg := config.Default()
-	cfg.PrimaryLLM.APIKey = "primary-secret"
-	cfg.ValidationLLM.APIKey = "validation-secret"
-
-	got := ConfiguredSecrets(&cfg)
-	want := []string{"primary-secret", "validation-secret", "validation-secret"}
-	if !reflect.DeepEqual(got, want) {
-		t.Fatalf("unexpected secrets: got=%v want=%v", got, want)
-	}
-}
-
-func TestConfiguredSecretsWithInheritedValidationKey(t *testing.T) {
-	cfg := config.Default()
-	cfg.PrimaryLLM.APIKey = "primary-secret"
-	cfg.ValidationLLM.APIKey = ""
-
-	got := ConfiguredSecrets(&cfg)
-	want := []string{"primary-secret", "", "primary-secret"}
-	if !reflect.DeepEqual(got, want) {
-		t.Fatalf("unexpected inherited secrets: got=%v want=%v", got, want)
+func TestConfiguredSecretsIncludesUnselectedBackends(t *testing.T) {
+	if ConfiguredSecrets(nil) != nil {
+		t.Fatal("nil configuration has secrets")
+	}
+	t.Setenv("SELECTED_KEY", "selected-secret")
+	t.Setenv("OTHER_KEY", "unselected-secret")
+	loaded, err := config.Load(ck.Bytes("config.yml", []byte("version: 2\nbackends:\n  selected:\n    endpoint: https://selected.invalid/v1\n    credential: SELECTED_KEY\n  other:\n    endpoint: https://other.invalid/v1\n    credential: OTHER_KEY\nllm:\n  proposal_profile: base\n")), "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := ConfiguredSecrets(&loaded.Config)
+	if len(got) != 2 {
+		t.Fatalf("secrets count = %d", len(got))
+	}
+	seen := map[string]bool{}
+	for _, value := range got {
+		seen[value] = true
+	}
+	if !seen["selected-secret"] || !seen["unselected-secret"] {
+		t.Fatal("missing resolved backend secret")
 	}
 }