feat(ql3): add opaque cluster environment bundle delivery

packages/ql3-cluster-control/test/mountedSecretProvider.test.cjs

@@ -30,6 +30,11 @@ const VERSIONED_SECRET_REF = createSecretRef({
   name: 'certificate',
   version: 3,
 });
+const ENVIRONMENT_BUNDLE_REF = createSecretRef({
+  projectId: 'project-1',
+  name: 'legacy-env-bundle',
+  version: 4,
+});
 
 function authority(secretRefs = [SECRET_REF]) {
   return {
@@ -46,6 +51,7 @@ function authority(secretRefs = [SECRET_REF]) {
     leaseGeneration: 1,
     leaseVersion: 1,
     secretRefs,
+    environmentBundleRefs: [],
   };
 }
 
@@ -58,10 +64,7 @@ test('maps canonical SecretRef to a stable path-free Kubernetes key', () => {
   const first = clusterMountedSecretFileName(SECRET_REF);
   assert.match(first, /^[0-9a-f]{64}$/);
   assert.equal(clusterMountedSecretFileName(SECRET_REF), first);
-  assert.notEqual(
-    clusterMountedSecretFileName(VERSIONED_SECRET_REF),
-    first,
-  );
+  assert.notEqual(clusterMountedSecretFileName(VERSIONED_SECRET_REF), first);
   assert.throws(
     () => clusterMountedSecretFileName('not-a-secret-ref'),
     ClusterMountedSecretProviderError,
@@ -82,6 +85,7 @@ test('resolves every request again and observes atomic material rotation', async
   assert.deepEqual(first.values, [
     { secretRef: SECRET_REF, value: 'generation-one' },
   ]);
+  assert.deepEqual(first.environmentBundles, []);
   await first.dispose();
 
   const replacement = `${file}.replacement`;
@@ -155,3 +159,35 @@ test('fails readiness for a missing or symlinked provider root', async (t) => {
     ClusterMountedSecretProviderError,
   );
 });
+
+test('delivers one larger opaque environment bundle without widening normal Secrets', async (t) => {
+  const root = await mkdtemp(path.join(os.tmpdir(), 'ql3-mounted-bundle-'));
+  t.after(() => rm(root, { recursive: true, force: true }));
+  await chmod(root, 0o700);
+  const value = JSON.stringify({
+    schema: 'qinglong/environment-bundle@v1',
+    entries: [{ name: 'LEGACY_VALUE', value: 'x'.repeat(20 * 1024) }],
+  });
+  await privateFile(
+    path.join(root, clusterMountedSecretFileName(ENVIRONMENT_BUNDLE_REF)),
+    value,
+  );
+  const provider = await createClusterMountedSecretProvider({
+    rootDirectory: root,
+  });
+  const resolution = await provider.resolve({
+    ...authority([]),
+    environmentBundleRefs: [ENVIRONMENT_BUNDLE_REF],
+  });
+  assert.deepEqual(resolution.values, []);
+  assert.deepEqual(resolution.environmentBundles, [
+    { secretRef: ENVIRONMENT_BUNDLE_REF, value },
+  ]);
+  await resolution.dispose();
+
+  await privateFile(
+    path.join(root, clusterMountedSecretFileName(SECRET_REF)),
+    'x'.repeat(16 * 1024 + 1),
+  );
+  await assert.rejects(provider.resolve(authority()), /material_unavailable/);
+});

packages/ql3-cluster-control/test/remoteWorkerSecretDeliveryService.test.cjs

@@ -21,7 +21,7 @@ function command() {
     taskId: 'task-1', taskRevision: 'revision-1', executionDigest: DIGEST,
     offerId: 'offer-1', leaseGeneration: 3,
     leaseToken: 'worker_generated_lease_capability_0000000000000001',
-    expectedLeaseVersion: 4, secretRefs: [SECRET_REF],
+    expectedLeaseVersion: 4, secretRefs: [SECRET_REF], environmentBundleRefs: [],
   };
 }
 
@@ -47,6 +47,7 @@ test('resolves plaintext only after repository authority succeeds', async () =>
       assert.equal('leaseToken' in input, false);
       return {
         values: [{ secretRef: SECRET_REF, value: 'resolved-value' }],
+        environmentBundles: [],
         dispose() { events.push('dispose'); },
       };
     },
@@ -56,6 +57,7 @@ test('resolves plaintext only after repository authority succeeds', async () =>
   assert.deepEqual(result.values, [
     { secretRef: SECRET_REF, value: 'resolved-value' },
   ]);
+  assert.deepEqual(result.environmentBundles, []);
   assert.deepEqual(events, ['authorize', 'resolve']);
   await result.dispose();
   assert.deepEqual(events, ['authorize', 'resolve', 'dispose']);
@@ -101,6 +103,7 @@ test('disposes malformed provider output and converts it to unavailable', async
     async resolve() {
       return {
         values: [{ secretRef: SECRET_REF, value: 'x'.repeat(17 * 1024) }],
+        environmentBundles: [],
         dispose() { disposed += 1; },
       };
     },
@@ -120,6 +123,7 @@ test('rejects extensible provider output and still invokes valid cleanup', async
     async resolve() {
       return {
         values: [{ secretRef: SECRET_REF, value: 'resolved-value' }],
+        environmentBundles: [],
         dispose() { disposed += 1; },
         diagnostic: 'must-not-cross-boundary',
       };

packages/ql3-cluster-control/test/workerIngressConfig.test.cjs

@@ -93,7 +93,7 @@ test('builds exact bounded Worker ingress and least-privilege Pool config', asyn
     host: '127.0.0.1',
     port: 5901,
     maxBodyBytes: 65_536,
-    maxResponseBytes: 65_536,
+    maxResponseBytes: 262_144,
     maxInFlightRequests: 32,
     authenticationRateWindowMs: 60_000,
     authenticationRatePerPeer: 20,

packages/ql3-cluster-control/test/workerIngressPipeline.test.cjs

@@ -592,6 +592,7 @@ test('binds one Secret batch to path identity and never echoes capabilities', as
           offerId: command.offerId,
           executionDigest: command.executionDigest,
           values: [{ secretRef, value: 'resolved-value' }],
+          environmentBundles: [],
           dispose() { disposed += 1; },
         };
       },
@@ -599,18 +600,20 @@ test('binds one Secret batch to path identity and never echoes capabilities', as
   });
   const leaseToken = 'worker_generated_lease_capability_0000000000000001';
   const body = {
-    schema: 'qinglong/remote-secret-delivery@v1',
+    schema: 'qinglong/remote-secret-delivery@v2',
     runId: 'run-1', attemptId: 'attempt-1', projectId: 'project-1',
     taskId: 'task-1', taskRevision: 'revision-1', executionDigest,
     workerGeneration: 2, offerId: 'offer-1', leaseGeneration: 3,
     leaseToken, expectedLeaseVersion: 4, secretRefs: [secretRef],
+    environmentBundleRefs: [],
   };
   const result = await (await pipeline.prepare(metadata('secrets'))).handle(body);
   assert.equal(result.statusCode, 200);
-  assert.equal(result.body.schema, 'qinglong/remote-secret-delivery@v1');
+  assert.equal(result.body.schema, 'qinglong/remote-secret-delivery@v2');
   assert.deepEqual(result.body.values, [
     { secretRef, value: 'resolved-value' },
   ]);
+  assert.deepEqual(result.body.environmentBundles, []);
   assert.equal(JSON.stringify(result.body).includes(leaseToken), false);
   const { schema: _schema, ...commandBody } = body;
   assert.deepEqual(observed, {
@@ -634,13 +637,14 @@ test('maps stale Secret delivery authority to conflict before any response', asy
   });
   await assert.rejects(
     (await pipeline.prepare(metadata('secrets'))).handle({
-      schema: 'qinglong/remote-secret-delivery@v1',
+      schema: 'qinglong/remote-secret-delivery@v2',
       runId: 'run-1', attemptId: 'attempt-1', projectId: 'project-1',
       taskId: 'task-1', taskRevision: 'revision-1',
       executionDigest: 'c'.repeat(64), workerGeneration: 2,
       offerId: 'offer-1', leaseGeneration: 3,
       leaseToken: 'worker_generated_lease_capability_0000000000000001',
       expectedLeaseVersion: 4, secretRefs: [secretRef],
+      environmentBundleRefs: [],
     }),
     (error) =>
       error.statusCode === 409 && error.code === 'worker_secret_delivery_fenced',
@@ -656,19 +660,21 @@ test('rejects a Secret service response whose authority drifts', async () => {
           runId: 'run-other', attemptId: 'attempt-1', offerId: 'offer-1',
           executionDigest: 'c'.repeat(64),
           values: [{ secretRef, value: 'must-not-escape' }],
+          environmentBundles: [],
         };
       },
     },
   });
   await assert.rejects(
     (await pipeline.prepare(metadata('secrets'))).handle({
-      schema: 'qinglong/remote-secret-delivery@v1',
+      schema: 'qinglong/remote-secret-delivery@v2',
       runId: 'run-1', attemptId: 'attempt-1', projectId: 'project-1',
       taskId: 'task-1', taskRevision: 'revision-1',
       executionDigest: 'c'.repeat(64), workerGeneration: 2,
       offerId: 'offer-1', leaseGeneration: 3,
       leaseToken: 'worker_generated_lease_capability_0000000000000001',
       expectedLeaseVersion: 4, secretRefs: [secretRef],
+      environmentBundleRefs: [],
     }),
     (error) =>
       error.statusCode === 503 && error.code === 'worker_ingress_unavailable',