feat(ql3): add owner-confirmed package secret binding

docs/QINGLONG_3_0_ARCHITECTURE_RFC.md

@@ -28,6 +28,7 @@
 - D-304/ADR-0392（已接受）：Plugin Package 进入安全 quarantine 时，Workflow/Prompt automation publication 不再仅依赖运行时 start guard 间接拒绝，而是与 quarantine event、Package-owned Task disabled revisions、Project Tool snapshot 和 withdrawal receipt 在同一 SQLite/PostgreSQL 事务中收敛为 `withdrawn`。原先仅能引用普通 lifecycle event 的外键升级为 append-only disposition-event 联合引用，历史 migration 与 publication digest schema 保持不变；SQLite edge/standalone 崩溃矩阵覆盖 automation publication insert 后、event/task/receipt/COMMIT 前后，PostgreSQL 通过触发器在既有 `SECURITY DEFINER` quarantine commit 内登记 disposition，再由同一外层 SERIALIZABLE transaction CAS publication head。能力位为 `plugin_package_automation_security_withdrawal@1`；不新增 package、daemon、timer、连接或常驻缓存，适用于低配路由设备和集群节点。SQLite 全量 228/228；PostgreSQL package 311 pass/1 条外部 URL 条件 skip；完整 18-package build/test 退出 0，backend 1,188 pass/2 skip，package/dependency boundary 零 finding；PostgreSQL 18.4 arm64 HA 125 项 gate 全绿、timeline `1→2`，报告 SHA-256 为 `ab156901b9c96ec5a62259c44d83d24ded011e0616dc827d928f3e13efd11786`。
 - D-305/ADR-0393（已接受）：Plugin Package Manifest 的逻辑 Secret requirement 获得按 resource generation 固定的不可变 binding。binding 精确覆盖 Manifest requirements，只保存同 Project、显式 version 的 `qlsecret://` 引用与 `approved-action-execution|local-owner-confirmation` authority evidence digest，不保存 Secret 明文；required 不可为空，optional 可显式为 `null`。发布由当前 active installation head、lock、generation 与 Manifest digest 联合 fencing，相同事实幂等、不同事实冲突；domain-separated digest、最多 64 项和 64 KiB 单行预算同时约束 Local 与 Cluster。SQLite 追加 `0091` ledger 与 capability v46，PostgreSQL 追加 `pg-0059`、capability v58，并只向 package executor 授予 `SELECT, INSERT`。不新增 package、daemon、timer、watcher、连接、缓存或集群 workload，低配路由设备只承担一个有界表和三个索引。D-305 不冒充 Secret 已进入执行路径：现有 materialization 拒绝仍保留，D-306 再完成用户授权、Secret resolution、runtime consumption 与 lifecycle/rebinding 语义。core 509/509、SQLite 232/232、PostgreSQL 316 pass/1 条件 skip；完整 18-package clean build/test 退出 0，backend 1,188 pass/2 skip，五项边界审计零 finding，workspace 仍无 single-source/shallow-source package。PostgreSQL 18.4 arm64 HA 125 项 gate 全绿、timeline `1→2`，报告 SHA-256 为 `acf0fea7ca7699989dfe70f5dd0061cdf5fb1968c691094331fea06ce01b96dc`。
 - D-306A/ADR-0394（已接受）：Package Task source 以 `package-secret` placeholder 引用逻辑 requirement，materialization 只用当前 generation 的 D-305 binding 编译为已有、固定 version 的 Task `SecretRef`；Package source 直接携带 SecretRef、缺失 binding、未批准 `secret.use`、跨 binding 引用和 optional/required 漂移全部失败关闭。binding 快照不含明文并进入 materialized revision digest，Local/Cluster 启动发布复用既有 repository/pool，Task dispatch、Local 短时解密和 Cluster offer/lease-fenced delivery 不另造协议。SQLite/PostgreSQL INSERT trigger 同时防止直接写库绕过；Local 只读 readiness 继续不加载 DDL。Local contract v47、Cluster v59；不新增 package、表、索引、连接、daemon、watcher、timer、cache 或 workload。完整 18-package clean build/test 退出 0；backend 1,188 pass/2 条件 skip/0 fail；五项 package/dependency/edge/service-manager/local-image 审计零 finding，workspace 仍无 single-source/shallow-source package，两个有序 migration ledger 精确为 PostgreSQL 61、SQLite 95 个 source；PostgreSQL 18.4 arm64 HA 125 项 gate 全绿、timeline `1→2`，报告 SHA-256 为 `f9107e8e54892a788779758f0573ac8d6a80f6d086516a1f5f5bbacb59bbb4be`。D-306A 不冒充产品闭环：Local bind/rebind 命令、Cluster Approved Action/API 与新 generation rotation/revocation 编排属于 D-306B。
+- D-306B1/ADR-0395（进行中）：先完成当前 active、尚未绑定 Package generation 的首次 Secret binding，不允许原地 rebind。共享 content-free plan 由服务端从 installation/proposal/lock/Manifest/generation 重建，调用方不能注入 generation 或 digest。Local 已复用短生命周期 `ql3-package` 私有 command-file 和单 SQLite authority：强 `local-console` User 必须同时具备 `secret.manage` 与当前 Project Owner，human confirmation 后在一个 `BEGIN IMMEDIATE` transaction 内复验 Owner fence、Package provenance、精确 Secret version、content-free audit 与 immutable binding；plan 后撤权原子回滚，exact replay 收敛，不同 audit identity 或当前代重复绑定失败关闭。未新增 package、migration、表、索引、依赖、进程、连接、listener、timer、watcher 或 cache。针对包粒度复审确认 18 个 workspace package 不按 LOC 机械合并；D-306 contract/plan 与 SQLite repository/administration 分别收敛为 owning-domain 两文件目录，公开 subpath 不变、无 wrapper。Cluster separation-of-duty Approved Action、PostgreSQL durable plan/proposal 与 HA 证据仍未完成，所以 ADR 保持 Proposed；rebind/rotation/revocation 继续属于必须创建新 generation 的 D-306B2。
 - D-302/ADR-0390（已接受）
   Cluster operator context 增加无网络、无 mutation 的内建 `ql3-cluster-admin context validate` 预检。它先复用 owner-private context
   reader，再让每个 entry 经过与真实请求相同的 production HTTPS/Kubernetes configuration preparation，验证精确 route、hostname、CA、

docs/adr/ADR-0395-owner-confirmed-plugin-package-secret-binding.md

@@ -0,0 +1,42 @@
+# ADR-0395：Owner 确认的 Plugin Package Secret 首次绑定
+
+- 状态：Proposed
+- 日期：2026-08-13
+- 关联 RFC：QL-RFC-0001 D-306B1
+- 关联 ADR：ADR-0364、ADR-0393、ADR-0394
+
+## 问题
+
+D-305 已提供按 Package generation 不可变的 Secret binding ledger，D-306A 已让 materialization 消费该 binding，但部署者仍缺少受支持的产品入口。直接开放 repository 会绕过 User、Project Policy、Owner confirmation、Secret version existence 与当前 generation fence；让既有 generation 原地改绑则会使同一 materialized revision 在不同时间指向不同 Secret。
+
+QingLong 3.0 同时面向低配路由设备和集群节点。本机产品入口不能引入常驻进程、第二条 SQLite 连接、watcher、timer 或 cache；Cluster 后续入口必须复用 separation-of-duty Approved Action，而不是复制 Local Owner authority。
+
+## 决策
+
+1. D-306B 拆成两个可独立验证的阶段：B1 只允许当前 active、尚未绑定 generation 的首次 binding；B2 才通过新 Package generation 完成 rebind、rotation 与 revocation。任何阶段都不得更新或删除历史 binding。
+2. B1 使用共享、content-free 的 `qinglong/plugin-package-secret-binding-plan@v1`。服务端从当前 installation、admission proposal、lock、Manifest 与 resource generation 重建目标和 canonical entries，调用方不能提交 generation、Manifest digest、lock digest 或 binding digest。
+3. Local 入口复用短生命周期 `ql3-package` 私有 command-file 链路。plan 与 execute 都要求强 `local-console` User、`secret.manage` 和当前 Project `owner`；execute 在 human confirmation 后进入既有单 SQLite operation authority，并在同一 `BEGIN IMMEDIATE` transaction 内重新验证 Owner fence、当前 generation、Package provenance、精确 Secret version existence、content-free audit 与 binding publish。
+4. plan 只包含 SecretRef 元数据，不包含 Secret 明文；响应只返回目标摘要、canonical entry、plan/binding digest 与 created/existing 状态。required requirement 不能为 `null`，optional requirement 可以显式为 `null`，所有非空引用必须同 Project且固定 version。
+5. plan 后撤销 Owner 必须使 execute 回滚且不留下 audit/binding。完全相同的 plan 与 audit identity 可以 exact replay；同一当前 generation 的第二次 bind/rebind、不同 audit identity 或任何 provenance drift 必须失败关闭，并提示通过新 generation 执行 B2。
+6. workspace package 继续按部署制品、authority、依赖隔离、adapter 与多消费者裁决，不按文件数合并。D-306 的 Runtime contract/plan 归入同包 `plugin-package/secret-binding/{binding,plan}`，SQLite repository/administration 归入同包 `plugin-package/secret-binding/{repository,administration}`；稳定公开 subpath 不变，不保留旧物理路径 wrapper，也不为单个 plan 新增微型 package。
+7. Local 实现不新增 package、migration、表、索引、依赖、进程、listener、连接、timer、watcher 或 cache。Cluster B1 仍须以 Approved Action、package-manager/package-executor 最小权限和 PostgreSQL HA 证据完成后，本 ADR 才能进入 Accepted。
+
+## 明确不在 B1 中完成
+
+- 不允许对已经绑定的 generation 原地 rebind、rotate 或 revoke。
+- 不读取、解密、输出或复制 Secret value。
+- 不让常驻 Local application、Cluster Control 或 Worker 获得管理 authority。
+- 不以 Local Owner confirmation 替代 Cluster separation-of-duty Approved Action。
+
+## 验证
+
+- Runtime contract：plan canonicalization、digest/shape drift、Local/Cluster authority 派生与稳定 package subpath。
+- Local 产品纵切面：真实 Package proposal/approval/activation，缺失 Secret version 拒绝，plan 后撤权原子回滚，恢复 Owner 后首次 publish、exact replay、重复 bind 与 audit identity drift 拒绝。
+- 完整 18-package clean build/test；需要本机 TLS listener 的 Worker 测试在允许回环监听的等价环境复跑。
+- package/dependency/edge/service-manager/local-image 审计与 GitNexus compare-to-`develop` 变更影响检查。
+
+## 当前证据
+
+- Runtime Core、Local SQLite、Local Owner CLI closure type-check 已通过；Local 产品定向纵切面 3/3。
+- 18-package clean build/test 中除受限沙箱禁止绑定 `127.0.0.1` 导致的 Worker TLS 三项外，其余已执行测试均为 0 fail；同一 Worker 完整包在允许回环监听的环境为 133/133。
+- Cluster Approved Action、PostgreSQL proposal/plan ledger、最小权限、真库与 physical HA 证据仍待 B1 后半段完成，因此本 ADR 保持 Proposed。

docs/adr/README.md

@@ -398,6 +398,7 @@
 | [ADR-0392](./ADR-0392-atomic-plugin-package-automation-security-withdrawal.md)                                | Plugin Package Automation 安全隔离原子撤回                                                                                           | Accepted |
 | [ADR-0393](./ADR-0393-generation-bound-plugin-package-secret-binding-ledger.md)                              | 按 Generation 固定的 Plugin Package Secret 绑定账本                                                                                  | Accepted |
 | [ADR-0394](./ADR-0394-generation-bound-plugin-package-secret-materialization.md)                             | 按 Generation 固定的 Plugin Package Secret Materialization                                                                           | Accepted |
+| [ADR-0395](./ADR-0395-owner-confirmed-plugin-package-secret-binding.md)                                      | Owner 确认的 Plugin Package Secret 首次绑定                                                                                           | Proposed |
 
 ## 规则
 

packages/ql3-local-admin/package.json

@@ -75,6 +75,11 @@
       "require": "./dist/plugin-package/pluginPackageLifecycle.js",
       "default": "./dist/plugin-package/pluginPackageLifecycle.js"
     },
+    "./package-secret-binding": {
+      "types": "./dist/plugin-package/pluginPackageSecretBinding.d.ts",
+      "require": "./dist/plugin-package/pluginPackageSecretBinding.js",
+      "default": "./dist/plugin-package/pluginPackageSecretBinding.js"
+    },
     "./package-recovery-catalog": {
       "types": "./dist/plugin-package/pluginPackageRecoveryCatalog.d.ts",
       "require": "./dist/plugin-package/pluginPackageRecoveryCatalog.js",

packages/ql3-local-admin/src/plugin-package/pluginPackageSecretBinding.ts

@@ -0,0 +1,8 @@
+export {
+  createLocalPluginPackageSecretBindingService,
+  LocalPluginPackageSecretBindingConflictError,
+  LocalPluginPackageSecretBindingUnavailableError,
+  type ExecuteLocalPluginPackageSecretBindingRequest,
+  type LocalPluginPackageSecretBindingService,
+  type PlanLocalPluginPackageSecretBindingRequest,
+} from '@qinglong/local-sqlite/plugin-package-secret-binding-administration';

packages/ql3-local-owner-cli/src/plugin-package/pluginPackageCommand.ts

@@ -26,6 +26,10 @@ import {
   type PluginPackageLifecycleImpact,
   type PluginPackageLifecycleReceipt,
 } from '@qinglong/runtime-core/plugin-package-lifecycle';
+import {
+  normalizePluginPackageSecretBindingPlan,
+  type PluginPackageSecretBindingPlan,
+} from '@qinglong/runtime-core/plugin-package-secret-binding-plan';
 import {
   pluginPackageInstallRecoveryAction,
   type PluginPackageInstallActionInput,
@@ -35,6 +39,7 @@ import type { PluginPackageInstallProposal } from '@qinglong/runtime-core/plugin
 
 import { createLocalPluginPackageManagementService } from '@qinglong/local-admin/package-management';
 import { createLocalPluginPackageLifecycleService } from '@qinglong/local-admin/package-lifecycle';
+import { createLocalPluginPackageSecretBindingService } from '@qinglong/local-admin/package-secret-binding';
 
 const MAX_PATH_BYTES = 4096;
 const MAX_DISPATCH_LIMIT = 64;
@@ -177,6 +182,30 @@ export interface ExecuteLocalPluginPackageLifecycleCommand {
   };
 }
 
+export interface PlanLocalPluginPackageSecretBindingCommand {
+  readonly schemaVersion: 1;
+  readonly operation: 'plugin-package.secret-binding.plan';
+  readonly options: LocalPluginPackageCommandOptions;
+  readonly request: {
+    readonly projectId: string;
+    readonly packageName: string;
+    readonly assignments: readonly Readonly<{
+      name: string;
+      secretRef: string | null;
+    }>[];
+  };
+}
+
+export interface ExecuteLocalPluginPackageSecretBindingCommand {
+  readonly schemaVersion: 1;
+  readonly operation: 'plugin-package.secret-binding.execute';
+  readonly options: LocalPluginPackageCommandOptions;
+  readonly request: {
+    readonly plan: PluginPackageSecretBindingPlan;
+    readonly auditEventId: string;
+  };
+}
+
 export type LocalPluginPackageCommand =
   | ProposeLocalPluginPackageCommand
   | DecideLocalPluginPackageCommand
@@ -186,7 +215,9 @@ export type LocalPluginPackageCommand =
   | ListLocalPluginPackageInstallationsCommand
   | DispatchLocalPluginPackageCommand
   | PlanLocalPluginPackageLifecycleCommand
-  | ExecuteLocalPluginPackageLifecycleCommand;
+  | ExecuteLocalPluginPackageLifecycleCommand
+  | PlanLocalPluginPackageSecretBindingCommand
+  | ExecuteLocalPluginPackageSecretBindingCommand;
 
 export interface LocalPluginPackageCommandRunner {
   run(
@@ -251,6 +282,19 @@ export type LocalPluginPackageCommandResult =
       status: 'created' | 'existing';
       approval: ReturnType<typeof approvalSummary>;
       receipt: ReturnType<typeof lifecycleReceiptSummary>;
+    }>
+  | Readonly<{
+      schemaVersion: 1;
+      operation: 'plugin-package.secret-binding.plan';
+      plan: Readonly<PluginPackageSecretBindingPlan>;
+      summary: ReturnType<typeof secretBindingPlanSummary>;
+    }>
+  | Readonly<{
+      schemaVersion: 1;
+      operation: 'plugin-package.secret-binding.execute';
+      status: 'created' | 'existing';
+      bindingDigest: string;
+      generationDigest: string;
     }>;
 
 export class LocalPluginPackageCommandConfigurationError extends TypeError {
@@ -558,6 +602,65 @@ function normalizeCommand(value: unknown): Readonly<LocalPluginPackageCommand> {
         );
       }
       break;
+    case 'plugin-package.secret-binding.plan':
+      exactObject(
+        value.request,
+        ['assignments', 'packageName', 'projectId'],
+        'Secret binding plan request',
+      );
+      if (
+        typeof value.request.projectId !== 'string' ||
+        !PROJECT_ID_PATTERN.test(value.request.projectId) ||
+        typeof value.request.packageName !== 'string' ||
+        !PACKAGE_NAME_PATTERN.test(value.request.packageName) ||
+        !Array.isArray(value.request.assignments) ||
+        value.request.assignments.length < 1 ||
+        value.request.assignments.length > 64
+      ) {
+        throw new LocalPluginPackageCommandConfigurationError(
+          'Secret binding plan request is invalid',
+        );
+      }
+      for (const assignment of value.request.assignments) {
+        exactObject(assignment, ['name', 'secretRef'], 'Secret assignment');
+        if (
+          typeof assignment.name !== 'string' ||
+          !/^[A-Z_][A-Z0-9_]{0,127}$/.test(assignment.name) ||
+          (assignment.secretRef !== null &&
+            (typeof assignment.secretRef !== 'string' ||
+              Buffer.byteLength(assignment.secretRef, 'utf8') > 512))
+        ) {
+          throw new LocalPluginPackageCommandConfigurationError(
+            'Secret assignment is invalid',
+          );
+        }
+      }
+      break;
+    case 'plugin-package.secret-binding.execute':
+      exactObject(
+        value.request,
+        ['auditEventId', 'plan'],
+        'Secret binding execution request',
+      );
+      if (
+        typeof value.request.auditEventId !== 'string' ||
+        !/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(
+          value.request.auditEventId,
+        )
+      ) {
+        throw new LocalPluginPackageCommandConfigurationError(
+          'Secret binding audit event ID is invalid',
+        );
+      }
+      try {
+        normalizePluginPackageSecretBindingPlan(value.request.plan);
+      } catch (error) {
+        throw new LocalPluginPackageCommandConfigurationError(
+          'Secret binding plan is invalid',
+          error,
+        );
+      }
+      break;
     default:
       throw new LocalPluginPackageCommandConfigurationError(
         'operation is invalid',
@@ -714,8 +817,7 @@ function lifecycleReceiptSummary(
     disposition: receipt.lifecycle.disposition,
     capabilityStatus: receipt.capability.status,
     taskTransitions: receipt.capability.taskTransitions.length,
-    previousActiveVectorDigest:
+    previousActiveVectorDigest: receipt.capability.previousActiveVectorDigest,
-      receipt.capability.previousActiveVectorDigest,
     currentActiveVectorDigest: receipt.capability.currentActiveVectorDigest,
     currentToolSnapshotDigest: receipt.capability.currentToolSnapshotDigest,
     retainedSourceCount: receipt.capability.retainedSourceCount,
@@ -724,12 +826,68 @@ function lifecycleReceiptSummary(
   });
 }
 
+function secretBindingPlanSummary(
+  plan: Readonly<PluginPackageSecretBindingPlan>,
+) {
+  return Object.freeze({
+    projectId: plan.target.projectId,
+    packageName: plan.target.packageName,
+    installationId: plan.target.installationId,
+    generation: plan.target.generation,
+    generationDigest: plan.target.generationDigest,
+    manifestDigest: plan.target.manifestDigest,
+    assignments: Object.freeze(
+      plan.entries.map((entry) =>
+        Object.freeze({
+          name: entry.name,
+          required: entry.required,
+          bound: entry.secretRef !== null,
+          secretRef: entry.secretRef,
+        }),
+      ),
+    ),
+    plannedAtMs: plan.plannedAtMs,
+    planDigest: plan.planDigest,
+  });
+}
+
 async function execute(
   command: Readonly<LocalPluginPackageCommand>,
   database: LocalSqlitePluginPackageManagementDatabase,
   authenticated: Readonly<AuthenticatedLocalCommand>,
 ): Promise<Readonly<LocalPluginPackageCommandResult>> {
   await authenticated.confirm();
+  if (command.operation === 'plugin-package.secret-binding.plan') {
+    const service = createLocalPluginPackageSecretBindingService(
+      database.authority,
+    );
+    const plan = await service.plan({
+      ...command.request,
+      principal: authenticated.principal,
+      plannedAtMs: Date.now(),
+    });
+    return Object.freeze({
+      schemaVersion: 1,
+      operation: command.operation,
+      plan,
+      summary: secretBindingPlanSummary(plan),
+    });
+  }
+  if (command.operation === 'plugin-package.secret-binding.execute') {
+    const service = createLocalPluginPackageSecretBindingService(
+      database.authority,
+    );
+    const result = await service.execute({
+      ...command.request,
+      principal: authenticated.principal,
+      confirmAuthorization: authenticated.confirm,
+    });
+    return Object.freeze({
+      schemaVersion: 1,
+      operation: command.operation,
+      ...result,
+    });
+  }
   if (command.operation === 'plugin-package.lifecycle.plan') {
     const service = createLocalPluginPackageLifecycleService({
       authority: database.authority,

packages/ql3-local-owner-cli/test/pluginPackageCommand.test.cjs

@@ -82,6 +82,7 @@ const {
 const {
   createPluginPackageResourceGeneration,
 } = require('@qinglong/runtime-core/plugin-package-resource-generation');
+const { createSecretRef } = require('@qinglong/runtime-core/secret-reference');
 const {
   materializePluginPackageResources,
 } = require('@qinglong/runtime-core/plugin-package-resource-materialization');
@@ -200,7 +201,7 @@ function packageArtifact(manifest) {
   ]);
 }
 
-function actionInput() {
+function actionInput(secretAware = false) {
   const manifest = {
     apiVersion: PLUGIN_PACKAGE_API_VERSION,
     kind: PLUGIN_PACKAGE_KIND,
@@ -224,8 +225,10 @@ function actionInput() {
       },
       permissions: {
         network: { allowedHosts: [] },
-        secrets: [],
+        secrets: secretAware ? [{ name: 'TOKEN', required: true }] : [],
-        tools: ['system.command'],
+        tools: secretAware
+          ? ['secret.use', 'system.command']
+          : ['system.command'],
       },
       contents: {
         tasks: ['tasks/collect.json'],
@@ -507,6 +510,46 @@ async function activatePackageAutomation(databasePath, lock, manifest) {
   }
 }
 
+async function activatePackageOnly(databasePath, projectId, packageName) {
+  const client = new DatabaseSync(databasePath);
+  const authority = new LocalSqliteOperationAuthority(client);
+  try {
+    const installs = new LocalSqlitePluginPackageInstallRepository(authority);
+    const queued = await installs.find(projectId, packageName);
+    const lock = await installs.findLock(queued.lockDigest);
+    const staged = transitionPluginPackageInstall(lock, queued, {
+      type: 'stage_completed',
+      mutationId: 'secret-binding-stage-package',
+      occurredAtMs: queued.updatedAtMs + 1,
+      stageRef: `stage:${lock.lockDigest}`,
+      artifactDigest: lock.source.artifactDigest,
+      manifestDigest: lock.manifestDigest,
+      contentDigest: lock.source.contentDigest,
+      evidenceDigest: 'e'.repeat(64),
+    });
+    await installs.commit(pluginPackageInstallCommit(queued, staged));
+    const activating = transitionPluginPackageInstall(lock, staged, {
+      type: 'activation_started',
+      mutationId: 'secret-binding-start-package',
+      occurredAtMs: staged.updatedAtMs + 1,
+    });
+    await installs.commit(pluginPackageInstallCommit(staged, activating));
+    const active = transitionPluginPackageInstall(lock, activating, {
+      type: 'activation_committed',
+      mutationId: 'secret-binding-commit-package',
+      occurredAtMs: activating.updatedAtMs + 1,
+      activationRef: `activation:${lock.lockDigest}`,
+      intentDigest: pluginPackageActivationIntentDigest(lock, activating),
+      generation: lock.targetGeneration,
+      contentDigest: lock.source.contentDigest,
+    });
+    await installs.commit(pluginPackageInstallCommit(activating, active));
+    return { active, lock };
+  } finally {
+    await authority.close();
+  }
+}
+
 function publisherTrustRunnerWithOneSnapshotFault() {
   let injectFault = true;
   return createLocalPluginPackagePublisherTrustCommandRunner({
@@ -1348,6 +1391,277 @@ test('runs the private command-file package lifecycle with replay-safe IDs', asy
   assertNoSensitiveMaterial(installationList);
 });
 
+test('plans and atomically binds a versioned Secret to the current Package generation', async (t) => {
+  const value = await fixture(t);
+  const input = actionInput(true);
+  const actionRef = 'proposal:secret-aware-cli-monitor-v1';
+  const approvalRequestId = 'approval-secret-aware-cli-monitor-v1';
+  await runLocalPluginPackageCommandFile(
+    commandFile(
+      value,
+      'plugin-package.propose',
+      {
+        actionRef,
+        approvalRequestId,
+        proposalAuditEventId: '21000000-0000-4000-8000-000000000001',
+        approvalAuditEventId: '21000000-0000-4000-8000-000000000002',
+        actionInput: input,
+      },
+      'secret-01-propose',
+    ),
+  );
+  await runLocalPluginPackageCommandFile(
+    commandFile(
+      value,
+      'plugin-package.decide',
+      {
+        actionRef,
+        approvalRequestId,
+        expectedVersion: 1,
+        decisionId: 'decision-secret-aware-cli-monitor-v1',
+        auditEventId: '21000000-0000-4000-8000-000000000003',
+        decision: 'approved',
+        reasonCode: 'reviewed',
+      },
+      'secret-02-decide',
+    ),
+  );
+  await runLocalPluginPackageCommandFile(
+    commandFile(
+      value,
+      'plugin-package.consume',
+      {
+        actionRef,
+        approvalRequestId,
+        expectedVersion: 2,
+        consumptionId: 'consume-secret-aware-cli-monitor-v1',
+        dispatchId: 'dispatch-secret-aware-cli-monitor-v1',
+        auditEventId: '21000000-0000-4000-8000-000000000004',
+      },
+      'secret-03-consume',
+    ),
+  );
+  const dispatched = await runLocalPluginPackageCommandFile(
+    commandFile(
+      value,
+      'plugin-package.dispatch',
+      { limit: 1 },
+      'secret-04-dispatch',
+    ),
+  );
+  assert.equal(dispatched.summary.succeeded, 1);
+  const { active } = await activatePackageOnly(
+    value.databasePath,
+    'default',
+    'cli-monitor',
+  );
+  const secretRef = createSecretRef({
+    projectId: 'default',
+    name: 'runtime-token',
+    version: 1,
+  });
+  await assert.rejects(
+    runLocalPluginPackageCommandFile(
+      commandFile(
+        value,
+        'plugin-package.secret-binding.plan',
+        {
+          projectId: 'default',
+          packageName: 'cli-monitor',
+          assignments: [
+            {
+              name: 'TOKEN',
+              secretRef: createSecretRef({
+                projectId: 'default',
+                name: 'runtime-token',
+                version: 2,
+              }),
+            },
+          ],
+        },
+        'secret-05-missing-version',
+      ),
+    ),
+    /version is unavailable/,
+  );
+  const secretDatabase = new DatabaseSync(value.databasePath);
+  try {
+    secretDatabase
+      .prepare(
+        `INSERT INTO "QingLong3LocalSecretEnvelopes" (
+           "project_id", "secret_name", "version", "mutation_id",
+           "key_id", "algorithm", "nonce", "ciphertext", "auth_tag",
+           "created_at_ms"
+         ) VALUES (?, ?, 1, ?, ?, 'aes-256-gcm', ?, ?, ?, ?)`,
+      )
+      .run(
+        'default',
+        'runtime-token',
+        'secret-aware-fixture-v1',
+        'fixture-key-v1',
+        Buffer.alloc(12, 1),
+        Buffer.from('ciphertext'),
+        Buffer.alloc(16, 2),
+        Date.now(),
+      );
+  } finally {
+    secretDatabase.close();
+  }
+
+  const planResult = await runLocalPluginPackageCommandFile(
+    commandFile(
+      value,
+      'plugin-package.secret-binding.plan',
+      {
+        projectId: 'default',
+        packageName: 'cli-monitor',
+        assignments: [{ name: 'TOKEN', secretRef }],
+      },
+      'secret-05-plan',
+    ),
+  );
+  assert.equal(planResult.summary.installationId, active.installationId);
+  assert.equal(planResult.summary.generation, 1);
+  assert.deepEqual(planResult.summary.assignments, [
+    { name: 'TOKEN', required: true, bound: true, secretRef },
+  ]);
+  assertNoSensitiveMaterial(planResult);
+
+  const revokeDatabase = new DatabaseSync(value.databasePath);
+  try {
+    revokeDatabase
+      .prepare(
+        `INSERT INTO "QingLong3ProjectRoleBindings" (
+           "project_id", "subject_type", "subject_id", "version", "state",
+           "role", "mutation_id", "changed_by_type", "changed_by_id",
+           "created_at_ms"
+         ) VALUES (
+           'default', 'user', 'owner-user', 2, 'revoked', NULL,
+           'secret-binding-revoke-owner', 'user', 'owner-user', ?
+         )`,
+      )
+      .run(Date.now());
+  } finally {
+    revokeDatabase.close();
+  }
+  const executePath = commandFile(
+    value,
+    'plugin-package.secret-binding.execute',
+    {
+      plan: planResult.plan,
+      auditEventId: '21000000-0000-4000-8000-000000000005',
+    },
+    'secret-06-execute',
+  );
+  await assert.rejects(
+    runLocalPluginPackageCommandFile(executePath),
+    /denies Secret management|Project policy changed/,
+  );
+  const restoreDatabase = new DatabaseSync(value.databasePath);
+  try {
+    assert.equal(
+      restoreDatabase
+        .prepare(
+          `SELECT COUNT(*) AS count
+           FROM "QingLong3PluginPackageSecretBindings"`,
+        )
+        .get().count,
+      0,
+    );
+    assert.equal(
+      restoreDatabase
+        .prepare(
+          `SELECT COUNT(*) AS count
+           FROM "QingLong3SecurityAuditEvents"
+           WHERE "operation_id" = 'plugin_package.secret.bind'`,
+        )
+        .get().count,
+      0,
+    );
+    restoreDatabase
+      .prepare(
+        `INSERT INTO "QingLong3ProjectRoleBindings" (
+           "project_id", "subject_type", "subject_id", "version", "state",
+           "role", "mutation_id", "changed_by_type", "changed_by_id",
+           "created_at_ms"
+         ) VALUES (
+           'default', 'user', 'owner-user', 3, 'active', 'owner',
+           'secret-binding-restore-owner', 'user', 'owner-user', ?
+         )`,
+      )
+      .run(Date.now());
+  } finally {
+    restoreDatabase.close();
+  }
+
+  const created = await runLocalPluginPackageCommandFile(executePath);
+  assert.equal(created.status, 'created');
+  assert.equal(
+    created.generationDigest,
+    planResult.plan.target.generationDigest,
+  );
+  assert.match(created.bindingDigest, /^[0-9a-f]{64}$/);
+  assertNoSensitiveMaterial(created);
+  const replay = await runLocalPluginPackageCommandFile(executePath);
+  assert.equal(replay.status, 'existing');
+  assert.equal(replay.bindingDigest, created.bindingDigest);
+
+  await assert.rejects(
+    runLocalPluginPackageCommandFile(
+      commandFile(
+        value,
+        'plugin-package.secret-binding.plan',
+        {
+          projectId: 'default',
+          packageName: 'cli-monitor',
+          assignments: [{ name: 'TOKEN', secretRef }],
+        },
+        'secret-07-rebind-current-generation',
+      ),
+    ),
+    /rebind requires a new generation/,
+  );
+  await assert.rejects(
+    runLocalPluginPackageCommandFile(
+      commandFile(
+        value,
+        'plugin-package.secret-binding.execute',
+        {
+          plan: planResult.plan,
+          auditEventId: '21000000-0000-4000-8000-000000000006',
+        },
+        'secret-08-different-audit',
+      ),
+    ),
+    /another audit identity/,
+  );
+
+  const inspection = new DatabaseSync(value.databasePath, { readOnly: true });
+  try {
+    assert.equal(
+      inspection
+        .prepare(
+          `SELECT COUNT(*) AS count
+           FROM "QingLong3PluginPackageSecretBindings"`,
+        )
+        .get().count,
+      1,
+    );
+    assert.equal(
+      inspection
+        .prepare(
+          `SELECT COUNT(*) AS count
+           FROM "QingLong3SecurityAuditEvents"
+           WHERE "operation_id" = 'plugin_package.secret.bind'`,
+        )
+        .get().count,
+      1,
+    );
+  } finally {
+    inspection.close();
+  }
+});
+
 test('denies an authenticated non-owner before package proposal mutation', async (t) => {
   const value = await fixture(t, false);
   await assert.rejects(

packages/ql3-local-sqlite/package.json

@@ -86,9 +86,14 @@
       "default": "./dist/plugin-package/pluginPackageMaterializedRevisionRepository.js"
     },
     "./plugin-package-secret-binding": {
-      "types": "./dist/plugin-package/pluginPackageSecretBindingRepository.d.ts",
+      "types": "./dist/plugin-package/secret-binding/repository.d.ts",
-      "require": "./dist/plugin-package/pluginPackageSecretBindingRepository.js",
+      "require": "./dist/plugin-package/secret-binding/repository.js",
-      "default": "./dist/plugin-package/pluginPackageSecretBindingRepository.js"
+      "default": "./dist/plugin-package/secret-binding/repository.js"
+    },
+    "./plugin-package-secret-binding-administration": {
+      "types": "./dist/plugin-package/secret-binding/administration.d.ts",
+      "require": "./dist/plugin-package/secret-binding/administration.js",
+      "default": "./dist/plugin-package/secret-binding/administration.js"
     },
     "./plugin-package-task-reconciliation": {
       "types": "./dist/plugin-package/pluginPackageTaskReconciliationRepository.d.ts",

packages/ql3-local-sqlite/src/plugin-package/secret-binding/administration.ts

@@ -0,0 +1,542 @@
+import type { DatabaseSync } from 'node:sqlite';
+
+import {
+  normalizePluginPackageInstallProposal,
+  type PluginPackageInstallProposal,
+} from '@qinglong/runtime-core/plugin-package-proposal';
+import {
+  normalizePluginPackageLock,
+  normalizePluginPackageInstallRecord,
+  type PluginPackageInstallRecord,
+  type PluginPackageLock,
+} from '@qinglong/runtime-core/plugin-package-install';
+import { createPluginPackageResourceGenerationFromReferences } from '@qinglong/runtime-core/plugin-package-resource-generation';
+import {
+  createPluginPackageSecretBindingFromPlan,
+  createPluginPackageSecretBindingPlan,
+  normalizePluginPackageSecretBindingPlan,
+  type PluginPackageSecretBindingPlan,
+} from '@qinglong/runtime-core/plugin-package-secret-binding-plan';
+import { parseSecretRef } from '@qinglong/runtime-core/secret-reference';
+import type { SecurityPrincipal } from '@qinglong/runtime-core/security';
+import type { SecurityAuditRecord } from '@qinglong/runtime-core/security-audit';
+import {
+  normalizeSecurityPrincipal,
+  type SecurityPolicyFence,
+} from '@qinglong/runtime-core/security';
+import { ProjectPolicyEngine } from '@qinglong/runtime-core/project-policy';
+
+import { LocalSqliteOperationAuthority } from '../../authority/operationAuthority';
+import { LocalSqliteProjectPolicyRepository } from '../../security/projectPolicyRepository';
+import {
+  insertLocalSecurityAudit,
+  localSecurityAuditFromRow,
+  LOCAL_SECURITY_AUDIT_SELECT,
+  sameSecurityAuditSemantic,
+} from '../../security/securityPersistence';
+import { LocalSqlitePluginPackageSecretBindingRepository } from './repository';
+
+type Row = Record<string, unknown>;
+
+const IDENTIFIER = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+const PACKAGE_NAME = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+const UUID =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+
+export interface PlanLocalPluginPackageSecretBindingRequest {
+  readonly projectId: string;
+  readonly packageName: string;
+  readonly assignments: readonly Readonly<{
+    name: string;
+    secretRef: string | null;
+  }>[];
+  readonly principal: SecurityPrincipal;
+  readonly plannedAtMs: number;
+}
+
+export interface ExecuteLocalPluginPackageSecretBindingRequest {
+  readonly plan: PluginPackageSecretBindingPlan;
+  readonly auditEventId: string;
+  readonly principal: SecurityPrincipal;
+  readonly confirmAuthorization: () => void | Promise<void>;
+}
+
+export interface LocalPluginPackageSecretBindingService {
+  plan(
+    request: PlanLocalPluginPackageSecretBindingRequest,
+  ): Promise<Readonly<PluginPackageSecretBindingPlan>>;
+  execute(request: ExecuteLocalPluginPackageSecretBindingRequest): Promise<
+    Readonly<{
+      status: 'created' | 'existing';
+      bindingDigest: string;
+      generationDigest: string;
+    }>
+  >;
+}
+
+export class LocalPluginPackageSecretBindingConflictError extends Error {
+  readonly code = 'LOCAL_PLUGIN_PACKAGE_SECRET_BINDING_CONFLICT';
+
+  constructor(message: string) {
+    super(
+      `Local Plugin Package Secret binding conflicts with state: ${message}`,
+    );
+    this.name = 'LocalPluginPackageSecretBindingConflictError';
+  }
+}
+
+export class LocalPluginPackageSecretBindingUnavailableError extends Error {
+  readonly code = 'LOCAL_PLUGIN_PACKAGE_SECRET_BINDING_UNAVAILABLE';
+
+  constructor(options?: ErrorOptions) {
+    super('Local Plugin Package Secret binding is unavailable', options);
+    this.name = 'LocalPluginPackageSecretBindingUnavailableError';
+  }
+}
+
+function rowText(row: Row, key: string): string {
+  const value = row[key];
+  if (typeof value !== 'string')
+    throw new LocalPluginPackageSecretBindingUnavailableError();
+  return value;
+}
+
+function identity(value: unknown, label: string, pattern: RegExp): string {
+  if (typeof value !== 'string' || !pattern.test(value)) {
+    throw new TypeError(`${label} is invalid`);
+  }
+  return value;
+}
+
+function timestamp(value: unknown, label: string): number {
+  if (!Number.isSafeInteger(value) || (value as number) < 0) {
+    throw new TypeError(`${label} is invalid`);
+  }
+  return value as number;
+}
+
+function loadCurrent(
+  client: DatabaseSync,
+  projectId: string,
+  packageName: string,
+): Readonly<{
+  record: PluginPackageInstallRecord;
+  lock: PluginPackageLock;
+  proposal: PluginPackageInstallProposal;
+}> {
+  const row = client
+    .prepare(
+      `SELECT install.record_json AS "recordJson",
+              install.lock_json AS "lockJson",
+              proposal.proposal_json AS "proposalJson"
+       FROM "QingLong3PluginPackageInstallHeads" AS head
+       JOIN "QingLong3PluginPackageInstalls" AS install
+         ON install.installation_id = head.installation_id
+       JOIN "QingLong3PluginPackageAdmissionReceipts" AS admission
+         ON admission.installation_id = install.installation_id
+       JOIN "QingLong3PluginPackageInstallProposals" AS proposal
+         ON proposal.action_ref = admission.action_ref
+       LEFT JOIN "QingLong3PluginPackageQuarantineEvents" AS quarantine
+         ON quarantine.project_id = install.project_id
+        AND quarantine.package_name = install.package_name
+        AND quarantine.installation_id = install.installation_id
+        AND quarantine.lock_digest = install.lock_digest
+       LEFT JOIN "QingLong3PluginPackageLifecycleHeads" AS lifecycle
+         ON lifecycle.project_id = install.project_id
+        AND lifecycle.package_name = install.package_name
+        AND lifecycle.installation_id = install.installation_id
+        AND lifecycle.lock_digest = install.lock_digest
+       WHERE head.project_id = ?
+         AND head.package_name = ?
+         AND install.state = 'active'
+         AND install.active_lock_digest = install.lock_digest
+         AND quarantine.event_digest IS NULL
+         AND COALESCE(lifecycle.disposition, 'active') = 'active'
+       LIMIT 2`,
+    )
+    .all(projectId, packageName) as Row[];
+  if (row.length !== 1) {
+    throw new LocalPluginPackageSecretBindingConflictError(
+      'current active Package authority is absent or ambiguous',
+    );
+  }
+  try {
+    const record = normalizePluginPackageInstallRecord(
+      JSON.parse(rowText(row[0]!, 'recordJson')),
+    );
+    const lock = normalizePluginPackageLock(
+      JSON.parse(rowText(row[0]!, 'lockJson')),
+    );
+    const proposal = normalizePluginPackageInstallProposal(
+      JSON.parse(rowText(row[0]!, 'proposalJson')),
+    );
+    if (
+      record.projectId !== projectId ||
+      record.packageName !== packageName ||
+      record.lockDigest !== lock.lockDigest ||
+      proposal.actionDigest !== lock.approval.actionDigest ||
+      proposal.previewDigest !== lock.approval.previewDigest ||
+      proposal.actionInput.projectId !== projectId ||
+      proposal.actionInput.manifest.metadata.name !== packageName ||
+      proposal.actionInput.targetGeneration !== record.targetGeneration ||
+      proposal.actionInput.source.contentDigest !== lock.source.contentDigest ||
+      proposal.actionInput.manifest.metadata.version !==
+        record.packageVersion ||
+      proposal.actionInput.manifest.spec.permissions.secrets.length === 0 ||
+      !proposal.actionInput.manifest.spec.permissions.tools.includes(
+        'secret.use',
+      )
+    ) {
+      throw new Error('current Package provenance drift');
+    }
+    return Object.freeze({ record, lock, proposal });
+  } catch (error) {
+    if (error instanceof LocalPluginPackageSecretBindingConflictError)
+      throw error;
+    throw new LocalPluginPackageSecretBindingUnavailableError({
+      cause: error instanceof Error ? error : undefined,
+    });
+  }
+}
+
+function generationFrom(current: ReturnType<typeof loadCurrent>) {
+  const { record, lock } = current;
+  return createPluginPackageResourceGenerationFromReferences({
+    installationId: record.installationId,
+    projectId: record.projectId,
+    packageName: record.packageName,
+    lockDigest: record.lockDigest,
+    generation: record.targetGeneration,
+    previousActiveLockDigest: record.previousActiveLockDigest,
+    contentDigest: lock.source.contentDigest,
+    resources: lock.resources,
+  });
+}
+
+function auditRecord(
+  plan: Readonly<PluginPackageSecretBindingPlan>,
+  eventId: string,
+  principal: Readonly<SecurityPrincipal>,
+  fence: Readonly<SecurityPolicyFence>,
+  occurredAtMs: number,
+): Readonly<SecurityAuditRecord> {
+  return Object.freeze({
+    eventId,
+    requestId: `package_secret_binding:${plan.planDigest}`,
+    operationId: 'plugin_package.secret.bind',
+    projectId: plan.target.projectId,
+    subject: principal.subject,
+    authenticationId: principal.authenticationId,
+    outcome: 'allowed',
+    reasons: Object.freeze(['owner_confirmed_secret_binding']),
+    fence,
+    occurredAtMs,
+  });
+}
+
+function verifySecretVersions(
+  client: DatabaseSync,
+  plan: Readonly<PluginPackageSecretBindingPlan>,
+): void {
+  for (const entry of plan.entries) {
+    if (entry.secretRef === null) continue;
+    const reference = parseSecretRef(entry.secretRef);
+    if (reference.version === undefined) {
+      throw new LocalPluginPackageSecretBindingConflictError(
+        `Secret ${entry.name} reference is not version-pinned`,
+      );
+    }
+    const row = client
+      .prepare(
+        `SELECT 1 AS present
+         FROM "QingLong3LocalSecretEnvelopes"
+         WHERE "project_id" = ? AND "secret_name" = ? AND "version" = ?
+         LIMIT 2`,
+      )
+      .all(reference.projectId, reference.name, reference.version) as Row[];
+    if (row.length !== 1) {
+      throw new LocalPluginPackageSecretBindingConflictError(
+        `Secret ${entry.name} version is unavailable`,
+      );
+    }
+  }
+}
+
+function verifyPolicyFence(
+  client: DatabaseSync,
+  principal: Readonly<SecurityPrincipal>,
+  fence: Readonly<SecurityPolicyFence>,
+  projectId: string,
+): void {
+  const row = client
+    .prepare(
+      `SELECT project."status" AS "status",
+              project."version" AS "projectVersion",
+              binding."version" AS "bindingVersion",
+              binding."state" AS "bindingState",
+              binding."role" AS "role"
+       FROM "QingLong3Projects" AS project
+       LEFT JOIN "QingLong3ProjectRoleBindings" AS binding
+         ON binding."project_id" = project."id"
+        AND binding."subject_type" = ?
+        AND binding."subject_id" = ?
+        AND binding."version" = (
+          SELECT MAX(current."version")
+          FROM "QingLong3ProjectRoleBindings" AS current
+          WHERE current."project_id" = project."id"
+            AND current."subject_type" = ?
+            AND current."subject_id" = ?
+        )
+       WHERE project."id" = ?
+       LIMIT 2`,
+    )
+    .all(
+      principal.subject.type,
+      principal.subject.id,
+      principal.subject.type,
+      principal.subject.id,
+      projectId,
+    ) as Row[];
+  const value = row[0];
+  if (
+    row.length !== 1 ||
+    !value ||
+    value.status !== 'active' ||
+    value.projectVersion !== fence.projectVersion ||
+    value.bindingVersion !== fence.bindingVersion ||
+    value.bindingState !== 'active' ||
+    value.role !== 'owner'
+  ) {
+    throw new LocalPluginPackageSecretBindingConflictError(
+      'Project policy changed after planning',
+    );
+  }
+}
+
+export function createLocalPluginPackageSecretBindingService(
+  authorityValue: LocalSqliteOperationAuthority | DatabaseSync,
+  now: () => number = Date.now,
+): Readonly<LocalPluginPackageSecretBindingService> {
+  const authority =
+    authorityValue instanceof LocalSqliteOperationAuthority
+      ? authorityValue
+      : new LocalSqliteOperationAuthority(authorityValue);
+  const policy = new ProjectPolicyEngine(
+    new LocalSqliteProjectPolicyRepository(authority),
+  );
+  const bindings = new LocalSqlitePluginPackageSecretBindingRepository(
+    authority,
+  );
+
+  const authorize = async (
+    principalValue: SecurityPrincipal,
+    projectId: string,
+    observedAtMs: number,
+  ) => {
+    const principal = normalizeSecurityPrincipal(principalValue, observedAtMs);
+    if (
+      principal.subject.type !== 'user' ||
+      principal.assurance !== 'local_console'
+    ) {
+      throw new LocalPluginPackageSecretBindingConflictError(
+        'binding requires a local-console User',
+      );
+    }
+    const decision = await policy.authorize(
+      principal,
+      projectId,
+      'secret.manage',
+    );
+    if (decision.effect !== 'allow' || decision.fence === null) {
+      throw new LocalPluginPackageSecretBindingConflictError(
+        'current Project policy denies Secret management',
+      );
+    }
+    return Object.freeze({ principal, fence: decision.fence });
+  };
+
+  return Object.freeze({
+    async plan(request: PlanLocalPluginPackageSecretBindingRequest) {
+      const projectId = identity(request.projectId, 'Project ID', IDENTIFIER);
+      const packageName = identity(
+        request.packageName,
+        'Package name',
+        PACKAGE_NAME,
+      );
+      const plannedAtMs = timestamp(request.plannedAtMs, 'plannedAtMs');
+      const authorization = await authorize(
+        request.principal,
+        projectId,
+        plannedAtMs,
+      );
+      return authority.enqueue(
+        async () => {
+          verifyPolicyFence(
+            authority.client,
+            authorization.principal,
+            authorization.fence,
+            projectId,
+          );
+          const current = loadCurrent(authority.client, projectId, packageName);
+          const generation = generationFrom(current);
+          if (bindings.findInTransaction(generation.generationDigest)) {
+            throw new LocalPluginPackageSecretBindingConflictError(
+              'current generation is already bound; rebind requires a new generation',
+            );
+          }
+          const plan = createPluginPackageSecretBindingPlan({
+            generation,
+            manifest: current.proposal.actionInput.manifest,
+            assignments: request.assignments,
+            plannedAtMs,
+          });
+          verifySecretVersions(authority.client, plan);
+          return plan;
+        },
+        () => new LocalPluginPackageSecretBindingUnavailableError(),
+      );
+    },
+
+    async execute(request: ExecuteLocalPluginPackageSecretBindingRequest) {
+      const plan = normalizePluginPackageSecretBindingPlan(request.plan);
+      if (typeof request.confirmAuthorization !== 'function') {
+        throw new TypeError('confirmAuthorization is invalid');
+      }
+      const observedAtMs = timestamp(now(), 'binding execution clock');
+      const authorization = await authorize(
+        request.principal,
+        plan.target.projectId,
+        observedAtMs,
+      );
+      await request.confirmAuthorization();
+      return authority.enqueue(
+        async () => {
+          authority.client.exec('BEGIN IMMEDIATE');
+          try {
+            const current = loadCurrent(
+              authority.client,
+              plan.target.projectId,
+              plan.target.packageName,
+            );
+            const expected = createPluginPackageSecretBindingPlan({
+              generation: generationFrom(current),
+              manifest: current.proposal.actionInput.manifest,
+              assignments: plan.entries.map(({ name, secretRef }) => ({
+                name,
+                secretRef,
+              })),
+              plannedAtMs: plan.plannedAtMs,
+            });
+            if (expected.planDigest !== plan.planDigest) {
+              throw new LocalPluginPackageSecretBindingConflictError(
+                'current Package generation changed after planning',
+              );
+            }
+            verifyPolicyFence(
+              authority.client,
+              authorization.principal,
+              authorization.fence,
+              plan.target.projectId,
+            );
+            verifySecretVersions(authority.client, plan);
+            const audit = auditRecord(
+              plan,
+              identity(request.auditEventId, 'audit event ID', UUID),
+              authorization.principal,
+              authorization.fence,
+              observedAtMs,
+            );
+            const auditsForPlan = authority.client
+              .prepare(
+                `SELECT ${LOCAL_SECURITY_AUDIT_SELECT}
+                 FROM "QingLong3SecurityAuditEvents"
+                 WHERE "request_id" = ? AND "operation_id" = ?
+                 LIMIT 2`,
+              )
+              .all(audit.requestId, audit.operationId) as Row[];
+            if (
+              auditsForPlan.length > 1 ||
+              (auditsForPlan.length === 1 &&
+                rowText(auditsForPlan[0]!, 'eventId') !== audit.eventId)
+            ) {
+              throw new LocalPluginPackageSecretBindingConflictError(
+                'binding plan already has another audit identity',
+              );
+            }
+            const existingAudit = authority.client
+              .prepare(
+                `SELECT ${LOCAL_SECURITY_AUDIT_SELECT}
+                 FROM "QingLong3SecurityAuditEvents"
+                 WHERE "event_id" = ? LIMIT 2`,
+              )
+              .get(audit.eventId) as Row | undefined;
+            if (existingAudit) {
+              if (
+                !sameSecurityAuditSemantic(
+                  localSecurityAuditFromRow(existingAudit),
+                  audit,
+                )
+              ) {
+                throw new LocalPluginPackageSecretBindingConflictError(
+                  'audit identity is already used by another operation',
+                );
+              }
+            } else {
+              insertLocalSecurityAudit(authority.client, audit);
+            }
+            const existingBinding = bindings.findInTransaction(
+              plan.target.generationDigest,
+            );
+            const result = existingBinding
+              ? (() => {
+                  if (
+                    existingBinding.authority.kind !==
+                      'local-owner-confirmation' ||
+                    existingBinding.authority.evidenceDigest !==
+                      plan.planDigest ||
+                    JSON.stringify(existingBinding.target) !==
+                      JSON.stringify(plan.target) ||
+                    JSON.stringify(existingBinding.entries) !==
+                      JSON.stringify(plan.entries)
+                  ) {
+                    throw new LocalPluginPackageSecretBindingConflictError(
+                      'current generation is already bound by another plan',
+                    );
+                  }
+                  return Object.freeze({
+                    status: 'existing' as const,
+                    binding: existingBinding,
+                  });
+                })()
+              : bindings.publishInTransaction(
+                  createPluginPackageSecretBindingFromPlan(
+                    plan,
+                    'local-owner-confirmation',
+                    observedAtMs,
+                  ),
+                );
+            authority.client.exec('COMMIT');
+            return Object.freeze({
+              status: result.status,
+              bindingDigest: result.binding.bindingDigest,
+              generationDigest: result.binding.target.generationDigest,
+            });
+          } catch (error) {
+            if (authority.client.isTransaction)
+              authority.client.exec('ROLLBACK');
+            if (
+              error instanceof LocalPluginPackageSecretBindingConflictError ||
+              error instanceof LocalPluginPackageSecretBindingUnavailableError
+            ) {
+              throw error;
+            }
+            throw new LocalPluginPackageSecretBindingUnavailableError({
+              cause: error instanceof Error ? error : undefined,
+            });
+          }
+        },
+        () => new LocalPluginPackageSecretBindingUnavailableError(),
+      );
+    },
+  });
+}

packages/ql3-local-sqlite/src/plugin-package/secret-binding/repository.ts

@@ -10,7 +10,7 @@ import {
   type PluginPackageSecretBindingRepository,
 } from '@qinglong/runtime-core/plugin-package-secret-binding';
 
-import { LocalSqliteOperationAuthority } from '../authority/operationAuthority';
+import { LocalSqliteOperationAuthority } from '../../authority/operationAuthority';
 
 type Row = Record<string, unknown>;
 
@@ -143,6 +143,16 @@ export class LocalSqlitePluginPackageSecretBindingRepository
     return row ? this.parse(row) : null;
   }
 
+  findInTransaction(
+    digest: string,
+  ): Readonly<PluginPackageSecretBinding> | null {
+    try {
+      return this.findStored(generationDigest(digest));
+    } catch (error) {
+      throw mapStorageError(error);
+    }
+  }
+
   private enqueue<T>(work: () => T): Promise<T> {
     return this.authority.enqueue(
       async () => {
@@ -169,9 +179,17 @@ export class LocalSqlitePluginPackageSecretBindingRepository
       binding: Readonly<PluginPackageSecretBinding>;
     }>
   > {
+    const binding = normalizePluginPackageSecretBinding(value);
+    return this.enqueue(() => this.publishInTransaction(binding));
+  }
+
+  publishInTransaction(value: Readonly<PluginPackageSecretBinding>): Readonly<{
+    status: 'created' | 'existing';
+    binding: Readonly<PluginPackageSecretBinding>;
+  }> {
     const binding = normalizePluginPackageSecretBinding(value);
     const bindingJson = serialize(binding);
-    return this.enqueue(() => {
+    try {
       const existing = this.findStored(binding.target.generationDigest);
       if (existing) {
         if (JSON.stringify(existing) !== bindingJson) {
@@ -245,6 +263,8 @@ export class LocalSqlitePluginPackageSecretBindingRepository
           result.changes === 1 ? ('created' as const) : ('existing' as const),
         binding: stored,
       });
-    });
+    } catch (error) {
+      throw mapStorageError(error);
+    }
   }
 }

packages/ql3-local-sqlite/src/runtime/runtimeDatabase.ts

@@ -278,7 +278,7 @@ export async function openLocalSqliteRuntimeDatabase(
       },
       pluginPackageSecretBindings() {
         pluginPackageSecretBindingsPromise ??= import(
-          '../plugin-package/pluginPackageSecretBindingRepository.js'
+          '../plugin-package/secret-binding/repository.js'
         ).then(
           ({ LocalSqlitePluginPackageSecretBindingRepository }) =>
             new LocalSqlitePluginPackageSecretBindingRepository(authority),

packages/ql3-local-sqlite/test/pluginPackageSecretBindingRepository.test.cjs

@@ -13,7 +13,7 @@ const {
 const { createSecretRef } = require('@qinglong/runtime-core/secret-reference');
 const {
   LocalSqlitePluginPackageSecretBindingRepository,
-} = require('../dist/plugin-package/pluginPackageSecretBindingRepository');
+} = require('../dist/plugin-package/secret-binding/repository');
 const { migrateLocalSqliteDatabase } = require('../dist/migration/migration');
 
 const LOCK_DIGEST = 'a'.repeat(64);

packages/ql3-runtime-core/package.json

@@ -84,7 +84,10 @@
         "dist/plugin-package/pluginPackageResourceMaterialization.d.ts"
       ],
       "plugin-package-secret-binding": [
-        "dist/plugin-package/pluginPackageSecretBinding.d.ts"
+        "dist/plugin-package/secret-binding/binding.d.ts"
+      ],
+      "plugin-package-secret-binding-plan": [
+        "dist/plugin-package/secret-binding/plan.d.ts"
       ],
       "plugin-package-task-reconciliation": [
         "dist/plugin-package/pluginPackageTaskReconciliation.d.ts"
@@ -375,9 +378,14 @@
       "default": "./dist/plugin-package/pluginPackageResourceMaterialization.js"
     },
     "./plugin-package-secret-binding": {
-      "types": "./dist/plugin-package/pluginPackageSecretBinding.d.ts",
+      "types": "./dist/plugin-package/secret-binding/binding.d.ts",
-      "require": "./dist/plugin-package/pluginPackageSecretBinding.js",
+      "require": "./dist/plugin-package/secret-binding/binding.js",
-      "default": "./dist/plugin-package/pluginPackageSecretBinding.js"
+      "default": "./dist/plugin-package/secret-binding/binding.js"
+    },
+    "./plugin-package-secret-binding-plan": {
+      "types": "./dist/plugin-package/secret-binding/plan.d.ts",
+      "require": "./dist/plugin-package/secret-binding/plan.js",
+      "default": "./dist/plugin-package/secret-binding/plan.js"
     },
     "./plugin-package-task-reconciliation": {
       "types": "./dist/plugin-package/pluginPackageTaskReconciliation.d.ts",

packages/ql3-runtime-core/src/plugin-package/pluginPackageResourceMaterialization.ts

@@ -27,7 +27,7 @@ import {
   assertPluginPackageSecretBindingMatches,
   type PluginPackageSecretBinding,
   type PluginPackageSecretBindingRepository,
-} from './pluginPackageSecretBinding';
+} from './secret-binding/binding';
 import {
   normalizeTaskDefinitionLabels,
   normalizeTaskDefinitionSpec,

packages/ql3-runtime-core/src/plugin-package/pluginPackageTaskPublication.ts

@@ -9,7 +9,7 @@ import {
   type PluginPackageResourceLockSource,
 } from './pluginPackageResourceMaterialization';
 import type { PluginPackageResourceGenerationSource } from './pluginPackageResourceGeneration';
-import type { PluginPackageSecretBindingRepository } from './pluginPackageSecretBinding';
+import type { PluginPackageSecretBindingRepository } from './secret-binding/binding';
 import {
   InvalidPluginPackageTaskReconciliationError,
   PluginPackageTaskReconciliationConflictError,

packages/ql3-runtime-core/src/plugin-package/secret-binding/binding.ts

@@ -5,13 +5,13 @@ import {
   normalizePluginPackageManifest,
   type PluginPackageManifest,
   type PluginPackageSecretRequirement,
-} from './pluginPackage';
+} from '../pluginPackage';
-import { pluginPackageManifestDigest } from './installation/pluginPackageInstall';
+import { pluginPackageManifestDigest } from '../installation/pluginPackageInstall';
 import {
   normalizePluginPackageResourceGeneration,
   type PluginPackageResourceGeneration,
-} from './pluginPackageResourceGeneration';
+} from '../pluginPackageResourceGeneration';
-import { parseSecretRef } from '../secret/secretReference';
+import { parseSecretRef } from '../../secret/secretReference';
 
 export const PLUGIN_PACKAGE_SECRET_BINDING_SCHEMA =
   'qinglong/plugin-package-secret-binding@v1' as const;
@@ -67,6 +67,13 @@ export interface CreatePluginPackageSecretBindingInput {
   readonly boundAtMs: number;
 }
 
+export interface CreatePluginPackageSecretBindingFromEntriesInput {
+  readonly target: Readonly<PluginPackageSecretBindingTarget>;
+  readonly entries: readonly Readonly<PluginPackageSecretBindingEntry>[];
+  readonly authority: Readonly<PluginPackageSecretBindingAuthority>;
+  readonly boundAtMs: number;
+}
+
 export interface PluginPackageSecretBindingRepository {
   find(
     generationDigest: string,
@@ -408,19 +415,24 @@ export function createPluginPackageSecretBinding(
   return Object.freeze({ ...unsigned, bindingDigest: bindingDigest(unsigned) });
 }
 
-export function normalizePluginPackageSecretBinding(
+export function createPluginPackageSecretBindingFromEntries(
-  value: unknown,
+  input: CreatePluginPackageSecretBindingFromEntriesInput,
 ): Readonly<PluginPackageSecretBinding> {
-  const binding = dataRecord(value, 'binding');
+  const target = normalizeTarget(input.target);
-  exactKeys(
+  const entries = normalizeEntries(input.entries, target.projectId);
-    binding,
+  const authority = normalizeAuthority(input.authority);
-    ['authority', 'bindingDigest', 'boundAtMs', 'entries', 'schema', 'target'],
+  const boundAtMs = timestamp(input.boundAtMs);
-    'binding',
+  const unsigned = unsignedBinding(target, entries, authority, boundAtMs);
-  );
+  return normalizePluginPackageSecretBinding({
-  if (binding.schema !== PLUGIN_PACKAGE_SECRET_BINDING_SCHEMA) {
+    ...unsigned,
-    return invalid('schema is unsupported');
+    bindingDigest: bindingDigest(unsigned),
-  }
+  });
-  const targetValue = dataRecord(binding.target, 'target');
+}
+
+function normalizeTarget(
+  value: unknown,
+): Readonly<PluginPackageSecretBindingTarget> {
+  const targetValue = dataRecord(value, 'target');
   exactKeys(
     targetValue,
     [
@@ -434,7 +446,7 @@ export function normalizePluginPackageSecretBinding(
     ],
     'target',
   );
-  const target = Object.freeze({
+  return Object.freeze({
     installationId: identifier(targetValue.installationId, 'installation ID'),
     projectId: identifier(targetValue.projectId, 'Project ID'),
     packageName: packageName(targetValue.packageName),
@@ -443,6 +455,21 @@ export function normalizePluginPackageSecretBinding(
     generationDigest: digest(targetValue.generationDigest, 'generation digest'),
     manifestDigest: digest(targetValue.manifestDigest, 'Manifest digest'),
   });
+}
+
+export function normalizePluginPackageSecretBinding(
+  value: unknown,
+): Readonly<PluginPackageSecretBinding> {
+  const binding = dataRecord(value, 'binding');
+  exactKeys(
+    binding,
+    ['authority', 'bindingDigest', 'boundAtMs', 'entries', 'schema', 'target'],
+    'binding',
+  );
+  if (binding.schema !== PLUGIN_PACKAGE_SECRET_BINDING_SCHEMA) {
+    return invalid('schema is unsupported');
+  }
+  const target = normalizeTarget(binding.target);
   const entries = normalizeEntries(binding.entries, target.projectId);
   const authority = normalizeAuthority(binding.authority);
   const boundAtMs = timestamp(binding.boundAtMs);

packages/ql3-runtime-core/src/plugin-package/secret-binding/plan.ts

@@ -0,0 +1,168 @@
+import { createHash } from 'node:crypto';
+
+import {
+  createPluginPackageSecretBinding,
+  createPluginPackageSecretBindingFromEntries,
+  type PluginPackageSecretBinding,
+  type PluginPackageSecretBindingAssignment,
+  type PluginPackageSecretBindingEntry,
+  type PluginPackageSecretBindingTarget,
+} from './binding';
+import type { PluginPackageManifest } from '../pluginPackage';
+import type { PluginPackageResourceGeneration } from '../pluginPackageResourceGeneration';
+
+export const PLUGIN_PACKAGE_SECRET_BINDING_PLAN_SCHEMA =
+  'qinglong/plugin-package-secret-binding-plan@v1' as const;
+export const MAX_PLUGIN_PACKAGE_SECRET_BINDING_PLAN_JSON_BYTES = 64 * 1024;
+
+export interface PluginPackageSecretBindingPlan {
+  readonly schema: typeof PLUGIN_PACKAGE_SECRET_BINDING_PLAN_SCHEMA;
+  readonly target: Readonly<PluginPackageSecretBindingTarget>;
+  readonly entries: readonly Readonly<PluginPackageSecretBindingEntry>[];
+  readonly plannedAtMs: number;
+  readonly planDigest: string;
+}
+
+export interface CreatePluginPackageSecretBindingPlanInput {
+  readonly generation: Readonly<PluginPackageResourceGeneration>;
+  readonly manifest: Readonly<PluginPackageManifest>;
+  readonly assignments: readonly Readonly<PluginPackageSecretBindingAssignment>[];
+  readonly plannedAtMs: number;
+}
+
+const DIGEST = /^[0-9a-f]{64}$/;
+const PLACEHOLDER_EVIDENCE_DIGEST = '0'.repeat(64);
+const PLAN_DIGEST_DOMAIN = Buffer.from(
+  'qinglong/plugin-package-secret-binding-plan-digest@v1\0',
+  'utf8',
+);
+
+function invalid(message: string): never {
+  throw new TypeError(
+    `Plugin Package Secret binding plan is invalid: ${message}`,
+  );
+}
+
+function exactKeys(value: object, expected: readonly string[]): void {
+  const actual = Object.keys(value).sort();
+  const canonical = [...expected].sort();
+  if (
+    actual.length !== canonical.length ||
+    actual.some((key, index) => key !== canonical[index])
+  ) {
+    invalid('shape is invalid');
+  }
+}
+
+function unsignedPlan(
+  binding: Pick<PluginPackageSecretBinding, 'target' | 'entries'>,
+  plannedAtMs: number,
+): Omit<PluginPackageSecretBindingPlan, 'planDigest'> {
+  if (!Number.isSafeInteger(plannedAtMs) || plannedAtMs < 0) {
+    return invalid('plannedAtMs is invalid');
+  }
+  return Object.freeze({
+    schema: PLUGIN_PACKAGE_SECRET_BINDING_PLAN_SCHEMA,
+    target: binding.target,
+    entries: binding.entries,
+    plannedAtMs,
+  });
+}
+
+function planDigest(
+  value: Omit<PluginPackageSecretBindingPlan, 'planDigest'>,
+): string {
+  return createHash('sha256')
+    .update(PLAN_DIGEST_DOMAIN)
+    .update(JSON.stringify(value), 'utf8')
+    .digest('hex');
+}
+
+function withDigest(
+  value: Omit<PluginPackageSecretBindingPlan, 'planDigest'>,
+): Readonly<PluginPackageSecretBindingPlan> {
+  const normalized = Object.freeze({
+    ...value,
+    planDigest: planDigest(value),
+  });
+  if (
+    Buffer.byteLength(JSON.stringify(normalized), 'utf8') >
+    MAX_PLUGIN_PACKAGE_SECRET_BINDING_PLAN_JSON_BYTES
+  ) {
+    return invalid('durable JSON byte budget exceeded');
+  }
+  return normalized;
+}
+
+export function createPluginPackageSecretBindingPlan(
+  input: CreatePluginPackageSecretBindingPlanInput,
+): Readonly<PluginPackageSecretBindingPlan> {
+  const draft = createPluginPackageSecretBinding({
+    generation: input.generation,
+    manifest: input.manifest,
+    assignments: input.assignments,
+    authority: Object.freeze({
+      kind: 'local-owner-confirmation',
+      evidenceDigest: PLACEHOLDER_EVIDENCE_DIGEST,
+    }),
+    boundAtMs: 0,
+  });
+  return withDigest(unsignedPlan(draft, input.plannedAtMs));
+}
+
+export function normalizePluginPackageSecretBindingPlan(
+  value: unknown,
+): Readonly<PluginPackageSecretBindingPlan> {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    return invalid('value must be an object');
+  }
+  exactKeys(value, [
+    'entries',
+    'planDigest',
+    'plannedAtMs',
+    'schema',
+    'target',
+  ]);
+  const candidate = value as PluginPackageSecretBindingPlan;
+  if (candidate.schema !== PLUGIN_PACKAGE_SECRET_BINDING_PLAN_SCHEMA) {
+    return invalid('schema is unsupported');
+  }
+  if (
+    typeof candidate.planDigest !== 'string' ||
+    !DIGEST.test(candidate.planDigest)
+  ) {
+    return invalid('plan digest is invalid');
+  }
+  const normalizedBinding = createPluginPackageSecretBindingFromEntries({
+    target: candidate.target,
+    entries: candidate.entries,
+    authority: {
+      kind: 'local-owner-confirmation',
+      evidenceDigest: PLACEHOLDER_EVIDENCE_DIGEST,
+    },
+    boundAtMs: 0,
+  });
+  const unsigned = unsignedPlan(normalizedBinding, candidate.plannedAtMs);
+  const normalized = withDigest(unsigned);
+  if (normalized.planDigest !== candidate.planDigest) {
+    return invalid('plan digest does not match content');
+  }
+  return normalized;
+}
+
+export function createPluginPackageSecretBindingFromPlan(
+  planValue: unknown,
+  authorityKind: PluginPackageSecretBinding['authority']['kind'],
+  boundAtMs: number,
+): Readonly<PluginPackageSecretBinding> {
+  const plan = normalizePluginPackageSecretBindingPlan(planValue);
+  return createPluginPackageSecretBindingFromEntries({
+    target: plan.target,
+    entries: plan.entries,
+    authority: {
+      kind: authorityKind,
+      evidenceDigest: plan.planDigest,
+    },
+    boundAtMs,
+  });
+}

packages/ql3-runtime-core/test/pluginPackageResourceMaterialization.test.cjs

@@ -25,7 +25,7 @@ const {
 const { createSecretRef } = require('../dist/secret/secretReference');
 const {
   createPluginPackageSecretBinding,
-} = require('../dist/plugin-package/pluginPackageSecretBinding');
+} = require('../dist/plugin-package/secret-binding/binding');
 const {
   InvalidPluginPackageResourceMaterializationError,
   MAX_PLUGIN_PACKAGE_MATERIALIZED_RESOURCE_BYTES,

packages/ql3-runtime-core/test/pluginPackageSecretBinding.test.cjs

@@ -7,7 +7,7 @@ const {
   assertPluginPackageSecretBindingMatches,
   createPluginPackageSecretBinding,
   normalizePluginPackageSecretBinding,
-} = require('../dist/plugin-package/pluginPackageSecretBinding');
+} = require('../dist/plugin-package/secret-binding/binding');
 const {
   createPluginPackageResourceGeneration,
 } = require('../dist/plugin-package/pluginPackageResourceGeneration');

packages/ql3-runtime-core/test/pluginPackageSecretBindingPlan.test.cjs

@@ -0,0 +1,144 @@
+const assert = require('node:assert/strict');
+const { test } = require('node:test');
+
+const {
+  createPluginPackageSecretBindingFromPlan,
+  createPluginPackageSecretBindingPlan,
+  normalizePluginPackageSecretBindingPlan,
+} = require('@qinglong/runtime-core/plugin-package-secret-binding-plan');
+const {
+  createPluginPackageResourceGeneration,
+} = require('@qinglong/runtime-core/plugin-package-resource-generation');
+const { createSecretRef } = require('@qinglong/runtime-core/secret-reference');
+
+const manifest = {
+  apiVersion: 'qinglong.io/v1alpha1',
+  kind: 'Package',
+  metadata: {
+    name: 'example-monitor',
+    displayName: 'Example Monitor',
+    version: '1.0.0',
+    description: 'Secret binding plan fixture',
+    license: 'Apache-2.0',
+  },
+  spec: {
+    compatibility: {
+      qinglong: '>=3.0.0-0 <4.0.0',
+      architectures: ['arm64'],
+      deploymentProfiles: ['edge'],
+    },
+    runtimes: [],
+    resources: {
+      memory: { recommended: '32Mi' },
+      disk: { install: '4Mi', working: '8Mi' },
+    },
+    permissions: {
+      network: { allowedHosts: [] },
+      secrets: [
+        { name: 'OPTIONAL_TOKEN', required: false },
+        { name: 'TOKEN', required: true },
+      ],
+      tools: ['secret.use'],
+    },
+    contents: { tasks: [], workflows: [], prompts: [], tools: [] },
+  },
+};
+
+const generation = createPluginPackageResourceGeneration({
+  installationId: 'install-1',
+  projectId: 'project-1',
+  packageName: 'example-monitor',
+  lockDigest: 'a'.repeat(64),
+  generation: 1,
+  previousActiveLockDigest: null,
+  contentDigest: 'b'.repeat(64),
+  contents: manifest.spec.contents,
+});
+
+function plan() {
+  return createPluginPackageSecretBindingPlan({
+    generation,
+    manifest,
+    assignments: [
+      { name: 'OPTIONAL_TOKEN', secretRef: null },
+      {
+        name: 'TOKEN',
+        secretRef: createSecretRef({
+          projectId: 'project-1',
+          name: 'runtime-token',
+          version: 2,
+        }),
+      },
+    ],
+    plannedAtMs: 100,
+  });
+}
+
+test('creates one canonical content-free Secret binding plan', () => {
+  const value = plan();
+  assert.match(value.planDigest, /^[0-9a-f]{64}$/);
+  assert.equal(value.plannedAtMs, 100);
+  assert.deepEqual(normalizePluginPackageSecretBindingPlan(value), value);
+  assert.equal(JSON.stringify(value).includes('secret-value'), false);
+  assert.equal(Object.isFrozen(value), true);
+});
+
+test('rejects target, entry, time and digest drift', () => {
+  const value = plan();
+  assert.throws(
+    () =>
+      normalizePluginPackageSecretBindingPlan({ ...value, plannedAtMs: -1 }),
+    /plannedAtMs is invalid/,
+  );
+  assert.throws(
+    () =>
+      normalizePluginPackageSecretBindingPlan({
+        ...value,
+        target: { ...value.target, projectId: 'project-2' },
+      }),
+    /crosses Project boundary|plan digest/,
+  );
+  assert.throws(
+    () => normalizePluginPackageSecretBindingPlan({ ...value, extra: true }),
+    /shape is invalid/,
+  );
+  assert.throws(
+    () =>
+      normalizePluginPackageSecretBindingPlan({
+        ...value,
+        planDigest: 'c'.repeat(64),
+      }),
+    /plan digest does not match/,
+  );
+});
+
+test('creates Local and Cluster authority bindings from the same plan', () => {
+  const value = plan();
+  const local = createPluginPackageSecretBindingFromPlan(
+    value,
+    'local-owner-confirmation',
+    110,
+  );
+  const cluster = createPluginPackageSecretBindingFromPlan(
+    value,
+    'approved-action-execution',
+    120,
+  );
+  assert.equal(local.authority.evidenceDigest, value.planDigest);
+  assert.equal(cluster.authority.evidenceDigest, value.planDigest);
+  assert.equal(local.boundAtMs, 110);
+  assert.equal(cluster.boundAtMs, 120);
+  assert.notEqual(local.bindingDigest, cluster.bindingDigest);
+});
+
+test('exports the plan contract only through its explicit subpath', () => {
+  assert.equal(
+    require('../dist').createPluginPackageSecretBindingPlan,
+    undefined,
+  );
+  assert.equal(
+    require('@qinglong/runtime-core/plugin-package-secret-binding-plan')
+      .createPluginPackageSecretBindingPlan,
+    createPluginPackageSecretBindingPlan,
+  );
+});

scripts/ql3-cluster-dependency-audit.cjs

@@ -1844,6 +1844,11 @@ function auditSourceImports(root, packagePath, findings) {
             '@qinglong/local-sqlite/task-definition-administration',
           ].includes(specifier)
         ) &&
+        !(
+          path.relative(packageDirectory, filePath) ===
+            'src/plugin-package/pluginPackageCommand.ts' &&
+          specifier === '@qinglong/local-admin/package-secret-binding'
+        ) &&
         ![
           {
             file: 'src/plugin-package/plugin-package-workflow-command/contractAuthority.ts',
@@ -2042,7 +2047,11 @@ function auditSourceImports(root, packagePath, findings) {
               '@qinglong/local-sqlite/operation-authority',
               '@qinglong/local-sqlite/plugin-package-lifecycle',
               '@qinglong/local-sqlite/project-policy',
-            ].includes(specifier))
+            ].includes(specifier)) ||
+          (path.relative(packageDirectory, filePath) ===
+            'src/plugin-package/pluginPackageSecretBinding.ts' &&
+            specifier ===
+              '@qinglong/local-sqlite/plugin-package-secret-binding-administration')
         )
       ) {
         findings.push({
@@ -2831,6 +2840,17 @@ function auditSourceImports(root, packagePath, findings) {
       ) {
         continue;
       }
+      if (
+        packagePath === 'packages/ql3-local-owner-cli' &&
+        path.relative(packageDirectory, filePath) ===
+          'src/plugin-package/pluginPackageCommand.ts' &&
+        [
+          '@qinglong/local-admin/package-secret-binding',
+          '@qinglong/runtime-core/plugin-package-secret-binding-plan',
+        ].includes(specifier)
+      ) {
+        continue;
+      }
       if (
         packagePath === 'packages/ql3-local-owner-cli' &&
         path.relative(packageDirectory, filePath) ===