feat(ql3): add optional console run drilldown

test/back/ql3ClusterCopilotConsoleAudit.test.cjs

@@ -28,6 +28,9 @@ test('keeps the QingLong 3.0 Copilot Console independent and read-only', () => {
     operations: [
       'inspect',
       'output',
+      'run_cancellation_status',
+      'run_cancellation_blocked_list',
+      'run_cancellation_inspect',
       'run_list',
       'run_read',
       'run_event_list',
@@ -61,7 +64,7 @@ test('keeps the QingLong 3.0 Copilot Console independent and read-only', () => {
       networkAccess: false,
       fileWrites: false,
     },
-    sourceFileCount: 6,
+    sourceFileCount: 7,
     findings: [],
     compatible: true,
   });

test/back/ql3ClusterCopilotConsoleDistributionAudit.test.cjs

@@ -27,6 +27,7 @@ test('accepts the signed multi-architecture Admin OCI workstation distribution',
     hostPublication: '127.0.0.1',
     kubernetesResident: false,
     additionalWorkspacePackages: 0,
+    runManagementAuthorityDefault: 'disabled',
     externalWorkstationCeremony: 'source-tag-private-report',
     ceremonyStatus: 'implementation-ready-public-release-pending',
     findings: [],

test/back/ql3ClusterCopilotConsoleLauncher.test.cjs

@@ -10,7 +10,9 @@ const launcher = path.join(
   ROOT,
   'deploy/console/ql3-cluster-copilot/docker-loopback.sh',
 );
-const image = `ghcr.io/example/qinglong3-cluster-admin@sha256:${'a'.repeat(64)}`;
+const image = `ghcr.io/example/qinglong3-cluster-admin@sha256:${'a'.repeat(
+  64,
+)}`;
 
 function fixture(t) {
   const directory = fs.realpathSync(
@@ -114,9 +116,24 @@ test('publishes standard serve only on host loopback', (t) => {
   assert.equal(args[args.indexOf('--memory') + 1], '512m');
   assert.equal(args[args.indexOf('--cpus') + 1], '1');
   assert.equal(args[args.indexOf('--pids-limit') + 1], '64');
+  assert.equal(args[args.indexOf('--publish') + 1], '127.0.0.1:5701:5701/tcp');
+});
+
+test('adds optional Run management files only after an explicit enabled switch', (t) => {
+  const value = fixture(t);
+  const result = invoke('check', {
+    ...value.env,
+    QL3_COPILOT_CONSOLE_RUN_MANAGEMENT: 'enabled',
+  });
+  assert.equal(result.status, 0, result.stderr);
+  const args = fs.readFileSync(value.capture, 'utf8').trimEnd().split('\n');
   assert.equal(
-    args[args.indexOf('--publish') + 1],
-    '127.0.0.1:5701:5701/tcp',
+    args[args.indexOf('--run-management-config') + 1],
+    '/var/run/secrets/qinglong3/copilot-console/run-management-client.json',
+  );
+  assert.equal(
+    args[args.indexOf('--run-management-assertion') + 1],
+    '/var/run/secrets/qinglong3/copilot-console/run-management-assertion.jwt',
   );
 });
 
@@ -126,8 +143,12 @@ test('rejects mutable, ambient and malformed host inputs before Docker', (t) =>
     { ...value.env, QL3_COPILOT_CONSOLE_IMAGE: 'ghcr.io/example/admin:latest' },
     { ...value.env, QL3_COPILOT_CONSOLE_NETWORK: 'host' },
     { ...value.env, QL3_COPILOT_CONSOLE_PORT: '80' },
-    { ...value.env, QL3_COPILOT_CONSOLE_PRIVATE_ROOT: `${value.privateRoot}:rw` },
+    {
+      ...value.env,
+      QL3_COPILOT_CONSOLE_PRIVATE_ROOT: `${value.privateRoot}:rw`,
+    },
     { ...value.env, QL3_COPILOT_CONSOLE_RESOURCE_CLASS: 'unbounded' },
+    { ...value.env, QL3_COPILOT_CONSOLE_RUN_MANAGEMENT: 'ambient' },
   ]) {
     const rejected = invoke('serve', environment);
     assert.equal(rejected.status, 78);

test/back/ql3PackageBoundaryAudit.test.cjs

@@ -340,10 +340,10 @@ test('current QL3 workspace has exactly eighteen reviewed package boundaries', (
       rootSourceFileRoles: clusterAdmin.rootSourceFileRoles,
     },
     {
-      sourceFiles: 124,
+      sourceFiles: 125,
       rootSourceFiles: 1,
       rootSourceLines: 61,
-      nestedSourceFiles: 123,
+      nestedSourceFiles: 124,
       rootSourceFileRoles: {
         'modelInvocationMigrationCli.ts': 'binary_entry',
       },
@@ -385,10 +385,10 @@ test('current QL3 workspace has exactly eighteen reviewed package boundaries', (
       rootSourceFileRoles: clusterControl.rootSourceFileRoles,
     },
     {
-    sourceFiles: 65,
+      sourceFiles: 65,
       rootSourceFiles: 2,
       rootSourceLines: 195,
-    nestedSourceFiles: 63,
+      nestedSourceFiles: 63,
       rootSourceFileRoles: {
         'aiCli.ts': 'binary_entry',
         'cli.ts': 'binary_entry',