fix: fail closed v3 legacy semantic fallbacks

backend/src/workspaces/diagnostics.ts

@@ -10,9 +10,9 @@ import { buildInstallationContract } from "./contracts.js";
 import type { RuntimeBindings } from "./runtime-renderer.js";
 import {
   resolveDiagnosticUrl,
-  validateCanonicalWorkspace,
-  type CanonicalWorkspace,
+  validateWorkspaceDescriptor,
   type RestDiagnosticRequest,
+  type WorkspaceV2,
   type WorkspaceDescriptor,
 } from "./schema.js";
 import type { WorkspaceErrorCode } from "./types.js";
@@ -542,7 +542,7 @@ function diagnosticError(code: WorkspaceErrorCode, field?: string): Diagnostic {
 }
 
 function bindingName(
-  workspace: CanonicalWorkspace,
+  workspace: WorkspaceV2,
   role: "DWH" | "VECTOR" | "VECTOR_WRITER" | "EMBEDDING",
   suffix: string,
 ): string {
@@ -559,7 +559,7 @@ function numericBinding(binding: Record<string, string>, name: string): number |
 }
 
 function diagnosticsForMissingBindings(
-  workspace: CanonicalWorkspace,
+  workspace: WorkspaceV2,
   bindings: RuntimeBindings,
 ): Diagnostic[] {
   const missing = new Set([
@@ -576,7 +576,7 @@ function diagnosticsForMissingBindings(
 }
 
 function connectorRequest(
-  workspace: CanonicalWorkspace,
+  workspace: WorkspaceV2,
   role: ConnectorRole,
   bindings: RuntimeBindings,
   timeoutMs: number,
@@ -650,7 +650,7 @@ function connectorRequest(
 }
 
 function tunnelProbeRequest(
-  workspace: CanonicalWorkspace,
+  workspace: WorkspaceV2,
   role: ConnectorRole,
   bindings: RuntimeBindings,
   timeoutMs: number,
@@ -694,7 +694,11 @@ export function createWorkspaceDiagnoser(
     bindings: RuntimeBindings,
     options: { writeProbe: boolean },
   ): Promise<WorkspaceDiagnostics> {
-    const canonical = validateCanonicalWorkspace(workspace);
+    const descriptor = validateWorkspaceDescriptor(workspace);
+    if (descriptor.workspace.schema_version !== 2) {
+      return { activatable: false, diagnostics: [diagnosticError("workspace_not_activatable")] };
+    }
+    const canonical = descriptor as WorkspaceV2;
     const diagnostics = diagnosticsForMissingBindings(canonical, bindings);
     if (diagnostics.length > 0) return { activatable: false, diagnostics };