feat(ql3): version worker support tier admission

packages/ql3-runtime-core/src/worker/workerSession.ts

@@ -1,4 +1,5 @@
 import { createHash } from 'node:crypto';
+import { assertRemoteWorkerCompatibilityCapability } from '../remote-execution/remoteWorkerCompatibility';
 
 export const WORKER_SESSION_STATUSES = ['online', 'draining', 'offline'] as const;
 export type WorkerSessionStatus = (typeof WORKER_SESSION_STATUSES)[number];
@@ -141,6 +142,11 @@ export function assertWorkerCapabilitiesSnapshot(
   if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
     invalid('Worker capabilities snapshot must be an object');
   }
+  try {
+    assertRemoteWorkerCompatibilityCapability(parsed);
+  } catch {
+    invalid('Worker capabilities compatibility contract is invalid');
+  }
   if (
     createHash('sha256').update(capabilitiesJson, 'utf8').digest('hex') !==
     capabilitiesHash

packages/ql3-runtime-core/src/worker/workerSessionTransport.ts

@@ -13,6 +13,7 @@ import {
   type WorkerSessionRecord,
   type WorkerSessionStatus,
 } from './workerSession';
+import { canonicalRemoteWorkerCapabilities } from '../remote-execution/remoteWorkerPlacement';
 
 export const WORKER_SESSION_REGISTER_SCHEMA =
   'qinglong/worker-session-register@v1';
@@ -153,6 +154,13 @@ function validateRegister(
       command?.capabilitiesJson,
       command?.capabilitiesHash,
     );
+    const canonical = canonicalRemoteWorkerCapabilities(
+      JSON.parse(command.capabilitiesJson) as unknown,
+    );
+    if (
+      canonical.json !== command.capabilitiesJson ||
+      canonical.hash !== command.capabilitiesHash
+    ) throw new TypeError('capabilities snapshot is not canonical');
     assertWorkerConcurrency(
       command?.maxConcurrentRuns,
       command?.availableSlots,