fix: close task3 qdrant and config quality gaps

harness/tests/test_config_resources.py

@@ -1,7 +1,12 @@
+import json
+
 import pytest
+import yaml
+from typer.testing import CliRunner
 
 from tht.adapters.evidence import FilesystemEvidenceSource, HttpManifestEvidenceSource
 from tht.adapters.factory import build_evidence_sources
+from tht.cli import app
 from tht.config import (
     ConfigError,
     PgvectorDirectConfig,
@@ -401,3 +406,111 @@ dwh:
     message = str(caught.value)
     assert "dwh.postgres_direct.connection.password" in message
     assert "missing" in message
+
+
+@pytest.mark.parametrize("resources", [None, [], "malformed", 7])
+def test_raw_resources_non_mapping_is_a_safe_config_error(tmp_path, resources):
+    values = {
+        "dwh": {
+            "type": "postgres_direct",
+            "connection": {"database": "d", "schema": "public", "user": "u", "password": "p"},
+        },
+        "resources": resources,
+    }
+    path = tmp_path / "invalid-resources.yaml"
+    path.write_text(yaml.safe_dump(values))
+
+    with pytest.raises(ConfigError, match="resources"):
+        load_config(path)
+    config_result = CliRunner().invoke(app, ["config", "check", "--config", str(path)])
+    assert config_result.exit_code == 1
+    assert "Traceback" not in config_result.stderr
+    vector_result = CliRunner().invoke(
+        app, ["vector", "index-schema", "--json", "-c", str(path)]
+    )
+    assert vector_result.exit_code == 1
+    assert vector_result.stderr == ""
+    assert json.loads(vector_result.stdout) == {"status": "failed", "code": "invalid_configuration"}
+
+
+@pytest.mark.parametrize("vector", [None, [], "malformed", 7])
+def test_raw_resources_vector_non_mapping_is_a_safe_config_error(tmp_path, vector):
+    values = {
+        "dwh": {
+            "type": "postgres_direct",
+            "connection": {"database": "d", "schema": "public", "user": "u", "password": "p"},
+        },
+        "resources": {"vector": vector},
+    }
+    path = tmp_path / "invalid-resources-vector.yaml"
+    path.write_text(yaml.safe_dump(values))
+
+    with pytest.raises(ConfigError, match="resources.vector"):
+        load_config(path)
+    config_result = CliRunner().invoke(app, ["config", "check", "--config", str(path)])
+    assert config_result.exit_code == 1
+    assert "Traceback" not in config_result.stderr
+    vector_result = CliRunner().invoke(
+        app, ["vector", "index-schema", "--json", "-c", str(path)]
+    )
+    assert vector_result.exit_code == 1
+    assert vector_result.stderr == ""
+    assert json.loads(vector_result.stdout) == {"status": "failed", "code": "invalid_configuration"}
+
+
+@pytest.mark.parametrize("embeddings", [None, [], "malformed", 7])
+def test_raw_resources_embeddings_non_mapping_is_not_silently_accepted(tmp_path, embeddings):
+    values = {
+        "dwh": {
+            "type": "postgres_direct",
+            "connection": {"database": "d", "schema": "public", "user": "u", "password": "p"},
+        },
+        "resources": {"embeddings": embeddings},
+    }
+    path = tmp_path / "invalid-resources-embeddings.yaml"
+    path.write_text(yaml.safe_dump(values))
+
+    with pytest.raises(ConfigError, match="resources.embeddings"):
+        load_config(path)
+    config_result = CliRunner().invoke(app, ["config", "check", "--config", str(path)])
+    assert config_result.exit_code == 1
+    assert "Traceback" not in config_result.stderr
+    vector_result = CliRunner().invoke(
+        app, ["vector", "index-schema", "--json", "-c", str(path)]
+    )
+    assert vector_result.exit_code == 1
+    assert vector_result.stderr == ""
+    assert json.loads(vector_result.stdout) == {"status": "failed", "code": "invalid_configuration"}
+
+
+@pytest.mark.parametrize("mutator", [
+    lambda values: values.update({1: "not-a-string-key"}),
+    lambda values: values["resources"].update({1: {"provider": "bad"}}),
+    lambda values: values["resources"].update({"embeddings": {1: "bad"}}),
+])
+def test_raw_non_string_mapping_keys_are_safe_config_errors(tmp_path, mutator):
+    values = {
+        "dwh": {
+            "type": "postgres_direct",
+            "connection": {"database": "d", "schema": "public", "user": "u", "password": "p"},
+        },
+        "resources": {"embeddings": {
+            "provider": "ollama_internal", "base_url": "http://embedding:11434",
+            "model": "qwen3-embedding:0.6b", "dimensions": 1024,
+        }},
+    }
+    mutator(values)
+    path = tmp_path / "invalid-mapping-key.yaml"
+    path.write_text(yaml.safe_dump(values))
+
+    with pytest.raises(ConfigError, match="mapping key"):
+        load_config(path)
+    config_result = CliRunner().invoke(app, ["config", "check", "--config", str(path)])
+    assert config_result.exit_code == 1
+    assert "Traceback" not in config_result.stderr
+    vector_result = CliRunner().invoke(
+        app, ["vector", "index-schema", "--json", "-c", str(path)]
+    )
+    assert vector_result.exit_code == 1
+    assert vector_result.stderr == ""
+    assert json.loads(vector_result.stdout) == {"status": "failed", "code": "invalid_configuration"}