feat(ql3): add read-only cluster copilot console

deploy/console/ql3-cluster-copilot/README.md

@@ -0,0 +1,74 @@
+# Cluster Copilot read-only Console
+
+This Console is an operator-workstation process, not a resident QingLong
+service. It serves digest-bound assets on an ephemeral `127.0.0.1` port and
+forwards only `inspect` and explicit `output` reads to the existing Cluster
+Copilot API. Do not deploy it as a Kubernetes workload, Ingress, shared LAN
+listener, Edge component or legacy 2.x Web route.
+
+Use `ql3-cluster-admin` from the same independently verified Admin release as
+the Cluster deployment. The Console intentionally runs directly on the trusted
+operator workstation. A container port mapping is not a supported substitute:
+the process binds container loopback and must not be widened to `0.0.0.0`.
+
+## Prepare private authority
+
+Create an absolute canonical directory owned by the current operator with mode
+`0700`. Copy `client-config.example.json` to `client.json`, install the reviewed
+Cluster API CA as `ca.pem`, and install a separately issued `ql3c_` Project API
+credential as `credential`. Give the credential only `run.read` and
+`artifact.read`; the Console has no route for diagnosis creation or
+cancellation even if a wider credential is supplied.
+
+Create an independent 256-bit browser session key without placing its value in
+argv or an environment variable:
+
+```sh
+install -d -m 0700 /absolute/private/ql3-copilot-console
+umask 077
+node -e 'process.stdout.write(require("node:crypto").randomBytes(32).toString("base64url"))' > /absolute/private/ql3-copilot-console/session
+chmod 0600 /absolute/private/ql3-copilot-console/client.json /absolute/private/ql3-copilot-console/ca.pem /absolute/private/ql3-copilot-console/credential /absolute/private/ql3-copilot-console/session
+```
+
+Every file must be a current-owner, non-symlink, canonical regular file. The
+session file contains exactly 43 base64url characters and no newline. It is a
+browser-to-loopback secret only; it cannot authenticate to the Cluster API.
+The `ql3c_` credential remains in the BFF process and is reread for every
+upstream request so file rotation takes effect without browser disclosure.
+
+## Check and start
+
+Run the preflight first:
+
+```sh
+ql3-cluster-admin copilot-console --check \
+  --config /absolute/private/ql3-copilot-console/client.json \
+  --credential /absolute/private/ql3-copilot-console/credential \
+  --session /absolute/private/ql3-copilot-console/session
+```
+
+It validates all three private authorities and performs one unauthenticated
+TLS 1.3 `GET /readyz`. It does not open the Console listener or reveal paths,
+endpoint, credential, Project or Cluster identity.
+
+Start a session with an ephemeral port:
+
+```sh
+ql3-cluster-admin copilot-console \
+  --config /absolute/private/ql3-copilot-console/client.json \
+  --credential /absolute/private/ql3-copilot-console/credential \
+  --session /absolute/private/ql3-copilot-console/session \
+  --port=0
+```
+
+Open only the exact `http://127.0.0.1:<port>` origin printed by the process,
+then enter the session key from the private file. The browser keeps it only in
+page memory; reloading locks the page. Stop the process with `SIGINT` or
+`SIGTERM`, then remove or rotate the session file.
+
+The BFF accepts at most two concurrent reads and sixteen connections, rejects
+a third request without queueing, caps request bodies at 4 KiB and responses at
+approximately 2 MiB, disables cache/cookies/frames/workers, and never polls.
+Model text is rendered as plain text and remains untrusted advice. These limits
+keep the workstation surface bounded, but this Cluster-only product is still
+excluded from small router Edge/Standalone artifacts.

deploy/console/ql3-cluster-copilot/client-config.example.json

@@ -0,0 +1,7 @@
+{
+  "schema": "qinglong/cluster-copilot-client-config@v1",
+  "endpoint": "https://replace-cluster-api.example.com:5800/",
+  "servername": "replace-cluster-api.example.com",
+  "caFile": "/absolute/private/ql3-copilot-console/ca.pem",
+  "requestTimeoutMs": 30000
+}

deploy/containers/ql3-cluster-admin/Dockerfile

@@ -74,13 +74,15 @@ COPY --from=workspace /workspace/packages/ql3-cluster-admin/package.json \
   node_modules/@qinglong/cluster-admin/package.json
 COPY --from=workspace /workspace/packages/ql3-cluster-admin/dist \
   node_modules/@qinglong/cluster-admin/dist
+COPY --from=workspace /workspace/packages/ql3-cluster-admin/assets/copilot-console \
+  node_modules/@qinglong/cluster-admin/assets/copilot-console
 
 FROM node:24.18.0-bookworm-slim@sha256:6f7b03f7c2c8e2e784dcf9295400527b9b1270fd37b7e9a7285cf83b6951452d AS runtime
 
 ARG SOURCE_REVISION=uncommitted
 
 LABEL org.opencontainers.image.title="QingLong 3.0 Cluster Admin" \
-  org.opencontainers.image.description="QingLong 3.0 cluster operations and bounded stdio MCP" \
+  org.opencontainers.image.description="QingLong 3.0 cluster operations and bounded Copilot surfaces" \
   org.opencontainers.image.source="https://github.com/whyour/qinglong" \
   org.opencontainers.image.revision="${SOURCE_REVISION}" \
   org.opencontainers.image.licenses="Apache-2.0"

deploy/containers/ql3-cluster-admin/package.json

@@ -2,7 +2,7 @@
   "name": "@qinglong/cluster-admin-image-dependencies",
   "version": "3.0.0-alpha.0",
   "private": true,
-  "description": "Locked external dependencies for QingLong 3.0 cluster operations and bounded stdio MCP",
+  "description": "Locked external dependencies for QingLong 3.0 cluster operations and bounded Copilot surfaces",
   "license": "Apache-2.0",
   "engines": {
     "node": ">=24.18.0 <25"

deploy/containers/ql3-cluster-admin/runtime-dependencies/package.json

@@ -2,7 +2,7 @@
   "name": "@qinglong/cluster-admin-image-dependencies",
   "version": "3.0.0-alpha.0",
   "private": true,
-  "description": "Production-only external dependency root for QingLong 3.0 cluster operations and bounded stdio MCP",
+  "description": "Production-only external dependency root for QingLong 3.0 cluster operations and bounded Copilot surfaces",
   "license": "Apache-2.0",
   "engines": {
     "node": ">=24.18.0 <25"

docs/QINGLONG_3_0_ARCHITECTURE_RFC.md

@@ -11,6 +11,7 @@
 
 最新增量证据（2026-08-16）：
 
+- D-327/ADR-0419（已接受）：QingLong 3.0 首个 Cluster 浏览器产品面已冻结为独立的 operator-workstation、loopback-only、只读 Copilot Console，而不是继续扩展 2.x Umi `src/pages`、legacy session 与 `/api` proxy。实现内聚在既有 `@qinglong/cluster-admin/copilot-console`，workspace 仍为 18 个 package；统一产品 façade 增加第十个静态命令 `copilot-console`。BFF 只监听 `127.0.0.1` ephemeral port，启动前复验包内 HTML/CSS/JS 的路径、realpath、类型、UTF-8、大小与固定 SHA-256；三项资源合计 24,150 bytes，无外部 asset/font/CDN。Cluster `ql3c_` credential 始终留在服务端 owner-private `0600` 文件且每次上游调用重新读取；浏览器只使用另一份 exact 256-bit session key，服务端只保存 domain-separated digest，页面只保存在内存，不进入 cookie、URL、argv、environment、local/session storage。Browser BFF 仅接受 exact `inspect|output`，复用 D-324 共享 TypeScript client，不执行 CLI 子进程、不直连数据库/application capability，并明确没有 diagnose/cancel、poller、WebSocket/SSE、ServiceWorker、queue/retry/cache 或后台 timer。Host、Origin、单 Authorization、route/operation 和 JSON framing 必须 exact；第三个并发 read 立即 `429`，固定 4 KiB request、约 2 MiB response、2 in-flight、16 connections 和 2 秒 shutdown ceiling。响应全为 `no-store` 且使用 default-deny CSP；模型文本只通过 `textContent` 显示并持续标记为 untrusted/no-action-authority。部署手册固定受信运维工作站生命周期，禁止 Kubernetes workload、Ingress、sidecar、共享 LAN 和容器 `0.0.0.0`；Edge/Standalone、Local MCP、Cluster Control/AI closure 均不导入 Console。npm pack dry-run 确认 245 files、258,012-byte tarball、1,614,503-byte unpacked，包含三项静态资源与全部 BFF/CLI 编译产物；独立审计还发现并修正真实 Admin Dockerfile 原先遗漏 assets 的发布缺陷，并把生产 files 白名单精确收窄到 `assets/copilot-console/*`。真实 Playwright 现场门覆盖 session 解锁、status read、显式 output reveal、390px 响应式布局和键盘路径；含 `<script>` 的模型输出保持纯文本，最终 0 error/0 warning，并修正了现代 HTML `/v` pattern 对未转义 `-` 的兼容问题。Console contract/CLI 12/12、定向产品入口 25/25、Cluster Admin 374 pass/3 条件 skip、完整 18-package clean build/test 退出 0、backend 1,215 pass/2 条件 skip/0 fail；package/dependency/Edge import/Cluster deployment/Console 审计零 finding，OCI/release 64/64、SBOM 11/11。真实 arm64 Admin image `qinglong3-cluster-admin:d327-local` 为 344,479,739 bytes，在 `10001:10001`、read-only root、network none、drop ALL、no-new-privileges、0.25 CPU、128 MiB/32 PIDs 下验证 10 个产品命令，并在同一受限容器内真实启动 Console、读取 digest-bound 页面与干净关闭。14 档 Local artifact 全部 compatible；默认 Edge/Standalone 仍精确为 2,589,890/2,589,968 bytes、315 files、56 modules，application+AI 为 4,493,043/4,493,175 bytes，MCP 为 7,315,930/7,316,038 bytes，证明 Cluster UI 没有进入低配路由设备。本 Gate 无 schema、migration、SQL、role、Pool、连接或 HA 拓扑变化，因此不重跑物理 HA，继续引用 D-323 PostgreSQL 18.6 arm64 142/142、timeline `1→2` 基线。下一独立 Gate 应交付可独立验签的 operator-workstation Admin/Console 分发物，或在同一 3.0 Console ownership 下增加受同一 BFF 约束的只读 Run/Task/Workflow 观察面；不得回接 2.x session、把浏览器变成 Cluster credential holder，或把 Console 变为常驻 Kubernetes 服务。
 - D-326/ADR-0418（已接受）：Cluster Copilot MCP 已补齐明确的外部 host 部署与资源边界。MCP 仍是 stdio 子进程，必须由支持 MCP 的外部 host 按 session 启动并持有 stdin/stdout；它不部署为 Kubernetes Deployment/Service，否则会形成没有消费者却长期持有 Project credential 的孤儿进程。新增 `deploy/mcp/ql3-cluster-copilot/` 提供 digest-pinned host 配置、owner-private client/MCP 配置示例和固定 Docker launcher；launcher 只允许显式命名网络与 `compact|standard|dense` 三档资源，分别限制为 192 MiB/0.25 CPU/32 PIDs/并发 1、512 MiB/1 CPU/64 PIDs/并发 4、1 GiB/2 CPU/96 PIDs/并发 16，并强制 `--pull never --init --read-only --cap-drop ALL --security-opt no-new-privileges --user 10001:10001`，只读挂载一个私有 authority root，禁止 Docker socket、Kubernetes token、数据库 credential、host/default/bridge/none 网络和可写工作目录。统一产品入口新增第九个静态命令 `ql3-cluster-admin copilot-mcp`；`ql3-copilot-mcp --check` 会先复验私有 config/credential/CA，再用无认证、固定 `GET /readyz` 做低敏预检，并在启动前拒绝配置并发超过 host resource class ceiling，serve 路径仍保持无 listener、无 queue/retry/poller/cache。部署审计同时禁止任何 Kubernetes YAML 常驻该 MCP，并修正了一个真实发布缺陷：OCI layout 旧 fixture 仍声称 Admin 镜像入口是 recovery CLI，现已与真实 `product-cli/cli.js` entrypoint 对齐。workspace 仍为 18 package、无 single-source/shallow package；Cluster Admin 保持 116 个源码、115 个位于嵌套职责目录，Admin SBOM 保持 91 components/87 external/4 internal，Control 和全部 Local 闭包不变。专项发布审计 145/145、Cluster Admin 362 pass/3 条件 skip、18-package clean build/test 退出 0、backend 1,210 pass/2 条件 skip/0 fail，package/dependency/Edge import/Cluster deployment 审计零 finding。真实 arm64 Admin image `qinglong3-cluster-admin:d326-local` 为 344,423,357 bytes，在 `10001:10001`、read-only root、network none、drop ALL、no-new-privileges、0.25 CPU、128 MiB/32 PIDs 下验证 9 个产品命令与新 entrypoint。14 档 Local artifact 全部逐档复验且与 D-325 完全一致：默认 Edge/Standalone 为 2,589,890/2,589,968 bytes、315 files、56 modules，application+AI 为 4,493,043/4,493,175 bytes，MCP 为 7,315,930/7,316,038 bytes，证明 Cluster MCP host 部署没有进入低配路由设备。本 Gate 无 schema、migration、SQL、role、Pool、连接或 HA 拓扑变化，因此不重跑物理 HA，继续引用 D-323 PostgreSQL 18.6 arm64 142/142、timeline `1→2` 基线。下一独立 Gate 应冻结 Cluster UI ownership/read-only Copilot surface，或使用公开 release digest 补真实外部 host session 证据；均不得把 stdio MCP 改成常驻服务或扩大其 credential/网络 authority。
 - D-325/ADR-0417（已接受）：Cluster Copilot 现已提供独立、受限、可部署的 MCP stdio 产品面。实现没有扩展旧 2.x Web UI，也没有把 Cluster authority 塞入 Edge/Standalone 的 `@qinglong/local-mcp-server`；而是在既有 `@qinglong/cluster-admin` 的内聚 `copilot-mcp/` 目录新增 `ql3-copilot-mcp` 与 `./copilot-mcp` export，workspace 仍保持 18 package。四个静态 Tool 只接收 Project、source Run、diagnosis request、trace/mutation identity，并直接调用 D-324 的共享 TypeScript client；不启动 CLI 子进程、不写 command 临时文件、不监听网络、不直连数据库/application capability，也不允许调用者提供 URL、header、credential、Model/Provider、Artifact、usage/cost 或 Policy fence。owner-private 0600 配置只保存 client config/credential 路径和显式 `1..16` 并发上限；credential 每次 Tool call 都重新执行 canonical/private/TOCTOU 与 token 校验，rotation 下一次调用立即生效。满载即时返回 `copilot_mcp_busy`，没有隐藏 queue、retry、poller、timer、watcher 或 cache。所有结果使用 exact `qinglong/cluster-copilot-mcp-result@v1`，固定 `instructionPolicy=data_only_never_execute` 与 `actionAuthority=none`；只有 output Tool 标为 `potentially_sensitive`/`untrusted_model_output`，远端错误仅投影有界 status/code/request identity/Retry-After。真实 stdio + TLS 1.3 E2E 已覆盖 initialize、discovery、四次直接请求、Bearer credential 热轮换、无 client certificate、敏感输出标注与 graceful close；并发和未知字段均失败关闭。Cluster Admin 完整测试 361 pass/3 条件 skip，18-package clean build/test 退出 0，backend 1,207 pass/2 条件 skip/0 fail；package/dependency/Edge import/Cluster deployment 四项审计零 finding，Cluster Admin 为 116 个源码且 115 个位于嵌套职责目录。Cluster Admin 镜像精确加入已固定的 `@modelcontextprotocol/server@2.0.0`，SBOM 为 91 components/87 external/4 internal；Cluster Control 和全部 Local 闭包不变。14 档 Local artifact 全部通过，默认 Edge/Standalone 仍为 2,589,890/2,589,968 bytes、315 files、56 modules，证明 Cluster MCP 没有进入低配路由设备；本 Gate 无 schema、migration、SQL、role、Pool、连接或部署拓扑变化，因此不重跑物理 HA，继续引用 D-323 PostgreSQL 18.6 arm64 142/142、timeline `1→2` 基线。下一独立 Gate 应冻结 Cluster UI ownership 或增加 MCP host 的明确部署清单/运维面，仍必须复用同一 API，不得回接 2.x controller/session 或扩大 credential authority。
 - D-324/ADR-0416（已接受）：Cluster Copilot failure diagnosis 已获得首个可直接部署的有界产品客户端。既有 `@qinglong/cluster-admin` 在内聚的 `copilot-client/` 目录提供共享 client 与 `ql3-copilot-client`，统一 `ql3-cluster-admin copilot` 静态委托同一 binary；没有为三个实现文件新增 workspace package。客户端只接受 owner-private 0600 的绝对 `--config`、`--command`、`--credential` 文件路径，Project API credential 固定为独立 `ql3c_` Bearer authority，禁止写入 argv 值、环境、stdin、command 或 operator context，也不复用管理面的 User JWT/mTLS client certificate。`diagnose|inspect|output|cancel` 四个 operation 只调用 D-321 至 D-323 的既有 API，TLS 固定 1.3、显式 CA/DNS、无连接复用/压缩/redirect/proxy/ambient CA；diagnose request identity、cancel mutation identity 和只读 transport identity 必须与唯一响应 `x-request-id` exact matching。成功响应重新执行 schema、target、状态机、digest、usage/cost 与 UTF-8 byte exact validation；只有调用者显式选择 `output` 才向 stdout 返回诊断文本，远端失败只投影 status、稳定 code、request identity 与有界 Retry-After。operator context 只能保存 Copilot config 路径，并新增离线 validate 与无认证固定 `GET /readyz` probe，不能保存 credential/command 或获得调用 authority。workspace 保持 18 package、`singleSourcePackages=[]`、`shallowSourcePackages=[]`；Cluster Admin 从 109 增至 112 个源码，其中 111 个在嵌套职责目录，未新增生产依赖、schema、migration、SQL、role、Pool、连接、进程、timer、watcher、queue、cache、Pod、Service 或 Kubernetes 权限。Copilot/产品 CLI 定向 19/19、Cluster Admin 354 pass/3 条件 skip、18-package clean build/test 退出 0、backend 1,207 pass/2 条件 skip/0 fail；package/dependency/Edge import/Cluster deployment 四项审计零 finding，14 档 Local artifact 全部通过。默认 Edge/Standalone 仍为 2,589,890/2,589,968 bytes、315 files、56 modules，证明 Cluster-only client 没有进入低配路由设备闭包。本 Gate 没有数据库或部署拓扑变更，因此不重跑物理 HA，继续引用 D-323 的 PostgreSQL 18.6 arm64 142/142、timeline `1→2` 与 SHA-256 `5dbcffb74a3181aabee66a8f68ecfa7a65e0491a6f2ba24e2bc903c83da9d766` 基线。下一独立 Gate 可让 UI/MCP 复用同一公开 API/contract，不能执行 CLI 子进程、直连 application capability/数据库或扩大 credential authority。

docs/adr/ADR-0419-loopback-read-only-cluster-copilot-console.md

@@ -0,0 +1,41 @@
+# ADR-0419：Loopback-only Cluster Copilot 只读 Console
+
+- 状态：Accepted
+- 日期：2026-08-16
+- 关联 RFC：QL-RFC-0001 D-327、Phase 2
+
+## 背景
+
+D-324 至 D-326 已交付共享 Cluster Copilot client、stdio MCP 产品面和受限外部 MCP host 部署，但人的浏览器尚无 QingLong 3.0 UI ownership。仓库根 `src/pages` 属于 2.x Umi Web 应用，其 legacy session、`/api` proxy 和 controller contract 不能成为 3.0 Cluster API 的新依赖。让浏览器直接持有 `ql3c_` Project API credential 也会把可调用 authority 暴露给页面脚本、扩展和浏览器存储。
+
+QingLong 同时面向低配路由设备和集群节点。本机 Console 不能进入 Edge/Standalone 默认闭包，也不应成为 Kubernetes 常驻 Pod；否则无人在场时仍会持续持有 Project credential、监听网络并增加资源成本。此前 workspace 已收敛为 18 个 package，Console 没有独立发布或部署闭包，不应为少量文件再拆第 19 个薄 package。
+
+## 决策
+
+1. Console 归属既有 `@qinglong/cluster-admin`，实现放入内聚 `copilot-console/` 目录并通过 `ql3-copilot-console` 与统一 `ql3-cluster-admin copilot-console` 暴露。它不是 2.x Web 页面、Cluster Control route、Kubernetes component 或新 workspace package。
+2. 进程只监听 `127.0.0.1`，默认选择 ephemeral port，并只服务 digest-bound 的 HTML/CSS/JavaScript。静态资源不访问外部字体、图片、脚本或 CDN；包内资源的路径、realpath、文件类型、UTF-8、大小和 SHA-256 在监听前全部复验。
+3. Browser 与 Cluster authority 分离。BFF 持有 canonical、current-owner、`0600` 的 `ql3c_` credential 并在每次上游请求重新读取；浏览器只提交另一份 exact 256-bit session key。服务端只保存 domain-separated SHA-256 session digest，页面只在内存保存明文，reload/pagehide 后丢弃，不使用 cookie、local/session storage、URL、argv 或 environment 传递 secret。
+4. Browser BFF 仅开放 `inspect` 与显式 `output` 两个 POST。request exact-shape 只包含 Project、source Run 和 diagnosis request identity；不接受 endpoint、header、credential、trace、mutation、Provider、Model、Artifact 或 Policy 字段。没有 diagnose/cancel、轮询、WebSocket、SSE、ServiceWorker、缓存、队列、retry 或后台 timer。
+5. 每个 read 同步复用 D-324 的 TypeScript client，不启动 CLI 子进程、不直连数据库/application capability。BFF 复验 exact Host、Origin、单一 Authorization header、content type/length 和 operation-route 一致性；未知或未授权 surface 统一为 `404`。
+6. 资源边界固定为 4 KiB request、约 2 MiB response、2 个 in-flight read、16 个连接和 2 秒 shutdown ceiling。第三个并发请求立即 `429`，不排队。上游错误只投影 status、稳定 code、request identity 和有界 Retry-After。
+7. 响应全部 `no-store`，CSP 默认拒绝并仅允许 same-origin script/style/connect，同时拒绝 frame、object、media、font、manifest 和 worker；无 cookie、无 credentialed fetch。模型输出只能通过 `textContent` 渲染，并在 UI 中持续标记为 untrusted advice 与无行动权。
+8. 部署生命周期属于受信 operator workstation 的短期进程。发布包必须包含静态资源、CLI 与 BFF；`--check` 在监听前验证 config/credential/session 并发出一个无认证 TLS 1.3 `/readyz`。不得把 Console 放入 Kubernetes YAML、Cluster Pod sidecar、共享 LAN 或容器 `0.0.0.0` listener。
+9. Edge/Standalone、Local MCP、Cluster Control 和 Cluster AI closure 不导入 Console。路由器默认制品字节、文件和 module 闭包必须保持不变；集群管理镜像可包含该短生命周期入口，但不会默认启动它。
+
+## 不选择
+
+- **修改 2.x Umi 页面**：会重新绑定 legacy session/controller/proxy，并使 3.0 UI ownership 无法独立演进。
+- **浏览器直连 Cluster API**：必须把 `ql3c_` authority 和 CA/endpoint 细节交给浏览器，难以阻止存储、扩展读取与跨站误用。
+- **Kubernetes Deployment/Ingress**：把仅供在场运维者使用的页面变成长生命周期 credential workload，并增加认证、TLS、HA 与资源治理面。
+- **把 Console 合入 MCP host**：浏览器 HTTP lifecycle 与 stdio parent-session lifecycle 不同，合并会混淆 host ownership 和 authorization projection。
+- **新增 workspace package**：没有独立 consumer/deployment closure，只会恢复用户已指出的单文件薄包问题。
+- **自动 polling 或流式输出**：增加请求、连接和低配工作站资源，且掩盖“状态读取”与“敏感输出显式读取”的产品边界。
+
+## 验收
+
+1. contract/server 单测覆盖 exact read schema、digest-bound assets、Host/Origin/session、无 mutation route、无隐藏 queue、低敏错误和幂等关闭。
+2. CLI 端到端覆盖 owner-private authority、无认证 TLS 1.3 readiness、ephemeral loopback 启动、真实页面读取与 signal 收敛。
+3. 浏览器现场门覆盖 session 解锁、status read、output explicit reveal、恶意 HTML 仅作文本显示、响应式布局、键盘 focus 与零 console error。
+4. package packlist、产品 catalog/help、OCI fixture 与真实 Admin image 都必须包含第十个 reviewed command 和三个静态资源。
+5. 独立部署审计拒绝 2.x `src`/`back` 耦合、Kubernetes resident Console、`0.0.0.0`、storage/cookie/worker/WebSocket、diagnose/cancel 或 package/export 漂移。
+6. 完整 Cluster Admin、18-package build/test、backend、架构/发布审计、真实 Admin image 与 14 档 Local artifact 全部通过后才允许 D-327 阶段提交。本 Gate 不修改 schema、migration、SQL、role、Pool、连接或 HA 拓扑，因此继续引用 D-323 PostgreSQL 18.6 physical HA 基线。

docs/adr/README.md

@@ -422,6 +422,7 @@
 | [ADR-0416](./ADR-0416-bounded-cluster-copilot-product-client.md)                                  | 有界 Cluster Copilot 产品客户端                                                                                                                              | Accepted |
 | [ADR-0417](./ADR-0417-bounded-cluster-copilot-mcp-stdio-surface.md)                               | 有界 Cluster Copilot MCP stdio 产品面                                                                                                                        | Accepted |
 | [ADR-0418](./ADR-0418-explicit-cluster-copilot-mcp-host-deployment.md)                           | 显式 Cluster Copilot MCP Host 部署与资源边界                                                                                                                 | Accepted |
+| [ADR-0419](./ADR-0419-loopback-read-only-cluster-copilot-console.md)                            | Loopback-only Cluster Copilot 只读 Console                                                                                                                    | Accepted |
 
 ## 规则
 

docs/ql3-package-boundaries.json

@@ -55,11 +55,12 @@
       "authorities": [
         "Kubernetes mutation",
         "PostgreSQL management",
-        "optional mTLS/OIDC human Approval management",
-        "caller-driven Approval management client",
-        "one-shot maintenance"
+      "optional mTLS/OIDC human Approval management",
+      "caller-driven Approval management client",
+      "loopback-only read-only Copilot Console",
+      "one-shot maintenance"
       ],
-      "rationale": "独立管理进程与一次性高权限命令必须排除在常驻 cluster-control 之外；Approval 的 service/transport/process/client 属于同一 Cluster Admin 制品与强人类认证 authority，使用包内 approval-management 领域目录而不是新增微包。"
+    "rationale": "独立管理进程、一次性高权限命令和 operator-workstation Console 必须排除在常驻 cluster-control 之外；Approval 的 service/transport/process/client 与只读 Copilot Console 均属于同一 Cluster Admin 制品，分别使用内聚领域目录而不是新增微包。"
     },
     {
       "path": "packages/ql3-cluster-control",

package.json

@@ -83,6 +83,7 @@
     "test:vault-transit-custody-live:ql3": "pnpm --filter @qinglong/ai build && pnpm --filter @qinglong/cluster-admin build && node scripts/ql3-vault-transit-prompt-output-custody-live-contract.cjs",
     "test:postgres-backup-prompt-output-recovery-live:ql3": "pnpm --filter @qinglong/ai build && pnpm --filter @qinglong/cluster-admin build && node scripts/ql3-postgres-prompt-output-recovery-live-contract.cjs",
     "audit:cluster-deployment:ql3": "node scripts/ql3-cluster-deployment-audit.cjs",
+    "audit:cluster-copilot-console:ql3": "node scripts/ql3-cluster-copilot-console-audit.cjs",
     "test:cluster-admin-product-live:ql3": "node scripts/ql3-cluster-admin-product-live-contract.cjs",
     "audit:provider-credential-management-deployment:ql3": "node scripts/ql3-provider-credential-management-deployment-audit.cjs",
     "audit:provider-credential-test-deployment:ql3": "node scripts/ql3-provider-credential-test-deployment-audit.cjs",

packages/ql3-cluster-admin/README.md

@@ -1,10 +1,25 @@
 # `@qinglong/cluster-admin`
 
 This private QingLong 3.0 package owns explicit cluster operations and the
-bounded Cluster Copilot MCP product surface. Database/Kubernetes administration
-remains short-lived and requires distinct purpose-bound authority; the MCP
-subpath has only the remote API client, opens no database or Kubernetes
-authority, and is intentionally separate from resident `cluster-control`.
+bounded Cluster Copilot MCP and Console product surfaces.
+Database/Kubernetes administration remains short-lived and requires distinct
+purpose-bound authority. The MCP subpath has only the remote API client; the
+Console is a loopback-only read BFF serving digest-bound static assets. Neither
+opens database or Kubernetes authority, enters the legacy 2.x Web application,
+or resides in `cluster-control`.
+
+The Console accepts only `inspect` and explicit `output` reads. Its Cluster
+API credential stays in a canonical owner-private file and is reread for each
+upstream request; browser JavaScript receives only a separate session token
+which cannot call Cluster APIs. It binds `127.0.0.1`, enforces exact
+Host/Origin, no-store responses and a closed CSP, renders model text only via
+`textContent`, and keeps diagnose/cancel, polling, cache, WebSocket,
+ServiceWorker and legacy session authority absent.
+
+The reviewed operator-workstation setup, private-file ceremony, preflight and
+session lifecycle are documented in
+`deploy/console/ql3-cluster-copilot/README.md`. Do not expose the Console
+through a container port mapping, Kubernetes workload or shared network.
 
 The admin role can append Identity/API Credential mutations and their security
 audit in one serializable transaction, and can perform bounded read-only audit

packages/ql3-cluster-admin/assets/copilot-console/app.css

@@ -0,0 +1,588 @@
+:root {
+  --paper: #f3f6f1;
+  --paper-deep: #e7ede6;
+  --ink: #17231d;
+  --muted: #607067;
+  --line: #cbd5cc;
+  --moss: #2f654d;
+  --moss-soft: #dce9df;
+  --amber: #c98724;
+  --plum: #69556d;
+  --rust: #a84f38;
+  --white: #fbfdf9;
+  --shadow: 0 24px 70px rgba(31, 52, 40, 0.12);
+  font-family:
+    "Avenir Next", "Segoe UI Variable", "Segoe UI", "PingFang SC",
+    "Hiragino Sans GB", sans-serif;
+  color: var(--ink);
+  background: var(--paper);
+  font-synthesis: none;
+}
+
+* {
+  box-sizing: border-box;
+}
+
+html {
+  min-width: 320px;
+  background:
+    linear-gradient(90deg, rgba(47, 101, 77, 0.035) 1px, transparent 1px)
+      0 0 / 24px 24px,
+    var(--paper);
+}
+
+body {
+  margin: 0;
+  min-height: 100vh;
+}
+
+button,
+input {
+  font: inherit;
+}
+
+button {
+  border: 1px solid var(--ink);
+  border-radius: 3px;
+  padding: 0.78rem 1rem;
+  color: var(--ink);
+  background: transparent;
+  cursor: pointer;
+  transition:
+    transform 140ms ease,
+    background-color 140ms ease,
+    color 140ms ease;
+}
+
+button:hover:not(:disabled) {
+  transform: translateY(-1px);
+  background: var(--ink);
+  color: var(--white);
+}
+
+button:disabled {
+  cursor: not-allowed;
+  opacity: 0.42;
+}
+
+button.primary {
+  background: var(--moss);
+  border-color: var(--moss);
+  color: var(--white);
+}
+
+button:focus-visible,
+input:focus-visible,
+pre:focus-visible {
+  outline: 3px solid color-mix(in srgb, var(--amber) 72%, white);
+  outline-offset: 3px;
+}
+
+input {
+  width: 100%;
+  border: 0;
+  border-bottom: 1px solid var(--ink);
+  border-radius: 0;
+  padding: 0.72rem 0;
+  color: var(--ink);
+  background: transparent;
+}
+
+input::placeholder {
+  color: #91a097;
+}
+
+.skip-link {
+  position: fixed;
+  left: 1rem;
+  top: 1rem;
+  z-index: 20;
+  transform: translateY(-180%);
+  padding: 0.7rem 1rem;
+  background: var(--ink);
+  color: white;
+}
+
+.skip-link:focus {
+  transform: translateY(0);
+}
+
+.shell {
+  width: min(1440px, 100%);
+  margin: 0 auto;
+  min-height: 100vh;
+  padding: 2rem clamp(1rem, 3vw, 3.5rem) 1.25rem;
+  display: flex;
+  flex-direction: column;
+}
+
+.masthead {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: 2rem;
+  padding-bottom: 1.6rem;
+  border-bottom: 1px solid var(--ink);
+}
+
+.brand-lockup {
+  display: flex;
+  align-items: center;
+  gap: 1.2rem;
+}
+
+.brand-mark {
+  display: grid;
+  place-items: center;
+  width: 3.15rem;
+  height: 3.15rem;
+  border: 1px solid var(--ink);
+  border-radius: 50%;
+  font-family: ui-monospace, "SFMono-Regular", Consolas, monospace;
+  font-weight: 800;
+  letter-spacing: -0.09em;
+}
+
+.eyebrow {
+  margin: 0 0 0.42rem;
+  font-family: ui-monospace, "SFMono-Regular", Consolas, monospace;
+  font-size: 0.69rem;
+  font-weight: 700;
+  letter-spacing: 0.12em;
+  text-transform: uppercase;
+  color: var(--muted);
+}
+
+h1,
+h2,
+h3,
+p {
+  margin-top: 0;
+}
+
+h1 {
+  margin-bottom: 0;
+  max-width: 18ch;
+  font-size: clamp(1.55rem, 3vw, 3rem);
+  line-height: 0.98;
+  letter-spacing: -0.055em;
+}
+
+h2 {
+  margin-bottom: 0.7rem;
+  font-size: clamp(1.45rem, 2vw, 2.15rem);
+  letter-spacing: -0.035em;
+}
+
+h3 {
+  letter-spacing: -0.025em;
+}
+
+.boundary {
+  min-width: 11rem;
+  display: grid;
+  grid-template-columns: auto 1fr;
+  gap: 0.22rem 0.52rem;
+  align-items: center;
+  font-size: 0.76rem;
+}
+
+.boundary strong {
+  grid-column: 2;
+  font-family: ui-monospace, "SFMono-Regular", Consolas, monospace;
+  font-weight: 500;
+  color: var(--muted);
+}
+
+.boundary-dot {
+  width: 0.65rem;
+  height: 0.65rem;
+  border-radius: 50%;
+  background: var(--moss);
+  box-shadow: 0 0 0 5px var(--moss-soft);
+}
+
+.workspace {
+  flex: 1;
+  display: grid;
+  grid-template-columns: minmax(18rem, 0.82fr) minmax(28rem, 1.4fr);
+  min-height: 680px;
+  border-bottom: 1px solid var(--ink);
+}
+
+.control-deck,
+.evidence-panel {
+  padding: clamp(1.5rem, 3vw, 3.25rem);
+}
+
+.control-deck {
+  border-right: 1px solid var(--ink);
+  background: rgba(251, 253, 249, 0.72);
+}
+
+.section-heading > p:last-child {
+  max-width: 44ch;
+  line-height: 1.7;
+  color: var(--muted);
+}
+
+.session-gate {
+  margin: 2.5rem 0 2rem;
+  padding: 1.1rem;
+  border-left: 3px solid var(--plum);
+  background: color-mix(in srgb, var(--plum) 8%, var(--white));
+}
+
+.inline-control {
+  display: grid;
+  grid-template-columns: minmax(0, 1fr) auto;
+  gap: 0.8rem;
+}
+
+.field-note {
+  margin: 0.75rem 0 0;
+  font-size: 0.78rem;
+  line-height: 1.55;
+  color: var(--muted);
+}
+
+.target-form {
+  display: grid;
+  gap: 0.45rem;
+}
+
+.target-form label,
+.session-gate label {
+  margin-top: 0.9rem;
+  font-size: 0.78rem;
+  font-weight: 750;
+  letter-spacing: 0.025em;
+}
+
+.actions {
+  display: grid;
+  grid-template-columns: 1fr 1fr;
+  gap: 0.65rem;
+  margin-top: 1.7rem;
+}
+
+.trust-note {
+  margin-top: 2.4rem;
+  padding-top: 1rem;
+  border-top: 1px solid var(--line);
+}
+
+.trust-note span {
+  font-family: ui-monospace, "SFMono-Regular", Consolas, monospace;
+  font-size: 0.68rem;
+  text-transform: uppercase;
+  letter-spacing: 0.1em;
+  color: var(--plum);
+}
+
+.trust-note p {
+  margin: 0.45rem 0 0;
+  font-size: 0.8rem;
+  line-height: 1.55;
+  color: var(--muted);
+}
+
+.evidence-panel {
+  position: relative;
+  background: var(--paper-deep);
+}
+
+.evidence-header,
+.output-heading {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: 1rem;
+}
+
+.status-chip {
+  border: 1px solid currentColor;
+  border-radius: 999px;
+  padding: 0.35rem 0.64rem;
+  font-family: ui-monospace, "SFMono-Regular", Consolas, monospace;
+  font-size: 0.68rem;
+  color: var(--muted);
+}
+
+.status-chip[data-tone="running"] {
+  color: var(--amber);
+}
+
+.status-chip[data-tone="success"] {
+  color: var(--moss);
+}
+
+.status-chip[data-tone="failed"] {
+  color: var(--rust);
+}
+
+.empty-state {
+  min-height: 450px;
+  display: grid;
+  place-content: center;
+  justify-items: center;
+  text-align: center;
+}
+
+.empty-state p {
+  max-width: 38ch;
+  line-height: 1.65;
+  color: var(--muted);
+}
+
+.empty-glyph {
+  width: 12rem;
+  height: 7rem;
+  margin-bottom: 2rem;
+  display: flex;
+  align-items: flex-end;
+  justify-content: center;
+  gap: 1.3rem;
+  border-bottom: 1px solid var(--ink);
+}
+
+.empty-glyph span {
+  width: 1px;
+  background: var(--ink);
+  transform-origin: bottom;
+  animation: signal 2.4s ease-in-out infinite;
+}
+
+.empty-glyph span:nth-child(1) {
+  height: 35%;
+}
+
+.empty-glyph span:nth-child(2) {
+  height: 82%;
+  animation-delay: 180ms;
+}
+
+.empty-glyph span:nth-child(3) {
+  height: 54%;
+  animation-delay: 360ms;
+}
+
+@keyframes signal {
+  0%,
+  100% {
+    transform: scaleY(0.55);
+    opacity: 0.42;
+  }
+  45% {
+    transform: scaleY(1);
+    opacity: 1;
+  }
+}
+
+.trace-rail {
+  list-style: none;
+  margin: 2.2rem 0;
+  padding: 0;
+  display: grid;
+  grid-template-columns: repeat(3, 1fr);
+}
+
+.trace-rail li {
+  position: relative;
+  display: grid;
+  grid-template-columns: auto 1fr;
+  gap: 0.75rem;
+  min-height: 5rem;
+}
+
+.trace-rail li:not(:last-child)::after {
+  content: "";
+  position: absolute;
+  top: 0.42rem;
+  left: 0.45rem;
+  right: -0.45rem;
+  height: 1px;
+  background: var(--moss);
+}
+
+.trace-node {
+  position: relative;
+  z-index: 1;
+  width: 0.9rem;
+  height: 0.9rem;
+  border: 3px solid var(--paper-deep);
+  border-radius: 50%;
+  background: var(--moss);
+  box-shadow: 0 0 0 1px var(--moss);
+}
+
+.trace-rail small,
+.fact-grid dt,
+.output-meta dt {
+  display: block;
+  margin-bottom: 0.42rem;
+  font-family: ui-monospace, "SFMono-Regular", Consolas, monospace;
+  font-size: 0.65rem;
+  letter-spacing: 0.11em;
+  color: var(--muted);
+}
+
+.trace-rail strong {
+  font-size: 0.9rem;
+  overflow-wrap: anywhere;
+}
+
+.fact-grid {
+  display: grid;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  margin: 0;
+  border-top: 1px solid var(--ink);
+  border-left: 1px solid var(--ink);
+}
+
+.fact-grid div {
+  min-height: 6.4rem;
+  padding: 1rem;
+  border-right: 1px solid var(--ink);
+  border-bottom: 1px solid var(--ink);
+}
+
+.fact-grid dd,
+.output-meta dd {
+  margin: 0;
+  font-family: ui-monospace, "SFMono-Regular", Consolas, monospace;
+  font-size: 0.82rem;
+  overflow-wrap: anywhere;
+}
+
+.output-panel {
+  margin-top: 2rem;
+  padding: 1.2rem;
+  border: 1px solid var(--plum);
+  background: var(--white);
+  box-shadow: var(--shadow);
+}
+
+.output-heading span {
+  border: 1px solid var(--plum);
+  padding: 0.3rem 0.55rem;
+  font-size: 0.66rem;
+  color: var(--plum);
+}
+
+.output-panel pre {
+  max-height: 28rem;
+  overflow: auto;
+  margin: 1rem 0;
+  padding: 1rem;
+  border-left: 3px solid var(--plum);
+  white-space: pre-wrap;
+  word-break: break-word;
+  font: 0.82rem/1.7 ui-monospace, "SFMono-Regular", Consolas, monospace;
+  background: #f1eef2;
+}
+
+.output-meta {
+  display: grid;
+  grid-template-columns: 0.7fr 0.7fr 1.6fr;
+  gap: 1rem;
+  margin: 0;
+}
+
+.message {
+  min-height: 1.4rem;
+  margin-top: 1.2rem;
+  font-size: 0.82rem;
+  color: var(--muted);
+}
+
+.message[data-tone="error"] {
+  color: var(--rust);
+}
+
+footer {
+  display: flex;
+  justify-content: space-between;
+  gap: 1rem;
+  padding-top: 1rem;
+  font-family: ui-monospace, "SFMono-Regular", Consolas, monospace;
+  font-size: 0.65rem;
+  color: var(--muted);
+}
+
+[hidden] {
+  display: none !important;
+}
+
+@media (max-width: 860px) {
+  .masthead,
+  footer {
+    flex-direction: column;
+  }
+
+  .workspace {
+    grid-template-columns: 1fr;
+  }
+
+  .control-deck {
+    border-right: 0;
+    border-bottom: 1px solid var(--ink);
+  }
+
+  .trace-rail {
+    grid-template-columns: 1fr;
+    gap: 1rem;
+  }
+
+  .trace-rail li {
+    min-height: 3rem;
+  }
+
+  .trace-rail li:not(:last-child)::after {
+    left: 0.42rem;
+    right: auto;
+    top: 0.8rem;
+    bottom: -1.45rem;
+    width: 1px;
+    height: auto;
+  }
+}
+
+@media (max-width: 520px) {
+  .shell {
+    padding-inline: 0.75rem;
+  }
+
+  .brand-lockup {
+    align-items: flex-start;
+  }
+
+  .brand-mark {
+    flex: 0 0 auto;
+    width: 2.7rem;
+    height: 2.7rem;
+  }
+
+  .control-deck,
+  .evidence-panel {
+    padding: 1.25rem;
+  }
+
+  .inline-control,
+  .actions,
+  .fact-grid,
+  .output-meta {
+    grid-template-columns: 1fr;
+  }
+}
+
+@media (prefers-reduced-motion: reduce) {
+  *,
+  *::before,
+  *::after {
+    scroll-behavior: auto !important;
+    transition-duration: 0.01ms !important;
+    animation-duration: 0.01ms !important;
+    animation-iteration-count: 1 !important;
+  }
+}

packages/ql3-cluster-admin/assets/copilot-console/app.js

@@ -0,0 +1,190 @@
+"use strict";
+
+(function () {
+  const commandSchema = "qinglong/cluster-copilot-console-read-request@v1";
+  const sessionForm = document.getElementById("session-form");
+  const sessionInput = document.getElementById("session-token");
+  const targetForm = document.getElementById("target-form");
+  const inspectButton = document.getElementById("inspect-button");
+  const outputButton = document.getElementById("output-button");
+  const emptyState = document.getElementById("empty-state");
+  const resultView = document.getElementById("result-view");
+  const outputPanel = document.getElementById("output-panel");
+  const outputText = document.getElementById("output-text");
+  const message = document.getElementById("message");
+  const statusChip = document.getElementById("status-chip");
+  let sessionToken = "";
+  let currentTarget = null;
+
+  const setText = function (id, value) {
+    document.getElementById(id).textContent =
+      value === null || value === undefined || value === "" ? "—" : String(value);
+  };
+
+  const setMessage = function (value, tone) {
+    message.textContent = value;
+    message.dataset.tone = tone || "neutral";
+  };
+
+  const dateTime = function (value) {
+    if (!Number.isSafeInteger(value)) return "—";
+    return new Intl.DateTimeFormat("zh-CN", {
+      dateStyle: "medium",
+      timeStyle: "medium",
+    }).format(new Date(value));
+  };
+
+  const setBusy = function (busy) {
+    inspectButton.disabled = busy;
+    outputButton.disabled =
+      busy || !currentTarget || currentTarget.outputAvailable !== true;
+  };
+
+  const request = async function (operation, target) {
+    const response = await fetch("/api/v1/copilot/" + operation, {
+      method: "POST",
+      cache: "no-store",
+      credentials: "omit",
+      redirect: "error",
+      referrerPolicy: "no-referrer",
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/json; charset=utf-8",
+        Authorization: "QL3-Console " + sessionToken,
+      },
+      body: JSON.stringify({
+        schema: commandSchema,
+        operation: operation,
+        projectId: target.projectId,
+        sourceRunId: target.sourceRunId,
+        requestId: target.requestId,
+      }),
+    });
+    const body = await response.json();
+    if (!response.ok) {
+      const error = new Error(
+        typeof body.code === "string" ? body.code : "console_request_failed",
+      );
+      error.code = typeof body.code === "string" ? body.code : "console_request_failed";
+      throw error;
+    }
+    return body;
+  };
+
+  const targetFromForm = function () {
+    const form = new FormData(targetForm);
+    return {
+      projectId: String(form.get("projectId") || "").trim(),
+      sourceRunId: String(form.get("sourceRunId") || "").trim(),
+      requestId: String(form.get("requestId") || "").trim(),
+    };
+  };
+
+  const renderInspection = function (response) {
+    const result = response.result;
+    const fact = result.result;
+    currentTarget = {
+      projectId: fact.projectId,
+      sourceRunId: fact.sourceRunId,
+      requestId: fact.requestId,
+      outputAvailable: fact.outputAvailable,
+    };
+    emptyState.hidden = true;
+    resultView.hidden = false;
+    outputPanel.hidden = true;
+    outputText.textContent = "";
+    setText("admitted-at", dateTime(fact.admittedAtMs));
+    setText("stage", fact.stage || (fact.status === "running" ? "processing" : null));
+    setText("outcome", fact.outcome || fact.status);
+    setText("diagnosis-run", fact.diagnosisRunId);
+    setText("reason", fact.reason);
+    setText(
+      "tokens",
+      fact.usage === null ? null : fact.usage.totalTokens,
+    );
+    setText(
+      "cost",
+      fact.usage === null || fact.usage.costMicros === null
+        ? null
+        : "$" + (fact.usage.costMicros / 1000000).toFixed(6),
+    );
+    statusChip.textContent = fact.status === "running" ? "诊断进行中" : fact.outcome;
+    statusChip.dataset.tone =
+      fact.status === "running"
+        ? "running"
+        : fact.outcome === "succeeded"
+          ? "success"
+          : "failed";
+    outputButton.disabled = fact.outputAvailable !== true;
+    setMessage(
+      fact.outputAvailable
+        ? "状态已验证。诊断内容仍未读取。"
+        : "状态已验证；当前没有可读取的诊断内容。",
+    );
+  };
+
+  const renderOutput = function (response) {
+    const fact = response.result.result;
+    outputPanel.hidden = false;
+    outputText.textContent = fact.result.text;
+    setText("finish-reason", fact.result.finishReason);
+    setText("output-bytes", fact.reference.outputBytes);
+    setText("content-digest", fact.reference.contentDigest);
+    setMessage("诊断内容已显式读取；请把它当作不可信建议进行复核。");
+    outputPanel.scrollIntoView({ behavior: "smooth", block: "nearest" });
+  };
+
+  sessionForm.addEventListener("submit", function (event) {
+    event.preventDefault();
+    const candidate = sessionInput.value.trim();
+    if (!/^[A-Za-z0-9_-]{43}$/.test(candidate)) {
+      setMessage("浏览器访问密钥格式无效。", "error");
+      return;
+    }
+    sessionToken = candidate;
+    sessionInput.value = "";
+    sessionForm.hidden = true;
+    targetForm.hidden = false;
+    setMessage("本次页面已解锁。访问密钥只保留在内存中。");
+    document.getElementById("project-id").focus();
+  });
+
+  targetForm.addEventListener("submit", async function (event) {
+    event.preventDefault();
+    const target = targetFromForm();
+    setBusy(true);
+    setMessage("正在读取 durable status…");
+    try {
+      const response = await request("inspect", target);
+      renderInspection(response);
+    } catch (error) {
+      currentTarget = null;
+      outputPanel.hidden = true;
+      statusChip.textContent = "读取失败";
+      statusChip.dataset.tone = "failed";
+      setMessage("无法读取诊断状态：" + error.code, "error");
+    } finally {
+      setBusy(false);
+    }
+  });
+
+  outputButton.addEventListener("click", async function () {
+    if (!currentTarget || currentTarget.outputAvailable !== true) return;
+    setBusy(true);
+    setMessage("正在显式读取诊断内容…");
+    try {
+      const response = await request("output", currentTarget);
+      renderOutput(response);
+    } catch (error) {
+      setMessage("无法读取诊断内容：" + error.code, "error");
+    } finally {
+      setBusy(false);
+    }
+  });
+
+  window.addEventListener("pagehide", function () {
+    sessionToken = "";
+    currentTarget = null;
+    outputText.textContent = "";
+  });
+})();

packages/ql3-cluster-admin/assets/copilot-console/index.html

@@ -0,0 +1,218 @@
+<!doctype html>
+<html lang="zh-CN">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <meta name="color-scheme" content="light" />
+    <meta
+      name="description"
+      content="QingLong 3.0 Cluster Copilot 只读诊断台"
+    />
+    <title>QingLong 3.0 · Copilot 诊断台</title>
+    <link rel="stylesheet" href="/app.css" />
+    <script src="/app.js" defer></script>
+  </head>
+  <body>
+    <a class="skip-link" href="#workspace">跳到诊断工作区</a>
+    <div class="shell">
+      <header class="masthead">
+        <div class="brand-lockup" aria-label="QingLong 3.0 Cluster Console">
+          <span class="brand-mark" aria-hidden="true">QL</span>
+          <div>
+            <p class="eyebrow">QingLong 3.0 / Cluster field console</p>
+            <h1>故障诊断，不替你执行。</h1>
+          </div>
+        </div>
+        <div class="boundary" aria-label="当前权限边界">
+          <span class="boundary-dot" aria-hidden="true"></span>
+          <span>只读边界</span>
+          <strong>inspect · output</strong>
+        </div>
+      </header>
+
+      <main id="workspace" class="workspace">
+        <section class="control-deck" aria-labelledby="target-title">
+          <div class="section-heading">
+            <p class="eyebrow">Target coordinates</p>
+            <h2 id="target-title">定位一次诊断</h2>
+            <p>
+              输入已存在的 Project、源 Run 和诊断请求。页面不会创建、取消或重试任何任务。
+            </p>
+          </div>
+
+          <form id="session-form" class="session-gate" autocomplete="off">
+            <label for="session-token">浏览器访问密钥</label>
+            <div class="inline-control">
+              <input
+                id="session-token"
+                name="sessionToken"
+                type="password"
+                inputmode="text"
+                spellcheck="false"
+                autocomplete="off"
+                required
+                pattern="[A-Za-z0-9_\-]{43}"
+                aria-describedby="session-note"
+              />
+              <button type="submit">解锁本次页面</button>
+            </div>
+            <p id="session-note" class="field-note">
+              从独立的 0600 session 文件读取并粘贴；仅保留在当前页面内存，不会发送到 Cluster API。
+            </p>
+          </form>
+
+          <form id="target-form" class="target-form" autocomplete="off" hidden>
+            <label for="project-id">Project</label>
+            <input
+              id="project-id"
+              name="projectId"
+              type="text"
+              maxlength="128"
+              spellcheck="false"
+              autocomplete="off"
+              placeholder="project-main"
+              required
+            />
+
+            <label for="run-id">源 Run</label>
+            <input
+              id="run-id"
+              name="sourceRunId"
+              type="text"
+              maxlength="36"
+              spellcheck="false"
+              autocomplete="off"
+              placeholder="run_..."
+              required
+            />
+
+            <label for="request-id">诊断请求</label>
+            <input
+              id="request-id"
+              name="requestId"
+              type="text"
+              maxlength="128"
+              spellcheck="false"
+              autocomplete="off"
+              placeholder="diag-request-..."
+              required
+            />
+
+            <div class="actions">
+              <button id="inspect-button" class="primary" type="submit">
+                读取诊断状态
+              </button>
+              <button id="output-button" type="button" disabled>
+                显式读取诊断内容
+              </button>
+            </div>
+          </form>
+
+          <aside class="trust-note">
+            <span>Authority note</span>
+            <p>
+              Cluster credential 只存在于本机 BFF 的私有文件中。浏览器不能读取它，也不能调用 diagnose 或 cancel。
+            </p>
+          </aside>
+        </section>
+
+        <section class="evidence-panel" aria-labelledby="evidence-title">
+          <div class="evidence-header">
+            <div>
+              <p class="eyebrow">Durable evidence</p>
+              <h2 id="evidence-title">诊断轨迹</h2>
+            </div>
+            <span id="status-chip" class="status-chip" data-tone="idle">等待目标</span>
+          </div>
+
+          <div id="empty-state" class="empty-state">
+            <div class="empty-glyph" aria-hidden="true">
+              <span></span><span></span><span></span>
+            </div>
+            <h3>先读取状态，再决定是否查看内容</h3>
+            <p>
+              状态响应只包含有界、低敏的 durable facts。模型文本必须由你再次明确选择。
+            </p>
+          </div>
+
+          <div id="result-view" hidden>
+            <ol class="trace-rail" aria-label="诊断状态时间线">
+              <li>
+                <span class="trace-node"></span>
+                <div>
+                  <small>ADMITTED</small>
+                  <strong id="admitted-at">—</strong>
+                </div>
+              </li>
+              <li>
+                <span class="trace-node"></span>
+                <div>
+                  <small>STAGE</small>
+                  <strong id="stage">—</strong>
+                </div>
+              </li>
+              <li>
+                <span class="trace-node"></span>
+                <div>
+                  <small>OUTCOME</small>
+                  <strong id="outcome">—</strong>
+                </div>
+              </li>
+            </ol>
+
+            <dl class="fact-grid">
+              <div>
+                <dt>Diagnosis Run</dt>
+                <dd id="diagnosis-run">—</dd>
+              </div>
+              <div>
+                <dt>Reason</dt>
+                <dd id="reason">—</dd>
+              </div>
+              <div>
+                <dt>Tokens</dt>
+                <dd id="tokens">—</dd>
+              </div>
+              <div>
+                <dt>Settled cost</dt>
+                <dd id="cost">—</dd>
+              </div>
+            </dl>
+
+            <section id="output-panel" class="output-panel" hidden>
+              <div class="output-heading">
+                <div>
+                  <p class="eyebrow">Explicit content read</p>
+                  <h3>诊断内容</h3>
+                </div>
+                <span>不可信模型输出</span>
+              </div>
+              <pre id="output-text" tabindex="0"></pre>
+              <dl class="output-meta">
+                <div>
+                  <dt>Finish reason</dt>
+                  <dd id="finish-reason">—</dd>
+                </div>
+                <div>
+                  <dt>Output bytes</dt>
+                  <dd id="output-bytes">—</dd>
+                </div>
+                <div>
+                  <dt>Content digest</dt>
+                  <dd id="content-digest">—</dd>
+                </div>
+              </dl>
+            </section>
+          </div>
+
+          <div id="message" class="message" role="status" aria-live="polite"></div>
+        </section>
+      </main>
+
+      <footer>
+        <span>Loopback only · no legacy session · no browser credential</span>
+        <span>QingLong 3.0 incubation / D-327</span>
+      </footer>
+    </div>
+  </body>
+</html>

packages/ql3-cluster-admin/package.json

@@ -2,7 +2,7 @@
   "name": "@qinglong/cluster-admin",
   "version": "3.0.0-alpha.0",
   "private": true,
-  "description": "QingLong 3.0 cluster operations and bounded Copilot MCP surface",
+  "description": "QingLong 3.0 cluster operations and bounded Copilot MCP/Console surfaces",
   "license": "Apache-2.0",
   "engines": {
     "node": ">=24.18.0 <25"
@@ -384,11 +384,17 @@
       "types": "./dist/copilot-mcp/server.d.ts",
       "require": "./dist/copilot-mcp/server.js",
       "default": "./dist/copilot-mcp/server.js"
+    },
+    "./copilot-console": {
+      "types": "./dist/copilot-console/server.d.ts",
+      "require": "./dist/copilot-console/server.js",
+      "default": "./dist/copilot-console/server.js"
     }
   },
   "files": [
     "dist/**/*.js",
-    "dist/**/*.d.ts"
+    "dist/**/*.d.ts",
+    "assets/copilot-console/*"
   ],
   "scripts": {
     "build": "tsc -p tsconfig.json",
@@ -400,6 +406,7 @@
     "ql3-cluster-admin": "dist/product-cli/cli.js",
     "ql3-copilot-client": "dist/copilot-client/cli.js",
     "ql3-copilot-mcp": "dist/copilot-mcp/cli.js",
+    "ql3-copilot-console": "dist/copilot-console/cli.js",
     "ql3-plugin-package-recover": "dist/plugin-package/recovery/pluginPackageRecoveryCli.js",
     "ql3-plugin-package-manage": "dist/plugin-package/management/pluginPackageManagementCli.js",
     "ql3-plugin-package-client": "dist/plugin-package/management/pluginPackageManagementClientCli.js",

packages/ql3-cluster-admin/src/copilot-console/assets.ts

@@ -0,0 +1,141 @@
+import { createHash } from 'node:crypto';
+import {
+  lstatSync,
+  readFileSync,
+  realpathSync,
+  type PathLike,
+} from 'node:fs';
+import { isAbsolute, relative, resolve, sep } from 'node:path';
+import { TextDecoder } from 'node:util';
+
+export interface ClusterCopilotConsoleAssets {
+  readonly html: string;
+  readonly css: string;
+  readonly javascript: string;
+}
+
+export class ClusterCopilotConsoleAssetError extends Error {
+  readonly code = 'QL3_CLUSTER_COPILOT_CONSOLE_ASSET_INVALID';
+
+  constructor() {
+    super('Cluster Copilot Console asset is invalid');
+    this.name = 'ClusterCopilotConsoleAssetError';
+  }
+}
+
+const ASSETS = Object.freeze([
+  Object.freeze({
+    name: 'index.html',
+    field: 'html',
+    maximumBytes: 32 * 1024,
+    digest: 'f9fa959f30b92c6b000eecb744ce1d0a7fce822c62b3e17dcf10d4d579a072ac',
+  }),
+  Object.freeze({
+    name: 'app.css',
+    field: 'css',
+    maximumBytes: 64 * 1024,
+    digest: '200c3405e1e12329fcfb50509b31b19f1567a91552865f039ce0c2de1530032c',
+  }),
+  Object.freeze({
+    name: 'app.js',
+    field: 'javascript',
+    maximumBytes: 32 * 1024,
+    digest: 'd60913e725e767d9fa2cb65d60c0eae6d75d219f4bec8aad166bed8b6507fe02',
+  }),
+] as const);
+
+function invalid(): never {
+  throw new ClusterCopilotConsoleAssetError();
+}
+
+function inside(parent: string, candidate: string): boolean {
+  const pathFromParent = relative(parent, candidate);
+  return (
+    pathFromParent !== '' &&
+    pathFromParent !== '..' &&
+    !pathFromParent.startsWith('..' + sep) &&
+    !isAbsolute(pathFromParent)
+  );
+}
+
+function readAsset(
+  assetRoot: string,
+  name: string,
+  maximumBytes: number,
+  digest: string,
+): string {
+  const candidate = resolve(assetRoot, name);
+  const status = lstatSync(candidate, { throwIfNoEntry: false });
+  if (
+    status === undefined ||
+    !status.isFile() ||
+    status.isSymbolicLink() ||
+    status.size < 1 ||
+    status.size > maximumBytes
+  ) {
+    return invalid();
+  }
+  const canonicalRoot = realpathSync(assetRoot);
+  const canonicalCandidate = realpathSync(candidate);
+  if (
+    !inside(canonicalRoot, canonicalCandidate) ||
+    canonicalCandidate !== resolve(canonicalRoot, name)
+  ) {
+    return invalid();
+  }
+  let bytes: Buffer | undefined;
+  try {
+    bytes = readFileSync(candidate as PathLike);
+    if (
+      bytes.byteLength !== status.size ||
+      createHash('sha256').update(bytes).digest('hex') !== digest ||
+      bytes.includes(0)
+    ) {
+      return invalid();
+    }
+    return new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+  } catch (error) {
+    if (error instanceof ClusterCopilotConsoleAssetError) throw error;
+    return invalid();
+  } finally {
+    bytes?.fill(0);
+  }
+}
+
+export function loadClusterCopilotConsoleAssets(
+  moduleDirectory: string,
+): Readonly<ClusterCopilotConsoleAssets> {
+  if (typeof moduleDirectory !== 'string' || !isAbsolute(moduleDirectory)) {
+    return invalid();
+  }
+  const packageRoot = resolve(moduleDirectory, '..', '..');
+  const assetRoot = resolve(packageRoot, 'assets', 'copilot-console');
+  const packageStatus = lstatSync(packageRoot, { throwIfNoEntry: false });
+  const assetStatus = lstatSync(assetRoot, { throwIfNoEntry: false });
+  if (
+    packageStatus === undefined ||
+    !packageStatus.isDirectory() ||
+    packageStatus.isSymbolicLink() ||
+    assetStatus === undefined ||
+    !assetStatus.isDirectory() ||
+    assetStatus.isSymbolicLink() ||
+    realpathSync(assetRoot) !==
+      resolve(realpathSync(packageRoot), 'assets', 'copilot-console')
+  ) {
+    return invalid();
+  }
+  const result: Record<string, string> = {};
+  for (const asset of ASSETS) {
+    result[asset.field] = readAsset(
+      assetRoot,
+      asset.name,
+      asset.maximumBytes,
+      asset.digest,
+    );
+  }
+  return Object.freeze({
+    html: result.html!,
+    css: result.css!,
+    javascript: result.javascript!,
+  });
+}

packages/ql3-cluster-admin/src/copilot-console/cli.ts

@@ -0,0 +1,245 @@
+#!/usr/bin/env node
+
+import {
+  executeClusterCopilotCommand,
+  probeClusterCopilotClientReadiness,
+  validateClusterCopilotClientConfiguration,
+  validateClusterCopilotClientCredentialFile,
+  type ClusterCopilotClientCommand,
+} from '../copilot-client/client';
+import { readCanonicalFile } from '../management-support/managementClientConfiguration';
+import { loadClusterCopilotConsoleAssets } from './assets';
+import {
+  clusterCopilotConsoleSessionDigest,
+  startClusterCopilotConsoleServer,
+} from './server';
+
+const USAGE = [
+  'Usage:',
+  '  ql3-copilot-console --config /absolute/client.json --credential /absolute/credential --session /absolute/session [--port=0..65535]',
+  '  ql3-copilot-console --check --config /absolute/client.json --credential /absolute/credential --session /absolute/session',
+  '',
+  'The Console binds only 127.0.0.1 and exposes inspect/output reads.',
+  'The browser session key remains in a separate owner-private 0600 file.',
+].join('\n');
+
+interface ClusterCopilotConsoleCliArguments {
+  readonly check: boolean;
+  readonly configFile: string;
+  readonly credentialFile: string;
+  readonly sessionFile: string;
+  readonly port: number;
+}
+
+const SESSION_TOKEN = /^[A-Za-z0-9_-]{43}$/;
+const MAXIMUM_SESSION_BYTES = 128;
+
+function usageFailure(): never {
+  process.stderr.write(USAGE + '\n');
+  process.exit(64);
+}
+
+function argumentValue(
+  argv: readonly string[],
+  index: number,
+  name: string,
+): Readonly<{ value: string; consumed: number }> | null {
+  const current = argv[index];
+  if (current === name) {
+    const next = argv[index + 1];
+    if (typeof next !== 'string' || next === '' || next.startsWith('--')) {
+      return usageFailure();
+    }
+    return Object.freeze({ value: next, consumed: 2 });
+  }
+  const prefix = name + '=';
+  if (current?.startsWith(prefix) && current.length > prefix.length) {
+    return Object.freeze({
+      value: current.slice(prefix.length),
+      consumed: 1,
+    });
+  }
+  return null;
+}
+
+export function parseClusterCopilotConsoleCliArguments(
+  argv: readonly string[],
+): Readonly<ClusterCopilotConsoleCliArguments> {
+  let check = false;
+  let configFile: string | undefined;
+  let credentialFile: string | undefined;
+  let sessionFile: string | undefined;
+  let port = 0;
+  let portSeen = false;
+  for (let index = 0; index < argv.length; ) {
+    const current = argv[index];
+    if (current === '--check' && !check) {
+      check = true;
+      index += 1;
+      continue;
+    }
+    const config = argumentValue(argv, index, '--config');
+    if (config) {
+      if (configFile !== undefined) return usageFailure();
+      configFile = config.value;
+      index += config.consumed;
+      continue;
+    }
+    const credential = argumentValue(argv, index, '--credential');
+    if (credential) {
+      if (credentialFile !== undefined) return usageFailure();
+      credentialFile = credential.value;
+      index += credential.consumed;
+      continue;
+    }
+    const session = argumentValue(argv, index, '--session');
+    if (session) {
+      if (sessionFile !== undefined) return usageFailure();
+      sessionFile = session.value;
+      index += session.consumed;
+      continue;
+    }
+    const portArgument = argumentValue(argv, index, '--port');
+    if (portArgument) {
+      if (portSeen || !/^(?:0|[1-9][0-9]{0,4})$/.test(portArgument.value)) {
+        return usageFailure();
+      }
+      portSeen = true;
+      port = Number(portArgument.value);
+      if (
+        !Number.isSafeInteger(port) ||
+        (port !== 0 && (port < 1_024 || port > 65_535))
+      ) {
+        return usageFailure();
+      }
+      index += portArgument.consumed;
+      continue;
+    }
+    return usageFailure();
+  }
+  if (
+    configFile === undefined ||
+    credentialFile === undefined ||
+    sessionFile === undefined ||
+    (check && port !== 0)
+  ) {
+    return usageFailure();
+  }
+  return Object.freeze({
+    check,
+    configFile,
+    credentialFile,
+    sessionFile,
+    port,
+  });
+}
+
+function readSessionDigest(sessionFile: string): Buffer {
+  let bytes: Buffer | undefined;
+  try {
+    bytes = readCanonicalFile(
+      sessionFile,
+      MAXIMUM_SESSION_BYTES,
+      'private',
+    );
+    if (
+      bytes.some((byte) => byte > 0x7f) ||
+      !SESSION_TOKEN.test(bytes.toString('ascii'))
+    ) {
+      throw new Error('invalid session token');
+    }
+    return clusterCopilotConsoleSessionDigest(bytes.toString('ascii'));
+  } finally {
+    bytes?.fill(0);
+  }
+}
+
+async function main(): Promise<void> {
+  if (
+    process.argv.length === 3 &&
+    (process.argv[2] === '--help' || process.argv[2] === '-h')
+  ) {
+    process.stdout.write(USAGE + '\n');
+    return;
+  }
+  const parsed = parseClusterCopilotConsoleCliArguments(process.argv.slice(2));
+  const assets = loadClusterCopilotConsoleAssets(__dirname);
+  validateClusterCopilotClientConfiguration(parsed.configFile);
+  validateClusterCopilotClientCredentialFile(parsed.credentialFile);
+  const sessionDigest = readSessionDigest(parsed.sessionFile);
+  if (parsed.check) {
+    try {
+      const readiness = await probeClusterCopilotClientReadiness(
+        parsed.configFile,
+      );
+      process.stdout.write(
+        JSON.stringify({
+          schemaVersion: 1,
+          component: 'qinglong3-cluster-copilot-console',
+          event: 'preflight_checked',
+          ready: readiness.ready,
+          listenAddress: '127.0.0.1',
+          browserCredential: 'forbidden',
+          clusterCredential: 'server_only',
+          operations: ['inspect', 'output'],
+          mutation: false,
+        }) + '\n',
+      );
+      if (!readiness.ready) process.exitCode = 69;
+      return;
+    } finally {
+      sessionDigest.fill(0);
+    }
+  }
+
+  const server = await startClusterCopilotConsoleServer({
+    assets,
+    executor: Object.freeze({
+      execute(command: Readonly<ClusterCopilotClientCommand>) {
+        return executeClusterCopilotCommand({
+          configFile: parsed.configFile,
+          credentialFile: parsed.credentialFile,
+          command,
+        });
+      },
+    }),
+    port: parsed.port,
+    sessionDigest,
+  });
+  sessionDigest.fill(0);
+  process.stdout.write(
+    JSON.stringify({
+      schemaVersion: 1,
+      component: 'qinglong3-cluster-copilot-console',
+      event: 'started',
+      origin: server.origin,
+      listenAddress: '127.0.0.1',
+      browserCredential: 'forbidden',
+      clusterCredential: 'server_only',
+      operations: ['inspect', 'output'],
+      mutation: false,
+    }) + '\n',
+  );
+
+  await new Promise<void>((resolve) => {
+    let stopping = false;
+    const stop = (): void => {
+      if (stopping) return;
+      stopping = true;
+      void server.close().finally(resolve);
+    };
+    process.once('SIGINT', stop);
+    process.once('SIGTERM', stop);
+  });
+}
+
+void main().catch(() => {
+  process.stderr.write(
+    JSON.stringify({
+      schemaVersion: 1,
+      component: 'qinglong3-cluster-copilot-console',
+      event: 'process_failed',
+    }) + '\n',
+  );
+  process.exitCode = 1;
+});

packages/ql3-cluster-admin/src/copilot-console/contracts.ts

@@ -0,0 +1,86 @@
+import {
+  CLUSTER_COPILOT_CLIENT_COMMAND_SCHEMA,
+  type ClusterCopilotClientCommand,
+} from '../copilot-client/contracts';
+
+export const CLUSTER_COPILOT_CONSOLE_READ_REQUEST_SCHEMA =
+  'qinglong/cluster-copilot-console-read-request@v1' as const;
+export const CLUSTER_COPILOT_CONSOLE_READ_RESPONSE_SCHEMA =
+  'qinglong/cluster-copilot-console-read-response@v1' as const;
+
+export type ClusterCopilotConsoleReadOperation = 'inspect' | 'output';
+
+export interface ClusterCopilotConsoleReadRequest {
+  readonly schema: typeof CLUSTER_COPILOT_CONSOLE_READ_REQUEST_SCHEMA;
+  readonly operation: ClusterCopilotConsoleReadOperation;
+  readonly projectId: string;
+  readonly sourceRunId: string;
+  readonly requestId: string;
+}
+
+export class InvalidClusterCopilotConsoleReadRequestError extends TypeError {
+  readonly code = 'QL3_CLUSTER_COPILOT_CONSOLE_READ_REQUEST_INVALID';
+
+  constructor() {
+    super('Cluster Copilot Console read request is invalid');
+    this.name = 'InvalidClusterCopilotConsoleReadRequestError';
+  }
+}
+
+const IDENTITY = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+const RUN_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,35}$/;
+
+function invalid(): never {
+  throw new InvalidClusterCopilotConsoleReadRequestError();
+}
+
+export function normalizeClusterCopilotConsoleReadRequest(
+  value: unknown,
+): Readonly<ClusterCopilotConsoleReadRequest> {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    return invalid();
+  }
+  const record = value as Record<string, unknown>;
+  const keys = Object.keys(record).sort();
+  const expected = [
+    'operation',
+    'projectId',
+    'requestId',
+    'schema',
+    'sourceRunId',
+  ];
+  if (
+    keys.length !== expected.length ||
+    keys.some((key, index) => key !== expected[index]) ||
+    record.schema !== CLUSTER_COPILOT_CONSOLE_READ_REQUEST_SCHEMA ||
+    (record.operation !== 'inspect' && record.operation !== 'output') ||
+    typeof record.projectId !== 'string' ||
+    !IDENTITY.test(record.projectId) ||
+    typeof record.sourceRunId !== 'string' ||
+    !RUN_ID.test(record.sourceRunId) ||
+    typeof record.requestId !== 'string' ||
+    !IDENTITY.test(record.requestId)
+  ) {
+    return invalid();
+  }
+  return Object.freeze({
+    schema: CLUSTER_COPILOT_CONSOLE_READ_REQUEST_SCHEMA,
+    operation: record.operation,
+    projectId: record.projectId,
+    sourceRunId: record.sourceRunId,
+    requestId: record.requestId,
+  });
+}
+
+export function clusterCopilotConsoleClientCommand(
+  request: Readonly<ClusterCopilotConsoleReadRequest>,
+): Readonly<ClusterCopilotClientCommand> {
+  const normalized = normalizeClusterCopilotConsoleReadRequest(request);
+  return Object.freeze({
+    schema: CLUSTER_COPILOT_CLIENT_COMMAND_SCHEMA,
+    operation: normalized.operation,
+    projectId: normalized.projectId,
+    sourceRunId: normalized.sourceRunId,
+    requestId: normalized.requestId,
+  });
+}

packages/ql3-cluster-admin/src/copilot-console/server.ts

@@ -0,0 +1,498 @@
+import { createHash, timingSafeEqual } from 'node:crypto';
+import {
+  createServer,
+  type IncomingMessage,
+  type ServerResponse,
+} from 'node:http';
+
+import {
+  ClusterCopilotClientConfigurationError,
+  ClusterCopilotClientRemoteError,
+  ClusterCopilotClientRequestError,
+  type ClusterCopilotClientCommand,
+  type ClusterCopilotClientResult,
+} from '../copilot-client/client';
+import {
+  type ClusterCopilotConsoleAssets,
+} from './assets';
+import {
+  CLUSTER_COPILOT_CONSOLE_READ_RESPONSE_SCHEMA,
+  InvalidClusterCopilotConsoleReadRequestError,
+  clusterCopilotConsoleClientCommand,
+  normalizeClusterCopilotConsoleReadRequest,
+} from './contracts';
+
+export const CLUSTER_COPILOT_CONSOLE_LIMITS = Object.freeze({
+  maximumBodyBytes: 4 * 1024,
+  maximumResponseBytes: 2 * 1024 * 1024 + 4 * 1024,
+  maximumConcurrentRequests: 2,
+  maximumConnections: 16,
+  shutdownTimeoutMs: 2_000,
+});
+
+export interface ClusterCopilotConsoleExecutor {
+  execute(
+    command: Readonly<ClusterCopilotClientCommand>,
+  ): Promise<Readonly<ClusterCopilotClientResult>>;
+}
+
+export interface ClusterCopilotConsoleServerOptions {
+  readonly assets: Readonly<ClusterCopilotConsoleAssets>;
+  readonly executor: ClusterCopilotConsoleExecutor;
+  readonly port: number;
+  readonly sessionDigest: Buffer;
+}
+
+export interface ClusterCopilotConsoleServer {
+  readonly origin: string;
+  close(): Promise<void>;
+}
+
+export class ClusterCopilotConsoleConfigurationError extends TypeError {
+  readonly code = 'QL3_CLUSTER_COPILOT_CONSOLE_CONFIG_INVALID';
+
+  constructor() {
+    super('Cluster Copilot Console configuration is invalid');
+    this.name = 'ClusterCopilotConsoleConfigurationError';
+  }
+}
+
+const SESSION_TOKEN = /^[A-Za-z0-9_-]{43}$/;
+const SESSION_DIGEST_DOMAIN = Buffer.from(
+  'qinglong-cluster-copilot-console-session-v1\0',
+  'utf8',
+);
+const CONTENT_SECURITY_POLICY = [
+  "default-src 'none'",
+  "base-uri 'none'",
+  "connect-src 'self'",
+  "form-action 'self'",
+  "frame-ancestors 'none'",
+  "script-src 'self'",
+  "style-src 'self'",
+  "img-src 'none'",
+  "font-src 'none'",
+  "object-src 'none'",
+  "media-src 'none'",
+  "manifest-src 'none'",
+  "worker-src 'none'",
+].join('; ');
+
+function invalid(): never {
+  throw new ClusterCopilotConsoleConfigurationError();
+}
+
+function exactObject(
+  value: unknown,
+  keys: readonly string[],
+): Record<string, unknown> {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    return invalid();
+  }
+  const record = value as Record<string, unknown>;
+  const actual = Object.keys(record).sort();
+  const expected = [...keys].sort();
+  if (
+    actual.length !== expected.length ||
+    actual.some((key, index) => key !== expected[index])
+  ) {
+    return invalid();
+  }
+  return record;
+}
+
+export function clusterCopilotConsoleSessionDigest(value: string): Buffer {
+  if (typeof value !== 'string' || !SESSION_TOKEN.test(value)) {
+    return invalid();
+  }
+  const decoded = Buffer.from(value, 'base64url');
+  if (
+    decoded.byteLength !== 32 ||
+    decoded.toString('base64url') !== value
+  ) {
+    decoded.fill(0);
+    return invalid();
+  }
+  decoded.fill(0);
+  return createHash('sha256')
+    .update(SESSION_DIGEST_DOMAIN)
+    .update(value, 'ascii')
+    .digest();
+}
+
+function securityHeaders(contentType: string): Readonly<Record<string, string>> {
+  return Object.freeze({
+    'cache-control': 'no-store',
+    'content-security-policy': CONTENT_SECURITY_POLICY,
+    'content-type': contentType,
+    'cross-origin-opener-policy': 'same-origin',
+    'cross-origin-resource-policy': 'same-origin',
+    'origin-agent-cluster': '?1',
+    'permissions-policy':
+      'camera=(), display-capture=(), geolocation=(), microphone=(), payment=(), usb=()',
+    'referrer-policy': 'no-referrer',
+    'x-content-type-options': 'nosniff',
+    'x-frame-options': 'DENY',
+  });
+}
+
+function send(
+  response: ServerResponse,
+  statusCode: number,
+  contentType: string,
+  body: string,
+  extraHeaders: Readonly<Record<string, string>> = {},
+): void {
+  const bytes = Buffer.from(body, 'utf8');
+  response.writeHead(statusCode, {
+    ...securityHeaders(contentType),
+    ...extraHeaders,
+    connection: 'close',
+    'content-length': String(bytes.byteLength),
+  });
+  response.end(bytes, () => bytes.fill(0));
+}
+
+function sendJson(
+  response: ServerResponse,
+  statusCode: number,
+  body: Readonly<Record<string, unknown>>,
+  extraHeaders: Readonly<Record<string, string>> = {},
+): void {
+  send(
+    response,
+    statusCode,
+    'application/json; charset=utf-8',
+    JSON.stringify(body),
+    extraHeaders,
+  );
+}
+
+function headerCount(request: IncomingMessage, name: string): number {
+  let count = 0;
+  for (let index = 0; index < request.rawHeaders.length; index += 2) {
+    if (request.rawHeaders[index]?.toLowerCase() === name) count += 1;
+  }
+  return count;
+}
+
+function targetPath(request: IncomingMessage): 'inspect' | 'output' | null {
+  if (request.method !== 'POST') return null;
+  if (request.url === '/api/v1/copilot/inspect') return 'inspect';
+  if (request.url === '/api/v1/copilot/output') return 'output';
+  return null;
+}
+
+function authorize(
+  request: IncomingMessage,
+  expectedOrigin: string,
+  sessionDigest: Buffer,
+): boolean {
+  if (
+    headerCount(request, 'authorization') !== 1 ||
+    headerCount(request, 'origin') !== 1 ||
+    request.headers.origin !== expectedOrigin ||
+    request.headers.host !== expectedOrigin.slice('http://'.length)
+  ) {
+    return false;
+  }
+  const authorization = request.headers.authorization;
+  if (
+    typeof authorization !== 'string' ||
+    !authorization.startsWith('QL3-Console ')
+  ) {
+    return false;
+  }
+  let candidate: Buffer | undefined;
+  try {
+    candidate = clusterCopilotConsoleSessionDigest(
+      authorization.slice('QL3-Console '.length),
+    );
+    return timingSafeEqual(candidate, sessionDigest);
+  } catch {
+    return false;
+  } finally {
+    candidate?.fill(0);
+  }
+}
+
+async function readJsonBody(request: IncomingMessage): Promise<unknown> {
+  if (
+    headerCount(request, 'content-type') !== 1 ||
+    headerCount(request, 'content-length') !== 1 ||
+    request.headers['content-type'] !== 'application/json; charset=utf-8' ||
+    request.headers['content-encoding'] !== undefined ||
+    request.headers['transfer-encoding'] !== undefined ||
+    typeof request.headers['content-length'] !== 'string' ||
+    !/^[1-9][0-9]*$/.test(request.headers['content-length'])
+  ) {
+    throw new InvalidClusterCopilotConsoleReadRequestError();
+  }
+  const expectedLength = Number(request.headers['content-length']);
+  if (
+    !Number.isSafeInteger(expectedLength) ||
+    expectedLength < 2 ||
+    expectedLength > CLUSTER_COPILOT_CONSOLE_LIMITS.maximumBodyBytes
+  ) {
+    throw new InvalidClusterCopilotConsoleReadRequestError();
+  }
+  const chunks: Buffer[] = [];
+  let length = 0;
+  try {
+    for await (const chunk of request) {
+      const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      length += bytes.byteLength;
+      if (
+        length > expectedLength ||
+        length > CLUSTER_COPILOT_CONSOLE_LIMITS.maximumBodyBytes
+      ) {
+        throw new InvalidClusterCopilotConsoleReadRequestError();
+      }
+      chunks.push(bytes);
+    }
+    if (request.aborted || length !== expectedLength) {
+      throw new InvalidClusterCopilotConsoleReadRequestError();
+    }
+    const body = Buffer.concat(chunks, length);
+    try {
+      return JSON.parse(body.toString('utf8'));
+    } finally {
+      body.fill(0);
+    }
+  } catch (error) {
+    if (error instanceof InvalidClusterCopilotConsoleReadRequestError) {
+      throw error;
+    }
+    throw new InvalidClusterCopilotConsoleReadRequestError();
+  } finally {
+    for (const chunk of chunks) chunk.fill(0);
+  }
+}
+
+function remoteFailure(
+  response: ServerResponse,
+  error: ClusterCopilotClientRemoteError,
+): void {
+  const statusCode =
+    error.statusCode === 404
+      ? 404
+      : error.statusCode === 429
+        ? 429
+        : 502;
+  sendJson(
+    response,
+    statusCode,
+    Object.freeze({
+      schema: CLUSTER_COPILOT_CONSOLE_READ_RESPONSE_SCHEMA,
+      code: error.responseCode,
+      requestId: error.requestId,
+      retryAfterSeconds: error.retryAfterSeconds,
+    }),
+    error.retryAfterSeconds === null
+      ? {}
+      : { 'retry-after': String(error.retryAfterSeconds) },
+  );
+}
+
+export async function startClusterCopilotConsoleServer(
+  options: ClusterCopilotConsoleServerOptions,
+): Promise<Readonly<ClusterCopilotConsoleServer>> {
+  const record = exactObject(options, [
+    'assets',
+    'executor',
+    'port',
+    'sessionDigest',
+  ]);
+  const assets = exactObject(record.assets, ['css', 'html', 'javascript']);
+  if (
+    typeof assets.html !== 'string' ||
+    assets.html.length < 1 ||
+    typeof assets.css !== 'string' ||
+    assets.css.length < 1 ||
+    typeof assets.javascript !== 'string' ||
+    assets.javascript.length < 1 ||
+    !record.executor ||
+    typeof (record.executor as ClusterCopilotConsoleExecutor).execute !==
+      'function' ||
+    !Number.isSafeInteger(record.port) ||
+    ((record.port as number) !== 0 &&
+      ((record.port as number) < 1_024 || (record.port as number) > 65_535)) ||
+    !Buffer.isBuffer(record.sessionDigest) ||
+    (record.sessionDigest as Buffer).byteLength !== 32
+  ) {
+    return invalid();
+  }
+  const sessionDigest = Buffer.from(record.sessionDigest as Buffer);
+  const executor = record.executor as ClusterCopilotConsoleExecutor;
+  let expectedOrigin = '';
+  let inFlight = 0;
+  let closed = false;
+
+  const server = createServer(async (request, response) => {
+    response.shouldKeepAlive = false;
+    const hostMatches =
+      expectedOrigin !== '' &&
+      request.headers.host === expectedOrigin.slice('http://'.length);
+    if (request.method === 'GET' && hostMatches) {
+      if (request.url === '/') {
+        send(response, 200, 'text/html; charset=utf-8', assets.html as string);
+        return;
+      }
+      if (request.url === '/app.css') {
+        send(response, 200, 'text/css; charset=utf-8', assets.css as string);
+        return;
+      }
+      if (request.url === '/app.js') {
+        send(
+          response,
+          200,
+          'text/javascript; charset=utf-8',
+          assets.javascript as string,
+        );
+        return;
+      }
+    }
+
+    const operation = targetPath(request);
+    if (
+      !hostMatches ||
+      operation === null ||
+      !authorize(request, expectedOrigin, sessionDigest)
+    ) {
+      sendJson(response, 404, Object.freeze({ code: 'not_found' }));
+      request.resume();
+      return;
+    }
+    if (
+      inFlight >= CLUSTER_COPILOT_CONSOLE_LIMITS.maximumConcurrentRequests
+    ) {
+      sendJson(
+        response,
+        429,
+        Object.freeze({
+          schema: CLUSTER_COPILOT_CONSOLE_READ_RESPONSE_SCHEMA,
+          code: 'cluster_copilot_console_busy',
+        }),
+        { 'retry-after': '1' },
+      );
+      request.resume();
+      return;
+    }
+
+    inFlight += 1;
+    try {
+      const body = await readJsonBody(request);
+      const normalized = normalizeClusterCopilotConsoleReadRequest(body);
+      if (normalized.operation !== operation) {
+        throw new InvalidClusterCopilotConsoleReadRequestError();
+      }
+      const result = await executor.execute(
+        clusterCopilotConsoleClientCommand(normalized),
+      );
+      const envelope = Object.freeze({
+        schema: CLUSTER_COPILOT_CONSOLE_READ_RESPONSE_SCHEMA,
+        operation,
+        requestId: result.requestId,
+        result,
+      });
+      const encoded = JSON.stringify(envelope);
+      if (
+        Buffer.byteLength(encoded, 'utf8') >
+        CLUSTER_COPILOT_CONSOLE_LIMITS.maximumResponseBytes
+      ) {
+        throw new ClusterCopilotClientRequestError();
+      }
+      send(
+        response,
+        200,
+        'application/json; charset=utf-8',
+        encoded,
+      );
+    } catch (error) {
+      if (response.headersSent) {
+        response.destroy();
+      } else if (
+        error instanceof InvalidClusterCopilotConsoleReadRequestError
+      ) {
+        sendJson(
+          response,
+          400,
+          Object.freeze({
+            schema: CLUSTER_COPILOT_CONSOLE_READ_RESPONSE_SCHEMA,
+            code: 'invalid_cluster_copilot_console_read_request',
+          }),
+        );
+      } else if (error instanceof ClusterCopilotClientRemoteError) {
+        remoteFailure(response, error);
+      } else if (
+        error instanceof ClusterCopilotClientConfigurationError ||
+        error instanceof ClusterCopilotClientRequestError
+      ) {
+        sendJson(
+          response,
+          503,
+          Object.freeze({
+            schema: CLUSTER_COPILOT_CONSOLE_READ_RESPONSE_SCHEMA,
+            code: 'cluster_copilot_console_upstream_unavailable',
+          }),
+        );
+      } else {
+        sendJson(
+          response,
+          503,
+          Object.freeze({
+            schema: CLUSTER_COPILOT_CONSOLE_READ_RESPONSE_SCHEMA,
+            code: 'cluster_copilot_console_unavailable',
+          }),
+        );
+      }
+    } finally {
+      inFlight -= 1;
+    }
+  });
+
+  server.maxConnections = CLUSTER_COPILOT_CONSOLE_LIMITS.maximumConnections;
+  server.headersTimeout = 5_000;
+  server.requestTimeout = 5_000;
+  server.keepAliveTimeout = 1;
+  server.maxRequestsPerSocket = 1;
+  server.on('clientError', (_error, socket) => socket.destroy());
+
+  try {
+    await new Promise<void>((resolve, reject) => {
+      server.once('error', reject);
+      server.listen(record.port as number, '127.0.0.1', () => {
+        server.off('error', reject);
+        resolve();
+      });
+    });
+    const address = server.address();
+    if (!address || typeof address === 'string') return invalid();
+    expectedOrigin = 'http://127.0.0.1:' + String(address.port);
+  } catch (error) {
+    sessionDigest.fill(0);
+    server.closeAllConnections();
+    if (error instanceof ClusterCopilotConsoleConfigurationError) throw error;
+    throw new ClusterCopilotConsoleConfigurationError();
+  }
+
+  return Object.freeze({
+    origin: expectedOrigin,
+    async close(): Promise<void> {
+      if (closed) return;
+      closed = true;
+      await new Promise<void>((resolve) => {
+        const timeout = setTimeout(() => {
+          server.closeAllConnections();
+        }, CLUSTER_COPILOT_CONSOLE_LIMITS.shutdownTimeoutMs);
+        timeout.unref();
+        server.close(() => {
+          clearTimeout(timeout);
+          resolve();
+        });
+        server.closeIdleConnections();
+      });
+      sessionDigest.fill(0);
+    },
+  });
+}

packages/ql3-cluster-admin/src/product-cli/productCommand.ts

@@ -46,6 +46,12 @@ export const QINGLONG3_CLUSTER_PRODUCT_COMMANDS: readonly QingLong3ClusterProduc
       target: 'copilot-mcp/cli.js',
       description: 'serve the bounded Cluster Copilot MCP over stdio',
     }),
+    Object.freeze({
+      name: 'copilot-console',
+      binary: 'ql3-copilot-console',
+      target: 'copilot-console/cli.js',
+      description: 'open the loopback-only read-only Copilot Console',
+    }),
     Object.freeze({
       name: 'package',
       binary: 'ql3-plugin-package-client',
@@ -192,7 +198,7 @@ export function qingLong3ClusterProductHelp(): string {
     '',
     'Use `ql3-cluster-admin <command> --help` for command-specific usage.',
     'Use `--context=/absolute/operator-context.json` only with remote client commands.',
-    'Keep the MCP config explicit; it contains stable paths to a separately rotated credential.',
+    'Keep MCP and Console authority explicit; neither belongs in operator context.',
     'Command and short-lived assertion files always remain explicit per invocation.',
     'Server, migration, recovery, executor and key-custody authorities remain isolated.',
   ].join('\n');

packages/ql3-cluster-admin/test/copilotConsole.test.cjs

@@ -0,0 +1,412 @@
+const assert = require('node:assert/strict');
+const { randomBytes } = require('node:crypto');
+const { request: httpRequest } = require('node:http');
+const { mkdtemp, mkdir, cp, writeFile } = require('node:fs/promises');
+const { tmpdir } = require('node:os');
+const { join, resolve } = require('node:path');
+const test = require('node:test');
+
+const {
+  ClusterCopilotClientRemoteError,
+} = require('../dist/copilot-client/client.js');
+const {
+  ClusterCopilotConsoleAssetError,
+  loadClusterCopilotConsoleAssets,
+} = require('../dist/copilot-console/assets.js');
+const {
+  CLUSTER_COPILOT_CONSOLE_READ_REQUEST_SCHEMA,
+  clusterCopilotConsoleClientCommand,
+  normalizeClusterCopilotConsoleReadRequest,
+} = require('../dist/copilot-console/contracts.js');
+const {
+  clusterCopilotConsoleSessionDigest,
+  startClusterCopilotConsoleServer,
+} = require('../dist/copilot-console/server.js');
+
+const moduleDirectory = resolve(__dirname, '../dist/copilot-console');
+
+function target(operation = 'inspect') {
+  return {
+    schema: CLUSTER_COPILOT_CONSOLE_READ_REQUEST_SCHEMA,
+    operation,
+    projectId: 'project-main',
+    sourceRunId: 'run-source-1',
+    requestId: 'diagnosis-request-1',
+  };
+}
+
+function inspection() {
+  return {
+    schemaVersion: 1,
+    operation: 'inspect',
+    requestId: 'transport-read-1',
+    result: {
+      schema: 'qinglong/cluster-copilot-failure-diagnosis-inspection-response@v1',
+      status: 'terminal',
+      projectId: 'project-main',
+      sourceRunId: 'run-source-1',
+      requestId: 'diagnosis-request-1',
+      diagnosisRunId: 'run-diagnosis-1',
+      outcome: 'succeeded',
+      stage: 'model',
+      reason: null,
+      outputAvailable: true,
+      admittedAtMs: 1_700_000_000_000,
+      finalizedAtMs: 1_700_000_001_000,
+      usage: {
+        inputTokens: 20,
+        outputTokens: 10,
+        totalTokens: 30,
+        currency: 'USD',
+        costMicros: 42,
+      },
+    },
+  };
+}
+
+function output() {
+  const text = '<script>never execute</script>';
+  return {
+    schemaVersion: 1,
+    operation: 'output',
+    requestId: 'transport-read-2',
+    result: {
+      schema: 'qinglong/cluster-copilot-failure-diagnosis-output-read-response@v1',
+      status: 'available',
+      projectId: 'project-main',
+      sourceRunId: 'run-source-1',
+      requestId: 'diagnosis-request-1',
+      diagnosisRunId: 'run-diagnosis-1',
+      reference: {
+        artifactId: 'artifact-diagnosis-1',
+        artifactDigest: 'a'.repeat(64),
+        contentDigest: 'b'.repeat(64),
+        outputBytes: Buffer.byteLength(text),
+        sealedAtMs: 1_700_000_001_000,
+      },
+      result: {
+        text,
+        finishReason: 'stop',
+        usage: {
+          inputTokens: 20,
+          outputTokens: 10,
+          totalTokens: 30,
+          costMicros: 42,
+        },
+      },
+    },
+  };
+}
+
+function request(origin, options = {}) {
+  const url = new URL(origin);
+  const body =
+    options.body === undefined
+      ? undefined
+      : Buffer.from(JSON.stringify(options.body), 'utf8');
+  return new Promise((resolve, reject) => {
+    const outgoing = httpRequest(
+      {
+        hostname: '127.0.0.1',
+        port: Number(url.port),
+        method: options.method || 'GET',
+        path: options.path || '/',
+        agent: false,
+        headers: {
+          ...(options.headers || {}),
+          ...(body === undefined
+            ? {}
+            : {
+                'content-type': 'application/json; charset=utf-8',
+                'content-length': String(body.length),
+              }),
+        },
+      },
+      (incoming) => {
+        const chunks = [];
+        incoming.on('data', (chunk) => chunks.push(chunk));
+        incoming.on('end', () => {
+          const bytes = Buffer.concat(chunks);
+          const text = bytes.toString('utf8');
+          resolve({
+            statusCode: incoming.statusCode,
+            headers: incoming.headers,
+            text,
+            body:
+              incoming.headers['content-type'] ===
+              'application/json; charset=utf-8'
+                ? JSON.parse(text)
+                : null,
+          });
+        });
+      },
+    );
+    outgoing.once('error', reject);
+    if (body !== undefined) outgoing.end(body);
+    else outgoing.end();
+  });
+}
+
+async function fixture(execute = async () => inspection()) {
+  const token = randomBytes(32).toString('base64url');
+  const server = await startClusterCopilotConsoleServer({
+    assets: loadClusterCopilotConsoleAssets(moduleDirectory),
+    executor: { execute },
+    port: 0,
+    sessionDigest: clusterCopilotConsoleSessionDigest(token),
+  });
+  return {
+    token,
+    server,
+    headers: {
+      authorization: 'QL3-Console ' + token,
+      origin: server.origin,
+    },
+  };
+}
+
+test('normalizes only the two read operations into the shared client contract', () => {
+  assert.deepEqual(
+    clusterCopilotConsoleClientCommand(
+      normalizeClusterCopilotConsoleReadRequest(target('inspect')),
+    ),
+    {
+      schema: 'qinglong/cluster-copilot-client-command@v1',
+      operation: 'inspect',
+      projectId: 'project-main',
+      sourceRunId: 'run-source-1',
+      requestId: 'diagnosis-request-1',
+    },
+  );
+  assert.equal(
+    clusterCopilotConsoleClientCommand(target('output')).operation,
+    'output',
+  );
+  assert.throws(
+    () =>
+      normalizeClusterCopilotConsoleReadRequest({
+        ...target(),
+        operation: 'diagnose',
+      }),
+    { code: 'QL3_CLUSTER_COPILOT_CONSOLE_READ_REQUEST_INVALID' },
+  );
+  assert.throws(
+    () =>
+      normalizeClusterCopilotConsoleReadRequest({
+        ...target(),
+        mutationId: 'forbidden',
+      }),
+    { code: 'QL3_CLUSTER_COPILOT_CONSOLE_READ_REQUEST_INVALID' },
+  );
+});
+
+test('loads only digest-bound packaged assets and rejects drift', async (t) => {
+  const assets = loadClusterCopilotConsoleAssets(moduleDirectory);
+  assert.match(assets.html, /故障诊断，不替你执行/);
+  assert.match(assets.css, /prefers-reduced-motion/);
+  assert.match(assets.javascript, /textContent = fact\.result\.text/);
+  assert.doesNotMatch(assets.javascript, /localStorage|sessionStorage|innerHTML/);
+
+  const root = await mkdtemp(join(tmpdir(), 'ql3-console-assets-'));
+  t.after(() => require('node:fs').rmSync(root, { recursive: true, force: true }));
+  const fakeModuleDirectory = join(root, 'dist', 'copilot-console');
+  await mkdir(fakeModuleDirectory, { recursive: true });
+  await cp(
+    resolve(moduleDirectory, '../../assets'),
+    join(root, 'assets'),
+    { recursive: true },
+  );
+  await writeFile(
+    join(root, 'assets', 'copilot-console', 'app.js'),
+    '"drift";\n',
+  );
+  assert.throws(
+    () => loadClusterCopilotConsoleAssets(fakeModuleDirectory),
+    ClusterCopilotConsoleAssetError,
+  );
+});
+
+test('serves an immutable same-origin shell with a closed browser policy', async (t) => {
+  const { server } = await fixture();
+  t.after(() => server.close());
+  const html = await request(server.origin);
+  assert.equal(html.statusCode, 200);
+  assert.equal(html.headers['cache-control'], 'no-store');
+  assert.equal(html.headers['x-frame-options'], 'DENY');
+  assert.match(html.headers['content-security-policy'], /default-src 'none'/);
+  assert.match(html.headers['content-security-policy'], /connect-src 'self'/);
+  assert.match(html.text, /Cluster field console/);
+
+  const css = await request(server.origin, { path: '/app.css' });
+  const javascript = await request(server.origin, { path: '/app.js' });
+  assert.equal(css.statusCode, 200);
+  assert.equal(javascript.statusCode, 200);
+  assert.equal(javascript.headers['content-type'], 'text/javascript; charset=utf-8');
+});
+
+test('keeps the Cluster credential server-side and forwards one exact inspect', async (t) => {
+  const commands = [];
+  const { server, headers } = await fixture(async (command) => {
+    commands.push(command);
+    return inspection();
+  });
+  t.after(() => server.close());
+  const response = await request(server.origin, {
+    method: 'POST',
+    path: '/api/v1/copilot/inspect',
+    headers,
+    body: target('inspect'),
+  });
+  assert.equal(response.statusCode, 200);
+  assert.deepEqual(commands, [
+    {
+      schema: 'qinglong/cluster-copilot-client-command@v1',
+      operation: 'inspect',
+      projectId: 'project-main',
+      sourceRunId: 'run-source-1',
+      requestId: 'diagnosis-request-1',
+    },
+  ]);
+  assert.equal(
+    response.body.schema,
+    'qinglong/cluster-copilot-console-read-response@v1',
+  );
+  assert.equal(response.body.result.result.outputAvailable, true);
+  assert.doesNotMatch(response.text, /ql3c_|authorization|credential/i);
+});
+
+test('returns model text as JSON data only after an explicit output read', async (t) => {
+  const { server, headers } = await fixture(async (command) => {
+    assert.equal(command.operation, 'output');
+    return output();
+  });
+  t.after(() => server.close());
+  const response = await request(server.origin, {
+    method: 'POST',
+    path: '/api/v1/copilot/output',
+    headers,
+    body: target('output'),
+  });
+  assert.equal(response.statusCode, 200);
+  assert.equal(
+    response.body.result.result.result.text,
+    '<script>never execute</script>',
+  );
+  assert.equal(response.headers['content-type'], 'application/json; charset=utf-8');
+  assert.equal(response.headers['x-content-type-options'], 'nosniff');
+});
+
+test('masks wrong Host, Origin, session and every non-read route', async (t) => {
+  let calls = 0;
+  const { server, token, headers } = await fixture(async () => {
+    calls += 1;
+    return inspection();
+  });
+  t.after(() => server.close());
+  const cases = [
+    { ...headers, origin: 'https://attacker.example' },
+    { ...headers, authorization: 'QL3-Console ' + randomBytes(32).toString('base64url') },
+    { ...headers, host: 'attacker.example' },
+  ];
+  for (const candidate of cases) {
+    const response = await request(server.origin, {
+      method: 'POST',
+      path: '/api/v1/copilot/inspect',
+      headers: candidate,
+      body: target(),
+    });
+    assert.equal(response.statusCode, 404);
+    assert.deepEqual(response.body, { code: 'not_found' });
+  }
+  const mutation = await request(server.origin, {
+    method: 'POST',
+    path: '/api/v1/copilot/diagnose',
+    headers: {
+      authorization: 'QL3-Console ' + token,
+      origin: server.origin,
+    },
+    body: target(),
+  });
+  assert.equal(mutation.statusCode, 404);
+  assert.equal(calls, 0);
+});
+
+test('rejects widened and route-confused read bodies before upstream authority', async (t) => {
+  let calls = 0;
+  const { server, headers } = await fixture(async () => {
+    calls += 1;
+    return inspection();
+  });
+  t.after(() => server.close());
+  const widened = await request(server.origin, {
+    method: 'POST',
+    path: '/api/v1/copilot/inspect',
+    headers,
+    body: { ...target(), endpoint: 'https://attacker.example' },
+  });
+  const confused = await request(server.origin, {
+    method: 'POST',
+    path: '/api/v1/copilot/output',
+    headers,
+    body: target('inspect'),
+  });
+  assert.equal(widened.statusCode, 400);
+  assert.equal(confused.statusCode, 400);
+  assert.equal(calls, 0);
+});
+
+test('rejects a third concurrent read without a hidden queue', async (t) => {
+  const releases = [];
+  const { server, headers } = await fixture(
+    () =>
+      new Promise((resolve) => {
+        releases.push(() => resolve(inspection()));
+      }),
+  );
+  t.after(() => server.close());
+  const options = {
+    method: 'POST',
+    path: '/api/v1/copilot/inspect',
+    headers,
+    body: target(),
+  };
+  const first = request(server.origin, options);
+  const second = request(server.origin, options);
+  while (releases.length < 2) {
+    await new Promise((resolve) => setImmediate(resolve));
+  }
+  const third = await request(server.origin, options);
+  assert.equal(third.statusCode, 429);
+  assert.equal(third.body.code, 'cluster_copilot_console_busy');
+  assert.equal(releases.length, 2);
+  releases.splice(0).forEach((release) => release());
+  assert.equal((await first).statusCode, 200);
+  assert.equal((await second).statusCode, 200);
+});
+
+test('projects only bounded remote failure facts and closes idempotently', async () => {
+  const { server, headers } = await fixture(async () => {
+    throw new ClusterCopilotClientRemoteError(
+      429,
+      'project_read_rate_limited',
+      'transport-read-3',
+      7,
+    );
+  });
+  const response = await request(server.origin, {
+    method: 'POST',
+    path: '/api/v1/copilot/inspect',
+    headers,
+    body: target(),
+  });
+  assert.equal(response.statusCode, 429);
+  assert.deepEqual(response.body, {
+    schema: 'qinglong/cluster-copilot-console-read-response@v1',
+    code: 'project_read_rate_limited',
+    requestId: 'transport-read-3',
+    retryAfterSeconds: 7,
+  });
+  assert.equal(response.headers['retry-after'], '7');
+  await server.close();
+  await server.close();
+});

packages/ql3-cluster-admin/test/copilotConsoleCli.test.cjs

@@ -0,0 +1,261 @@
+const assert = require('node:assert/strict');
+const { spawn } = require('node:child_process');
+const { randomBytes } = require('node:crypto');
+const fs = require('node:fs');
+const { request: httpRequest } = require('node:http');
+const { createServer } = require('node:https');
+const os = require('node:os');
+const path = require('node:path');
+const { test } = require('node:test');
+
+const {
+  CLUSTER_COPILOT_CLIENT_CONFIG_SCHEMA,
+} = require('../dist/copilot-client/client.js');
+
+const packageRoot = path.resolve(__dirname, '..');
+const cliPath = path.join(packageRoot, 'dist', 'copilot-console', 'cli.js');
+const tlsFixture = path.resolve(
+  packageRoot,
+  '../ql3-cluster-control/test/fixtures/mtls',
+);
+const credential =
+  'ql3c_console_' + Buffer.alloc(32, 9).toString('base64url');
+
+function privateFile(directory, name, contents) {
+  const filePath = path.join(directory, name);
+  fs.writeFileSync(filePath, contents, { mode: 0o600 });
+  return fs.realpathSync(filePath);
+}
+
+function runCli(args) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, [cliPath, ...args], {
+      cwd: packageRoot,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    const stdout = [];
+    const stderr = [];
+    child.stdout.on('data', (chunk) => stdout.push(chunk));
+    child.stderr.on('data', (chunk) => stderr.push(chunk));
+    child.once('error', reject);
+    child.once('close', (status, signal) => {
+      resolve({
+        status,
+        signal,
+        stdout: Buffer.concat(stdout).toString('utf8'),
+        stderr: Buffer.concat(stderr).toString('utf8'),
+      });
+    });
+  });
+}
+
+function firstLine(stream) {
+  return new Promise((resolve, reject) => {
+    let buffered = '';
+    const receive = (chunk) => {
+      buffered += chunk.toString('utf8');
+      const newline = buffered.indexOf('\n');
+      if (newline === -1) return;
+      stream.off('data', receive);
+      stream.off('error', reject);
+      resolve(buffered.slice(0, newline));
+    };
+    stream.on('data', receive);
+    stream.once('error', reject);
+  });
+}
+
+function get(origin) {
+  const url = new URL(origin);
+  return new Promise((resolve, reject) => {
+    const request = httpRequest(
+      {
+        hostname: '127.0.0.1',
+        port: Number(url.port),
+        method: 'GET',
+        path: '/',
+        agent: false,
+      },
+      (response) => {
+        const chunks = [];
+        response.on('data', (chunk) => chunks.push(chunk));
+        response.on('end', () =>
+          resolve({
+            statusCode: response.statusCode,
+            body: Buffer.concat(chunks).toString('utf8'),
+          }),
+        );
+      },
+    );
+    request.once('error', reject);
+    request.end();
+  });
+}
+
+async function fixture(t) {
+  const directory = fs.realpathSync(
+    fs.mkdtempSync(path.join(os.tmpdir(), 'ql3-copilot-console-cli-')),
+  );
+  t.after(() => fs.rmSync(directory, { recursive: true, force: true }));
+  const requests = [];
+  const server = createServer(
+    {
+      key: fs.readFileSync(path.join(tlsFixture, 'server-key.pem')),
+      cert: fs.readFileSync(path.join(tlsFixture, 'server-cert.pem')),
+      minVersion: 'TLSv1.3',
+      maxVersion: 'TLSv1.3',
+    },
+    (request, response) => {
+      requests.push({
+        method: request.method,
+        path: request.url,
+        authorization: request.headers.authorization,
+        tls: request.socket.getProtocol(),
+      });
+      const bytes = Buffer.from('{"status":"ready"}', 'utf8');
+      response.writeHead(200, {
+        'content-type': 'application/json; charset=utf-8',
+        'content-length': String(bytes.byteLength),
+      });
+      response.end(bytes);
+    },
+  );
+  await new Promise((resolve, reject) => {
+    server.once('error', reject);
+    server.listen(0, '127.0.0.1', resolve);
+  });
+  t.after(
+    () =>
+      new Promise((resolve) => {
+        server.close(() => resolve());
+      }),
+  );
+  const caFile = privateFile(
+    directory,
+    'ca.pem',
+    fs.readFileSync(path.join(tlsFixture, 'ca-cert.pem')),
+  );
+  const configFile = privateFile(
+    directory,
+    'client.json',
+    JSON.stringify({
+      schema: CLUSTER_COPILOT_CLIENT_CONFIG_SCHEMA,
+      endpoint: `https://localhost:${server.address().port}/`,
+      servername: 'localhost',
+      caFile,
+      requestTimeoutMs: 2_000,
+    }),
+  );
+  return {
+    requests,
+    configFile,
+    credentialFile: privateFile(directory, 'credential', credential),
+    sessionFile: privateFile(
+      directory,
+      'session',
+      randomBytes(32).toString('base64url'),
+    ),
+  };
+}
+
+test('CLI exposes deterministic help and a low-sensitive failure surface', async () => {
+  const usage = [
+    'Usage:',
+    '  ql3-copilot-console --config /absolute/client.json --credential /absolute/credential --session /absolute/session [--port=0..65535]',
+    '  ql3-copilot-console --check --config /absolute/client.json --credential /absolute/credential --session /absolute/session',
+    '',
+    'The Console binds only 127.0.0.1 and exposes inspect/output reads.',
+    'The browser session key remains in a separate owner-private 0600 file.',
+  ].join('\n');
+  assert.deepEqual(await runCli(['--help']), {
+    status: 0,
+    signal: null,
+    stdout: usage + '\n',
+    stderr: '',
+  });
+  const failed = await runCli([
+    '--config',
+    '/private/operator/client-secret.json',
+    '--credential',
+    '/private/operator/cluster-secret',
+    '--session',
+    '/private/operator/browser-secret',
+  ]);
+  assert.equal(failed.status, 1);
+  assert.equal(failed.stdout, '');
+  assert.deepEqual(JSON.parse(failed.stderr), {
+    schemaVersion: 1,
+    component: 'qinglong3-cluster-copilot-console',
+    event: 'process_failed',
+  });
+  assert.doesNotMatch(failed.stderr, /client-secret|cluster-secret|browser-secret/);
+});
+
+test('preflight proves private authority and unauthenticated TLS 1.3 readiness', async (t) => {
+  const value = await fixture(t);
+  const result = await runCli([
+    '--check',
+    '--config',
+    value.configFile,
+    '--credential',
+    value.credentialFile,
+    '--session',
+    value.sessionFile,
+  ]);
+  assert.equal(result.status, 0);
+  assert.equal(result.stderr, '');
+  assert.deepEqual(JSON.parse(result.stdout), {
+    schemaVersion: 1,
+    component: 'qinglong3-cluster-copilot-console',
+    event: 'preflight_checked',
+    ready: true,
+    listenAddress: '127.0.0.1',
+    browserCredential: 'forbidden',
+    clusterCredential: 'server_only',
+    operations: ['inspect', 'output'],
+    mutation: false,
+  });
+  assert.deepEqual(value.requests, [
+    {
+      method: 'GET',
+      path: '/readyz',
+      authorization: undefined,
+      tls: 'TLSv1.3',
+    },
+  ]);
+});
+
+test('serve mode starts an ephemeral loopback origin and shuts down cleanly', async (t) => {
+  const value = await fixture(t);
+  const child = spawn(
+    process.execPath,
+    [
+      cliPath,
+      '--config',
+      value.configFile,
+      '--credential',
+      value.credentialFile,
+      '--session',
+      value.sessionFile,
+      '--port=0',
+    ],
+    { cwd: packageRoot, stdio: ['ignore', 'pipe', 'pipe'] },
+  );
+  t.after(() => {
+    if (child.exitCode === null && child.signalCode === null) child.kill('SIGKILL');
+  });
+  const started = JSON.parse(await firstLine(child.stdout));
+  assert.equal(started.event, 'started');
+  assert.match(started.origin, /^http:\/\/127\.0\.0\.1:[0-9]+$/);
+  assert.deepEqual(started.operations, ['inspect', 'output']);
+  assert.equal(started.mutation, false);
+  const shell = await get(started.origin);
+  assert.equal(shell.statusCode, 200);
+  assert.match(shell.body, /Cluster field console/);
+  child.kill('SIGTERM');
+  const result = await new Promise((resolve, reject) => {
+    child.once('error', reject);
+    child.once('close', (status, signal) => resolve({ status, signal }));
+  });
+  assert.deepEqual(result, { status: 0, signal: null });
+});

packages/ql3-cluster-admin/test/productCli.test.cjs

@@ -333,7 +333,7 @@ function validContextFixture(t) {
 
 test('catalog exposes only reviewed product entrypoints from the same package', () => {
   assert.equal(manifest.bin['ql3-cluster-admin'], 'dist/product-cli/cli.js');
-  assert.equal(QINGLONG3_CLUSTER_PRODUCT_COMMANDS.length, 9);
+  assert.equal(QINGLONG3_CLUSTER_PRODUCT_COMMANDS.length, 10);
   assert.equal(
     new Set(QINGLONG3_CLUSTER_PRODUCT_COMMANDS.map(({ name }) => name)).size,
     QINGLONG3_CLUSTER_PRODUCT_COMMANDS.length,
@@ -351,7 +351,8 @@ test('catalog exposes only reviewed product entrypoints from the same package',
     );
     assert.equal(
       command.binary.includes('-client') ||
-        command.binary === 'ql3-copilot-mcp',
+        command.binary === 'ql3-copilot-mcp' ||
+        command.binary === 'ql3-copilot-console',
       true,
     );
   }
@@ -380,6 +381,7 @@ test('help and version are bounded installation-derived product facts', () => {
   assert.match(help, /\n  run\s+retry or stop Runs/);
   assert.match(help, /\n  copilot\s+diagnose, inspect, read or cancel Runs/);
   assert.match(help, /\n  copilot-mcp\s+serve the bounded Cluster Copilot MCP/);
+  assert.match(help, /\n  copilot-console\s+open the loopback-only read-only/);
   assert.match(help, /Server, migration, recovery, executor and key-custody/);
   assert.equal(help.includes('plugin-package-manage'), false);
   assert.equal(

scripts/ql3-cluster-admin-product-live-contract.cjs

@@ -17,6 +17,10 @@ const COMMANDS = Object.freeze([
     name: 'copilot-mcp',
     usage: 'Usage: ql3-copilot-mcp --config ',
   }),
+  Object.freeze({
+    name: 'copilot-console',
+    usage: 'Usage:\n  ql3-copilot-console --config ',
+  }),
   Object.freeze({
     name: 'package',
     usage: 'Usage: ql3-plugin-package-client ',
@@ -206,6 +210,97 @@ process.stdout.write(JSON.stringify({ schemaVersion: 1, injected: true, contextP
   }
 }
 
+function runConsoleContract(image) {
+  const source = String.raw`
+const { spawn } = require('node:child_process');
+const { writeFileSync } = require('node:fs');
+const { get } = require('node:http');
+const { rootCertificates } = require('node:tls');
+const facade = '/opt/qinglong/node_modules/@qinglong/cluster-admin/dist/product-cli/cli.js';
+const config = '/tmp/copilot-client.json';
+const credential = '/tmp/copilot-credential';
+const session = '/tmp/copilot-session';
+writeFileSync('/tmp/ca.pem', rootCertificates[0], { mode: 0o600 });
+writeFileSync(config, JSON.stringify({ schema: 'qinglong/cluster-copilot-client-config@v1', endpoint: 'https://localhost:65535/', servername: 'localhost', caFile: '/tmp/ca.pem', requestTimeoutMs: 1000 }), { mode: 0o600 });
+writeFileSync(credential, 'ql3c_console_' + Buffer.alloc(32, 9).toString('base64url'), { mode: 0o600 });
+writeFileSync(session, 'A'.repeat(43), { mode: 0o600 });
+const child = spawn(process.execPath, [facade, 'copilot-console', '--config', config, '--credential', credential, '--session', session, '--port=0'], { stdio: ['ignore', 'pipe', 'pipe'] });
+let stdout = '';
+let settled = false;
+const timeout = setTimeout(() => finish(41), 5000);
+function finish(code) {
+  if (settled) return;
+  settled = true;
+  clearTimeout(timeout);
+  if (child.exitCode === null && child.signalCode === null) child.kill('SIGKILL');
+  process.exitCode = code;
+}
+child.once('error', () => finish(42));
+child.stdout.on('data', (chunk) => {
+  stdout += chunk.toString('utf8');
+  const newline = stdout.indexOf('\n');
+  if (newline === -1 || settled) return;
+  let started;
+  try { started = JSON.parse(stdout.slice(0, newline)); } catch { finish(43); return; }
+  if (started.event !== 'started' || !/^http:\/\/127\.0\.0\.1:[0-9]+$/.test(started.origin) || JSON.stringify(started.operations) !== JSON.stringify(['inspect', 'output']) || started.mutation !== false) { finish(44); return; }
+  get(started.origin, (response) => {
+    const chunks = [];
+    response.on('data', (chunk) => chunks.push(chunk));
+    response.once('end', () => {
+      const body = Buffer.concat(chunks).toString('utf8');
+      if (response.statusCode !== 200 || !body.includes('Cluster field console') || !body.includes('/app.css') || !body.includes('/app.js')) { finish(45); return; }
+      child.once('close', (status, signal) => {
+        if (status !== 0 || signal !== null) { finish(46); return; }
+        settled = true;
+        clearTimeout(timeout);
+        process.stdout.write(JSON.stringify({ loopback: true, assets: true, cleanShutdown: true }));
+      });
+      child.kill('SIGTERM');
+    });
+  }).once('error', () => finish(47));
+});
+`;
+  const output = docker([
+    'run',
+    '--rm',
+    '--read-only',
+    '--network',
+    'none',
+    '--cap-drop',
+    'ALL',
+    '--security-opt',
+    'no-new-privileges',
+    '--user',
+    '10001:10001',
+    '--pids-limit',
+    '32',
+    '--memory',
+    '128m',
+    '--cpus',
+    '0.25',
+    '--tmpfs',
+    '/tmp:rw,noexec,nosuid,nodev,size=8m,mode=700,uid=10001,gid=10001',
+    '--entrypoint',
+    'node',
+    image,
+    '-e',
+    source,
+  ]);
+  let result;
+  try {
+    result = JSON.parse(output);
+  } catch {
+    fail('Console live result is invalid');
+  }
+  if (
+    result?.loopback !== true ||
+    result?.assets !== true ||
+    result?.cleanShutdown !== true
+  ) {
+    fail('Console live contract drifted');
+  }
+}
+
 function main() {
   if (process.env.QL3_CLUSTER_ADMIN_PRODUCT_LIVE !== '1') {
     fail('QL3_CLUSTER_ADMIN_PRODUCT_LIVE=1 is required');
@@ -245,6 +340,7 @@ function main() {
   const version = runImage(image, ['--version']).trim();
   if (version !== '3.0.0-alpha.0') fail('product version contract drifted');
   runOperatorContextContract(image);
+  runConsoleContract(image);
 
   process.stdout.write(
     `${JSON.stringify({
@@ -257,6 +353,8 @@ function main() {
       operatorContext: true,
       contextPreflight: true,
       contextReadiness: true,
+      consoleLoopback: true,
+      consoleAssets: true,
       isolation: Object.freeze({
         readOnlyRoot: true,
         network: 'none',

scripts/ql3-cluster-copilot-console-audit.cjs

@@ -0,0 +1,319 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const CONSOLE_ROOT = 'packages/ql3-cluster-admin/src/copilot-console';
+const ASSET_ROOT = 'packages/ql3-cluster-admin/assets/copilot-console';
+const DEPLOYMENT_ROOT = 'deploy/console/ql3-cluster-copilot';
+const REQUIRED_FILES = Object.freeze([
+  CONSOLE_ROOT + '/assets.ts',
+  CONSOLE_ROOT + '/cli.ts',
+  CONSOLE_ROOT + '/contracts.ts',
+  CONSOLE_ROOT + '/server.ts',
+  ASSET_ROOT + '/index.html',
+  ASSET_ROOT + '/app.css',
+  ASSET_ROOT + '/app.js',
+  DEPLOYMENT_ROOT + '/README.md',
+  DEPLOYMENT_ROOT + '/client-config.example.json',
+  'deploy/containers/ql3-cluster-admin/Dockerfile',
+  'scripts/ql3-cluster-admin-product-live-contract.cjs',
+]);
+
+function finding(code, target, detail) {
+  return Object.freeze({ code, target, detail });
+}
+
+function filesBelow(root, relativeDirectory) {
+  const absolute = path.join(root, relativeDirectory);
+  const result = [];
+  const pending = [absolute];
+  while (pending.length > 0) {
+    const current = pending.pop();
+    for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
+      const candidate = path.join(current, entry.name);
+      if (entry.isDirectory()) pending.push(candidate);
+      else if (entry.isFile()) result.push(path.relative(root, candidate));
+    }
+  }
+  return result.sort();
+}
+
+function auditClusterCopilotConsole(options = {}) {
+  const root = options.root || path.resolve(__dirname, '..');
+  const readFile =
+    options.readFile ||
+    ((relativePath) => fs.readFileSync(path.join(root, relativePath), 'utf8'));
+  const findings = [];
+  const source = {};
+
+  for (const relativePath of REQUIRED_FILES) {
+    try {
+      source[relativePath] = readFile(relativePath);
+    } catch (error) {
+      findings.push(
+        finding(
+          'CLUSTER_COPILOT_CONSOLE_FILE_MISSING',
+          relativePath,
+          error instanceof Error ? error.name : 'Error',
+        ),
+      );
+    }
+  }
+
+  const expectFragments = (relativePath, fragments) => {
+    const contents = source[relativePath];
+    if (typeof contents !== 'string') return;
+    for (const fragment of fragments) {
+      if (!contents.includes(fragment)) {
+        findings.push(
+          finding(
+            'CLUSTER_COPILOT_CONSOLE_CONTRACT_MISSING',
+            relativePath,
+            fragment,
+          ),
+        );
+      }
+    }
+  };
+  const rejectFragments = (relativePath, fragments) => {
+    const contents = source[relativePath];
+    if (typeof contents !== 'string') return;
+    for (const fragment of fragments) {
+      if (contents.includes(fragment)) {
+        findings.push(
+          finding(
+            'CLUSTER_COPILOT_CONSOLE_AUTHORITY_WIDENED',
+            relativePath,
+            fragment,
+          ),
+        );
+      }
+    }
+  };
+
+  expectFragments(CONSOLE_ROOT + '/contracts.ts', [
+    "export type ClusterCopilotConsoleReadOperation = 'inspect' | 'output'",
+    'CLUSTER_COPILOT_CONSOLE_READ_REQUEST_SCHEMA',
+    'clusterCopilotConsoleClientCommand',
+  ]);
+  rejectFragments(CONSOLE_ROOT + '/contracts.ts', [
+    "| 'diagnose'",
+    "| 'cancel'",
+    'mutationId',
+    'traceId',
+    'endpoint',
+    'credential',
+  ]);
+  expectFragments(CONSOLE_ROOT + '/server.ts', [
+    "server.listen(record.port as number, '127.0.0.1'",
+    'request.headers.origin !== expectedOrigin',
+    "request.headers.host !== expectedOrigin.slice('http://'.length)",
+    'maximumConcurrentRequests: 2',
+    "request.url === '/api/v1/copilot/inspect'",
+    "request.url === '/api/v1/copilot/output'",
+    "default-src 'none'",
+    "frame-ancestors 'none'",
+    "'cache-control': 'no-store'",
+  ]);
+  rejectFragments(CONSOLE_ROOT + '/server.ts', [
+    "'0.0.0.0'",
+    'createSecureServer',
+    'WebSocket',
+    'set-cookie',
+    'diagnose',
+    'cancel',
+    'child_process',
+    'node:fs',
+    'node:net',
+  ]);
+  expectFragments(CONSOLE_ROOT + '/cli.ts', [
+    '--session /absolute/session',
+    'readCanonicalFile(',
+    "'private'",
+    'validateClusterCopilotClientCredentialFile',
+    "clusterCredential: 'server_only'",
+    "operations: ['inspect', 'output']",
+    'mutation: false',
+  ]);
+  rejectFragments(CONSOLE_ROOT + '/cli.ts', [
+    'process.env',
+    '0.0.0.0',
+    'diagnose',
+    'cancel',
+  ]);
+  expectFragments(ASSET_ROOT + '/index.html', [
+    '故障诊断，不替你执行。',
+    '只读边界',
+    '显式读取诊断内容',
+    '不可信模型输出',
+  ]);
+  expectFragments(ASSET_ROOT + '/app.js', [
+    'credentials: "omit"',
+    'cache: "no-store"',
+    'outputText.textContent = fact.result.text',
+    'sessionToken = ""',
+  ]);
+  rejectFragments(ASSET_ROOT + '/app.js', [
+    'localStorage',
+    'sessionStorage',
+    'innerHTML',
+    'eval(',
+    'new Function',
+    'WebSocket',
+    'EventSource',
+    'diagnose',
+    'cancel',
+    'http://',
+    'https://',
+  ]);
+  expectFragments(ASSET_ROOT + '/app.css', [
+    '@media (max-width: 520px)',
+    '@media (prefers-reduced-motion: reduce)',
+    ':focus-visible',
+  ]);
+  expectFragments(DEPLOYMENT_ROOT + '/README.md', [
+    'operator-workstation process',
+    'Do not deploy it as a Kubernetes workload',
+    'only `inspect` and explicit `output` reads',
+    '--port=0',
+    'TLS 1.3 `GET /readyz`',
+    'excluded from small router Edge/Standalone artifacts',
+  ]);
+  rejectFragments(DEPLOYMENT_ROOT + '/README.md', [
+    '--host=0.0.0.0',
+    'kubectl apply',
+    'localStorage',
+  ]);
+  expectFragments('deploy/containers/ql3-cluster-admin/Dockerfile', [
+    'COPY --from=workspace /workspace/packages/ql3-cluster-admin/assets/copilot-console',
+    'node_modules/@qinglong/cluster-admin/assets/copilot-console',
+  ]);
+  expectFragments('scripts/ql3-cluster-admin-product-live-contract.cjs', [
+    'function runConsoleContract(image)',
+    "[facade, 'copilot-console'",
+    "started.event !== 'started'",
+    "body.includes('Cluster field console')",
+    'runConsoleContract(image);',
+    'consoleLoopback: true',
+    'consoleAssets: true',
+  ]);
+
+  let manifest;
+  try {
+    manifest = JSON.parse(readFile('packages/ql3-cluster-admin/package.json'));
+  } catch (error) {
+    findings.push(
+      finding(
+        'CLUSTER_COPILOT_CONSOLE_PACKAGE_INVALID',
+        'packages/ql3-cluster-admin/package.json',
+        error instanceof Error ? error.name : 'Error',
+      ),
+    );
+  }
+  if (
+    manifest?.bin?.['ql3-copilot-console'] !==
+      'dist/copilot-console/cli.js' ||
+    manifest?.exports?.['./copilot-console']?.require !==
+      './dist/copilot-console/server.js' ||
+    !Array.isArray(manifest?.files) ||
+    !manifest.files.includes('assets/copilot-console/*')
+  ) {
+    findings.push(
+      finding(
+        'CLUSTER_COPILOT_CONSOLE_PACKAGE_INVALID',
+        'packages/ql3-cluster-admin/package.json',
+        'bin, export or asset packlist drifted',
+      ),
+    );
+  }
+
+  let productCommand = '';
+  try {
+    productCommand = readFile(
+      'packages/ql3-cluster-admin/src/product-cli/productCommand.ts',
+    );
+  } catch {}
+  if (
+    !productCommand.includes("name: 'copilot-console'") ||
+    !productCommand.includes("binary: 'ql3-copilot-console'") ||
+    !productCommand.includes("target: 'copilot-console/cli.js'")
+  ) {
+    findings.push(
+      finding(
+        'CLUSTER_COPILOT_CONSOLE_PRODUCT_ENTRY_MISSING',
+        'packages/ql3-cluster-admin/src/product-cli/productCommand.ts',
+        'static product delegation is incomplete',
+      ),
+    );
+  }
+
+  for (const relativePath of filesBelow(root, 'src')) {
+    const contents = readFile(relativePath);
+    if (
+      contents.includes('ql3-copilot-console') ||
+      contents.includes('cluster-copilot-console-read') ||
+      contents.includes('copilot/failure-diagnoses')
+    ) {
+      findings.push(
+        finding(
+          'CLUSTER_COPILOT_CONSOLE_LEGACY_UI_COUPLED',
+          relativePath,
+          'legacy src imports or routes the QingLong 3.0 Console',
+        ),
+      );
+    }
+  }
+  for (const relativePath of filesBelow(root, 'back')) {
+    const contents = readFile(relativePath);
+    if (
+      contents.includes('ql3-copilot-console') ||
+      contents.includes('cluster-copilot-console-read')
+    ) {
+      findings.push(
+        finding(
+          'CLUSTER_COPILOT_CONSOLE_LEGACY_BACKEND_COUPLED',
+          relativePath,
+          'legacy backend owns the QingLong 3.0 Console',
+        ),
+      );
+    }
+  }
+  for (const relativePath of filesBelow(root, 'deploy/kubernetes')) {
+    if (!/\.ya?ml$/u.test(relativePath)) continue;
+    const contents = readFile(relativePath);
+    if (contents.includes('ql3-copilot-console')) {
+      findings.push(
+        finding(
+          'CLUSTER_COPILOT_CONSOLE_KUBERNETES_RESIDENT',
+          relativePath,
+          'operator-workstation Console must not be a Kubernetes workload',
+        ),
+      );
+    }
+  }
+
+  return Object.freeze({
+    schemaVersion: 1,
+    component: 'cluster-copilot-console',
+    owner: '@qinglong/cluster-admin',
+    lifecycle: 'operator-workstation-loopback',
+    operations: Object.freeze(['inspect', 'output']),
+    legacyUiCoupled: false,
+    kubernetesResident: false,
+    assetCount: 3,
+    sourceFileCount: 4,
+    findings: Object.freeze(findings),
+    compatible: findings.length === 0,
+  });
+}
+
+function main() {
+  const report = auditClusterCopilotConsole();
+  process.stdout.write(JSON.stringify(report) + '\n');
+  if (!report.compatible) process.exitCode = 1;
+}
+
+if (require.main === module) main();
+
+module.exports = { auditClusterCopilotConsole };

scripts/ql3-cluster-dependency-audit.cjs

@@ -3101,6 +3101,9 @@ function auditPackageScripts(packagePath, manifest, findings) {
 
 function auditPackageFiles(packagePath, manifest, findings) {
   const expected = ['dist/**/*.js', 'dist/**/*.d.ts'];
+  if (packagePath === 'packages/ql3-cluster-admin') {
+    expected.push('assets/copilot-console/*');
+  }
   if (packagePath === 'packages/ql3-local-process') expected.push('assets');
   if (packagePath === 'packages/ql3-local-sqlite') expected.push('drizzle');
   if (JSON.stringify(manifest.files) !== JSON.stringify(expected)) {

scripts/ql3-cluster-oci-layout-audit.cjs

@@ -240,7 +240,7 @@ function expectedImageConfig(architecture, revision, image) {
           ? isControlAi
             ? 'Optional QingLong 3.0 AI-enabled cluster control plane'
             : 'QingLong 3.0 PostgreSQL-backed cluster control plane'
-          : 'QingLong 3.0 cluster operations and bounded stdio MCP',
+          : 'QingLong 3.0 cluster operations and bounded Copilot surfaces',
         'org.opencontainers.image.licenses': 'Apache-2.0',
         'org.opencontainers.image.revision': revision,
         'org.opencontainers.image.source': 'https://github.com/whyour/qinglong',

test/back/ql3ClusterAdminProductLiveContract.test.cjs

@@ -2,6 +2,7 @@
 
 const assert = require('node:assert/strict');
 const { spawnSync } = require('node:child_process');
+const fs = require('node:fs');
 const path = require('node:path');
 const { test } = require('node:test');
 const {
@@ -47,3 +48,13 @@ test('fails closed before Docker without explicit opt-in', () => {
   assert.match(result.stderr, /QL3_CLUSTER_ADMIN_PRODUCT_LIVE=1 is required/);
   assert.equal(result.stderr.includes('spawn'), false);
 });
+
+test('binds the live image gate to loopback Console assets and shutdown', () => {
+  const source = fs.readFileSync(script, 'utf8');
+  assert.match(source, /function runConsoleContract\(image\)/);
+  assert.match(source, /\[facade, 'copilot-console'/);
+  assert.match(source, /body\.includes\('Cluster field console'\)/);
+  assert.match(source, /runConsoleContract\(image\);/);
+  assert.match(source, /consoleLoopback: true/);
+  assert.match(source, /consoleAssets: true/);
+});

test/back/ql3ClusterCopilotConsoleAudit.test.cjs

@@ -0,0 +1,155 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const test = require('node:test');
+
+const {
+  auditClusterCopilotConsole,
+} = require('../../scripts/ql3-cluster-copilot-console-audit.cjs');
+
+const root = path.resolve(__dirname, '../..');
+
+function intercept(target, mutate) {
+  return (relativePath) => {
+    const source = fs.readFileSync(path.join(root, relativePath), 'utf8');
+    return relativePath === target ? mutate(source) : source;
+  };
+}
+
+test('keeps the QingLong 3.0 Copilot Console independent and read-only', () => {
+  const report = auditClusterCopilotConsole({ root });
+  assert.deepEqual(report, {
+    schemaVersion: 1,
+    component: 'cluster-copilot-console',
+    owner: '@qinglong/cluster-admin',
+    lifecycle: 'operator-workstation-loopback',
+    operations: ['inspect', 'output'],
+    legacyUiCoupled: false,
+    kubernetesResident: false,
+    assetCount: 3,
+    sourceFileCount: 4,
+    findings: [],
+    compatible: true,
+  });
+});
+
+test('rejects a remote listener or mutation vocabulary', () => {
+  const listener = auditClusterCopilotConsole({
+    root,
+    readFile: intercept(
+      'packages/ql3-cluster-admin/src/copilot-console/server.ts',
+      (source) => source.replaceAll('127.0.0.1', '0.0.0.0'),
+    ),
+  });
+  const mutation = auditClusterCopilotConsole({
+    root,
+    readFile: intercept(
+      'packages/ql3-cluster-admin/src/copilot-console/contracts.ts',
+      (source) =>
+        source.replace(
+          "'inspect' | 'output'",
+          "'inspect' | 'output' | 'cancel'",
+        ),
+    ),
+  });
+  assert.equal(listener.compatible, false);
+  assert.equal(mutation.compatible, false);
+  assert.ok(
+    listener.findings.some(
+      ({ code }) => code === 'CLUSTER_COPILOT_CONSOLE_CONTRACT_MISSING',
+    ),
+  );
+  assert.ok(
+    mutation.findings.some(
+      ({ code }) => code === 'CLUSTER_COPILOT_CONSOLE_AUTHORITY_WIDENED',
+    ),
+  );
+});
+
+test('rejects browser persistence, dynamic rendering and product drift', () => {
+  for (const injected of ['localStorage', 'innerHTML', 'WebSocket']) {
+    const report = auditClusterCopilotConsole({
+      root,
+      readFile: intercept(
+        'packages/ql3-cluster-admin/assets/copilot-console/app.js',
+        (source) => source + '\n// ' + injected + '\n',
+      ),
+    });
+    assert.equal(report.compatible, false);
+    assert.ok(
+      report.findings.some(
+        ({ code }) => code === 'CLUSTER_COPILOT_CONSOLE_AUTHORITY_WIDENED',
+      ),
+    );
+  }
+  const product = auditClusterCopilotConsole({
+    root,
+    readFile: intercept(
+      'packages/ql3-cluster-admin/src/product-cli/productCommand.ts',
+      (source) => source.replace("name: 'copilot-console'", "name: 'removed'"),
+    ),
+  });
+  assert.equal(product.compatible, false);
+  assert.ok(
+    product.findings.some(
+      ({ code }) => code === 'CLUSTER_COPILOT_CONSOLE_PRODUCT_ENTRY_MISSING',
+    ),
+  );
+  const image = auditClusterCopilotConsole({
+    root,
+    readFile: intercept(
+      'deploy/containers/ql3-cluster-admin/Dockerfile',
+      (source) =>
+        source.replaceAll(
+          'packages/ql3-cluster-admin/assets/copilot-console',
+          'packages/ql3-cluster-admin/assets/removed',
+        ),
+    ),
+  });
+  assert.equal(image.compatible, false);
+  assert.ok(
+    image.findings.some(
+      ({ code, target }) =>
+        code === 'CLUSTER_COPILOT_CONSOLE_CONTRACT_MISSING' &&
+        target === 'deploy/containers/ql3-cluster-admin/Dockerfile',
+    ),
+  );
+});
+
+test('rejects coupling into the legacy UI or Kubernetes workloads', () => {
+  const legacyTarget = 'src/pages/login/index.tsx';
+  const legacy = auditClusterCopilotConsole({
+    root,
+    readFile: intercept(
+      legacyTarget,
+      (source) => source + '\n// ql3-copilot-console\n',
+    ),
+  });
+  const kubernetesTarget =
+    'deploy/kubernetes/ql3-cluster/base/deployment.yaml';
+  const kubernetes = auditClusterCopilotConsole({
+    root,
+    readFile: intercept(
+      kubernetesTarget,
+      (source) => source + '\n# ql3-copilot-console\n',
+    ),
+  });
+  assert.equal(legacy.compatible, false);
+  assert.equal(kubernetes.compatible, false);
+  assert.ok(
+    legacy.findings.some(
+      ({ code, target }) =>
+        code === 'CLUSTER_COPILOT_CONSOLE_LEGACY_UI_COUPLED' &&
+        target === legacyTarget,
+    ),
+  );
+  assert.ok(
+    kubernetes.findings.some(
+      ({ code, target }) =>
+        code === 'CLUSTER_COPILOT_CONSOLE_KUBERNETES_RESIDENT' &&
+        target === kubernetesTarget,
+    ),
+  );
+});

test/back/ql3ClusterDependencyAudit.test.cjs

@@ -14,6 +14,10 @@ const {
 test('ships runtime JavaScript and declarations without development maps', () => {
   for (const [packagePath, files] of [
     ['packages/ql3-runtime-core', ['dist/**/*.js', 'dist/**/*.d.ts']],
+    [
+      'packages/ql3-cluster-admin',
+      ['dist/**/*.js', 'dist/**/*.d.ts', 'assets/copilot-console/*'],
+    ],
     [
       'packages/ql3-local-process',
       ['dist/**/*.js', 'dist/**/*.d.ts', 'assets'],

test/back/ql3ClusterOciLayoutAudit.test.cjs

@@ -135,7 +135,7 @@ function createFixture(t, options = {}) {
               ? isControlAi
                 ? 'Optional QingLong 3.0 AI-enabled cluster control plane'
                 : 'QingLong 3.0 PostgreSQL-backed cluster control plane'
-              : 'QingLong 3.0 cluster operations and bounded stdio MCP',
+              : 'QingLong 3.0 cluster operations and bounded Copilot surfaces',
             'org.opencontainers.image.licenses': 'Apache-2.0',
             'org.opencontainers.image.revision': revision,
             'org.opencontainers.image.source':

test/back/ql3PackageBoundaryAudit.test.cjs

@@ -340,10 +340,10 @@ test('current QL3 workspace has exactly eighteen reviewed package boundaries', (
       rootSourceFileRoles: clusterAdmin.rootSourceFileRoles,
     },
     {
-      sourceFiles: 116,
+      sourceFiles: 120,
       rootSourceFiles: 1,
       rootSourceLines: 61,
-      nestedSourceFiles: 115,
+      nestedSourceFiles: 119,
       rootSourceFileRoles: {
         'modelInvocationMigrationCli.ts': 'binary_entry',
       },