feat(local): bind legacy adoption provenance

test/back/ql3ClusterDependencyAudit.test.cjs

@@ -2257,11 +2257,11 @@ test('confines reconciliation Secret and Config inspection to its exact row plan
   fs.mkdirSync(secretConfigDirectory, { recursive: true });
   fs.writeFileSync(
     path.join(secretConfigDirectory, 'rowPlan.ts'),
-    "import { inspect } from '@qinglong/local-admin/reconciliation-secret-and-config-inspection';",
+    "import { inspect } from '@qinglong/local-admin/reconciliation-secret-and-config-inspection';\nimport { digest } from '@qinglong/local-sqlite/adoption-provenance';",
   );
   fs.writeFileSync(
     path.join(secretConfigDirectory, 'neighbor.ts'),
-    "import { inspect } from '@qinglong/local-admin/reconciliation-secret-and-config-inspection';",
+    "import { inspect } from '@qinglong/local-admin/reconciliation-secret-and-config-inspection';\nimport { digest } from '@qinglong/local-sqlite/adoption-provenance';",
   );
   t.after(() => fs.rmSync(root, { recursive: true, force: true }));
 
@@ -2276,6 +2276,11 @@ test('confines reconciliation Secret and Config inspection to its exact row plan
         specifier:
           '@qinglong/local-admin/reconciliation-secret-and-config-inspection',
       },
+      {
+        code: 'FORBIDDEN_LOCAL_ADOPTION_CLI_AUTHORITY_IMPORT',
+        file: 'packages/ql3-local-owner-cli/src/deployment/reconciliation/application/secret-and-config/neighbor.ts',
+        specifier: '@qinglong/local-sqlite/adoption-provenance',
+      },
     ],
   );
 });

test/back/ql3ClusterOciLayoutAudit.test.cjs

@@ -138,9 +138,9 @@ function createFixture(t, options = {}) {
                   'io.qinglong.ai': 'excluded',
                   'io.qinglong.local.application-config': '2,3,4',
                   'io.qinglong.local.compose-selection': '1',
-                  'io.qinglong.local.sqlite-contract-max': '50',
-                  'io.qinglong.local.sqlite-contract-min': '50',
-                  'io.qinglong.local.sqlite-write-contract': '50',
+                  'io.qinglong.local.sqlite-contract-max': '51',
+                  'io.qinglong.local.sqlite-contract-min': '51',
+                  'io.qinglong.local.sqlite-write-contract': '51',
                   'io.qinglong.profile': 'edge,standalone',
                 }
               : {}),

test/back/ql3LocalImageAudit.test.cjs

@@ -188,7 +188,7 @@ test('rejects removal of the SQLite rollout compatibility labels', () => {
     const dockerfilePath = path.join(current.target, 'Dockerfile');
     const dockerfile = fs
       .readFileSync(dockerfilePath, 'utf8')
-      .replace('  io.qinglong.local.sqlite-write-contract="50" \\\n', '');
+      .replace('  io.qinglong.local.sqlite-write-contract="51" \\\n', '');
     fs.writeFileSync(dockerfilePath, dockerfile);
     const report = auditLocalImageContract(current.root);
     assert.equal(report.compatible, false);

test/back/ql3PackageBoundaryAudit.test.cjs

@@ -79,7 +79,7 @@ test('current QL3 workspace has exactly eighteen reviewed package boundaries', (
       },
       {
         directory: 'packages/ql3-local-sqlite/src/migrations',
-        directSourceFiles: 101,
+        directSourceFiles: 103,
         reviewKind: 'ordered_ledger',
       },
     ],
@@ -540,10 +540,10 @@ test('current QL3 workspace has exactly eighteen reviewed package boundaries', (
       rootSourceFileRoles: localSqlite.rootSourceFileRoles,
     },
     {
-      sourceFiles: 203,
+      sourceFiles: 206,
       rootSourceFiles: 1,
       rootSourceLines: 31,
-      nestedSourceFiles: 202,
+      nestedSourceFiles: 205,
       rootSourceFileRoles: { 'index.ts': 'public_export' },
     },
   );