feat: render private semantic service endpoints

backend/test/workspace-runtime-renderer.test.ts

@@ -1,6 +1,11 @@
 import { expect, test } from "vitest";
 import { parse } from "yaml";
-import { renderRuntimeConfig, type RuntimeBindings, type RuntimePaths } from "../src/workspaces/runtime-renderer.js";
+import {
+  renderRuntimeConfig,
+  type RuntimeBindings,
+  type RuntimePaths,
+  type SemanticRuntimeConfig,
+} from "../src/workspaces/runtime-renderer.js";
 import { supportsSessionRuntime } from "../src/workspaces/bindings.js";
 import { parseWorkspaceYaml } from "../src/workspaces/schema.js";
 
@@ -58,6 +63,12 @@ const paths: RuntimePaths = {
   artifacts: "/data/workspaces/psd-clinical/artifacts",
   indexes: "/data/workspaces/psd-clinical/indexes",
 };
+const semanticRuntime: SemanticRuntimeConfig = {
+  internalQdrantUrl: "http://qdrant:6333",
+  internalEmbeddingUrl: "http://embedding:11434",
+  internalEmbeddingModel: "qwen3-embedding:0.6b",
+  internalEmbeddingDimensions: 1024,
+};
 const legacyWorkspace = parseWorkspaceYaml(`workspace:
   schema_version: 1
   id: psd-clinical
@@ -174,8 +185,56 @@ test("refuses to render a v1 descriptor until an explicit migration creates v2",
 
 test("fails closed for v3 runtime rendering and session support", () => {
   expect(supportsSessionRuntime(directBindings)).toBe(true);
-  expect(() => renderRuntimeConfig(workspaceV3, directBindings, paths))
-    .toThrow(/unsupported|schema version 3|qdrant|ollama_internal/i);
+  const rendered = parse(renderRuntimeConfig(workspaceV3, directBindings, paths, undefined, {}, semanticRuntime));
+
+  expect(rendered.resources).toMatchObject({
+    vector: {
+      engine: "qdrant",
+      base_url: "http://qdrant:6333",
+      collection: "psd-clinical",
+    },
+  });
+  expect(rendered.embeddings).toMatchObject({
+    provider: "ollama_internal",
+    base_url: "http://embedding:11434",
+    model: "qwen3-embedding:0.6b",
+    dimensions: 1024,
+  });
+});
+
+test("schema v3 runtime rendering never exposes external semantic endpoints from bindings", () => {
+  const rendered = parse(renderRuntimeConfig(workspaceV3, {
+    ...directBindings,
+    vector: {
+      transport: "rest_api",
+      missing: [],
+      values: {
+        THT_WS_PSD_CLINICAL_VECTOR_BASE_URL: "https://vector.example.test",
+        THT_WS_PSD_CLINICAL_VECTOR_API_KEY_FILE: "/run/secrets/vector-api-key",
+      },
+    },
+    embedding: {
+      transport: "rest_api",
+      missing: [],
+      values: {
+        THT_WS_PSD_CLINICAL_EMBEDDING_BASE_URL: "https://embedding.example.test",
+      },
+    },
+  }, paths, undefined, {}, semanticRuntime));
+
+  expect(rendered.resources.vector).toMatchObject({
+    engine: "qdrant",
+    base_url: "http://qdrant:6333",
+    collection: "psd-clinical",
+  });
+  expect(rendered.embeddings).toMatchObject({
+    provider: "ollama_internal",
+    base_url: "http://embedding:11434",
+    model: "qwen3-embedding:0.6b",
+    dimensions: 1024,
+  });
+  expect(JSON.stringify(rendered)).not.toContain("vector.example.test");
+  expect(JSON.stringify(rendered)).not.toContain("embedding.example.test");
 });
 
 test("omits direct TLS fields when binding validation did not retain a file path", () => {