fix: enforce internal embeddings contract

harness/tests/test_config_resources.py

@@ -106,7 +106,7 @@ roots:
   sessions: {runtime_root / 'sessions'}
   artifacts: {runtime_root / 'artifacts'}
   indexes: {runtime_root / 'indexes'}
-embeddings: {{base_url: http://embedding.invalid, model: embed, dim: 768}}
+embeddings: {{provider: ollama_internal, base_url: http://embedding:11434, model: qwen3-embedding:0.6b, dim: 1024}}
 """)
     monkeypatch.setenv("THT_DATA_ROOT", str(data_root))
 
@@ -204,7 +204,7 @@ dwh:
 vectors:
   type: thoth_vector_http
   writer: {base_url: https://vectors.test/, api_key: writer}
-embeddings: {base_url: http://ollama:11434, dim: 768}
+embeddings: {provider: ollama_internal, base_url: http://embedding:11434, model: qwen3-embedding:0.6b, dim: 1024}
 """
     )
 
@@ -302,6 +302,25 @@ dwh:
         load_config(workspace)
 
 
+def test_rejects_external_top_level_embedding_configuration(tmp_path):
+    workspace = tmp_path / "workspace.yaml"
+    workspace.write_text(
+        """
+dwh:
+  type: postgres_direct
+  connection: {database: analytics, schema: mart, user: reader, password: secret}
+embeddings:
+  provider: openai_compatible
+  base_url: https://embedding.example.test
+  model: text-embedding-3-large
+  dim: 3072
+"""
+    )
+
+    with pytest.raises(ConfigError, match="ollama_internal|provider|base_url|model|1024"):
+        load_config(workspace)
+
+
 def test_builds_typed_evidence_sources_and_keeps_legacy_compatible(tmp_path):
     common = """
 dwh:

harness/tests/test_internal_embeddings.py

@@ -137,3 +137,20 @@ def test_internal_embeddings_reject_non_finite_values():
 
     with pytest.raises(EmbeddingsError, match="finite|finit"):
         embedder.embed(["alpha"])
+
+
+def test_internal_embeddings_reject_non_object_json_payload():
+    from tht.vectorstore.embeddings import OllamaInternalEmbeddings
+
+    embedder = OllamaInternalEmbeddings(
+        EmbeddingsConfig(
+            provider="ollama_internal",
+            base_url="http://embedding:11434",
+            model="qwen3-embedding:0.6b",
+            dim=1024,
+        ),
+        session=_Session([_Response([_vector(1.0)])]),
+    )
+
+    with pytest.raises(EmbeddingsError, match="response|payload|embeddings"):
+        embedder.embed(["alpha"])

harness/tht/config.py

@@ -454,6 +454,7 @@ def load_config(path: Path) -> Config:
         if cfg.runtime_identity is not None
         else path.resolve().as_posix()
     )
+    _validate_active_embeddings_config(cfg.embeddings, path)
     return cfg
 
 
@@ -499,6 +500,35 @@ def _validate_internal_embedding_contract(raw: dict[str, Any], path: Path) -> No
         )
 
 
+def _validate_active_embeddings_config(
+    embeddings: "EmbeddingsConfig | None",
+    path: Path,
+) -> None:
+    if embeddings is None:
+        return
+    if embeddings.provider != "ollama_internal":
+        raise ConfigError(
+            f"Configurazione non valida in {path}:\n"
+            "embeddings.provider deve essere 'ollama_internal'"
+        )
+    if embeddings.model != "qwen3-embedding:0.6b":
+        raise ConfigError(
+            f"Configurazione non valida in {path}:\n"
+            "embeddings.model deve essere 'qwen3-embedding:0.6b'"
+        )
+    if embeddings.dim != 1024:
+        raise ConfigError(
+            f"Configurazione non valida in {path}:\n"
+            "embeddings.dim deve essere 1024"
+        )
+    if not _is_allowed_internal_embedding_url(embeddings.base_url):
+        raise ConfigError(
+            f"Configurazione non valida in {path}:\n"
+            "embeddings.base_url deve usare http://embedding:11434 "
+            "oppure un endpoint loopback di sviluppo su porta 11434"
+        )
+
+
 def _is_allowed_internal_embedding_url(value: Any) -> bool:
     if not isinstance(value, str):
         return False

harness/tht/vectorstore/embeddings.py

@@ -33,7 +33,12 @@ class OllamaInternalEmbeddings:
             raise EmbeddingsError(
                 f"internal Ollama embeddings request failed for model {self.model}"
             ) from exc
-        payload = response.json()
+        try:
+            payload = response.json()
+        except ValueError as exc:
+            raise EmbeddingsError("internal Ollama returned an invalid JSON response") from exc
+        if not isinstance(payload, dict):
+            raise EmbeddingsError("internal Ollama returned a non-object response payload")
         embeddings = payload.get("embeddings")
         if not isinstance(embeddings, list):
             raise EmbeddingsError("internal Ollama response is missing embeddings")