feat(ql3): enforce architecture support tiers

test/back/ql3ReleaseCandidateContract.test.cjs

@@ -41,13 +41,28 @@ test('freezes an independent low-resource local release family', () => {
   assert.equal(contract.workspace.packageCount, 18);
   assert.equal(
     contract.compatibility.releaseIdentitySchema,
-    'qinglong/release-identity@v1',
+    'qinglong/release-identity@v2',
   );
+  assert.deepEqual(contract.compatibility.architectureSupport, {
+    tier1: ['amd64', 'arm64'],
+    candidates: ['ppc64le', 's390x'],
+    experimentalBlocked: ['arm/v7'],
+    legacyOnly: ['arm/v6', '386'],
+    legacyLine: '2.x',
+  });
+  assert.deepEqual(contract.compatibility.platforms, [
+    'linux/amd64',
+    'linux/arm64',
+  ]);
   assert.match(
     contract.compatibility.releaseIdentityDigest,
     /^sha256:[a-f0-9]{64}$/u,
   );
   assert.match(contract.contractDigest, /^sha256:[a-f0-9]{64}$/u);
+  assert.equal(
+    contract.requiredGates.includes('architecture-support-tier'),
+    true,
+  );
   assert.equal(
     contract.requiredGates.includes('offline-deployment-lock-materialization'),
     true,
@@ -81,6 +96,33 @@ test('closes the cluster release family with the Worker image', () => {
   );
   assert.equal(contract.releasePlan.clusterEvidenceRequired, true);
   assert.equal(contract.releasePlan.osMatrix.length, 8);
+  assert.deepEqual(
+    [
+      ...new Set(
+        contract.releasePlan.osMatrix.map((entry) => entry.image_arch),
+      ),
+    ],
+    ['amd64', 'arm64'],
+  );
+  assert.deepEqual(
+    contract.releasePlan.osMatrix.slice(0, 2).map((entry) => ({
+      runner: entry.runner,
+      node_arch: entry.node_arch,
+      image_arch: entry.image_arch,
+    })),
+    [
+      {
+        runner: 'ubuntu-24.04',
+        node_arch: 'x64',
+        image_arch: 'amd64',
+      },
+      {
+        runner: 'ubuntu-24.04-arm',
+        node_arch: 'arm64',
+        image_arch: 'arm64',
+      },
+    ],
+  );
   assert.equal(
     contract.requiredGates.includes('edge-and-standalone-rollout'),
     false,

test/back/ql3VersionTransition.test.cjs

@@ -86,11 +86,18 @@ function replaceVersion(
 
 test('audits one source-derived QingLong 3 release identity', () => {
   assert.deepEqual(auditReleaseVersionContract(root), {
-    schemaVersion: 1,
-    schema: 'qinglong/release-identity@v1',
+    schemaVersion: 2,
+    schema: 'qinglong/release-identity@v2',
     version: SOURCE_VERSION,
     nodeVersion: '24.18.0',
     nodeEngine: '>=24.18.0 <25',
+    architectureSupport: {
+      tier1: ['amd64', 'arm64'],
+      candidates: ['ppc64le', 's390x'],
+      experimentalBlocked: ['arm/v7'],
+      legacyOnly: ['arm/v6', '386'],
+      legacyLine: '2.x',
+    },
     legacyRootPackageVersion: LEGACY_VERSION,
     legacyRootExcluded: true,
     workspacePackageCount: 18,
@@ -226,6 +233,19 @@ test('rejects invalid SemVer, downgrade, plan mutation and a symbolic-link ident
     /identity shape or value is incompatible/,
   );
   copyFile(root, fixture, 'ql3-release.json');
+  const architectureDrift = JSON.parse(
+    fs.readFileSync(invalidIdentityPath, 'utf8'),
+  );
+  architectureDrift.architectureSupport.tier1.push('ppc64le');
+  fs.writeFileSync(
+    invalidIdentityPath,
+    `${JSON.stringify(architectureDrift, null, 2)}\n`,
+  );
+  assert.throws(
+    () => auditReleaseVersionContract(fixture),
+    /identity shape or value is incompatible/,
+  );
+  copyFile(root, fixture, 'ql3-release.json');
   fs.renameSync(
     path.join(fixture, 'ql3-release.json'),
     path.join(fixture, 'identity-target.json'),