feat(ql3): add optional console run drilldown

scripts/ql3-cluster-copilot-console-audit.cjs

@@ -14,6 +14,7 @@ const REQUIRED_FILES = Object.freeze([
   CONSOLE_ROOT + '/evidenceVerifier.ts',
   CONSOLE_ROOT + '/evidenceVerifierCli.ts',
   CONSOLE_ROOT + '/server.ts',
+  'packages/ql3-cluster-admin/src/run-management/runCancellationInspection.ts',
   CLIENT_FILE,
   ASSET_ROOT + '/index.html',
   ASSET_ROOT + '/app.css',
@@ -21,6 +22,7 @@ const REQUIRED_FILES = Object.freeze([
   ASSET_ROOT + '/app.js',
   DEPLOYMENT_ROOT + '/README.md',
   DEPLOYMENT_ROOT + '/client-config.example.json',
+  DEPLOYMENT_ROOT + '/run-management-client-config.example.json',
   'deploy/containers/ql3-cluster-admin/Dockerfile',
   'scripts/ql3-cluster-admin-product-live-contract.cjs',
 ]);
@@ -103,6 +105,9 @@ function auditClusterCopilotConsole(options = {}) {
     'clusterCopilotConsoleClientCommand',
     'clusterCopilotConsoleProjectReadPath',
     "'run_event_list'",
+    "'run_cancellation_status'",
+    "'run_cancellation_blocked_list'",
+    "'run_cancellation_inspect'",
     "'task_read'",
     "'workflow_step_list'",
   ]);
@@ -130,6 +135,7 @@ function auditClusterCopilotConsole(options = {}) {
     "request.headers.host !== expectedOrigin.slice('http://'.length)",
     'maximumConcurrentRequests: 2',
     "'/api/v1/copilot/inspect': 'inspect'",
+    "'/api/v1/run-management/cancellation-status': 'run_cancellation_status'",
     "'/api/v1/observe/run-list': 'run_list'",
     "'/api/v1/observe/task-list': 'task_list'",
     "'/api/v1/observe/workflow-list': 'workflow_list'",
@@ -144,27 +150,29 @@ function auditClusterCopilotConsole(options = {}) {
     'WebSocket',
     'set-cookie',
     'diagnose',
-    'cancel',
+    'run.cancellation.rearm',
     'child_process',
     'node:fs',
     'node:net',
   ]);
   expectFragments(CONSOLE_ROOT + '/cli.ts', [
     '--session /absolute/session',
+    '--run-management-config /absolute/run-client.json',
+    '--run-management-assertion /absolute/assertion.jwt',
     'readCanonicalFile(',
     "'private'",
     'validateClusterCopilotClientCredentialFile',
     "clusterCredential: 'server_only'",
     'networkBoundary: parsed.networkBoundary',
     "publishedHostAddress: '127.0.0.1'",
-    'operations: CLUSTER_COPILOT_CONSOLE_READ_OPERATIONS',
+    'runManagementAuthority: runManagementAuthority',
     'mutation: false',
   ]);
   rejectFragments(CONSOLE_ROOT + '/cli.ts', [
     'process.env',
     '0.0.0.0',
     'diagnose',
-    'cancel',
+    "operation: 'run.cancellation.rearm'",
   ]);
   expectFragments(CONSOLE_ROOT + '/evidenceVerifier.ts', [
     'qinglong/cluster-console-evidence-verification@v1',
@@ -214,6 +222,9 @@ function auditClusterCopilotConsole(options = {}) {
     '读取 Run 列表',
     '读取 Workflow Runs',
     '显式读取诊断内容',
+    '读取取消可用性',
+    '读取首屏 Blocked Runs',
+    '该只读面没有 rearm',
     '模型文本是不可信内容',
     '导出脱敏包',
     '/evidence-bundle.js',
@@ -237,7 +248,7 @@ function auditClusterCopilotConsole(options = {}) {
     'WebSocket',
     'EventSource',
     'diagnose',
-    'cancel',
+    'run.cancellation.rearm',
     'http://',
     'https://',
     'navigator.',
@@ -280,6 +291,8 @@ function auditClusterCopilotConsole(options = {}) {
     'Do not deploy it as a Kubernetes workload',
     'Run, Task, Workflow',
     'thirteen exact operations',
+    'available vocabulary to sixteen',
+    'QL3_COPILOT_CONSOLE_RUN_MANAGEMENT=enabled',
     '--port=0',
     'TLS 1.3 `GET /readyz`',
     'excluded from small router Edge/Standalone artifacts',
@@ -423,6 +436,9 @@ function auditClusterCopilotConsole(options = {}) {
     operations: Object.freeze([
       'inspect',
       'output',
+      'run_cancellation_status',
+      'run_cancellation_blocked_list',
+      'run_cancellation_inspect',
       'run_list',
       'run_read',
       'run_event_list',
@@ -456,7 +472,7 @@ function auditClusterCopilotConsole(options = {}) {
       networkAccess: false,
       fileWrites: false,
     }),
-    sourceFileCount: 6,
+    sourceFileCount: 7,
     findings: Object.freeze(findings),
     compatible: findings.length === 0,
   });