test(ql3): prove Kubernetes secret binding projection

docs/QINGLONG_3_0_ARCHITECTURE_RFC.md

@@ -28,7 +28,7 @@
 - D-304/ADR-0392（已接受）：Plugin Package 进入安全 quarantine 时，Workflow/Prompt automation publication 不再仅依赖运行时 start guard 间接拒绝，而是与 quarantine event、Package-owned Task disabled revisions、Project Tool snapshot 和 withdrawal receipt 在同一 SQLite/PostgreSQL 事务中收敛为 `withdrawn`。原先仅能引用普通 lifecycle event 的外键升级为 append-only disposition-event 联合引用，历史 migration 与 publication digest schema 保持不变；SQLite edge/standalone 崩溃矩阵覆盖 automation publication insert 后、event/task/receipt/COMMIT 前后，PostgreSQL 通过触发器在既有 `SECURITY DEFINER` quarantine commit 内登记 disposition，再由同一外层 SERIALIZABLE transaction CAS publication head。能力位为 `plugin_package_automation_security_withdrawal@1`；不新增 package、daemon、timer、连接或常驻缓存，适用于低配路由设备和集群节点。SQLite 全量 228/228；PostgreSQL package 311 pass/1 条外部 URL 条件 skip；完整 18-package build/test 退出 0，backend 1,188 pass/2 skip，package/dependency boundary 零 finding；PostgreSQL 18.4 arm64 HA 125 项 gate 全绿、timeline `1→2`，报告 SHA-256 为 `ab156901b9c96ec5a62259c44d83d24ded011e0616dc827d928f3e13efd11786`。
 - D-305/ADR-0393（已接受）：Plugin Package Manifest 的逻辑 Secret requirement 获得按 resource generation 固定的不可变 binding。binding 精确覆盖 Manifest requirements，只保存同 Project、显式 version 的 `qlsecret://` 引用与 `approved-action-execution|local-owner-confirmation` authority evidence digest，不保存 Secret 明文；required 不可为空，optional 可显式为 `null`。发布由当前 active installation head、lock、generation 与 Manifest digest 联合 fencing，相同事实幂等、不同事实冲突；domain-separated digest、最多 64 项和 64 KiB 单行预算同时约束 Local 与 Cluster。SQLite 追加 `0091` ledger 与 capability v46，PostgreSQL 追加 `pg-0059`、capability v58，并只向 package executor 授予 `SELECT, INSERT`。不新增 package、daemon、timer、watcher、连接、缓存或集群 workload，低配路由设备只承担一个有界表和三个索引。D-305 不冒充 Secret 已进入执行路径：现有 materialization 拒绝仍保留，D-306 再完成用户授权、Secret resolution、runtime consumption 与 lifecycle/rebinding 语义。core 509/509、SQLite 232/232、PostgreSQL 316 pass/1 条件 skip；完整 18-package clean build/test 退出 0，backend 1,188 pass/2 skip，五项边界审计零 finding，workspace 仍无 single-source/shallow-source package。PostgreSQL 18.4 arm64 HA 125 项 gate 全绿、timeline `1→2`，报告 SHA-256 为 `acf0fea7ca7699989dfe70f5dd0061cdf5fb1968c691094331fea06ce01b96dc`。
 - D-306A/ADR-0394（已接受）：Package Task source 以 `package-secret` placeholder 引用逻辑 requirement，materialization 只用当前 generation 的 D-305 binding 编译为已有、固定 version 的 Task `SecretRef`；Package source 直接携带 SecretRef、缺失 binding、未批准 `secret.use`、跨 binding 引用和 optional/required 漂移全部失败关闭。binding 快照不含明文并进入 materialized revision digest，Local/Cluster 启动发布复用既有 repository/pool，Task dispatch、Local 短时解密和 Cluster offer/lease-fenced delivery 不另造协议。SQLite/PostgreSQL INSERT trigger 同时防止直接写库绕过；Local 只读 readiness 继续不加载 DDL。Local contract v47、Cluster v59；不新增 package、表、索引、连接、daemon、watcher、timer、cache 或 workload。完整 18-package clean build/test 退出 0；backend 1,188 pass/2 条件 skip/0 fail；五项 package/dependency/edge/service-manager/local-image 审计零 finding，workspace 仍无 single-source/shallow-source package，两个有序 migration ledger 精确为 PostgreSQL 61、SQLite 95 个 source；PostgreSQL 18.4 arm64 HA 125 项 gate 全绿、timeline `1→2`，报告 SHA-256 为 `f9107e8e54892a788779758f0573ac8d6a80f6d086516a1f5f5bbacb59bbb4be`。D-306A 不冒充产品闭环：Local bind/rebind 命令、Cluster Approved Action/API 与新 generation rotation/revocation 编排属于 D-306B。
-- D-306B1/ADR-0395（进行中）：先完成当前 active、尚未绑定 Package generation 的首次 Secret binding，不允许原地 rebind。共享 content-free plan 由服务端从 installation/proposal/lock/Manifest/generation 重建，调用方不能注入 generation 或 digest。Local 已复用短生命周期 `ql3-package` 私有 command-file 和单 SQLite authority：强 `local-console` User 必须同时具备 `secret.manage` 与当前 Project Owner，human confirmation 后在一个 `BEGIN IMMEDIATE` transaction 内复验 Owner fence、Package provenance、精确 Secret version、content-free audit 与 immutable binding；plan 后撤权原子回滚，exact replay 收敛，不同 audit identity 或当前代重复绑定失败关闭。Cluster 核心 authority 已补齐 package-manager `plan→propose→separation-of-duty decide`、package-executor 有界 approved queue consumer、Approved Action handler 与 immutable PostgreSQL binding publish；executor 只对可选 read-only Kubernetes Secret 投影执行 metadata-only existence check，不读取 Secret value，缺投影失败关闭。产品入口已复用既有 `/api/v3/plugin-packages/management`、mTLS/OIDC 强 User 身份、同一个 package-manager Pool、分布式 quota 与 `ql3-cluster-admin package` 一次性 client，新增严格 exact-shape 的 `plugin-package.secret-binding.plan|propose|decide|inspect` 四命令；成功响应仅含 target、固定 version SecretRef、审批与 digest 摘要，客户端会拒绝跨 Project SecretRef、重复 requirement、错误 action/approval/digest 绑定和扩展响应。该入口不把 Secret value、executor、Kubernetes 或 binding 表直读 authority 装进 management 进程，也不增加 listener、连接或 workload。PostgreSQL 18 三角色真实纵切面已从正式 transport 完整执行 install/activate→plan/replay/propose/decide/inspect→consume/dispatch/bind，并证明 manager 不能读取最终 binding 表。完整 18-package clean build/test 退出 0，cluster-admin 315 pass/3 条件 skip，backend 1,188 pass/2 条件 skip/0 fail；package/dependency/deployment/CloudNativePG/edge/service-manager/local-image 七项审计零 finding。最新 PostgreSQL 18.4 arm64 physical HA 通过 125 gate、timeline `1→2`，报告 SHA-256 为 `6506b74721891cfd5709b1661562c204a310e99ed06131a25c464128f4ded4c6`。未新增 package、migration、表、索引、依赖、常驻进程、连接、listener、timer、watcher、cache 或 workload；18 个 workspace package仍无 single-source/shallow-source package。Kubernetes live exercise 与 B2 rebind/rotation/revocation 仍待完成，所以 ADR 保持 Proposed。
+- D-306B1/ADR-0395（已接受）：当前 active、尚未绑定 Package generation 的首次 Secret binding 已形成 Local 与 Cluster 产品闭环，且不允许原地 rebind。共享 content-free plan 由服务端从 installation/proposal/lock/Manifest/generation 重建；Local 使用短生命周期 `ql3-package`、Owner human confirmation 与单 SQLite transaction，Cluster 使用既有 package-management HTTPS/CLI、package-manager separation-of-duty Approval 和短生命周期 package-executor。三节点 K3s `v1.34.3+k3s1` arm64 现场门已在真实 PostgreSQL `18.4` 上完成两个 management Pod 跨节点部署、正式 client `plan→跨副本 replay→propose→双人 decide→inspect`、真实 executor Job 与只读 Kubernetes Secret projection。management/executor 均无 Secret API 读取权和 ServiceAccount token；management 不挂载 Package value，executor 只验证投影元数据；最终恰好一条 immutable binding，Approval consumed、execution succeeded，数据库敏感值扫描为 0。16/16 gate 的 owner-private、低敏报告通过独立 exact-shape 审计，SHA-256 为 `aaabb5ebea77c50bce671f91dd3051671fd20875c11a8f787fe8933f29dbfa4d`。完整 18-package clean build/test、backend 与七项边界审计，以及 PostgreSQL 18.4 physical HA 125 gate/timeline `1→2` 证据继续有效；没有新增 workspace package、migration、表、索引、依赖或常驻 workload。B2 rebind/rotation/revocation 必须通过新 Package generation 独立推进。
 - D-302/ADR-0390（已接受）
   Cluster operator context 增加无网络、无 mutation 的内建 `ql3-cluster-admin context validate` 预检。它先复用 owner-private context
   reader，再让每个 entry 经过与真实请求相同的 production HTTPS/Kubernetes configuration preparation，验证精确 route、hostname、CA、

docs/adr/ADR-0395-owner-confirmed-plugin-package-secret-binding.md

@@ -1,6 +1,6 @@
 # ADR-0395：Owner 确认的 Plugin Package Secret 首次绑定
 
-- 状态：Proposed
+- 状态：Accepted
 - 日期：2026-08-13
 - 关联 RFC：QL-RFC-0001 D-306B1
 - 关联 ADR：ADR-0364、ADR-0393、ADR-0394
@@ -40,6 +40,7 @@ QingLong 3.0 同时面向低配路由设备和集群节点。本机产品入口
 - Runtime Core、Local SQLite、Local Owner CLI closure type-check 已通过；Local 产品定向纵切面 3/3。
 - 18-package clean build/test 中除受限沙箱禁止绑定 `127.0.0.1` 导致的 Worker TLS 三项外，其余已执行测试均为 0 fail；同一 Worker 完整包在允许回环监听的环境为 133/133。
 - Cluster 核心 authority 已完成：package-manager durable plan/proposal/decision、package-executor 有界 consumer/dispatch/handler、只读可选 Secret 投影与 immutable binding publish。`cluster-admin` 与 `cluster-postgres` 最终全包合计 638 pass/2 条件 skip；PostgreSQL 18 三角色真实纵切面 1/1，覆盖真实 install/activate、plan/propose/decide、consume/dispatch/bind、exact replay、manager 对 binding 表拒绝和 content-free 断言，并发现、修复 INSERT placeholder typmod 缺失。
-- Cluster 产品入口已完成：复用既有 `/api/v3/plugin-packages/management` HTTPS route、mTLS/OIDC 强 User 身份、package-manager Pool、分布式 quota 与 `ql3-cluster-admin package` 一次性 client，开放 exact-shape 的 `plugin-package.secret-binding.plan|propose|decide|inspect`。响应仅含 content-free target、固定 version SecretRef、审批和 digest 摘要；client 会拒绝跨 Project、重复 requirement、action/approval/digest 漂移和扩展响应。management 进程不取得 Secret value、Kubernetes、executor 或最终 binding 表 authority，也不新增 listener、连接、进程或 workload。
+- Cluster 产品入口已完成：复用既有 `/api/v3/plugin-packages/management` HTTPS route、TLS 1.3 服务端认证与 OIDC 强 User 身份、package-manager Pool、分布式 quota 与 `ql3-cluster-admin package` 一次性 client，开放 exact-shape 的 `plugin-package.secret-binding.plan|propose|decide|inspect`。响应仅含 content-free target、固定 version SecretRef、审批和 digest 摘要；client 会拒绝跨 Project、重复 requirement、action/approval/digest 漂移和扩展响应。management 进程不取得 Secret value、Kubernetes、executor 或最终 binding 表 authority，也不新增 listener、连接、进程或 workload。
 - 当前 Cluster Admin runtime 镜像的统一产品 facade 已在 UID `10001:10001`、128 MiB、0.25 CPU、32 PIDs、read-only root、无网络、全 capability drop 和 `no-new-privileges` 下完成 live contract；七个子命令、operator context preflight/readiness 与 `package` 分派均通过。这是制品/CLI 资源门，不冒充 Kubernetes Secret projection 或多 Pod live exercise。
-- 正式 transport 经 PostgreSQL 18 三角色真实纵切面 1/1，覆盖 install/activate、plan/exact replay/propose/separation-of-duty decide/authorized inspect、consumer/dispatch/bind、manager 最终表拒绝与 content-free 输出。`cluster-admin` 315 pass/3 条件 skip；完整 18-package clean build/test 退出 0，backend 1,188 pass/2 条件 skip/0 fail。package boundary、cluster dependency、cluster deployment、CloudNativePG、edge import、service-manager bridge、local image 七项审计零 finding；workspace 仍为 18 包且没有 single-source/shallow-source package。PostgreSQL 18.4 arm64 physical HA 125 gate、timeline `1→2` 已通过，报告 SHA-256 为 `6506b74721891cfd5709b1661562c204a310e99ed06131a25c464128f4ded4c6`。Kubernetes live exercise 仍待完成，因此本 ADR 保持 Proposed。
+- 正式 transport 经 PostgreSQL 18 三角色真实纵切面 1/1，覆盖 install/activate、plan/exact replay/propose/separation-of-duty decide/authorized inspect、consumer/dispatch/bind、manager 最终表拒绝与 content-free 输出。`cluster-admin` 315 pass/3 条件 skip；完整 18-package clean build/test 退出 0，backend 1,188 pass/2 条件 skip/0 fail。package boundary、cluster dependency、cluster deployment、CloudNativePG、edge import、service-manager bridge、local image 七项审计零 finding；workspace 仍为 18 包且没有 single-source/shallow-source package。PostgreSQL 18.4 arm64 physical HA 125 gate、timeline `1→2` 已通过，报告 SHA-256 为 `6506b74721891cfd5709b1661562c204a310e99ed06131a25c464128f4ded4c6`。
+- 三节点 K3s `v1.34.3+k3s1` arm64 现场门已完成真实 PostgreSQL `18.4` migration、两个 management Pod 跨节点反亲和、五次正式 HTTPS client `plan→跨副本 replay→propose→双人 decide→inspect`、真实 package-executor Job 与只读 Kubernetes Secret projection。management 与 executor ServiceAccount 均不能 `get/list secrets`、均不挂载 API token；management 不挂载 Package value，executor 只做 projection metadata existence check。数据库恰好发布一条 `approved-action-execution` binding，Approval consumed、execution succeeded，敏感值在 binding/plan/approval/execution JSON 中命中数为 0。低敏私有报告通过 16/16 gate 和独立 exact-shape 审计，SHA-256 为 `aaabb5ebea77c50bce671f91dd3051671fd20875c11a8f787fe8933f29dbfa4d`。本门不冒充 Kubernetes control-plane HA；PostgreSQL physical failover 继续由独立 125-gate 合约负责。B1 接受条件已满足，B2 rebind/rotation/revocation 作为后续新 generation 状态机继续推进。

package.json

@@ -48,6 +48,8 @@
     "test:prompt-output-projection-kubernetes-live:ql3": "pnpm --filter @qinglong/ai build && node scripts/ql3-prompt-output-projection-kubernetes-live-contract.cjs",
     "audit:prompt-output-projection-kubernetes-live:ql3": "node scripts/ql3-prompt-output-projection-kubernetes-live-audit.cjs",
     "test:plugin-package-kubernetes-live:ql3": "node scripts/ql3-plugin-package-kubernetes-live-contract.cjs",
+    "test:plugin-package-secret-binding-kubernetes-live:ql3": "pnpm --filter @qinglong/cluster-admin build && node scripts/ql3-plugin-package-secret-binding-kubernetes-live-contract.cjs",
+    "audit:plugin-package-secret-binding-kubernetes-live:ql3": "node scripts/ql3-plugin-package-secret-binding-kubernetes-live-audit.cjs",
     "test:plugin-package-recovery-e2e:ql3": "pnpm --filter @qinglong/cluster-admin check && pnpm --filter @qinglong/cluster-control check && node scripts/ql3-plugin-package-recovery-e2e-live-contract.cjs",
     "benchmark:edge": "node scripts/ql3-edge-benchmark.cjs",
     "benchmark:cluster-control": "node scripts/ql3-cluster-control-benchmark.cjs",

scripts/ql3-plugin-package-secret-binding-kubernetes-live-audit.cjs

@@ -0,0 +1,259 @@
+#!/usr/bin/env node
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const FIXTURE = 'qinglong/plugin-package-secret-binding-kubernetes-live@v1';
+const SHA256 = /^sha256:[a-f0-9]{64}$/;
+const FORBIDDEN_KEY =
+  /(secretRef|secretValue|material|assertion|jwt|password|dsn|privateKey|certificate|kubeconfig|podUid|nodeUid|podName|nodeName)/i;
+const REQUIRED_GATES = Object.freeze([
+  'realThreeNodeKubernetes',
+  'twoManagementReplicasOnDistinctNodes',
+  'formalHttpsClientCommands',
+  'planReplayedAcrossReplicas',
+  'separationOfDutyDecision',
+  'authorizedInspection',
+  'realExecutorJob',
+  'projectedSecretMetadataAccepted',
+  'bindingPublishedExactlyOnce',
+  'managementCannotReadSecrets',
+  'managementDoesNotMountPackageValues',
+  'executorCannotReadSecrets',
+  'executorHasNoServiceAccountToken',
+  'executorProjectionReadOnly',
+  'databaseContainsNoSensitiveValue',
+  'passed',
+]);
+
+function exact(value, keys) {
+  return Boolean(
+    value &&
+      typeof value === 'object' &&
+      !Array.isArray(value) &&
+      JSON.stringify(Object.keys(value).sort()) ===
+        JSON.stringify([...keys].sort()),
+  );
+}
+
+function scan(value, findings, location = 'report') {
+  if (Array.isArray(value)) {
+    value.forEach((entry, index) =>
+      scan(entry, findings, `${location}[${index}]`),
+    );
+    return;
+  }
+  if (!value || typeof value !== 'object') return;
+  for (const [key, entry] of Object.entries(value)) {
+    if (FORBIDDEN_KEY.test(key))
+      findings.push(`${location}.${key} is forbidden`);
+    if (
+      typeof entry === 'string' &&
+      /(qlsecret:v1:|-----BEGIN |postgres(?:ql)?:\/\/|eyJ[A-Za-z0-9_-]+\.)/.test(
+        entry,
+      )
+    ) {
+      findings.push(`${location}.${key} contains sensitive material`);
+    }
+    scan(entry, findings, `${location}.${key}`);
+  }
+}
+
+function validatePluginPackageSecretBindingKubernetesLiveReport(report) {
+  const findings = [];
+  if (
+    !exact(report, [
+      'schemaVersion',
+      'fixture',
+      'observedAtMs',
+      'platform',
+      'management',
+      'review',
+      'executor',
+      'persistence',
+      'gates',
+      'limitations',
+    ]) ||
+    report.schemaVersion !== 1 ||
+    report.fixture !== FIXTURE ||
+    !Number.isSafeInteger(report.observedAtMs) ||
+    report.observedAtMs < 1
+  ) {
+    findings.push('report envelope is invalid');
+  }
+  if (
+    !exact(report.platform, [
+      'architecture',
+      'kubernetesVersion',
+      'nodeCount',
+      'postgresVersionNumber',
+      'adminImageId',
+    ]) ||
+    !['amd64', 'arm64'].includes(report.platform?.architecture) ||
+    typeof report.platform?.kubernetesVersion !== 'string' ||
+    report.platform?.nodeCount !== 3 ||
+    report.platform?.postgresVersionNumber !== 180004 ||
+    !SHA256.test(report.platform?.adminImageId ?? '')
+  ) {
+    findings.push('platform evidence is invalid');
+  }
+  if (
+    !exact(report.management, [
+      'replicas',
+      'distinctNodeHashes',
+      'serviceAccountTokenMounted',
+      'packageValueVolumeMounted',
+      'canGetSecrets',
+      'canListSecrets',
+    ]) ||
+    report.management?.replicas !== 2 ||
+    !Array.isArray(report.management?.distinctNodeHashes) ||
+    report.management.distinctNodeHashes.length !== 2 ||
+    new Set(report.management.distinctNodeHashes).size !== 2 ||
+    !report.management.distinctNodeHashes.every((value) =>
+      SHA256.test(value),
+    ) ||
+    report.management.serviceAccountTokenMounted !== false ||
+    report.management.packageValueVolumeMounted !== false ||
+    report.management.canGetSecrets !== false ||
+    report.management.canListSecrets !== false
+  ) {
+    findings.push('management isolation evidence is invalid');
+  }
+  if (
+    !exact(report.review, [
+      'commands',
+      'requesterSubjectHash',
+      'reviewerSubjectHash',
+      'distinctUsers',
+      'planStatus',
+      'replayStatus',
+      'decisionStatus',
+      'inspectionStale',
+      'actionDigest',
+      'planDigest',
+    ]) ||
+    JSON.stringify(report.review?.commands) !==
+      JSON.stringify([
+        'plugin-package.secret-binding.plan',
+        'plugin-package.secret-binding.plan',
+        'plugin-package.secret-binding.propose',
+        'plugin-package.secret-binding.decide',
+        'plugin-package.secret-binding.inspect',
+      ]) ||
+    !SHA256.test(report.review?.requesterSubjectHash ?? '') ||
+    !SHA256.test(report.review?.reviewerSubjectHash ?? '') ||
+    report.review?.requesterSubjectHash ===
+      report.review?.reviewerSubjectHash ||
+    report.review?.distinctUsers !== true ||
+    report.review?.planStatus !== 'created' ||
+    report.review?.replayStatus !== 'existing' ||
+    report.review?.decisionStatus !== 'decided' ||
+    report.review?.inspectionStale !== false ||
+    !SHA256.test(`sha256:${report.review?.actionDigest ?? ''}`) ||
+    !SHA256.test(`sha256:${report.review?.planDigest ?? ''}`)
+  ) {
+    findings.push('review ceremony evidence is invalid');
+  }
+  if (
+    !exact(report.executor, [
+      'jobSucceeded',
+      'serviceAccountTokenMounted',
+      'canGetSecrets',
+      'canListSecrets',
+      'projectionReadOnly',
+      'projectionFileCount',
+      'projectionKeyHash',
+      'outputSensitiveFree',
+    ]) ||
+    report.executor?.jobSucceeded !== true ||
+    report.executor?.serviceAccountTokenMounted !== false ||
+    report.executor?.canGetSecrets !== false ||
+    report.executor?.canListSecrets !== false ||
+    report.executor?.projectionReadOnly !== true ||
+    report.executor?.projectionFileCount !== 1 ||
+    !SHA256.test(report.executor?.projectionKeyHash ?? '') ||
+    report.executor?.outputSensitiveFree !== true
+  ) {
+    findings.push('executor projection evidence is invalid');
+  }
+  if (
+    !exact(report.persistence, [
+      'bindingCount',
+      'authorityKind',
+      'evidenceDigest',
+      'entryCount',
+      'approvalConsumed',
+      'executionSucceeded',
+      'sensitiveMatchCount',
+    ]) ||
+    report.persistence?.bindingCount !== 1 ||
+    report.persistence?.authorityKind !== 'approved-action-execution' ||
+    !SHA256.test(`sha256:${report.persistence?.evidenceDigest ?? ''}`) ||
+    report.persistence?.entryCount !== 1 ||
+    report.persistence?.approvalConsumed !== true ||
+    report.persistence?.executionSucceeded !== true ||
+    report.persistence?.sensitiveMatchCount !== 0
+  ) {
+    findings.push('durable binding evidence is invalid');
+  }
+  if (
+    !exact(report.gates, REQUIRED_GATES) ||
+    REQUIRED_GATES.some((gate) => report.gates?.[gate] !== true)
+  ) {
+    findings.push('one or more required gates are false or missing');
+  }
+  if (
+    !Array.isArray(report.limitations) ||
+    report.limitations.length !== 2 ||
+    report.limitations.some(
+      (value) =>
+        typeof value !== 'string' || value.length < 16 || value.length > 512,
+    )
+  ) {
+    findings.push('limitations are invalid');
+  }
+  scan(report, findings);
+  return Object.freeze({
+    schemaVersion: 1,
+    fixture: FIXTURE,
+    findings: Object.freeze(findings),
+    compatible: findings.length === 0,
+  });
+}
+
+function main(argv) {
+  if (argv.length !== 1 || !argv[0].startsWith('--report=/')) {
+    throw new Error(
+      'usage: ql3-plugin-package-secret-binding-kubernetes-live-audit --report=/absolute/report.json',
+    );
+  }
+  const reportPath = argv[0].slice('--report='.length);
+  if (path.resolve(reportPath) !== reportPath)
+    throw new Error('report path is invalid');
+  const report = JSON.parse(fs.readFileSync(reportPath, 'utf8'));
+  const result = validatePluginPackageSecretBindingKubernetesLiveReport(report);
+  process.stdout.write(`${JSON.stringify(result)}\n`);
+  if (!result.compatible) process.exitCode = 1;
+}
+
+if (require.main === module) {
+  try {
+    main(process.argv.slice(2));
+  } catch (error) {
+    process.stderr.write(
+      `QL3 Secret binding Kubernetes live audit failed: ${
+        error instanceof Error ? error.message : String(error)
+      }\n`,
+    );
+    process.exitCode = 1;
+  }
+}
+
+module.exports = {
+  FIXTURE,
+  REQUIRED_GATES,
+  validatePluginPackageSecretBindingKubernetesLiveReport,
+};

scripts/ql3-plugin-package-secret-binding-kubernetes-live-bootstrap.cjs

@@ -0,0 +1,343 @@
+#!/usr/bin/env node
+
+'use strict';
+
+const assert = require('node:assert/strict');
+const { randomUUID } = require('node:crypto');
+const fs = require('node:fs');
+
+const {
+  createPostgresDatabaseOpener,
+} = require('@qinglong/cluster-postgres/package-executor');
+const {
+  PostgresApprovalRequestRepository,
+} = require('@qinglong/cluster-postgres/approved-action');
+const {
+  PostgresPluginPackageInstallRepository,
+} = require('@qinglong/cluster-postgres/plugin-package-install');
+const {
+  PLUGIN_PACKAGE_API_VERSION,
+  PLUGIN_PACKAGE_KIND,
+  planPluginPackageInstall,
+} = require('@qinglong/runtime-core/plugin-package');
+const {
+  pluginPackageActivationIntentDigest,
+  pluginPackageInstallCommit,
+  transitionPluginPackageInstall,
+} = require('@qinglong/runtime-core/plugin-package-install');
+const {
+  createPluginPackagePublisherProvenance,
+} = require('@qinglong/runtime-core/plugin-package-publisher-provenance');
+const { createSecretRef } = require('@qinglong/runtime-core/secret-reference');
+const {
+  secretProjectionFileName,
+} = require('@qinglong/runtime-core/secret-projection');
+const {
+  createClusterPluginPackageManagementService,
+} = require('@qinglong/cluster-admin/plugin-package-management');
+const {
+  createClusterPluginPackageApprovedActionDispatcher,
+} = require('@qinglong/cluster-admin/plugin-package-approved-action');
+
+const PROJECT_ID = 'secret-binding-kubernetes-live';
+const PACKAGE_NAME = 'secret-binding-live';
+const REQUESTER_ID = 'secret-binding-requester';
+const REVIEWER_ID = 'secret-binding-reviewer';
+const MIGRATION_URL = process.env.QL3_TEST_POSTGRES_MIGRATION_URL;
+const MANAGER_URL = process.env.QL3_TEST_POSTGRES_PACKAGE_MANAGER_URL;
+const EXECUTOR_URL = process.env.QL3_TEST_POSTGRES_PACKAGE_EXECUTOR_URL;
+
+function opener(role, connectionString) {
+  assert.ok(connectionString, `${role} URL is required`);
+  return createPostgresDatabaseOpener({
+    role,
+    connection: { connectionString, tls: { mode: 'disable' } },
+    pool: { maxConnections: 2, applicationName: `ql3-live-${role}` },
+    onPoolError(error) {
+      throw error;
+    },
+  });
+}
+
+function principal(id, authenticationId, now) {
+  return Object.freeze({
+    subject: Object.freeze({ type: 'user', id }),
+    authenticationId,
+    authenticatedAtMs: now - 1,
+    expiresAtMs: now + 120_000,
+    assurance: 'multi_factor',
+  });
+}
+
+function audit(eventId, requestId, projectId, now, fence) {
+  return Object.freeze({
+    eventId,
+    requestId,
+    operationId: 'approval.consume',
+    projectId,
+    subject: Object.freeze({ type: 'system', id: 'cluster_package_executor' }),
+    authenticationId: 'secret-binding-kubernetes-live-bootstrap',
+    outcome: 'allowed',
+    reasons: Object.freeze(['package_review']),
+    fence,
+    occurredAtMs: now,
+  });
+}
+
+async function main() {
+  let now = Date.now();
+  const migration = await opener('migration', MIGRATION_URL)();
+  const manager = await opener('package-manager', MANAGER_URL)();
+  const executor = await opener('package-executor', EXECUTOR_URL)();
+  try {
+    await migration.pool.query(
+      `INSERT INTO "ql3"."projects" (
+         id, name, slug, status, version, created_at_ms, updated_at_ms
+       ) VALUES ($1, $1, $1, 'active', 1, $2, $2)`,
+      [PROJECT_ID, now],
+    );
+    await migration.pool.query(
+      `INSERT INTO "ql3"."project_role_bindings" (
+         project_id, subject_type, subject_id, version, state, role,
+         mutation_id, changed_by_type, changed_by_id, created_at_ms
+       ) VALUES
+         ($1, 'user', $2, 1, 'active', 'owner', $4, 'system', 'live', $6),
+         ($1, 'user', $3, 1, 'active', 'admin', $5, 'system', 'live', $6)`,
+      [
+        PROJECT_ID,
+        REQUESTER_ID,
+        REVIEWER_ID,
+        'secret-binding-live-owner',
+        'secret-binding-live-reviewer',
+        now,
+      ],
+    );
+
+    const manifest = Object.freeze({
+      apiVersion: PLUGIN_PACKAGE_API_VERSION,
+      kind: PLUGIN_PACKAGE_KIND,
+      metadata: {
+        name: PACKAGE_NAME,
+        displayName: 'Kubernetes Secret binding live fixture',
+        version: '1.0.0',
+        description: 'Content-free Secret binding Kubernetes evidence fixture',
+        license: 'Apache-2.0',
+      },
+      spec: {
+        compatibility: {
+          qinglong: '>=3.0.0-0 <4.0.0',
+          architectures: ['arm64', 'amd64'],
+          deploymentProfiles: ['cluster-control'],
+        },
+        runtimes: [],
+        resources: {
+          memory: { recommended: '16Mi' },
+          disk: { install: '4Mi', working: '8Mi' },
+        },
+        permissions: {
+          network: { allowedHosts: [] },
+          secrets: [{ name: 'TOKEN', required: true }],
+          tools: ['secret.use'],
+        },
+        contents: { tasks: [], workflows: [], prompts: [], tools: [] },
+      },
+    });
+    const environment = Object.freeze({
+      qinglongVersion: '3.0.0-alpha.0',
+      architecture: process.arch === 'x64' ? 'amd64' : 'arm64',
+      deploymentProfile: 'cluster-control',
+      runtimes: [],
+      availableMemoryBytes: 128 * 1024 * 1024,
+      availableDiskBytes: 256 * 1024 * 1024,
+    });
+    const plan = planPluginPackageInstall(manifest, environment);
+    const actionInput = Object.freeze({
+      lockId: 'secret-binding-live-lock',
+      projectId: PROJECT_ID,
+      manifest,
+      plan,
+      environment,
+      source: {
+        kind: 'offline',
+        locator: `offline:sha256:${'a'.repeat(64)}`,
+        artifactDigest: 'a'.repeat(64),
+        artifactBytes: 2048,
+        contentDigest: 'b'.repeat(64),
+      },
+      architecture: environment.architecture,
+      deploymentProfile: 'cluster-control',
+      targetGeneration: 1,
+    });
+    const actionRef = `install:${PACKAGE_NAME}:v1`;
+    const approvalId = 'secret-binding-live-install-approval';
+    const management = createClusterPluginPackageManagementService({
+      pool: manager.pool,
+      now: () => now,
+      approvalLifetimeMs: 120_000,
+    });
+    const proposed = await management.propose({
+      actionRef,
+      approvalRequestId: approvalId,
+      proposalAuditEventId: randomUUID(),
+      approvalAuditEventId: randomUUID(),
+      requestedAtMs: now,
+      actionInput,
+      principal: principal(REQUESTER_ID, 'bootstrap-requester', now),
+    });
+    now += 10;
+    const decided = await management.decide({
+      approvalRequestId: approvalId,
+      expectedVersion: proposed.approvalRequest.version,
+      decisionId: 'secret-binding-live-install-decision',
+      auditEventId: randomUUID(),
+      decision: 'approved',
+      reasonCode: 'reviewed',
+      decidedAtMs: now,
+      principal: principal(REVIEWER_ID, 'bootstrap-reviewer', now),
+    });
+    const fence = Object.freeze({ projectVersion: 1, bindingVersion: 1 });
+    now += 10;
+    const consumed = await new PostgresApprovalRequestRepository(
+      executor.pool,
+    ).consume({
+      requestId: approvalId,
+      expectedVersion: decided.request.version,
+      consumptionId: 'secret-binding-live-install-consume',
+      dispatchId: 'secret-binding-live-install-dispatch',
+      action: decided.request.action,
+      requestedBy: Object.freeze({ type: 'user', id: REQUESTER_ID }),
+      consumedBy: Object.freeze({
+        type: 'system',
+        id: 'cluster_package_executor',
+      }),
+      consumedAtMs: now,
+      authorizationFence: fence,
+      audit: audit(randomUUID(), approvalId, PROJECT_ID, now, fence),
+    });
+    assert.equal(consumed.status, 'consumed');
+    let id = 0;
+    now += 10;
+    const dispatched = await createClusterPluginPackageApprovedActionDispatcher(
+      {
+        pool: executor.pool,
+        owner: 'secret-binding-live-bootstrap',
+        clock: () => now,
+        createId: () => `secret-binding-live-bootstrap-${++id}`,
+        secretExistenceInspector: { async assertExists() {} },
+      },
+    ).dispatchBatch({ limit: 4 });
+    assert.equal(dispatched.succeeded, 1);
+
+    const installs = new PostgresPluginPackageInstallRepository(executor.pool);
+    const queued = await installs.find(PROJECT_ID, PACKAGE_NAME);
+    assert.ok(queued);
+    const lock = await installs.findLock(queued.lockDigest);
+    assert.ok(lock);
+    now += 10;
+    const staged = transitionPluginPackageInstall(lock, queued, {
+      type: 'stage_completed',
+      mutationId: 'secret-binding-live-stage',
+      occurredAtMs: now,
+      stageRef: `stage:${lock.lockDigest}`,
+      artifactDigest: lock.source.artifactDigest,
+      manifestDigest: lock.manifestDigest,
+      contentDigest: lock.source.contentDigest,
+      evidenceDigest: 'c'.repeat(64),
+    });
+    const provenance = createPluginPackagePublisherProvenance({
+      projectId: PROJECT_ID,
+      packageName: PACKAGE_NAME,
+      installationId: queued.installationId,
+      lockDigest: lock.lockDigest,
+      artifactDigest: staged.stageReceipt.artifactDigest,
+      manifestDigest: staged.stageReceipt.manifestDigest,
+      contentDigest: staged.stageReceipt.contentDigest,
+      stageEvidenceDigest: staged.stageReceipt.evidenceDigest,
+      signature: {
+        publisher: 'live.qinglong.test',
+        keyId: 'live-key-1',
+        signatureDigest: 'd'.repeat(64),
+        keyNotBeforeMs: now - 1,
+        keyNotAfterMs: now + 120_000,
+        verifiedAtMs: now,
+      },
+    });
+    await executor.pool.query(
+      `INSERT INTO "ql3"."plugin_package_publisher_provenance" (
+         installation_id, project_id, package_name, lock_digest,
+         artifact_digest, manifest_digest, content_digest,
+         stage_evidence_digest, publisher, key_id, signature_digest,
+         key_not_before_ms, key_not_after_ms, verified_at_ms,
+         provenance_digest, provenance_json
+       ) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16::jsonb)`,
+      [
+        provenance.installationId,
+        provenance.projectId,
+        provenance.packageName,
+        provenance.lockDigest,
+        provenance.artifactDigest,
+        provenance.manifestDigest,
+        provenance.contentDigest,
+        provenance.stageEvidenceDigest,
+        provenance.publisher,
+        provenance.keyId,
+        provenance.signatureDigest,
+        provenance.keyNotBeforeMs,
+        provenance.keyNotAfterMs,
+        provenance.verifiedAtMs,
+        provenance.provenanceDigest,
+        JSON.stringify(provenance),
+      ],
+    );
+    await installs.commit(pluginPackageInstallCommit(queued, staged));
+    now += 10;
+    const activating = transitionPluginPackageInstall(lock, staged, {
+      type: 'activation_started',
+      mutationId: 'secret-binding-live-activate',
+      occurredAtMs: now,
+    });
+    await installs.commit(pluginPackageInstallCommit(staged, activating));
+    now += 10;
+    const active = transitionPluginPackageInstall(lock, activating, {
+      type: 'activation_committed',
+      mutationId: 'secret-binding-live-commit',
+      occurredAtMs: now,
+      activationRef: `active:${lock.lockDigest}`,
+      intentDigest: pluginPackageActivationIntentDigest(lock, activating),
+      generation: 1,
+      contentDigest: lock.source.contentDigest,
+    });
+    await installs.commit(pluginPackageInstallCommit(activating, active));
+
+    const secretRef = createSecretRef({
+      projectId: PROJECT_ID,
+      name: 'runtime-token',
+      version: 1,
+    });
+    const evidence = `${JSON.stringify({
+      schemaVersion: 1,
+      event: 'secret_binding_prerequisite_ready',
+      projectId: PROJECT_ID,
+      packageName: PACKAGE_NAME,
+      requesterId: REQUESTER_ID,
+      reviewerId: REVIEWER_ID,
+      secretRef,
+      projectionKey: secretProjectionFileName(secretRef),
+      installationId: active.installationId,
+      generation: active.targetGeneration,
+    })}\n`;
+    fs.writeFileSync('/dev/termination-log', evidence);
+    process.stdout.write(evidence);
+  } finally {
+    await Promise.all([migration.close(), manager.close(), executor.close()]);
+  }
+}
+
+main().catch((error) => {
+  process.stderr.write(
+    `QL3 Secret binding Kubernetes bootstrap failed: ${
+      error instanceof Error ? error.stack || error.message : String(error)
+    }\n`,
+  );
+  process.exitCode = 1;
+});

test/back/ql3PluginPackageSecretBindingKubernetesLiveAudit.test.cjs

@@ -0,0 +1,99 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const { test } = require('node:test');
+
+const {
+  FIXTURE,
+  REQUIRED_GATES,
+  validatePluginPackageSecretBindingKubernetesLiveReport,
+} = require('../../scripts/ql3-plugin-package-secret-binding-kubernetes-live-audit.cjs');
+
+function report() {
+  const digest = 'a'.repeat(64);
+  return {
+    schemaVersion: 1,
+    fixture: FIXTURE,
+    observedAtMs: 1,
+    platform: {
+      architecture: 'arm64',
+      kubernetesVersion: 'v1.34.3+k3s1',
+      nodeCount: 3,
+      postgresVersionNumber: 180004,
+      adminImageId: `sha256:${digest}`,
+    },
+    management: {
+      replicas: 2,
+      distinctNodeHashes: [
+        `sha256:${'1'.repeat(64)}`,
+        `sha256:${'2'.repeat(64)}`,
+      ],
+      serviceAccountTokenMounted: false,
+      packageValueVolumeMounted: false,
+      canGetSecrets: false,
+      canListSecrets: false,
+    },
+    review: {
+      commands: [
+        'plugin-package.secret-binding.plan',
+        'plugin-package.secret-binding.plan',
+        'plugin-package.secret-binding.propose',
+        'plugin-package.secret-binding.decide',
+        'plugin-package.secret-binding.inspect',
+      ],
+      requesterSubjectHash: `sha256:${'3'.repeat(64)}`,
+      reviewerSubjectHash: `sha256:${'4'.repeat(64)}`,
+      distinctUsers: true,
+      planStatus: 'created',
+      replayStatus: 'existing',
+      decisionStatus: 'decided',
+      inspectionStale: false,
+      actionDigest: '5'.repeat(64),
+      planDigest: '6'.repeat(64),
+    },
+    executor: {
+      jobSucceeded: true,
+      serviceAccountTokenMounted: false,
+      canGetSecrets: false,
+      canListSecrets: false,
+      projectionReadOnly: true,
+      projectionFileCount: 1,
+      projectionKeyHash: `sha256:${'7'.repeat(64)}`,
+      outputSensitiveFree: true,
+    },
+    persistence: {
+      bindingCount: 1,
+      authorityKind: 'approved-action-execution',
+      evidenceDigest: '8'.repeat(64),
+      entryCount: 1,
+      approvalConsumed: true,
+      executionSucceeded: true,
+      sensitiveMatchCount: 0,
+    },
+    gates: Object.fromEntries(REQUIRED_GATES.map((gate) => [gate, true])),
+    limitations: [
+      'single-server k3s control plane is not Kubernetes control-plane HA evidence',
+      'PostgreSQL physical failover is proven by the independent 125-gate HA contract',
+    ],
+  };
+}
+
+test('accepts one exact low-sensitive Secret binding Kubernetes report', () => {
+  assert.deepEqual(
+    validatePluginPackageSecretBindingKubernetesLiveReport(report()).findings,
+    [],
+  );
+});
+
+test('rejects false gates, topology drift and sensitive material', () => {
+  const invalid = report();
+  invalid.gates.realExecutorJob = false;
+  invalid.management.distinctNodeHashes[1] =
+    invalid.management.distinctNodeHashes[0];
+  invalid.executor.secretRef = 'qlsecret:v1:forbidden';
+  const findings =
+    validatePluginPackageSecretBindingKubernetesLiveReport(invalid).findings;
+  assert.ok(findings.some((value) => value.includes('management')));
+  assert.ok(findings.some((value) => value.includes('gates')));
+  assert.ok(findings.some((value) => value.includes('forbidden')));
+});

test/back/ql3PluginPackageSecretBindingKubernetesLiveContract.test.cjs

@@ -0,0 +1,46 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const { test } = require('node:test');
+
+const ROOT = path.resolve(__dirname, '../..');
+const CONTRACT = path.join(
+  ROOT,
+  'scripts/ql3-plugin-package-secret-binding-kubernetes-live-contract.cjs',
+);
+const BOOTSTRAP = path.join(
+  ROOT,
+  'scripts/ql3-plugin-package-secret-binding-kubernetes-live-bootstrap.cjs',
+);
+
+test('wires the Secret binding Kubernetes live gate as an explicit opt-in', () => {
+  const scripts = require(path.join(ROOT, 'package.json')).scripts;
+  assert.equal(
+    scripts['test:plugin-package-secret-binding-kubernetes-live:ql3'],
+    'pnpm --filter @qinglong/cluster-admin build && node scripts/ql3-plugin-package-secret-binding-kubernetes-live-contract.cjs',
+  );
+  assert.equal(
+    scripts['audit:plugin-package-secret-binding-kubernetes-live:ql3'],
+    'node scripts/ql3-plugin-package-secret-binding-kubernetes-live-audit.cjs',
+  );
+  const source = fs.readFileSync(CONTRACT, 'utf8');
+  assert.match(source, /QL3_PLUGIN_PACKAGE_SECRET_BINDING_KUBERNETES_LIVE/);
+  assert.match(source, /K3sDockerLiveFixture/);
+  assert.match(source, /readyManagementPods/);
+  assert.match(source, /hostAliases/);
+  assert.match(source, /pluginPackageManagementClientCli\.js/);
+  assert.match(source, /ql3-cluster-plugin-package-values/);
+  assert.match(source, /automountServiceAccountToken: false/);
+  assert.match(source, /can-i/);
+  assert.match(source, /sensitiveMatchCount/);
+});
+
+test('keeps prerequisite construction in a one-shot cluster Job', () => {
+  const source = fs.readFileSync(BOOTSTRAP, 'utf8');
+  assert.match(source, /createClusterPluginPackageManagementService/);
+  assert.match(source, /createClusterPluginPackageApprovedActionDispatcher/);
+  assert.match(source, /secretProjectionFileName/);
+  assert.doesNotMatch(source, /setInterval|setTimeout|watch\(/);
+});