Summary

Unit test migrate::tests::security_without_guardrail_gets_guardrail_commented fails in v0.17.0.

Reproduction

cargo nextest run --config-file .github/nextest.toml --workspace --lib --bins

Output:

FAIL [0.010s] zeph-config migrate::tests::security_without_guardrail_gets_guardrail_commented

thread panicked at crates/zeph-config/src/migrate.rs:1178:9:
migration must add guardrail keys for configs without [security.guardrail]: got:

[security]# autonomy_level = "supervised"

# [security.content_isolation]
# enabled = true
...

Expected behavior

When a config has [security] but no [security.guardrail] section, migration should inject commented guardrail stub keys into the output.

Actual behavior

Migration outputs only [security] header with a comment for autonomy_level, no guardrail stub is added.

Context

• Introduced in v0.17.0 (after unified [[llm.providers]] config refactor in PR epic: config simplification — unified [[llm.providers]] schema #2134 / config: cleanup — remove old CloudLlmConfig / OrchestratorConfig / RouterConfig #2139)
• All other 6456 tests pass
• Severity: HIGH — CI-95 unit test regression (breaks cargo nextest without --no-fail-fast)

Labels

bug