Harden configuration validation

internal/config/storage_publish_test.go

@@ -153,6 +153,108 @@ storage:
 	}
 }
 
+func TestStorageBackendSelectionValidation(t *testing.T) {
+	tests := []struct {
+		name        string
+		storageYAML string
+		sessionYAML string
+		wantErr     string
+		wantBackend string
+	}{
+		{
+			name:        "omitted storage defaults local",
+			wantBackend: StorageBackendLocal,
+		},
+		{
+			name: "explicit local backend",
+			storageYAML: `storage:
+  backend: local
+`,
+			wantBackend: StorageBackendLocal,
+		},
+		{
+			name: "case insensitive s3 backend normalizes",
+			storageYAML: `storage:
+  backend: S3
+  s3:
+    bucket: my-dnd-archive
+`,
+			wantBackend: StorageBackendS3,
+		},
+		{
+			name: "unknown backend",
+			storageYAML: `storage:
+  backend: s33
+`,
+			wantErr: "pipeline.storage.backend must be one of: local, s3",
+		},
+		{
+			name: "s3 block requires s3 backend",
+			storageYAML: `storage:
+  backend: local
+  s3:
+    bucket: my-dnd-archive
+`,
+			wantErr: "pipeline.storage.s3 is only supported when pipeline.storage.backend is s3",
+		},
+		{
+			name: "s3 backend requires s3 block",
+			storageYAML: `storage:
+  backend: s3
+`,
+			wantErr: "pipeline.storage.s3 is required when pipeline.storage.backend is s3",
+		},
+		{
+			name: "s3 backend requires bucket for publish",
+			storageYAML: `storage:
+  backend: s3
+  s3: {}
+`,
+			wantErr: "pipeline.storage.s3.bucket is required when S3 session audio or publish upload is enabled",
+		},
+		{
+			name: "s3 audio requires s3 backend",
+			sessionYAML: `session_id: 2026-05-03
+inputs:
+  audio_s3:
+    prefix: audio/
+`,
+			wantErr: "pipeline.storage.backend must be s3 when session.inputs.audio_s3 is configured",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			pipelineYAML := testPipelineBaseYAML
+			if tt.storageYAML != "" {
+				pipelineYAML += "\n" + tt.storageYAML
+			}
+			sessionYAML := testSessionBaseYAML
+			if tt.sessionYAML != "" {
+				sessionYAML = tt.sessionYAML
+			}
+			pipelinePath, sessionPath := writeConfigFiles(t, pipelineYAML, sessionYAML)
+			cfg, err := Load(pipelinePath, sessionPath)
+			if err != nil {
+				t.Fatalf("Load() error = %v", err)
+			}
+			err = Validate(cfg)
+			if tt.wantErr != "" {
+				if err == nil || !strings.Contains(err.Error(), tt.wantErr) {
+					t.Fatalf("Validate() error = %v, want %q", err, tt.wantErr)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("Validate() error = %v", err)
+			}
+			if cfg.Pipeline.Storage.Backend != tt.wantBackend {
+				t.Fatalf("storage.backend = %q, want %q", cfg.Pipeline.Storage.Backend, tt.wantBackend)
+			}
+		})
+	}
+}
+
 func TestSpoolAndPublishDefaults(t *testing.T) {
 	pipelinePath, sessionPath := writeConfigFiles(t, testPipelineBaseYAML, testSessionBaseYAML)
 
@@ -681,6 +783,7 @@ func TestStorageS3BucketRequiredWhenS3DependentFeatureEnabled(t *testing.T) {
 	pipelineYAML := testPipelineBaseYAML + `
 storage:
   backend: s3
+  s3: {}
 `
 	sessionYAML := `session_id: 2026-05-03
 campaign: forsaken