feat: render private semantic service endpoints

backend/src/workspaces/runtime-renderer.ts

@@ -20,6 +20,20 @@ export interface RuntimeInstallationOverlay {
   profile?: unknown;
 }
 
+export interface SemanticRuntimeConfig {
+  internalQdrantUrl: string;
+  internalEmbeddingUrl: string;
+  internalEmbeddingModel: string;
+  internalEmbeddingDimensions: number;
+}
+
+const DEFAULT_SEMANTIC_RUNTIME: SemanticRuntimeConfig = {
+  internalQdrantUrl: "http://qdrant:6333",
+  internalEmbeddingUrl: "http://embedding:11434",
+  internalEmbeddingModel: "qwen3-embedding:0.6b",
+  internalEmbeddingDimensions: 1024,
+};
+
 function seconds(timeoutMs: number | undefined): number | undefined {
   return timeoutMs === undefined ? undefined : Math.max(1, Math.ceil(timeoutMs / 1_000));
 }
@@ -85,13 +99,77 @@ export function renderRuntimeConfig(
   paths: RuntimePaths,
   identity?: RuntimeIdentity,
   installation: RuntimeInstallationOverlay = {},
+  semanticRuntime: SemanticRuntimeConfig = DEFAULT_SEMANTIC_RUNTIME,
 ): string {
   const descriptor = validateWorkspaceDescriptor(workspace);
+  const contract = buildInstallationContract(descriptor);
+  const name = (role: "DWH" | "VECTOR" | "EMBEDDING", suffix: string) => {
+    const variable = contract.variables.find((entry) => entry.role === role && entry.suffix === suffix);
+    if (!variable) throw new Error(`workspace contract is missing ${role}_${suffix}`);
+    return variable.name;
+  };
   if (descriptor.workspace.schema_version !== 2) {
     if (descriptor.workspace.schema_version === 1) {
       throw new Error("Workspace descriptor requires explicit migration to schema version 2");
     }
-    throw new Error("Schema version 3 runtime rendering is unsupported until the internal semantic runtime is implemented");
+    if (bindings.dwh.missing.length > 0) {
+      throw new Error("runtime configuration requires complete bindings");
+    }
+
+    const dwhRest = bindings.dwh.transport === "rest_api";
+    const dwhIdentity = { database: descriptor.dwh.database, schema: descriptor.dwh.schema };
+    const database = bindings.dwh.transport === "postgres_direct"
+      ? { ...legacyDirectConnection(bindings.dwh, {
+        host: name("DWH", "HOST"),
+        port: name("DWH", "PORT"),
+        user: name("DWH", "USER"),
+        passwordFile: name("DWH", "PASSWORD_FILE"),
+        tlsCaFile: name("DWH", "TLS_CA_FILE"),
+      }, dwhIdentity), transport: "direct" }
+      : placeholderConnection(dwhIdentity);
+    const renderedV3: Record<string, unknown> = {
+      ...(identity ? {
+        runtime_identity: {
+          workspace_id: identity.workspaceId,
+          workspace_revision: identity.workspaceRevision,
+          source_identity: `workspace://${identity.workspaceId}`,
+        },
+      } : {}),
+      ...(installation.session_storage === undefined
+        ? {} : { session_storage: installation.session_storage }),
+      ...(installation.profile === undefined ? {} : { profile: installation.profile }),
+      language: descriptor.workspace.language,
+      database,
+      embeddings: {
+        provider: "ollama_internal",
+        base_url: semanticRuntime.internalEmbeddingUrl,
+        model: semanticRuntime.internalEmbeddingModel,
+        dimensions: semanticRuntime.internalEmbeddingDimensions,
+      },
+      resources: {
+        vector: {
+          engine: "qdrant",
+          base_url: semanticRuntime.internalQdrantUrl,
+          collection: descriptor.semantic_index.vector_store.collection,
+        },
+      },
+      roots: paths,
+      paths,
+    };
+    if (bindings.dwh.transport === "postgres_direct") {
+      renderedV3.dwh = { type: "postgres_direct", connection: database };
+    } else if (dwhRest) {
+      renderedV3.rest = legacyRestEndpoint(bindings.dwh, {
+        baseUrl: name("DWH", "BASE_URL"),
+        apiKeyFile: name("DWH", "API_KEY_FILE"),
+        tlsCaFile: name("DWH", "TLS_CA_FILE"),
+      }, descriptor.diagnostics?.dwh_rest?.auth !== "none");
+      renderedV3.database = placeholderConnection(dwhIdentity);
+      renderedV3.dwh = { type: "thoth_rest", database: dwhIdentity, endpoint: renderedV3.rest };
+    } else {
+      throw new Error("ssh_tunnel runtime configuration requires a diagnostic tunnel");
+    }
+    return stringify(renderedV3, { lineWidth: 0, sortMapEntries: false });
   }
 
   const canonical = descriptor as WorkspaceV2;
@@ -99,12 +177,6 @@ export function renderRuntimeConfig(
     throw new Error("runtime configuration requires complete bindings");
   }
 
-  const contract = buildInstallationContract(canonical);
-  const name = (role: "DWH" | "VECTOR" | "EMBEDDING", suffix: string) => {
-    const variable = contract.variables.find((entry) => entry.role === role && entry.suffix === suffix);
-    if (!variable) throw new Error(`workspace contract is missing ${role}_${suffix}`);
-    return variable.name;
-  };
   const dwhIdentity = { database: canonical.dwh.database, schema: canonical.dwh.schema };
   const vectorIdentity = {
     database: canonical.semantic_index.vector_store.database ?? canonical.dwh.database,