extract_params never supplies base_url — tool always fails via executor

The investigation executor calls tool.run(**tool.extract_params(sources)). extract_params returns only {"query": None, "limit": 50, "start": "-1h"} — it never extracts base_url or tenant_id from the integration config. Inside run(), vl_conf = kwargs.get("sources", {}).get("victoria_logs", {}) will always be {} (no sources key is passed), so config.base_url will always be "", and the method immediately returns {"available": False, "error": "VictoriaLogs base_url is required."}. Every executor-driven call to this tool is dead on arrival.

The pattern used by AlertmanagerAlertsTool (see app/tools/AlertmanagerAlertsTool/__init__.py) is the correct approach: extract_params must surface base_url and tenant_id directly, and run() must accept them as explicit parameters instead of fishing them out of **kwargs["sources"].

Verification test calls raise_for_status on an un-mocked mock

mock_response.raise_for_status is a MagicMock by default — calling it does nothing and won't raise. The verify path in client.py calls resp.raise_for_status() before parsing the body, so a 4xx/5xx response would never be exercised here. Consider adding mock_response.raise_for_status.return_value = None explicitly, and a separate case where mock_response.raise_for_status.side_effect = httpx.HTTPStatusError(...) to verify the "failed" path through HTTP errors (not just exception injection).

Documentation example contradicts the "opt-in header" behaviour

VICTORIA_LOGS_TENANT_ID="0" is shown as an example value with no accompanying note. The PR specifically changed tenant_id from "0" to None so the AccountID header is only sent when the variable is explicitly set. A reader following the docs example verbatim will always send AccountID: 0, which is the old default behaviour the PR intentionally removed. Either document "omit this variable entirely for single-tenant deployments" or clarify that "0" is the VictoriaLogs default tenant and is appropriate for single-tenant setups.

_verify_victoria_logs() returns status="verified" on success, but the rest of verify.py (and verification_exit_code()) expects the success status to be "passed". As written, a successful VictoriaLogs verification will still be treated as failing the core-gate because no core result will have status=="passed". Use "passed" here (and keep "missing"/"failed" for other outcomes) to match the existing contract.

VictoriaLogsTool.run() reads credentials from kwargs["sources"], but the investigation executor calls tools as action.run(**action.extract_params(available_sources)) (no implicit "sources" kwarg). With the current extract_params() returning only query/limit/start, run() will see an empty sources dict and always fail with missing base_url. Adjust the tool to accept base_url/tenant_id/integration_id as explicit run() args and have extract_params() return them (plus a non-empty default query), or include a "sources" entry in extract_params in a way consistent with the executor contract.

This test asserts VictoriaLogs verification status == "verified", but verify.py uses "passed"/"missing"/"failed" as its status contract (and verification_exit_code() checks for "passed"). Once _verify_victoria_logs is aligned to return "passed" on success, update this assertion accordingly.

These run() tests pass credentials via a "sources" kwarg, but the investigation executor calls tools as action.run(**action.extract_params(available_sources)) and does not inject "sources". As a result, the tests can pass even if the tool is unusable in real investigations. Update the tool/tests so extract_params returns all required kwargs (e.g. base_url/tenant_id/query/limit/start) and tests invoke run() using only extract_params output (mirroring execute_actions.py).

The docs show VICTORIA_LOGS_TENANT_ID="0" (and CLI example uses --tenant_id 0), but the integration logic treats tenant_id as optional and only sends the AccountID header when explicitly configured. Suggest updating the examples to omit tenant_id entirely unless the deployment is actually multi-tenant (to avoid encouraging always sending AccountID=0).

VictoriaLogsTool.requires includes "base_url", but input_schema doesn't define a base_url field (and build_prompt.py renders required inputs from input_schema properties). This makes the planner metadata inconsistent and hides a required runtime credential from the prompt/tool contract. Add base_url (and any other required credential fields like tenant_id/integration_id, if applicable) to input_schema so the declared interface matches how the tool is invoked.