feat: bind evidence credentials through local files

backend/src/workspaces/diagnostics.ts

@@ -22,6 +22,7 @@ export interface Diagnostic {
   level: "error" | "warning" | "info";
   code: WorkspaceErrorCode | "binding_ok";
   field?: string;
+  variable?: string;
   message: string;
 }
 
@@ -640,9 +641,19 @@ async function diagnoseSchemaV3Workspace(
   timeoutMs: number,
   semanticRuntime: SemanticRuntimeConfig,
 ): Promise<WorkspaceDiagnostics> {
-  const diagnostics = [...bindings.dwh.missing]
-    .sort()
-    .map((field) => diagnosticError("binding_missing", field));
+  const evidenceField = descriptor.evidence?.source.type === "http"
+    ? "evidence.source.authentication"
+    : descriptor.evidence?.source.type === "s3"
+      ? "evidence.source.credentials"
+      : undefined;
+  const evidenceDiagnostics = [...bindings.evidence.missing].sort().map((variable): Diagnostic => ({
+    ...diagnosticError("binding_missing", evidenceField),
+    variable,
+  }));
+  const diagnostics = [
+    ...[...bindings.dwh.missing].sort().map((field) => diagnosticError("binding_missing", field)),
+    ...evidenceDiagnostics,
+  ];
   if (diagnostics.length > 0) {
     return { activatable: false, diagnostics };
   }