fix: enforce internal embeddings contract

harness/tht/config.py

@@ -454,6 +454,7 @@ def load_config(path: Path) -> Config:
         if cfg.runtime_identity is not None
         else path.resolve().as_posix()
     )
+    _validate_active_embeddings_config(cfg.embeddings, path)
     return cfg
 
 
@@ -499,6 +500,35 @@ def _validate_internal_embedding_contract(raw: dict[str, Any], path: Path) -> No
         )
 
 
+def _validate_active_embeddings_config(
+    embeddings: "EmbeddingsConfig | None",
+    path: Path,
+) -> None:
+    if embeddings is None:
+        return
+    if embeddings.provider != "ollama_internal":
+        raise ConfigError(
+            f"Configurazione non valida in {path}:\n"
+            "embeddings.provider deve essere 'ollama_internal'"
+        )
+    if embeddings.model != "qwen3-embedding:0.6b":
+        raise ConfigError(
+            f"Configurazione non valida in {path}:\n"
+            "embeddings.model deve essere 'qwen3-embedding:0.6b'"
+        )
+    if embeddings.dim != 1024:
+        raise ConfigError(
+            f"Configurazione non valida in {path}:\n"
+            "embeddings.dim deve essere 1024"
+        )
+    if not _is_allowed_internal_embedding_url(embeddings.base_url):
+        raise ConfigError(
+            f"Configurazione non valida in {path}:\n"
+            "embeddings.base_url deve usare http://embedding:11434 "
+            "oppure un endpoint loopback di sviluppo su porta 11434"
+        )
+
+
 def _is_allowed_internal_embedding_url(value: Any) -> bool:
     if not isinstance(value, str):
         return False