diff --git a/tests/test_persimmons_vault_model.py b/tests/test_persimmons_vault_model.py
new file mode 100644
index 0000000..d7b3160
--- /dev/null
+++ b/tests/test_persimmons_vault_model.py
@@ -0,0 +1,74 @@
+from __future__ import annotations
+
+import unittest
+
+from tea_mcp.persimmons import (
+    LEGACY_REPO,
+    list_repositories,
+    metadata_vault,
+    public_connection,
+    vault_from_input,
+)
+
+
+class VaultModelTests(unittest.IsolatedAsyncioTestCase):
+    def test_vault_context_is_explicit_and_legacy_compatible(self):
+        self.assertEqual(vault_from_input({"vault_kind": "user"}), {"kind": "user"})
+        self.assertEqual(
+            vault_from_input({"vault_kind": "repository", "repository": "team/project"}),
+            {"kind": "repository", "repository": "team/project"},
+        )
+        implicit = vault_from_input({})
+        self.assertEqual(implicit["kind"], "repository")
+        self.assertEqual(implicit["repository"], LEGACY_REPO)
+        self.assertTrue(implicit["implicit_legacy"])
+
+        self.assertEqual(metadata_vault({}), {"kind": "repository", "repository": LEGACY_REPO})
+        self.assertEqual(
+            metadata_vault({"vault": {"kind": "user"}}),
+            {"kind": "user"},
+        )
+
+    def test_public_record_carries_vault_without_private_value(self):
+        record = public_connection(
+            "ABCDEF123456",
+            {
+                "name": "Example connection",
+                "provider": "Gitea",
+                "account": "",
+                "credential_type": "PAT",
+                "scopes": ["Repositories"],
+                "vault": {"kind": "repository", "repository": "team/project"},
+            },
+            available=True,
+        )
+        self.assertEqual(record["vault_kind"], "repository")
+        self.assertEqual(record["repository"], "team/project")
+        self.assertNotIn("credential", record)
+
+    async def test_repository_discovery_only_returns_writable_repos(self):
+        repos = [
+            {
+                "full_name": "team/project",
+                "private": True,
+                "owner": {"login": "team"},
+                "permissions": {"admin": False, "push": True, "pull": True},
+            },
+            {
+                "full_name": "team/read-only",
+                "private": True,
+                "owner": {"login": "team"},
+                "permissions": {"admin": False, "push": False, "pull": True},
+            },
+        ]
+
+        async def request(method, path, *, params=None, json=None):
+            self.assertEqual((method, path), ("GET", "user/repos"))
+            return repos
+
+        result = await list_repositories(request)
+        self.assertEqual([item["full_name"] for item in result["repositories"]], ["team/project"])
+
+
+if __name__ == "__main__":
+    unittest.main()