docs: describe read-only workspace runtime configuration

scripts/verify-workspace-install-docs.sh

@@ -207,7 +207,7 @@ for name, port in (("qdrant", "6333"), ("embedding", "11434")):
 if "devices" in str(services["embedding"]):
     raise SystemExit("base embedding service must stay CPU-first")
 volumes = set(doc["volumes"])
-for required in ("qdrant-data", "embedding-models"):
+for required in ("qdrant-data", "embedding-models", "workspace-secrets"):
     if required not in volumes:
         raise SystemExit(f"missing volume {required}")
 model_init = services["embedding-model-init"]
@@ -360,18 +360,16 @@ required_contract_phrases = [
     "A custom endpoint requires",
     "HTTP endpoint additionally requires",
     "page size cannot exceed 1000",
-    "Public docs, exports, and rendered YAML never expose file contents.",
+    "Public docs, APIs, and rendered YAML never expose file contents.",
     "THT_WORKSPACE_SECRET_ROOTS",
     "readable regular file",
     "strictly below",
     "Content-only revision",
-    "read-only Evidence summary",
-    "excludes Evidence bytes",
     "`schema_version` value `1`",
     "It is authoritative for workspace ID,\nname, description, and display order.",
     "The descriptor at `<id>/workspace.yaml` must match the\ncatalog metadata exactly.",
-    "Catalog-only entries without `<id>/workspace.yaml` are valid bootstrap slots and surface as\n`configuration_required`.",
-    "The API never writes `thoth-workspaces.yaml` or `<id>/evidence/**`.",
+    "catalog-only entries are invalid and reject the complete candidate revision.",
+    "The API never writes `thoth-workspaces.yaml`,\n`<id>/workspace.yaml`, `<id>/schema/**`, or `<id>/evidence/**`.",
 ]
 normalized_contract = normalize_space(contract)
 for phrase in required_contract_phrases:
@@ -399,22 +397,10 @@ for forbidden in (
     if forbidden in active_public:
         raise SystemExit("old registry layout text found")
 
-legacy_docs = re.compile(r"(?:^|\n)\s*(?:<id>|[a-z0-9-]+)/(?:(?:contract\.env\.example|README\.md))")
-if "workspace-docs/<id>/{contract.env.example,README.md}" not in all_public:
-    raise SystemExit("generated docs path invalid")
-for pattern in (
-    r"(?<!workspace-docs/)<id>/README\.md",
-    r"(?<!workspace-docs/)<id>/contract\.env\.example",
-    r"(?<!workspace-docs/)example/README\.md",
-    r"(?<!workspace-docs/)example/contract\.env\.example",
-):
-    if re.search(pattern, contract):
-        raise SystemExit("generated docs path invalid")
 required_tree_lines = [
-    "registry.git/", "├── thoth-workspaces.yaml", "├── example/", "│   ├── workspace.yaml",
-    "│   └── evidence/...", "├── another/", "│   └── workspace.yaml", "└── workspace-docs/",
-    "    ├── example/{contract.env.example,README.md}",
-    "    └── another/{contract.env.example,README.md}",
+    "workspace-repository.git/", "├── thoth-workspaces.yaml", "├── example/",
+    "│   ├── workspace.yaml", "│   └── evidence/...", "└── another/",
+    "    └── workspace.yaml",
 ]
 if any(line not in contract for line in required_tree_lines):
     raise SystemExit("missing canonical Evidence layout")
@@ -440,15 +426,19 @@ if not all(token in revision_text for token in ("same 40-hex Git commit", "catal
     raise SystemExit("missing same-revision ownership")
 if "Evidence-only commit" not in relationships.get("Content-only revision", "") or "revision.commit" not in relationships.get("Content-only revision", ""):
     raise SystemExit("missing content-only revision identity")
-if "docs-only" not in relationships.get("Docs-only sync commit", "").lower() or "workspace-docs/**" not in relationships.get("Docs-only sync commit", ""):
-    raise SystemExit("missing docs-only sync rule")
+repository_consumer = relationships.get("Repository consumer", "")
+if not all(token in repository_consumer for token in ("complete candidate", "atomically activates", "never edits, commits, or pushes")):
+    raise SystemExit("missing read-only repository-consumer rule")
+runtime_secrets = relationships.get("Runtime secrets", "")
+if not all(token in runtime_secrets for token in ("configured/missing status only", "runtime lease")):
+    raise SystemExit("missing runtime-secret lifecycle rule")
 p11 = relationships.get("P1.1", "")
 p6 = relationships.get("P6", "")
 if not all(token in p11 for token in ("lexical URI `<id>/evidence`", "Git tree", "same commit", "does not recursively inspect nested symlinks", "out of scope for P1.1")):
     raise SystemExit("missing P1.1 lexical/tree ownership")
 if not all(token in p6 for token in ("commit-addressed materialization", "realpath", "recursive containment", "nested-symlink", "race")):
     raise SystemExit("missing P6 materialization ownership")
-no_scope = "P1.1 performs no acquisition, extraction, preprocessing/indexing, embeddings, Qdrant writes, `ACTIVE` publication, retention, or GC."
+no_scope = "P1.1 performs no acquisition, extraction, preprocessing/indexing, embeddings, Qdrant writes, active-snapshot retention, or GC."
 p1_adverbs = r"(?:\s+(?:also|then|now|directly|itself))*"
 p1_base_operation = r"""(?:
     acquire|materialize|extract|preprocess|index|retain|
@@ -513,56 +503,38 @@ if len(automated) != 1 or len(manual) != 1:
     raise SystemExit("separate automated/manual states missing")
 
 flow_tokens = [
-    "Clone the one shared registry",
+    "Create a local workspace",
     "thoth-workspaces.yaml",
-    "<id>/workspace.yaml",
-    "<id>/evidence/**",
-    "configuration_required",
-    "The API may create `<id>/workspace.yaml` only when the catalog slot already exists and no Git",
-    "After bootstrap, existing descriptors change only through curator Git commit/push and",
-    "The API never writes `thoth-workspaces.yaml` or `<id>/evidence/**`.",
-    "workspace-docs/<id>/contract.env.example",
-    "workspace-docs/<id>/README.md",
-    "Evidence `*_FILE` files outside Git",
-    "THT_WORKSPACE_SECRET_ROOTS",
-    "`*_SOURCE` paths",
-    "tht config check -c <path>",
-    "P2/P6 later performs preprocessing and materialization",
+    "<workspace-id>/workspace.yaml",
+    "commit",
+    "push",
+    "ThothII",
+    "Update workspace repository",
+    "workspace-secrets",
+    "Validate workspace",
+    "Test connections",
 ]
 for guide in (local_path, server_path):
     text = guide.read_text()
     match = re.search(
-        r"^## Curator flow for shared-registry Evidence\s*$\n(.*?)(?=^## |\Z)",
+        r"^## Prepare and publish a workspace source\s*$\n(.*?)(?=^## |\Z)",
         text,
         re.MULTILINE | re.DOTALL,
     )
     if not match:
-        raise SystemExit(f"{guide.name}: missing curator flow")
-    section = match.group(1)
+        raise SystemExit(f"{guide.name}: missing workspace source flow")
+    section = text
     positions = [section.find(token) for token in flow_tokens]
     if any(position < 0 for position in positions):
         raise SystemExit(f"{guide.name}: curator flow missing registry rule")
-    if positions != sorted(positions):
-        raise SystemExit(f"{guide.name}: curator flow out of order")
-
-for guide in (local_path, server_path):
-    guide_text = guide.read_text()
-    if "authoritative for workspace ID, name, description, and\ndisplay order" not in guide_text:
-        raise SystemExit("missing catalog authority")
-    if "The API may create `<id>/workspace.yaml` only when the catalog slot already exists" not in guide_text:
-        raise SystemExit("missing bootstrap create-once rule")
-    if "After bootstrap, existing descriptors change only through curator Git commit/push and\n" not in guide_text:
-        raise SystemExit("missing existing-descriptor curator ownership")
 
 readme_required = [
     "thoth-workspaces.yaml",
     "<id>/workspace.yaml",
     "<id>/evidence/**",
-    "workspace-docs/<id>/{contract.env.example,README.md}",
     "authoritative for workspace ID, name, description, and\ndisplay order",
-    "configuration_required",
-    "existing descriptors remain curator-owned and change only through curator Git commit,\npush, and installation pull.",
-    "The API never writes `thoth-workspaces.yaml` or `<id>/evidence/**`;",
+    "the complete candidate is rejected",
+    "ThothII\nnever writes any workspace repository content.",
     "docs/migrations/p1-to-p1-1-registry-layout.md",
 ]
 normalized_readme = normalize_space(readme)
@@ -1702,23 +1674,24 @@ verify_manual() {
   if [[ "$profile" == local ]]; then
     headings=(
       "Prerequisites"
-      "Git remote: SSH and HTTPS"
-      "Shared Git values, local bindings, and secret files"
-      "Direct PostgreSQL, REST, and SSH tunnel bindings"
-      "Bootstrap, first pull, and diagnostics"
-      "Publish, update, backup, outage recovery, and rollback"
+      "Prepare and publish a workspace source"
+      "Configure the remote Git repository"
+      "Start and update the installation"
+      "Complete runtime secrets in Workspace management"
+      "Validation and activation behavior"
+      "Backup, rotation, and recovery"
       "Troubleshooting"
     )
   else
     headings=(
       "Service account, storage, and firewall"
-      "Gitea and remote Git setup"
-      "Git credentials, CA, SSH key, and known-hosts mounts"
-      "Shared Git values, local bindings, and secret files"
-      "Direct PostgreSQL, REST, and SSH tunnel bindings"
-      "Same-origin reverse proxy, bootstrap, and health"
-      "Pull, publish, upgrade, backup, and recovery"
-      "Troubleshooting and snapshot rollback"
+      "Prepare and publish a workspace source"
+      "Configure the remote Git repository"
+      "Start and update the installation"
+      "Complete runtime secrets in Workspace management"
+      "Validation and activation behavior"
+      "Backup, rotation, and recovery"
+      "Troubleshooting"
     )
   fi
   for heading in "${headings[@]}"; do
@@ -1731,9 +1704,10 @@ verify_manual() {
   if [[ "$profile" == local ]]; then
     expected_steps=(
       'export THT_SOURCE_ROOT=/absolute/path/to/ThothII'
-      '--env-file "$THT_OPERATOR_ENV"'
-      "-f \"\$THT_SOURCE_ROOT/compose.yaml\" -f \"\$THT_SOURCE_ROOT/deploy/compose.$profile.yaml\""
-      '"$THT_SOURCE_ROOT/scripts/generate-connector-secrets-override.sh"'
+      'thothii-installation.yaml'
+      'workspaceRepository'
+      '"$THTCTL" --installation "$INSTALLATION" start'
+      '"$THTCTL" --installation "$INSTALLATION" doctor'
     )
   else
     expected_steps=(
@@ -1761,6 +1735,82 @@ verify_manual() {
   echo "$profile manual canonical base+override references passed"
 }
 
+verify_read_only_workspace_runtime_contract() {
+  python3 - "$root" <<'PY'
+import pathlib, sys, yaml
+
+root = pathlib.Path(sys.argv[1])
+compose = yaml.safe_load((root / "compose.yaml").read_text())
+services = compose["services"]
+core = services["core"]
+maintenance = services["workspace-maintenance"]
+environment = core["environment"]
+
+for forbidden in ("THT_WORKSPACE_GIT_AUTHOR_NAME", "THT_WORKSPACE_GIT_AUTHOR_EMAIL"):
+    if forbidden in environment:
+        raise SystemExit(f"compose retains Git write identity: {forbidden}")
+for key, value in {
+    "THT_WORKSPACE_SECRET_STORE_ROOT": "/data/workspace-secrets",
+    "THT_WORKSPACE_SECRET_RUNTIME_ROOT": "/tmp/thothii-workspace-secrets",
+}.items():
+    if environment.get(key) != value or maintenance["environment"].get(key) != value:
+        raise SystemExit(f"workspace secret setting missing from core/maintenance: {key}")
+if "workspace-secrets" not in compose["volumes"]:
+    raise SystemExit("workspace-secrets persistent volume is missing")
+if not any("workspace-secrets:/data/workspace-secrets" in str(value) for value in core["volumes"]):
+    raise SystemExit("core does not persist the workspace secret vault")
+if not any(mount.get("source") == "workspace-secrets" and mount.get("target") == "/data/workspace-secrets"
+           for mount in maintenance["volumes"] if isinstance(mount, dict)):
+    raise SystemExit("workspace-maintenance cannot use the encrypted workspace vault")
+
+checked = [
+    root / "docs/install/local-workspace-registry.md",
+    root / "docs/install/server-workspace-registry.md",
+    root / "docs/guida-utente.md",
+    root / "deploy/workspace-registry.env.example",
+    root / "deploy/psd/operator.env.example",
+    root / "docs/install/examples/thothii-installation.local.yaml",
+    root / "docs/install/examples/thothii-installation.server.yaml",
+]
+joined = "\n".join(path.read_text() for path in checked)
+for forbidden in (
+    "THT_WORKSPACE_GIT_AUTHOR_NAME",
+    "THT_WORKSPACE_GIT_AUTHOR_EMAIL",
+    "connector-secrets.local.yaml",
+    "connector-secrets.server.yaml",
+    "THT_WORKSPACE_BINDINGS_ENV_FILE",
+    "POST /workspaces/publish",
+    "POST /workspaces/import",
+    "Import workspace bundle",
+):
+    if forbidden in joined:
+        raise SystemExit(f"active workspace documentation retains obsolete contract: {forbidden}")
+for required in (
+    "GitHub, GitLab, or Gitea",
+    "read-only consumer",
+    "workspace-secrets",
+    "write-only",
+    "previous active revision",
+):
+    if required.lower() not in joined.lower():
+        raise SystemExit(f"active workspace documentation lacks required concept: {required}")
+
+ui = (root / "frontend/src/shell/WorkspaceManager.tsx").read_text()
+for required in (
+    "Create a local workspace",
+    "Update workspace repository",
+    "No workspace selection is required",
+    "Temporary files are deleted after the test",
+):
+    if required not in ui:
+        raise SystemExit(f"Workspace management lacks required explanation: {required}")
+for forbidden in ("Import bundle", "Export bundle", "localStorage"):
+    if forbidden in ui:
+        raise SystemExit(f"Workspace management retains obsolete behavior: {forbidden}")
+PY
+  echo "read-only workspace repository and encrypted runtime-secret contract passed"
+}
+
 verify_local_installation_example() {
   local example="$root/docs/install/examples/thothii-installation.local.yaml"
   [[ -f "$example" ]] || {
@@ -1768,7 +1818,7 @@ verify_local_installation_example() {
     return 1
   }
 
-  local fixture source_copy operator_dir copied_example connector_override env_file
+  local fixture source_copy operator_dir copied_example env_file
   fixture="$(mktemp -d "${TMPDIR%/}/thoth local install.XXXXXX")"
   trap 'rm -rf "$fixture"' RETURN
   [[ "$fixture" == *" "* ]] || {
@@ -1788,27 +1838,15 @@ verify_local_installation_example() {
   write_private "$operator_dir/thothii.secrets" 'THT_MODEL_API_KEY=fixture-local-model-key'
   write_private "$operator_dir/git-ssh-key" 'fixture-local-ssh-key'
   write_private "$operator_dir/git-known-hosts" 'fixture-local-known-hosts'
-  write_private "$operator_dir/dwh-password" 'fixture-local-dwh-password'
-  printf '%s\n' \
-    'THT_WS_NORTH_STAR_RESEARCH_DWH_TRANSPORT=postgres_direct' \
-    'THT_WS_NORTH_STAR_RESEARCH_DWH_PASSWORD_FILE=/run/secrets/north-star-research-dwh-password' \
-    >"$operator_dir/workspace-bindings.env"
   env_file="$source_copy/deploy/env/local.env"
   mkdir -p "$source_copy/deploy/env"
   printf '%s\n' \
     'THT_WORKSPACE_GIT_REMOTE=ssh://git@git.example.invalid/platform/thoth-workspaces.git' \
     "PI_AUTH_FILE=$operator_dir/pi-auth.json" \
     "THT_SECRETS_FILE=$operator_dir/thothii.secrets" \
-    "THT_WORKSPACE_BINDINGS_ENV_FILE=$operator_dir/workspace-bindings.env" \
     "THT_WORKSPACE_GIT_SSH_KEY_FILE=$operator_dir/git-ssh-key" \
     "THT_WORKSPACE_GIT_KNOWN_HOSTS_FILE=$operator_dir/git-known-hosts" \
-    "THT_WS_NORTH_STAR_RESEARCH_DWH_PASSWORD_SOURCE=$operator_dir/dwh-password" \
     >"$env_file"
-  connector_override="$operator_dir/connector-secrets.local.yaml"
-  "$root/scripts/generate-connector-secrets-override.sh" \
-    --bindings-env "$operator_dir/workspace-bindings.env" \
-    --operator-env "$env_file" \
-    --output "$connector_override" >/dev/null
 
   copied_example="$fixture/thothii-installation.yaml"
   local contents
@@ -1827,7 +1865,7 @@ verify_local_installation_example() {
     echo "local installation example does not resolve its required fields" >&2
     return 1
   }
-  [[ "${#overrides[@]}" -eq 2 && "${overrides[1]}" == "$connector_override" ]] || {
+  [[ "${#overrides[@]}" -eq 1 && "${overrides[0]}" == "$source_copy/deploy/compose.git-ssh.yaml" ]] || {
     echo "local installation example does not select the expected optional overrides" >&2
     return 1
   }
@@ -1863,7 +1901,7 @@ verify_server_installation_example() {
     return 1
   }
 
-  local fixture source_copy operator_dir copied_example connector_override env_file backup_root
+  local fixture source_copy operator_dir copied_example env_file backup_root
   fixture="$(mktemp -d "${TMPDIR%/}/thoth server install.XXXXXX")"
   trap 'rm -rf "$fixture"' RETURN
   [[ "$fixture" == *" "* ]] || {
@@ -1874,7 +1912,7 @@ verify_server_installation_example() {
   operator_dir="$fixture/server operator files"
   backup_root="$fixture/server backups"
   mkdir -p "$source_copy/deploy/pi" "$source_copy/deploy/workspaces" \
-    "$operator_dir/data" "$operator_dir/pi-state" "$operator_dir/workspace-registry" "$backup_root"
+    "$operator_dir/data/workspace-secrets" "$operator_dir/pi-state" "$operator_dir/workspace-registry" "$backup_root"
   "$root/scripts/prepare-server-pi-state.sh" \
     "$operator_dir/pi-state" "$(id -u)" "$(id -g)" >/dev/null
   cp "$root/compose.yaml" "$source_copy/compose.yaml"
@@ -1891,14 +1929,9 @@ verify_server_installation_example() {
   write_private "$operator_dir/thothii.secrets" 'THT_MODEL_API_KEY=fixture-server-model-key'
   write_private "$operator_dir/git-ssh-key" 'fixture-server-ssh-key'
   write_private "$operator_dir/git-known-hosts" 'fixture-server-known-hosts'
-  write_private "$operator_dir/dwh-password" 'fixture-server-dwh-password'
   write_private "$operator_dir/session-runtime-password" 'fixture-server-session-runtime-password'
   write_private "$operator_dir/session-migrator-password" 'fixture-server-session-migrator-password'
   write_private "$operator_dir/session-ca.pem" 'fixture-server-session-ca'
-  printf '%s\n' \
-    'THT_WS_NORTH_STAR_RESEARCH_DWH_TRANSPORT=postgres_direct' \
-    'THT_WS_NORTH_STAR_RESEARCH_DWH_PASSWORD_FILE=/run/secrets/north-star-research-dwh-password' \
-    >"$operator_dir/workspace-bindings.env"
   env_file="$operator_dir/server.env"
   printf '%s\n' \
     'THOTH_SERVER_BIND=127.0.0.1' \
@@ -1907,10 +1940,8 @@ verify_server_installation_example() {
     'THT_WORKSPACE_GIT_BRANCH=main' \
     "PI_AUTH_FILE=$operator_dir/pi-auth.json" \
     "THT_SECRETS_FILE=$operator_dir/thothii.secrets" \
-    "THT_WORKSPACE_BINDINGS_ENV_FILE=$operator_dir/workspace-bindings.env" \
     "THT_WORKSPACE_GIT_SSH_KEY_FILE=$operator_dir/git-ssh-key" \
     "THT_WORKSPACE_GIT_KNOWN_HOSTS_FILE=$operator_dir/git-known-hosts" \
-    "THT_WS_NORTH_STAR_RESEARCH_DWH_PASSWORD_SOURCE=$operator_dir/dwh-password" \
     "THT_DATA_ROOT=$operator_dir/data" \
     "THT_PI_STATE_ROOT=$operator_dir/pi-state" \
     "THT_WORKSPACE_REGISTRY_ROOT=$operator_dir/workspace-registry" \
@@ -1925,11 +1956,6 @@ verify_server_installation_example() {
     "THT_SESSION_MIGRATOR_PASSWORD_SOURCE=$operator_dir/session-migrator-password" \
     "THT_SESSION_CA_SOURCE=$operator_dir/session-ca.pem" \
     >"$env_file"
-  connector_override="$operator_dir/connector-secrets.server.yaml"
-  "$root/scripts/generate-connector-secrets-override.sh" \
-    --bindings-env "$operator_dir/workspace-bindings.env" \
-    --operator-env "$env_file" \
-    --output "$connector_override" >/dev/null
 
   copied_example="$fixture/thothii-installation.yaml"
   local contents
@@ -1948,8 +1974,8 @@ verify_server_installation_example() {
     echo "server installation example does not resolve its required fields" >&2
     return 1
   }
-  [[ "${#overrides[@]}" -eq 3 && "${overrides[0]}" == "$source_copy/deploy/compose.session-server.yaml.example" \
-    && "${overrides[2]}" == "$connector_override" ]] || {
+  [[ "${#overrides[@]}" -eq 2 && "${overrides[0]}" == "$source_copy/deploy/compose.session-server.yaml.example" \
+    && "${overrides[1]}" == "$source_copy/deploy/compose.git-ssh.yaml" ]] || {
     echo "server installation example does not select the expected optional overrides" >&2
     return 1
   }
@@ -2053,34 +2079,25 @@ write_private() {
 }
 
 verify_compose_fixtures() {
-  local fixture connector_override profile rendered
+  local fixture profile rendered
   fixture="$(mktemp -d "${TMPDIR%/}/thoth-install-fixtures.XXXXXX")"
   trap 'rm -rf "$fixture"' RETURN
-  mkdir -p "$fixture/data" "$fixture/pi-state" "$fixture/workspace-registry"
+  mkdir -p "$fixture/data/workspace-secrets" "$fixture/pi-state" "$fixture/workspace-registry"
 
   write_private "$fixture/pi-auth.json" '{"zai":{"type":"api_key","key":"fixture-native-auth-key"}}'
   write_private "$fixture/thothii.secrets" 'THT_MODEL_API_KEY=fixture-model-api-key'
   write_private "$fixture/git-ssh-key" 'fixture-git-ssh-key'
   write_private "$fixture/git-known-hosts" 'fixture-git-known-hosts'
-  write_private "$fixture/dwh-password" 'fixture-dwh-password'
   write_private "$fixture/session-runtime-password" 'fixture-session-runtime-password'
   write_private "$fixture/session-migrator-password" 'fixture-session-migrator-password'
   write_private "$fixture/session-ca.pem" 'fixture-session-ca'
   cp "$root/deploy/workspaces/server-sessions.yaml.example" "$fixture/server-sessions.yaml"
-
-  printf '%s\n' \
-    'THT_WS_NORTH_STAR_RESEARCH_DWH_TRANSPORT=postgres_direct' \
-    'THT_WS_NORTH_STAR_RESEARCH_DWH_PASSWORD_FILE=/run/secrets/north-star-research-dwh-password' \
-    >"$fixture/workspace-bindings.env"
-
   printf '%s\n' \
     'THT_WORKSPACE_GIT_REMOTE=ssh://git@git.example.invalid/platform/thoth-workspaces.git' \
     "PI_AUTH_FILE=$fixture/pi-auth.json" \
     "THT_SECRETS_FILE=$fixture/thothii.secrets" \
-    "THT_WORKSPACE_BINDINGS_ENV_FILE=$fixture/workspace-bindings.env" \
     "THT_WORKSPACE_GIT_SSH_KEY_FILE=$fixture/git-ssh-key" \
     "THT_WORKSPACE_GIT_KNOWN_HOSTS_FILE=$fixture/git-known-hosts" \
-    "THT_WS_NORTH_STAR_RESEARCH_DWH_PASSWORD_SOURCE=$fixture/dwh-password" \
     "THT_DATA_ROOT=$fixture/data" \
     "THT_PI_STATE_ROOT=$fixture/pi-state" \
     "THT_WORKSPACE_REGISTRY_ROOT=$fixture/workspace-registry" \
@@ -2094,12 +2111,6 @@ verify_compose_fixtures() {
     "THT_SESSION_CA_SOURCE=$fixture/session-ca.pem" \
     >"$fixture/operator.env"
 
-  connector_override="$fixture/connector-secrets.local.yaml"
-  "$root/scripts/generate-connector-secrets-override.sh" \
-    --bindings-env "$fixture/workspace-bindings.env" \
-    --operator-env "$fixture/operator.env" \
-    --output "$connector_override" >/dev/null
-
   for profile in local server; do
     rendered="$fixture/$profile.json"
     files=(
@@ -2111,7 +2122,6 @@ verify_compose_fixtures() {
     fi
     files+=(
       -f "$root/deploy/compose.git-ssh.yaml"
-      -f "$connector_override"
     )
     "$root/scripts/compose-with-preflight.sh" --env-file "$fixture/operator.env" \
       "${files[@]}" config --format json >"$rendered"
@@ -2133,15 +2143,9 @@ for (const target of [
     throw new Error(profile + ": missing read-only Pi mount " + target);
   }
 }
-for (const [name, value] of Object.entries({
-  THT_WS_NORTH_STAR_RESEARCH_DWH_PASSWORD_FILE: "/run/secrets/north-star-research-dwh-password",
-})) {
-  if (core.environment?.[name] !== value) throw new Error(profile + ": missing binding " + name);
-}
 const secretTargets = new Set((core.secrets || []).map((secret) => secret.target));
 for (const target of [
   "thothii.secrets",
-  "north-star-research-dwh-password",
 ]) {
   if (!secretTargets.has(target)) throw new Error(profile + ": missing secret target " + target);
 }
@@ -2156,7 +2160,7 @@ if ((config.services.frontend.secrets || []).length !== 0) {
 const rendered = JSON.stringify(config);
 for (const value of [
   "fixture-native-auth-key", "fixture-model-api-key", "fixture-git-ssh-key",
-  "fixture-git-known-hosts", "fixture-dwh-password",
+  "fixture-git-known-hosts",
   "fixture-session-runtime-password", "fixture-session-migrator-password", "fixture-session-ca",
 ]) {
   if (rendered.includes(value)) throw new Error(profile + ": rendered Compose leaked " + value);
@@ -2178,6 +2182,7 @@ case "$mode" in
     [[ $# -eq 1 ]] || { echo "usage: $0 --fixtures-only" >&2; exit 2; }
     verify_internal_semantic_infrastructure_docs
     echo "internal semantic infrastructure documentation contract passed"
+    verify_read_only_workspace_runtime_contract
     verify_workspace_evidence_contract
     verify_local_guide
     verify_windows_line_endings_guide
@@ -2197,6 +2202,7 @@ case "$mode" in
       || { echo "usage: $0 --profile {local|server}" >&2; exit 2; }
     if [[ "$profile" == local ]]; then
       verify_internal_semantic_infrastructure_docs
+      verify_read_only_workspace_runtime_contract
       verify_workspace_evidence_contract
       verify_local_guide
       verify_windows_line_endings_guide
@@ -2204,6 +2210,7 @@ case "$mode" in
       verify_local_installation_example
     else
       verify_internal_semantic_infrastructure_docs
+      verify_read_only_workspace_runtime_contract
       verify_workspace_evidence_contract
       verify_server_guide
       verify_reverse_proxy_nginx_guide