fix: align workspace diagnostic contracts

backend/test/workspaces-bindings.test.ts

@@ -2,7 +2,7 @@ import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, expect, test } from "vitest";
-import { resolveBinding } from "../src/workspaces/bindings.js";
+import { resolveBinding, resolveRuntimeBindings } from "../src/workspaces/bindings.js";
 import { parseWorkspaceYaml } from "../src/workspaces/schema.js";
 
 const workspace = parseWorkspaceYaml(`workspace:
@@ -56,6 +56,64 @@ test("marks a portable workspace non-activatable when its local REST key file is
   expect(result.missing).toContain("THT_WS_PSD_CLINICAL_DWH_API_KEY_FILE");
 });
 
+test("does not require a REST secret file when its declared diagnostic uses auth none", () => {
+  const unauthenticatedWorkspace = parseWorkspaceYaml(`workspace:
+  schema_version: 2
+  id: psd-clinical
+  name: Policlinico San Donato
+  language: it
+dwh:
+  engine: postgres
+  database: postgres
+  schema: datawarehouse
+  supported_transports: [rest_api]
+semantic_index:
+  vector_store:
+    engine: pgvector
+    database: postgres
+    schema: vectors
+    collection: clinical_documents
+    dimensions: 768
+    distance: cosine
+    supported_transports: [rest_api]
+  embedding:
+    provider: ollama_compatible
+    model: nomic-embed-text-v2-moe
+    dimensions: 768
+diagnostics:
+  dwh_rest:
+    method: POST
+    path: /rpc/ping
+    auth: none
+    response: { database: database, schema: schema }
+  vector_rest:
+    metadata:
+      method: GET
+      path: /vector/metadata
+      auth: none
+      response: { collection: collection, dimensions: dimensions, distance: distance }
+  embedding:
+    method: GET
+    path: /models
+    auth: none
+    response: { model: model, dimensions: dimensions }
+llm_policy:
+  allowed: [zai/glm-5.2]
+`);
+
+  const bindings = resolveRuntimeBindings(unauthenticatedWorkspace, {
+    THT_WS_PSD_CLINICAL_DWH_TRANSPORT: "rest_api",
+    THT_WS_PSD_CLINICAL_DWH_BASE_URL: "https://dwh.example.test",
+    THT_WS_PSD_CLINICAL_VECTOR_TRANSPORT: "rest_api",
+    THT_WS_PSD_CLINICAL_VECTOR_BASE_URL: "https://vector.example.test",
+    THT_WS_PSD_CLINICAL_EMBEDDING_BASE_URL: "https://embedding.example.test",
+  }, ["/run/secrets"]);
+
+  expect(bindings.dwh.missing).toEqual([]);
+  expect(bindings.vector.missing).toEqual([]);
+  expect(bindings.embedding.missing).toEqual([]);
+});
+
 test("resolves direct bindings from the stable workspace namespace", () => {
   const password = secretPath("dwh-password");
   const result = resolveBinding(workspace, "DWH", {