feat(ql3): verify cluster evidence offline

test/back/ql3ClusterAdminProductLiveContract.test.cjs

@@ -59,6 +59,10 @@ test('binds the live image gate to native and container-published loopback', ()
   assert.match(source, /consoleAssets: true/);
   assert.match(source, /consoleEvidenceBundle: true/);
   assert.match(source, /createClusterConsoleEvidenceBundle/);
+  assert.match(source, /function runEvidenceVerifierContract\(image\)/);
+  assert.match(source, /\[facade, 'evidence-verify'/);
+  assert.match(source, /tamperRejected: true/);
+  assert.match(source, /evidenceVerifier: true/);
   assert.match(source, /function runPublishedConsoleContract\(image\)/);
   assert.match(
     source,

test/back/ql3ClusterCopilotConsoleAudit.test.cjs

@@ -52,7 +52,16 @@ test('keeps the QingLong 3.0 Copilot Console independent and read-only', () => {
       attestation: 'none',
       actionAuthority: 'none',
     },
-    sourceFileCount: 4,
+    offlineVerifier: {
+      lifecycle: 'operator-local-explicit-file-read',
+      bundleDigest: 'recomputed',
+      rawFactDigests: 'not_recomputed_without_raw_facts',
+      serverSignature: 'not_verified',
+      mutation: false,
+      networkAccess: false,
+      fileWrites: false,
+    },
+    sourceFileCount: 6,
     findings: [],
     compatible: true,
   });
@@ -160,6 +169,30 @@ test('rejects evidence export network, persistence and authority widening', () =
   }
 });
 
+test('rejects offline verifier network, write and ambient authority widening', () => {
+  for (const injected of [
+    "require('node:https')",
+    'writeFileSync(',
+    'process.env',
+    'process.stdin',
+    'fetch(',
+  ]) {
+    const report = auditClusterCopilotConsole({
+      root,
+      readFile: intercept(
+        'packages/ql3-cluster-admin/src/copilot-console/evidenceVerifier.ts',
+        (source) => source + '\n// ' + injected + '\n',
+      ),
+    });
+    assert.equal(report.compatible, false);
+    assert.ok(
+      report.findings.some(
+        ({ code }) => code === 'CLUSTER_COPILOT_CONSOLE_AUTHORITY_WIDENED',
+      ),
+    );
+  }
+});
+
 test('rejects coupling into the legacy UI or Kubernetes workloads', () => {
   const legacyTarget = 'src/pages/login/index.tsx';
   const legacy = auditClusterCopilotConsole({

test/back/ql3PackageBoundaryAudit.test.cjs

@@ -340,10 +340,10 @@ test('current QL3 workspace has exactly eighteen reviewed package boundaries', (
       rootSourceFileRoles: clusterAdmin.rootSourceFileRoles,
     },
     {
-      sourceFiles: 120,
+      sourceFiles: 122,
       rootSourceFiles: 1,
       rootSourceLines: 61,
-      nestedSourceFiles: 119,
+      nestedSourceFiles: 121,
       rootSourceFileRoles: {
         'modelInvocationMigrationCli.ts': 'binary_entry',
       },