fix(ci): close remaining clean-runner gaps

.github/workflows/ql3-ci.yml

@@ -952,6 +952,9 @@ jobs:
           docker exec ${{ job.services.postgres.id }} psql -U postgres -d ql3_contract -v ON_ERROR_STOP=1 -c "CREATE ROLE ql3_migration LOGIN PASSWORD 'ql3_migration_test'"
           docker exec ${{ job.services.postgres.id }} psql -U postgres -d ql3_contract -v ON_ERROR_STOP=1 -c "CREATE ROLE ql3_runtime LOGIN PASSWORD 'ql3_runtime_test'"
           docker exec ${{ job.services.postgres.id }} psql -U postgres -d ql3_contract -v ON_ERROR_STOP=1 -c "CREATE ROLE ql3_admin LOGIN PASSWORD 'ql3_admin_test'"
+          docker exec ${{ job.services.postgres.id }} psql -U postgres -d ql3_contract -v ON_ERROR_STOP=1 -c "CREATE ROLE ql3_ai_maintenance LOGIN PASSWORD 'ql3_ai_maintenance_test'"
+          docker exec ${{ job.services.postgres.id }} psql -U postgres -d ql3_contract -v ON_ERROR_STOP=1 -c "CREATE ROLE ql3_ai_credential_manager LOGIN PASSWORD 'ql3_ai_credential_manager_test'"
+          docker exec ${{ job.services.postgres.id }} psql -U postgres -d ql3_contract -v ON_ERROR_STOP=1 -c "CREATE ROLE ql3_ai_credential_tester LOGIN PASSWORD 'ql3_ai_credential_tester_test'"
           docker exec ${{ job.services.postgres.id }} psql -U postgres -d ql3_contract -v ON_ERROR_STOP=1 -c "CREATE ROLE ql3_automation_manager LOGIN PASSWORD 'ql3_automation_manager_test'"
           docker exec ${{ job.services.postgres.id }} psql -U postgres -d ql3_contract -v ON_ERROR_STOP=1 -c "CREATE ROLE ql3_approval_manager LOGIN PASSWORD 'ql3_approval_manager_test'"
           docker exec ${{ job.services.postgres.id }} psql -U postgres -d ql3_contract -v ON_ERROR_STOP=1 -c "CREATE ROLE ql3_run_manager LOGIN PASSWORD 'ql3_run_manager_test'"
@@ -1085,6 +1088,8 @@ jobs:
           chmod +x kubectl
       - name: Install workspace dependencies without lifecycle scripts
         run: pnpm install --frozen-lockfile --ignore-scripts
+      - name: Build migration evidence dependency
+        run: pnpm run build:packages:ql3
       - name: Audit the locked CloudNativePG deployment contract
         run: |
           pnpm audit:cloudnativepg:ql3

scripts/ql3-local-profile-artifact-audit.cjs

@@ -22,7 +22,7 @@ const DEFAULT_MAX_MCP_ARTIFACT_FILES = 1536;
 const DEFAULT_MAX_MCP_ARTIFACT_BYTES = 16 * 1024 * 1024;
 const DEFAULT_MAX_RSS_DELTA_BYTES = 20 * 1024 * 1024;
 const DEFAULT_MAX_MCP_RSS_DELTA_BYTES = 48 * 1024 * 1024;
-const DEFAULT_MAX_APPLICATION_RSS_DELTA_BYTES = 24 * 1024 * 1024;
+const DEFAULT_MAX_APPLICATION_RSS_DELTA_BYTES = 28 * 1024 * 1024;
 const PACKAGE_CHAIN = Object.freeze([
   Object.freeze({
     name: '@qinglong/runtime-core',

scripts/ql3-plugin-package-recovery-e2e-live-contract.cjs

@@ -428,6 +428,9 @@ psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname postgres \\
   --set=migration_password="$QL3_MIGRATION_PASSWORD" \\
   --set=runtime_password="$QL3_RUNTIME_PASSWORD" \\
   --set=admin_password="$QL3_ADMIN_PASSWORD" \\
+  --set=automation_manager_password="$QL3_AUTOMATION_MANAGER_PASSWORD" \\
+  --set=approval_manager_password="$QL3_APPROVAL_MANAGER_PASSWORD" \\
+  --set=run_manager_password="$QL3_RUN_MANAGER_PASSWORD" \\
   --set=package_manager_password="$QL3_PACKAGE_MANAGER_PASSWORD" \\
   --set=package_executor_password="$QL3_PACKAGE_EXECUTOR_PASSWORD" \\
   --set=worker_credential_manager_password="$QL3_WORKER_CREDENTIAL_MANAGER_PASSWORD" \\
@@ -436,6 +439,9 @@ psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname postgres \\
 CREATE ROLE ql3_migration LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS PASSWORD :'migration_password';
 CREATE ROLE ql3_runtime LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS PASSWORD :'runtime_password';
 CREATE ROLE ql3_admin LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS PASSWORD :'admin_password';
+CREATE ROLE ql3_automation_manager LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS PASSWORD :'automation_manager_password';
+CREATE ROLE ql3_approval_manager LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS PASSWORD :'approval_manager_password';
+CREATE ROLE ql3_run_manager LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS PASSWORD :'run_manager_password';
 CREATE ROLE ql3_package_manager LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS PASSWORD :'package_manager_password';
 CREATE ROLE ql3_package_executor LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS PASSWORD :'package_executor_password';
 CREATE ROLE ql3_worker_credential_manager LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS PASSWORD :'worker_credential_manager_password';
@@ -455,6 +461,9 @@ createdb --username "$POSTGRES_USER" --owner ql3_migration qinglong
         'migration-password': secrets.migration,
         'runtime-password': secrets.runtime,
         'admin-password': secrets.admin,
+        'automation-manager-password': secrets.automationManager,
+        'approval-manager-password': secrets.approvalManager,
+        'run-manager-password': secrets.runManager,
         'package-manager-password': secrets.packageManager,
         'package-executor-password': secrets.packageExecutor,
         'worker-credential-manager-password': secrets.workerCredentialManager,
@@ -533,6 +542,33 @@ createdb --username "$POSTGRES_USER" --owner ql3_migration qinglong
                   },
                 },
               },
+              {
+                name: 'QL3_AUTOMATION_MANAGER_PASSWORD',
+                valueFrom: {
+                  secretKeyRef: {
+                    name: 'ql3-e2e-postgres-auth',
+                    key: 'automation-manager-password',
+                  },
+                },
+              },
+              {
+                name: 'QL3_APPROVAL_MANAGER_PASSWORD',
+                valueFrom: {
+                  secretKeyRef: {
+                    name: 'ql3-e2e-postgres-auth',
+                    key: 'approval-manager-password',
+                  },
+                },
+              },
+              {
+                name: 'QL3_RUN_MANAGER_PASSWORD',
+                valueFrom: {
+                  secretKeyRef: {
+                    name: 'ql3-e2e-postgres-auth',
+                    key: 'run-manager-password',
+                  },
+                },
+              },
               {
                 name: 'QL3_PACKAGE_MANAGER_PASSWORD',
                 valueFrom: {
@@ -1664,6 +1700,9 @@ async function main(argv = process.argv.slice(2)) {
     migration: randomSecret(),
     runtime: randomSecret(),
     admin: randomSecret(),
+    automationManager: randomSecret(),
+    approvalManager: randomSecret(),
+    runManager: randomSecret(),
     packageManager: randomSecret(),
     packageExecutor: randomSecret(),
     workerCredentialManager: randomSecret(),

test/back/ql3CiCleanCheckoutContract.test.cjs

@@ -55,6 +55,9 @@ test('pins backend CI to the released Node line and bootstraps a clean checkout'
 test('provisions every role required by the PostgreSQL migration stream', () => {
   const postgres = jobSource('cluster-postgres', 'cluster-postgres-ha');
   for (const role of [
+    'ql3_ai_maintenance',
+    'ql3_ai_credential_manager',
+    'ql3_ai_credential_tester',
     'ql3_automation_manager',
     'ql3_approval_manager',
     'ql3_run_manager',
@@ -101,6 +104,16 @@ test('bootstraps jobs that previously depended on local modules or artifacts', (
     'pnpm run build:packages:ql3',
     'pnpm test:provider-credential-test-kubernetes-live:ql3',
   ]);
+
+  const cloudNativePgLive = jobSource(
+    'cluster-cloudnativepg-live',
+    'cluster-provider-credential-test-kubernetes-live',
+  );
+  assertOrdered(cloudNativePgLive, [
+    'pnpm install --frozen-lockfile --ignore-scripts',
+    'pnpm run build:packages:ql3',
+    'pnpm test:cloudnativepg-live:ql3',
+  ]);
 });
 
 test('rebuilds the only native legacy binding used by resource evidence', () => {
@@ -185,7 +198,7 @@ test('keeps the Node 24 compact Profile RSS budget below application and MCP tie
   );
   assert.match(
     LOCAL_PROFILE_AUDIT,
-    /DEFAULT_MAX_APPLICATION_RSS_DELTA_BYTES = 24 \* 1024 \* 1024/,
+    /DEFAULT_MAX_APPLICATION_RSS_DELTA_BYTES = 28 \* 1024 \* 1024/,
   );
   assert.match(
     LOCAL_PROFILE_AUDIT,

test/back/ql3PluginPackageRecoveryE2ELiveContract.test.cjs

@@ -55,6 +55,18 @@ test('fixture uses a real HTTPS and content-addressed OCI Distribution surface',
 
 test('gate runs migration, healthy activation and a durable rejected upgrade', () => {
   assert.match(live, /operations\/base\/migrate-job\.yaml/);
+  assert.match(
+    live,
+    /CREATE ROLE ql3_automation_manager LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS/,
+  );
+  assert.match(
+    live,
+    /CREATE ROLE ql3_approval_manager LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS/,
+  );
+  assert.match(
+    live,
+    /CREATE ROLE ql3_run_manager LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS/,
+  );
   assert.match(live, /plugin-package-recovery\/base\/recover-job\.yaml/);
   assert.match(fixture, /PostgresPluginPackageInstallRepository/);
   assert.match(