fix(ql3): materialize projected runtime files

test/back/ql3ClusterDeploymentAudit.test.cjs

@@ -47,6 +47,44 @@ test('accepts the exact locked non-root multi-replica cluster deployment', () =>
   ]);
 });
 
+test('rejects exposing symlink-backed runtime keyring projections to Cluster Control', () => {
+  const withoutMaterializer = auditClusterDeployment({
+    root: ROOT,
+    readFile: intercept(
+      'deploy/kubernetes/ql3-cluster/base/deployment.yaml',
+      (source) => source.replace(
+        '        - name: materialize-runtime-files\n',
+        '        - name: materialize-runtime-files-disabled\n',
+      ),
+    ),
+  });
+  assert.equal(withoutMaterializer.compatible, false);
+  assert.equal(
+    withoutMaterializer.findings.some(
+      ({ code }) => code === 'QL3_CLUSTER_KUBERNETES_POSTGRES_CA_BINDING',
+    ),
+    true,
+  );
+
+  const projectedIntoRuntime = auditClusterDeployment({
+    root: ROOT,
+    readFile: intercept(
+      'deploy/kubernetes/ql3-cluster/base/deployment.yaml',
+      (source) => source.replace(
+        '            - name: postgres-runtime-private\n              mountPath: /var/run/secrets/qinglong3/postgres-runtime\n              readOnly: true\n',
+        '            - name: postgres-runtime-projected\n              mountPath: /var/run/secrets/qinglong3/postgres-runtime\n              readOnly: true\n',
+      ),
+    ),
+  });
+  assert.equal(projectedIntoRuntime.compatible, false);
+  assert.equal(
+    projectedIntoRuntime.findings.some(
+      ({ code }) => code === 'QL3_CLUSTER_KUBERNETES_POSTGRES_CA_BINDING',
+    ),
+    true,
+  );
+});
+
 test('keeps Cluster Copilot MCP external, digest-pinned and resource-bounded', () => {
   const widened = auditClusterDeployment({
     root: ROOT,
@@ -237,7 +275,7 @@ test('keeps Cluster AI optional with projected authority and an independent dige
     readFile: intercept(
       'deploy/kubernetes/ql3-cluster/base/deployment.yaml',
       (source) =>
-        source.replace(
+        source.replaceAll(
           `image: qinglong3-cluster-control:${VERSION}`,
           `image: qinglong3-cluster-control-ai:${VERSION}`,
         ),
@@ -1261,7 +1299,7 @@ test('rejects inline runtime credentials and a privileged container', () => {
             /valueFrom:\n\s+secretKeyRef:\n\s+name: ql3-cluster-control-runtime\n\s+key: postgres-runtime-url/,
             'value: postgresql://inline-secret',
           )
-          .replace(
+          .replaceAll(
             'allowPrivilegeEscalation: false',
             'allowPrivilegeEscalation: true',
           ),

test/back/ql3DeploymentLockContract.test.cjs

@@ -921,7 +921,7 @@ test('source-surface audit freezes every reviewed cluster and worker authority',
     schemaVersion: 1,
     deploymentYamlFiles: 241,
     imageOccurrences: {
-      control: 2,
+      control: 3,
       'control-ai': 1,
       admin: 28,
       worker: 2,

test/back/ql3SecurityAdministrationKubernetesLiveContract.test.cjs

@@ -1,6 +1,7 @@
 const assert = require('node:assert/strict');
 const { spawnSync } = require('node:child_process');
 const fs = require('node:fs');
+const os = require('node:os');
 const path = require('node:path');
 const { test } = require('node:test');
 
@@ -20,6 +21,7 @@ const {
   inputAuthorityEvidenceSource,
   migrationFailureEvidence,
   networkPolicyReadinessSource,
+  runtimeFileMaterializationSource,
 } = require('../../scripts/ql3-security-administration-kubernetes-live-contract.cjs');
 
 const values = Object.freeze({
@@ -205,6 +207,21 @@ test('runs the credential ceremony against two real anti-affine control replicas
     deployment.spec.template.spec.containers[0].terminationMessagePolicy,
     'FallbackToLogsOnError',
   );
+  const materializer = deployment.spec.template.spec.initContainers[0];
+  assert.equal(materializer.name, 'materialize-runtime-files');
+  assert.deepEqual(materializer.command.slice(0, 2), ['node', '-e']);
+  assert.match(materializer.command[2], /realpathSync/);
+  assert.match(materializer.command[2], /COPYFILE_EXCL/);
+  assert.match(materializer.command[2], /chmodSync\(output,0o400\)/);
+  assert.equal(materializer.securityContext.runAsNonRoot, undefined);
+  assert.equal(materializer.securityContext.readOnlyRootFilesystem, true);
+  assert.deepEqual(materializer.securityContext.capabilities.drop, ['ALL']);
+  assert.equal(
+    deployment.spec.template.spec.containers[0].volumeMounts.some(
+      (mount) => mount.name.includes('projected'),
+    ),
+    false,
+  );
   assert.equal(
     deployment.spec.template.spec.affinity.podAntiAffinity
       .requiredDuringSchedulingIgnoredDuringExecution[0].topologyKey,
@@ -215,7 +232,7 @@ test('runs the credential ceremony against two real anti-affine control replicas
     environment.some(
       (entry) =>
         entry.name === 'QL3_API_CREDENTIAL_PEPPER_KEYRING_FILE' &&
-        entry.value.endsWith('/keyring.json'),
+        entry.value === '/var/run/secrets/qinglong3/runtime/keyring.json',
     ),
   );
   assert.equal(
@@ -224,6 +241,44 @@ test('runs the credential ceremony against two real anti-affine control replicas
   );
 });
 
+test('materializes kubelet symlink projections as private regular files', (context) => {
+  const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'ql3-runtime-files-'));
+  context.after(() => fs.rmSync(directory, { recursive: true, force: true }));
+  const postgresDirectory = path.join(directory, 'postgres-projected');
+  const keyringDirectory = path.join(directory, 'keyring-projected');
+  const targetDirectory = path.join(directory, 'runtime');
+  for (const [projectedDirectory, name, value] of [
+    [postgresDirectory, 'ca.crt', 'test-ca'],
+    [keyringDirectory, 'keyring.json', '{"schemaVersion":1}'],
+  ]) {
+    const generation = path.join(projectedDirectory, '..2026_08_26');
+    fs.mkdirSync(generation, { recursive: true });
+    fs.writeFileSync(path.join(generation, name), value);
+    fs.symlinkSync('..2026_08_26', path.join(projectedDirectory, '..data'));
+  }
+  fs.mkdirSync(targetDirectory);
+  const result = spawnSync(
+    process.execPath,
+    ['-e', runtimeFileMaterializationSource({
+      postgresDirectory,
+      keyringDirectory,
+      targetDirectory,
+    })],
+    { encoding: 'utf8' },
+  );
+  assert.equal(result.status, 0, result.stderr);
+  for (const [name, value] of [
+    ['ca.crt', 'test-ca'],
+    ['keyring.json', '{"schemaVersion":1}'],
+  ]) {
+    const output = path.join(targetDirectory, name);
+    assert.equal(fs.lstatSync(output).isFile(), true);
+    assert.equal(fs.lstatSync(output).isSymbolicLink(), false);
+    assert.equal(fs.statSync(output).mode & 0o777, 0o400);
+    assert.equal(fs.readFileSync(output, 'utf8'), value);
+  }
+});
+
 test('keeps failed control rollout evidence bounded and content-free', () => {
   const failure = JSON.stringify({
     schemaVersion: 1,

test/back/ql3VersionTransition.test.cjs

@@ -103,8 +103,8 @@ test('audits one source-derived QingLong 3 release identity', () => {
     workspacePackageCount: 18,
     containerRootCount: 4,
     deploymentFileCount: 260,
-    deploymentImageReferences: 34,
-    deploymentVersionOccurrences: 38,
+    deploymentImageReferences: 35,
+    deploymentVersionOccurrences: 39,
     compatible: true,
   });
 });
@@ -116,7 +116,7 @@ test('plans the exact governed version surface without touching legacy 2.x', ()
     targetVersion: TARGET_VERSION,
   });
   assert.equal(plan.fileCount, 66);
-  assert.equal(plan.replacementCount, 85);
+  assert.equal(plan.replacementCount, 86);
   assert.equal(plan.legacyRootPackageVersion, LEGACY_VERSION);
   assert.equal(plan.legacyRootExcluded, true);
   assert.equal(