feat(ql3): version worker support tier admission

scripts/ql3-postgres-ha-contract.cjs

@@ -5501,7 +5501,7 @@ async function runCredentialDeliveryCommitResponseLossMatrix(options) {
 
     const sessions = new PostgresWorkerSessionRepository(ingressDatabase.pool);
     const capabilitiesJson =
-      '{"architecture":"arm64","executors":["remote-worker"]}';
+      '{"architecture":"arm64","executors":["remote-worker"],"protocolVersion":"1.0.0","supportTier":"tier1"}';
     const capabilitiesHash = createHash('sha256')
       .update(capabilitiesJson)
       .digest('hex');

scripts/ql3-worker-kubernetes-rollout-live-contract.cjs

@@ -15,6 +15,10 @@ const { createMutualTlsPki } = require('./lib/ql3-live-pki.cjs');
 const {
   validateWorkerKubernetesRolloutLiveReport,
 } = require('./ql3-worker-kubernetes-rollout-live-audit.cjs');
+const {
+  remoteWorkerArchitectureForNodeRuntime,
+  remoteWorkerSupportTierForArchitecture,
+} = require('../packages/ql3-runtime-core/dist/remote-execution/remoteWorkerCompatibility.js');
 
 const ROOT = path.resolve(__dirname, '..');
 const K3S_IMAGE = 'rancher/k3s:v1.34.3-k3s1';
@@ -1613,6 +1617,9 @@ async function main(argv = process.argv.slice(2)) {
         'tls.crt': pkiMaterial.oldClientCertificate,
       },
     });
+    const workerArchitecture = remoteWorkerArchitectureForNodeRuntime(
+      process.arch, process.config.variables.arm_version,
+    );
     apply({
       apiVersion: 'v1',
       kind: 'ConfigMap',
@@ -1621,9 +1628,12 @@ async function main(argv = process.argv.slice(2)) {
         'worker-id': WORKER_ID,
         'control-origin': `https://${ingressServername}:5801`,
         'capabilities.json': `${JSON.stringify({
-          architecture: process.arch,
+          architecture: workerArchitecture,
           operatingSystem: 'linux',
-          executors: ['local_process'],
+          executors: ['remote-worker'],
+          protocolVersion: '1.0.0',
+          supportTier:
+            remoteWorkerSupportTierForArchitecture(workerArchitecture),
           runtimes: [{ name: 'node', version: '24.18.0' }],
           labels: { contract: 'kubernetes-product-live' },
           capacity: { cpuCores: 1, memoryBytes: 256 * 1024 * 1024 },

scripts/ql3-worker-postgres-live-contract.cjs

@@ -62,6 +62,10 @@ const {
 const {
   createCertificateAuthority,
 } = require('../packages/ql3-worker-runtime/test/helpers/certificateAuthority.cjs');
+const {
+  remoteWorkerArchitectureForNodeRuntime,
+  remoteWorkerSupportTierForArchitecture,
+} = require('../packages/ql3-runtime-core/dist/remote-execution/remoteWorkerCompatibility.js');
 
 const IMAGE = process.env.QL3_WORKER_POSTGRES_IMAGE ?? 'postgres:18';
 const LINUX_NODE_IMAGE =
@@ -80,6 +84,8 @@ const AUTOMATION_MANAGER_USER = 'ql3_automation_manager';
 const AUTOMATION_MANAGER_PASSWORD = 'ql3_automation_manager_live';
 const APPROVAL_MANAGER_USER = 'ql3_approval_manager';
 const APPROVAL_MANAGER_PASSWORD = 'ql3_approval_manager_live';
+const RUN_MANAGER_USER = 'ql3_run_manager';
+const RUN_MANAGER_PASSWORD = 'ql3_run_manager_live';
 const PACKAGE_MANAGER_USER = 'ql3_package_manager';
 const PACKAGE_MANAGER_PASSWORD = 'ql3_package_manager_live';
 const PACKAGE_EXECUTOR_USER = 'ql3_package_executor';
@@ -655,13 +661,18 @@ async function prepareWorkerFiles(root) {
   const certificateFile = path.join(authority, 'tls.crt');
   const privateKeyFile = path.join(authority, 'tls.key');
   const tokenFile = path.join(authority, 'credential-token');
+  const architecture = remoteWorkerArchitectureForNodeRuntime(
+    process.arch, process.config.variables.arm_version,
+  );
   await Promise.all([
     writePrivate(
       capabilitiesFile,
       `${JSON.stringify({
-        architecture: process.arch,
+        architecture,
         operatingSystem: process.platform,
         executors: ['remote-worker'],
+        protocolVersion: '1.0.0',
+        supportTier: remoteWorkerSupportTierForArchitecture(architecture),
         runtimes: [{ name: 'node', version: process.versions.node }],
         labels: { contract: 'postgres-live' },
         capacity: {
@@ -862,6 +873,9 @@ async function main() {
     await superuserDatabase.pool.query(
       `CREATE ROLE ${APPROVAL_MANAGER_USER} LOGIN PASSWORD '${APPROVAL_MANAGER_PASSWORD}'`,
     );
+    await superuserDatabase.pool.query(
+      `CREATE ROLE ${RUN_MANAGER_USER} LOGIN PASSWORD '${RUN_MANAGER_PASSWORD}'`,
+    );
     await superuserDatabase.pool.query(
       `CREATE ROLE ${PACKAGE_MANAGER_USER} LOGIN PASSWORD '${PACKAGE_MANAGER_PASSWORD}'`,
     );
@@ -962,9 +976,11 @@ async function main() {
       QL3_WORKER_INGRESS_TLS_CLIENT_CA_FILE: files.ingressClientCaFile,
     });
     assert.equal(ingressConfig.enabled, true);
-    const runtimePort = createClusterWorkerRuntimePort(runtimeDatabase.pool, {
-      artifactStore,
-    });
+    const runtimePort = createClusterWorkerRuntimePort(
+      runtimeDatabase.pool,
+      { artifactStore },
+      { cancellationDispatchOwnerId: 'ql3-worker-postgres-live' },
+    );
     const runtime = Object.freeze({
       ...runtimePort,
       activation: Object.freeze({

scripts/ql3-worker-resource-benchmark.cjs

@@ -14,6 +14,10 @@ const fixtures = path.resolve(
   __dirname,
   '../packages/ql3-cluster-control/test/fixtures/mtls',
 );
+const {
+  remoteWorkerArchitectureForNodeRuntime,
+  remoteWorkerSupportTierForArchitecture,
+} = require('../packages/ql3-runtime-core/dist/remote-execution/remoteWorkerCompatibility.js');
 
 function argumentsMap() {
   return new Map(
@@ -69,13 +73,18 @@ async function child() {
   const certificateFile = path.join(authority, 'tls.crt');
   const privateKeyFile = path.join(authority, 'tls.key');
   const tokenFile = path.join(authority, 'credential-token');
+  const architecture = remoteWorkerArchitectureForNodeRuntime(
+    process.arch, process.config.variables.arm_version,
+  );
   await Promise.all([
     writePrivate(
       capabilitiesFile,
       `${JSON.stringify({
-        architecture: process.arch,
+        architecture,
         operatingSystem: process.platform,
-        executors: ['local_process'],
+        executors: ['remote-worker'],
+        protocolVersion: '1.0.0',
+        supportTier: remoteWorkerSupportTierForArchitecture(architecture),
         runtimes: [{ name: 'node', version: process.versions.node }],
         labels: {},
         capacity: {