feat(ql3): establish 3.0 incubation baseline

scripts/ql3-linux-resource-gate.cjs

@@ -0,0 +1,690 @@
+#!/usr/bin/env node
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+const MIB = 1024 * 1024;
+const MAX_CHILD_OUTPUT_BYTES = 4 * MIB;
+const PROMPT_RESOURCE_OUTPUT_BYTES = 512 * 1024;
+const RESOURCE_TIERS = Object.freeze({
+  'router-stress-ci': Object.freeze({
+    evidenceClass: 'ci_stress_only',
+    supportedMinimum: false,
+    memoryMaxBytes: 128 * MIB,
+    swapMaxBytes: 0,
+    cpuQuotaCores: 0.5,
+    pidsMax: 64,
+    workload: 'edge',
+    edgeMaxRssDeltaMb: 64,
+    edgeMaxCancelMs: 5_000,
+    sqliteIterations: 100,
+    sqliteMaxTransactionP95Ms: 500,
+    sqliteMaxBatchStallMs: 5_000,
+    sqliteMaxRssDeltaMb: 32,
+    workflowLockSamples: 16,
+    workflowMaxLockP95Ms: 500,
+    workflowMaxProcessRssMb: 96,
+    promptMaxProcessRssMb: 120,
+  }),
+  'edge-release-ci': Object.freeze({
+    evidenceClass: 'ci_release_guard',
+    supportedMinimum: false,
+    memoryMaxBytes: 256 * MIB,
+    swapMaxBytes: 0,
+    cpuQuotaCores: 1,
+    pidsMax: 128,
+    workload: 'edge',
+    edgeMaxRssDeltaMb: 96,
+    edgeMaxCancelMs: 5_000,
+    sqliteIterations: 250,
+    sqliteMaxTransactionP95Ms: 250,
+    sqliteMaxBatchStallMs: 2_500,
+    sqliteMaxRssDeltaMb: 64,
+    workflowLockSamples: 32,
+    workflowMaxLockP95Ms: 250,
+    workflowMaxProcessRssMb: 160,
+    promptMaxProcessRssMb: 192,
+  }),
+  'cluster-control-ci': Object.freeze({
+    evidenceClass: 'ci_cluster_guard',
+    supportedMinimum: false,
+    memoryMaxBytes: 512 * MIB,
+    swapMaxBytes: 0,
+    cpuQuotaCores: 2,
+    pidsMax: 256,
+    workload: 'cluster-control',
+    clusterMaxRssDeltaMb: 128,
+    clusterMaxDisabledActivationMs: 1_000,
+  }),
+});
+
+class QingLong3LinuxResourceGateError extends Error {
+  constructor(message) {
+    super(`QingLong 3.0 Linux resource gate failed: ${message}`);
+    this.name = 'QingLong3LinuxResourceGateError';
+  }
+}
+
+function parseArguments(argv) {
+  const options = { json: false };
+  for (const argument of argv) {
+    if (argument === '--json') {
+      options.json = true;
+      continue;
+    }
+    const separator = argument.indexOf('=');
+    if (separator < 1) {
+      throw new QingLong3LinuxResourceGateError(
+        `unsupported argument ${argument}`,
+      );
+    }
+    const name = argument.slice(0, separator);
+    const value = argument.slice(separator + 1);
+    if (name === '--tier') options.tier = value;
+    else if (name === '--expected-arch') options.expectedArch = value;
+    else {
+      throw new QingLong3LinuxResourceGateError(
+        `unsupported argument ${argument}`,
+      );
+    }
+  }
+  if (!(options.tier in RESOURCE_TIERS)) {
+    throw new QingLong3LinuxResourceGateError(
+      `--tier must be one of ${Object.keys(RESOURCE_TIERS).join(', ')}`,
+    );
+  }
+  if (
+    options.expectedArch !== undefined &&
+    !['x64', 'arm64'].includes(options.expectedArch)
+  ) {
+    throw new QingLong3LinuxResourceGateError(
+      '--expected-arch must be x64 or arm64',
+    );
+  }
+  return Object.freeze(options);
+}
+
+function parseLimit(raw, label) {
+  const value = raw.trim();
+  if (value === 'max') return Number.POSITIVE_INFINITY;
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed < 0) {
+    throw new QingLong3LinuxResourceGateError(`${label} is invalid`);
+  }
+  return parsed;
+}
+
+function parseCpuMax(raw) {
+  const [quotaRaw, periodRaw, extra] = raw.trim().split(/\s+/);
+  if (!quotaRaw || !periodRaw || extra !== undefined) {
+    throw new QingLong3LinuxResourceGateError('cpu.max is invalid');
+  }
+  if (quotaRaw === 'max') return Number.POSITIVE_INFINITY;
+  const quota = parseLimit(quotaRaw, 'cpu.max quota');
+  const period = parseLimit(periodRaw, 'cpu.max period');
+  if (quota < 1 || period < 1) {
+    throw new QingLong3LinuxResourceGateError('cpu.max must be positive');
+  }
+  return quota / period;
+}
+
+function parseKeyValueFile(raw, label) {
+  const values = {};
+  for (const line of raw.trim().split('\n')) {
+    const [name, valueRaw, extra] = line.trim().split(/\s+/);
+    const value = Number(valueRaw);
+    if (
+      !name ||
+      extra !== undefined ||
+      !Number.isSafeInteger(value) ||
+      value < 0
+    ) {
+      throw new QingLong3LinuxResourceGateError(`${label} is invalid`);
+    }
+    values[name] = value;
+  }
+  return Object.freeze(values);
+}
+
+function unescapeMountPath(value) {
+  return value.replace(/\\040/g, ' ').replace(/\\011/g, '\t');
+}
+
+function parseMountOptions(raw) {
+  const mounts = new Map();
+  for (const line of raw.trim().split('\n')) {
+    const fields = line.split(' ');
+    if (fields.length < 4) continue;
+    mounts.set(
+      unescapeMountPath(fields[1]),
+      Object.freeze(fields[3].split(',')),
+    );
+  }
+  return mounts;
+}
+
+function readLinuxEnvelope(root = '/') {
+  const read = (relativePath) =>
+    fs.readFileSync(path.join(root, relativePath), 'utf8');
+  const status = parseKeyValueFile(
+    read('proc/self/status')
+      .split('\n')
+      .filter((line) => /^(NoNewPrivs|Seccomp):/.test(line))
+      .map((line) => line.replace(':', ' '))
+      .join('\n'),
+    'process security status',
+  );
+  return Object.freeze({
+    cgroupVersion: 2,
+    memoryMaxBytes: parseLimit(read('sys/fs/cgroup/memory.max'), 'memory.max'),
+    memoryPeakBytes: parseLimit(
+      read('sys/fs/cgroup/memory.peak'),
+      'memory.peak',
+    ),
+    swapMaxBytes: parseLimit(
+      read('sys/fs/cgroup/memory.swap.max'),
+      'memory.swap.max',
+    ),
+    cpuQuotaCores: parseCpuMax(read('sys/fs/cgroup/cpu.max')),
+    pidsMax: parseLimit(read('sys/fs/cgroup/pids.max'), 'pids.max'),
+    memoryEvents: parseKeyValueFile(
+      read('sys/fs/cgroup/memory.events'),
+      'memory.events',
+    ),
+    noNewPrivileges: status.NoNewPrivs,
+    seccompMode: status.Seccomp,
+    mounts: parseMountOptions(read('proc/mounts')),
+  });
+}
+
+function validateEnvelope(tierName, envelope, identity) {
+  const tier = RESOURCE_TIERS[tierName];
+  const violations = [];
+  const exact = (actual, expected, label) => {
+    if (actual !== expected) {
+      violations.push(`${label} ${actual} did not equal ${expected}`);
+    }
+  };
+  exact(envelope.memoryMaxBytes, tier.memoryMaxBytes, 'memory.max');
+  exact(envelope.swapMaxBytes, tier.swapMaxBytes, 'memory.swap.max');
+  exact(envelope.cpuQuotaCores, tier.cpuQuotaCores, 'cpu.max cores');
+  exact(envelope.pidsMax, tier.pidsMax, 'pids.max');
+  exact(envelope.noNewPrivileges, 1, 'NoNewPrivs');
+  exact(envelope.seccompMode, 2, 'Seccomp');
+  if (identity.platform !== 'linux') {
+    violations.push(`platform ${identity.platform} is not linux`);
+  }
+  if (!['x64', 'arm64'].includes(identity.architecture)) {
+    violations.push(`architecture ${identity.architecture} is unsupported`);
+  }
+  if (identity.uid === 0) violations.push('resource workload must be non-root');
+  for (const mountPath of ['/', '/workspace']) {
+    if (!envelope.mounts.get(mountPath)?.includes('ro')) {
+      violations.push(`${mountPath} must be mounted read-only`);
+    }
+  }
+  if (!envelope.mounts.get('/tmp')?.includes('rw')) {
+    violations.push('/tmp must be a writable bounded tmpfs');
+  }
+  return Object.freeze(violations);
+}
+
+function createWorkloadPlans(root, tierName) {
+  const tier = RESOURCE_TIERS[tierName];
+  if (tier.workload === 'edge') {
+    return Object.freeze([
+      Object.freeze({
+        name: 'edge-executor',
+        script: path.join(root, 'scripts/ql3-edge-benchmark.cjs'),
+        args: Object.freeze([
+          '--json',
+          `--max-rss-delta-mb=${tier.edgeMaxRssDeltaMb}`,
+          `--max-cancel-ms=${tier.edgeMaxCancelMs}`,
+        ]),
+      }),
+      Object.freeze({
+        name: 'node-sqlite',
+        script: path.join(root, 'scripts/ql3-node-sqlite-benchmark.cjs'),
+        args: Object.freeze([
+          '--json',
+          `--iterations=${tier.sqliteIterations}`,
+          '--batch-size=10',
+          `--max-transaction-p95-ms=${tier.sqliteMaxTransactionP95Ms}`,
+          `--max-batch-stall-ms=${tier.sqliteMaxBatchStallMs}`,
+          `--max-rss-delta-mb=${tier.sqliteMaxRssDeltaMb}`,
+        ]),
+      }),
+      Object.freeze({
+        name: 'local-workflow-product',
+        format: 'node_test',
+        nodeArgs: Object.freeze([
+          '--test',
+          `--test-name-pattern=${
+            tierName === 'edge-release-ci'
+              ? 'executes one admitted Workflow|stops one running Workflow Task'
+              : 'executes one admitted Workflow'
+          }`,
+          path.join(
+            root,
+            'packages/ql3-local-application/test/activation.test.cjs',
+          ),
+        ]),
+        maxProcessRssBytes: tier.workflowMaxProcessRssMb * MIB,
+        ...(tierName === 'edge-release-ci'
+          ? {
+              contract: Object.freeze({
+                kind: 'local_workflow_product_lifecycle',
+                profile: 'edge',
+                completedWorkflowSteps: 2,
+                completedAttempts: 2,
+                cancelCommandStatus: 'accepted',
+                exactReplay: true,
+                processIdentityObserved: true,
+                processExited: true,
+                parentRunStatus: 'cancelled',
+                attemptStatus: 'cancelled',
+                cancelledStepRuns: 2,
+                cancelEvents: 1,
+                cancelAudits: 1,
+                physicalPowerLossProven: false,
+              }),
+            }
+          : {}),
+      }),
+      ...(tierName === 'edge-release-ci'
+        ? ['edge', 'standalone'].map((profile) =>
+            Object.freeze({
+          name: `local-ai-prompt-durable-output-${profile}`,
+          format: 'node_test',
+          nodeArgs: Object.freeze([
+            '--test',
+            '--test-name-pattern=executes one active Package Prompt',
+            path.join(
+              root,
+              'packages/ql3-local-application/test/activation.test.cjs',
+            ),
+          ]),
+          env: Object.freeze({
+            QL3_PROMPT_RESOURCE_PROFILE: profile,
+            QL3_PROMPT_RESOURCE_OUTPUT_BYTES: String(
+              PROMPT_RESOURCE_OUTPUT_BYTES,
+            ),
+          }),
+          maxProcessRssBytes: tier.promptMaxProcessRssMb * MIB,
+          contract: Object.freeze({
+            kind: 'durable_prompt_output_resource',
+            profile,
+            journalMode: profile === 'edge' ? 'delete' : 'wal',
+            durableOutputBytes: PROMPT_RESOURCE_OUTPUT_BYTES,
+            providerCalls: 2,
+            keyLoads: 1,
+            keyResolutions: 1,
+            exactReplay: true,
+            contentFree: true,
+            maxLogicalWriteAmplificationPermille: 3_000,
+            maxAllocatedWriteAmplificationPermille: 3_500,
+            maxWalWriteAmplificationPermille:
+              profile === 'standalone' ? 3_000 : 0,
+            requireWalGrowth: profile === 'standalone',
+            runAttempts: 0,
+            physicalPowerLossProven: false,
+          }),
+            }),
+          )
+        : []),
+      Object.freeze({
+        name: 'local-workflow-sqlite-lock',
+        format: 'json',
+        script: path.join(
+          root,
+          'scripts/ql3-local-workflow-resource-benchmark.cjs',
+        ),
+        args: Object.freeze([
+          '--json',
+          `--lock-samples=${tier.workflowLockSamples}`,
+          `--max-lock-p95-ms=${tier.workflowMaxLockP95Ms}`,
+        ]),
+      }),
+      Object.freeze({
+        name: 'local-workflow-admission-crash-recovery',
+        format: 'node_test',
+        nodeArgs: Object.freeze([
+          path.join(
+            root,
+            'packages/ql3-local-sqlite/test/pluginPackageWorkflowAdmissionCrashMatrix.test.cjs',
+          ),
+        ]),
+        contract: Object.freeze({
+          profiles: Object.freeze(['edge', 'standalone']),
+          crashPointsPerProfile: 8,
+          scenarios: 16,
+          mechanism: 'process_sigkill_then_database_reopen',
+          physicalPowerLossProven: false,
+        }),
+      }),
+      Object.freeze({
+        name: 'local-workflow-control-crash-recovery',
+        format: 'node_test',
+        nodeArgs: Object.freeze([
+          path.join(
+            root,
+            'packages/ql3-local-sqlite/test/pluginPackageWorkflowTaskControlCrashMatrix.test.cjs',
+          ),
+        ]),
+        contract: Object.freeze({
+          profiles: Object.freeze(['edge', 'standalone']),
+          crashPointsPerProfile: 8,
+          scenarios: 16,
+          conclusiveStopObserved: true,
+          physicalPowerLossProven: false,
+        }),
+      }),
+      ...(tierName === 'edge-release-ci'
+        ? [
+            Object.freeze({
+              name: 'local-ai-prompt-model-invocation-crash-recovery',
+              format: 'node_test',
+              nodeArgs: Object.freeze([
+                path.join(
+                  root,
+                  'packages/ql3-ai/test/modelInvocationCrashMatrix.test.cjs',
+                ),
+              ]),
+              contract: Object.freeze({
+                profiles: Object.freeze(['edge', 'standalone']),
+                crashPointsPerProfile: 7,
+                scenarios: 14,
+                boundaries: Object.freeze([
+                  'model_start',
+                  'model_completion',
+                ]),
+                mechanism: 'process_sigkill_then_database_reopen',
+                physicalPowerLossProven: false,
+              }),
+            }),
+            Object.freeze({
+              name: 'local-ai-prompt-outer-transaction-crash-recovery',
+              format: 'node_test',
+              nodeArgs: Object.freeze([
+                path.join(
+                  root,
+                  'packages/ql3-ai/test/pluginPackagePromptCrashMatrix.test.cjs',
+                ),
+              ]),
+              contract: Object.freeze({
+                profiles: Object.freeze(['edge', 'standalone']),
+                operations: Object.freeze(['admission', 'finalization']),
+                crashPointsPerProfile: 10,
+                scenarios: 20,
+                mechanism: 'process_sigkill_then_database_reopen',
+                exactReplay: true,
+                contentFree: true,
+                promptAdmissionFinalizationCrashProven: true,
+                physicalPowerLossProven: false,
+              }),
+            }),
+          ]
+        : []),
+    ]);
+  }
+  return Object.freeze([
+    Object.freeze({
+      name: 'cluster-control',
+      script: path.join(root, 'scripts/ql3-cluster-control-benchmark.cjs'),
+      args: Object.freeze([
+        '--json',
+        `--max-rss-delta-mb=${tier.clusterMaxRssDeltaMb}`,
+        `--max-disabled-activation-ms=${tier.clusterMaxDisabledActivationMs}`,
+      ]),
+    }),
+  ]);
+}
+
+function parseNodeTestReport(output, plan) {
+  const count = (name) =>
+    Number(output.match(new RegExp(`\\b${name} (\\d+)`))?.[1]);
+  const evidenceRecords = [
+    ...output.matchAll(/QL3_RESOURCE_EVIDENCE=(\{[^\n]+\})/g),
+  ].map((match) => JSON.parse(match[1]));
+  const evidence = evidenceRecords[0];
+  const report = {
+    tests: count('tests'),
+    pass: count('pass'),
+    fail: count('fail'),
+    skipped: count('skipped'),
+    evidence,
+    ...(evidenceRecords.length > 1 ? { evidenceRecords } : {}),
+    contract: plan.contract,
+  };
+  if (report.fail !== 0 || report.pass < 1) {
+    throw new QingLong3LinuxResourceGateError(
+      `${plan.name} returned an invalid node:test summary`,
+    );
+  }
+  if (
+    plan.maxProcessRssBytes !== undefined &&
+    (evidenceRecords.length < 1 ||
+      evidenceRecords.some(
+        (record) =>
+          !Number.isSafeInteger(record.peakProcessRssBytes) ||
+          record.peakProcessRssBytes > plan.maxProcessRssBytes,
+      ))
+  ) {
+    throw new QingLong3LinuxResourceGateError(
+      `${plan.name} process RSS exceeded its tier budget`,
+    );
+  }
+  if (plan.contract?.kind === 'durable_prompt_output_resource') {
+    const contract = plan.contract;
+    const invalid =
+      !evidence ||
+      evidence.profile !== contract.profile ||
+      evidence.journalMode !== contract.journalMode ||
+      evidence.durableOutputBytes !== contract.durableOutputBytes ||
+      evidence.providerCalls !== contract.providerCalls ||
+      evidence.keyLoads !== contract.keyLoads ||
+      evidence.keyResolutions !== contract.keyResolutions ||
+      evidence.liveOnlyKeyLoads !== 0 ||
+      evidence.exactReplay !== contract.exactReplay ||
+      evidence.contentFree !== contract.contentFree ||
+      evidence.durableFacts?.attempts !== contract.runAttempts ||
+      evidence.physicalPowerLossProven !==
+        contract.physicalPowerLossProven ||
+      !Number.isSafeInteger(
+        evidence.databaseLogicalWriteAmplificationPermille,
+      ) ||
+      evidence.databaseLogicalWriteAmplificationPermille < 1 ||
+      evidence.databaseLogicalWriteAmplificationPermille >
+        contract.maxLogicalWriteAmplificationPermille ||
+      !Number.isSafeInteger(
+        evidence.databaseAllocatedWriteAmplificationPermille,
+      ) ||
+      evidence.databaseAllocatedWriteAmplificationPermille < 1 ||
+      evidence.databaseAllocatedWriteAmplificationPermille >
+        contract.maxAllocatedWriteAmplificationPermille ||
+      !Number.isSafeInteger(evidence.walWriteAmplificationPermille) ||
+      evidence.walWriteAmplificationPermille < 0 ||
+      evidence.walWriteAmplificationPermille >
+        contract.maxWalWriteAmplificationPermille ||
+      (contract.requireWalGrowth && evidence.walGrowthBytes < 1) ||
+      (!contract.requireWalGrowth && evidence.walGrowthBytes !== 0);
+    if (invalid) {
+      throw new QingLong3LinuxResourceGateError(
+        `${plan.name} durable Prompt output evidence violated its contract`,
+      );
+    }
+  }
+  if (plan.contract?.kind === 'local_workflow_product_lifecycle') {
+    const contract = plan.contract;
+    const completionEvidence = evidenceRecords.find(
+      (record) =>
+        record.workflowSteps !== undefined && record.attempts !== undefined,
+    );
+    const cancellationEvidence = evidenceRecords.find(
+      (record) => record.cancelCommandStatus !== undefined,
+    );
+    const invalid =
+      !completionEvidence ||
+      completionEvidence.schemaVersion !== 1 ||
+      completionEvidence.profile !== contract.profile ||
+      completionEvidence.workflowSteps !== contract.completedWorkflowSteps ||
+      completionEvidence.attempts !== contract.completedAttempts ||
+      !cancellationEvidence ||
+      cancellationEvidence.schemaVersion !== 1 ||
+      cancellationEvidence.profile !== contract.profile ||
+      cancellationEvidence.cancelCommandStatus !==
+        contract.cancelCommandStatus ||
+      cancellationEvidence.exactReplay !== contract.exactReplay ||
+      cancellationEvidence.processIdentityObserved !==
+        contract.processIdentityObserved ||
+      cancellationEvidence.processExited !== contract.processExited ||
+      cancellationEvidence.parentRunStatus !== contract.parentRunStatus ||
+      cancellationEvidence.attemptStatus !== contract.attemptStatus ||
+      cancellationEvidence.cancelledStepRuns !== contract.cancelledStepRuns ||
+      cancellationEvidence.cancelEvents !== contract.cancelEvents ||
+      cancellationEvidence.cancelAudits !== contract.cancelAudits ||
+      cancellationEvidence.physicalPowerLossProven !==
+        contract.physicalPowerLossProven;
+    if (invalid) {
+      throw new QingLong3LinuxResourceGateError(
+        `${plan.name} local Workflow cancellation evidence violated its contract`,
+      );
+    }
+  }
+  return Object.freeze(report);
+}
+
+function runWorkload(plan, root) {
+  const nodeArgs = plan.nodeArgs ?? [plan.script, ...plan.args];
+  const result = spawnSync(process.execPath, nodeArgs, {
+    cwd: root,
+    encoding: 'utf8',
+    env: { ...process.env, ...plan.env },
+    maxBuffer: MAX_CHILD_OUTPUT_BYTES,
+  });
+  if (result.error) throw result.error;
+  if (result.status !== 0) {
+    throw new QingLong3LinuxResourceGateError(
+      `${plan.name} failed: ${(result.stderr || result.stdout).trim()}`,
+    );
+  }
+  if (plan.format === 'node_test') {
+    return Object.freeze({
+      name: plan.name,
+      report: parseNodeTestReport(result.stdout, plan),
+    });
+  }
+  try {
+    return Object.freeze({
+      name: plan.name,
+      report: JSON.parse(result.stdout.trim()),
+    });
+  } catch (error) {
+    throw new QingLong3LinuxResourceGateError(
+      `${plan.name} returned invalid JSON: ${
+        error instanceof Error ? error.message : String(error)
+      }`,
+    );
+  }
+}
+
+function eventDelta(before, after, name) {
+  return (after[name] ?? 0) - (before[name] ?? 0);
+}
+
+function main() {
+  const options = parseArguments(process.argv.slice(2));
+  const nodeMajor = Number(process.versions.node.split('.')[0]);
+  if (nodeMajor < 24) {
+    throw new QingLong3LinuxResourceGateError(
+      'Node.js 24 or newer is required',
+    );
+  }
+  if (
+    options.expectedArch !== undefined &&
+    process.arch !== options.expectedArch
+  ) {
+    throw new QingLong3LinuxResourceGateError(
+      `architecture ${process.arch} did not equal ${options.expectedArch}`,
+    );
+  }
+  const root = path.resolve(__dirname, '..');
+  const before = readLinuxEnvelope();
+  const identity = Object.freeze({
+    platform: process.platform,
+    architecture: process.arch,
+    node: process.version,
+    uid: process.getuid?.() ?? null,
+    gid: process.getgid?.() ?? null,
+  });
+  const violations = [...validateEnvelope(options.tier, before, identity)];
+  const workloads = createWorkloadPlans(root, options.tier).map((plan) =>
+    runWorkload(plan, root),
+  );
+  const after = readLinuxEnvelope();
+  for (const event of ['max', 'oom', 'oom_kill', 'oom_group_kill']) {
+    const delta = eventDelta(before.memoryEvents, after.memoryEvents, event);
+    if (delta !== 0)
+      violations.push(`memory.events ${event} increased by ${delta}`);
+  }
+  if (after.memoryPeakBytes > after.memoryMaxBytes) {
+    violations.push('memory.peak exceeded memory.max');
+  }
+  const tier = RESOURCE_TIERS[options.tier];
+  const report = {
+    schemaVersion: 1,
+    tier: options.tier,
+    evidenceClass: tier.evidenceClass,
+    supportedMinimum: tier.supportedMinimum,
+    identity,
+    envelope: {
+      memoryMaxBytes: after.memoryMaxBytes,
+      memoryPeakBytes: after.memoryPeakBytes,
+      swapMaxBytes: after.swapMaxBytes,
+      cpuQuotaCores: after.cpuQuotaCores,
+      pidsMax: after.pidsMax,
+      noNewPrivileges: after.noNewPrivileges,
+      seccompMode: after.seccompMode,
+      rootReadOnly: after.mounts.get('/')?.includes('ro') ?? false,
+      workspaceReadOnly:
+        after.mounts.get('/workspace')?.includes('ro') ?? false,
+      tmpWritable: after.mounts.get('/tmp')?.includes('rw') ?? false,
+      memoryEventsBefore: before.memoryEvents,
+      memoryEventsAfter: after.memoryEvents,
+    },
+    workloads,
+    gates: {
+      passed: violations.length === 0,
+      violations,
+    },
+  };
+  process.stdout.write(
+    `${JSON.stringify(report, null, options.json ? 0 : 2)}\n`,
+  );
+  if (violations.length > 0) process.exitCode = 1;
+}
+
+module.exports = {
+  RESOURCE_TIERS,
+  QingLong3LinuxResourceGateError,
+  createWorkloadPlans,
+  parseArguments,
+  parseCpuMax,
+  parseKeyValueFile,
+  parseLimit,
+  parseMountOptions,
+  parseNodeTestReport,
+  validateEnvelope,
+};
+
+if (require.main === module) {
+  try {
+    main();
+  } catch (error) {
+    process.stderr.write(
+      `${error instanceof Error ? error.message : String(error)}\n`,
+    );
+    process.exitCode = 1;
+  }
+}