fix: nest internal semantic runtime resources

backend/src/config.ts

@@ -125,7 +125,7 @@ function internalServiceUrl(
     throw new Error(`${label} configuration is invalid`);
   }
   if (
-    (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+    parsed.protocol !== "http:"
     || parsed.username.length > 0
     || parsed.password.length > 0
     || parsed.pathname !== "/"

backend/src/workspaces/runtime-renderer.ts

@@ -140,18 +140,18 @@ export function renderRuntimeConfig(
       ...(installation.profile === undefined ? {} : { profile: installation.profile }),
       language: descriptor.workspace.language,
       database,
-      embeddings: {
-        provider: "ollama_internal",
-        base_url: semanticRuntime.internalEmbeddingUrl,
-        model: semanticRuntime.internalEmbeddingModel,
-        dimensions: semanticRuntime.internalEmbeddingDimensions,
-      },
       resources: {
         vector: {
           engine: "qdrant",
           base_url: semanticRuntime.internalQdrantUrl,
           collection: descriptor.semantic_index.vector_store.collection,
         },
+        embeddings: {
+          provider: "ollama_internal",
+          base_url: semanticRuntime.internalEmbeddingUrl,
+          model: semanticRuntime.internalEmbeddingModel,
+          dimensions: semanticRuntime.internalEmbeddingDimensions,
+        },
       },
       roots: paths,
       paths,

backend/test/config.test.ts

@@ -58,6 +58,10 @@ test("loadConfig accepts only the allowed internal semantic runtime hosts", () =
     .toThrow(/internal.*qdrant|host validation|invalid/i);
   expect(() => loadConfig({ THT_INTERNAL_EMBEDDING_URL: "http://example.com:11434" }))
     .toThrow(/internal.*embedding|host validation|invalid/i);
+  expect(() => loadConfig({ THT_INTERNAL_QDRANT_URL: "https://qdrant:6333" }))
+    .toThrow(/internal.*qdrant|invalid/i);
+  expect(() => loadConfig({ THT_INTERNAL_EMBEDDING_URL: "https://embedding:11434" }))
+    .toThrow(/internal.*embedding|invalid/i);
 });
 
 test("loadConfig enables the legacy workspace request only through explicit local mode", () => {

backend/test/workspace-runtime-renderer.test.ts

@@ -193,13 +193,14 @@ test("fails closed for v3 runtime rendering and session support", () => {
       base_url: "http://qdrant:6333",
       collection: "psd-clinical",
     },
+    embeddings: {
+      provider: "ollama_internal",
+      base_url: "http://embedding:11434",
+      model: "qwen3-embedding:0.6b",
+      dimensions: 1024,
+    },
   });
-  expect(rendered.embeddings).toMatchObject({
-    provider: "ollama_internal",
-    base_url: "http://embedding:11434",
-    model: "qwen3-embedding:0.6b",
-    dimensions: 1024,
-  });
+  expect(rendered).not.toHaveProperty("embeddings");
 });
 
 test("schema v3 runtime rendering never exposes external semantic endpoints from bindings", () => {
@@ -227,12 +228,13 @@ test("schema v3 runtime rendering never exposes external semantic endpoints from
     base_url: "http://qdrant:6333",
     collection: "psd-clinical",
   });
-  expect(rendered.embeddings).toMatchObject({
+  expect(rendered.resources.embeddings).toMatchObject({
     provider: "ollama_internal",
     base_url: "http://embedding:11434",
     model: "qwen3-embedding:0.6b",
     dimensions: 1024,
   });
+  expect(rendered).not.toHaveProperty("embeddings");
   expect(JSON.stringify(rendered)).not.toContain("vector.example.test");
   expect(JSON.stringify(rendered)).not.toContain("embedding.example.test");
 });