feat(ql3): gate local secret transitions before activation

This commit is contained in:
whyour
2026-08-13 20:29:47 +08:00
parent 326783ff14
commit c877147d0f
37 changed files with 2495 additions and 39 deletions
@@ -146,9 +146,11 @@ test('creates a reviewed edge database and opens runtime only after readiness',
'0094-capability-v47',
'0095-plugin-package-secret-binding-target-guard',
'0096-capability-v48',
'0097-plugin-package-secret-binding-transition-receipts',
'0098-capability-v49',
]);
assert.equal(migrated.readiness.contractName, 'local-control-core');
assert.equal(migrated.readiness.contractVersion, 48);
assert.equal(migrated.readiness.contractVersion, 49);
assert.equal(migrated.readiness.journalMode, 'delete');
assert.equal(fs.statSync(databasePath).mode & 0o777, 0o600);
@@ -594,8 +596,8 @@ test('backfills v14 execution revisions with a verified independent digest', asy
.get(),
},
{
contract_version: 48,
migration_id: '0095-plugin-package-secret-binding-target-guard',
contract_version: 49,
migration_id: '0097-plugin-package-secret-binding-transition-receipts',
},
);
} finally {
@@ -782,19 +784,19 @@ test('excludes reviewed optional feature tables while preserving unknown table d
const options = { databasePath, profile: 'edge' };
await migrateLocalSqlitePath(options);
const client = new DatabaseSync(databasePath);
assert.equal((await auditLocalSqlitePath(options)).tableCount, 80);
assert.equal((await auditLocalSqlitePath(options)).tableCount, 81);
client.exec(
'CREATE TABLE "ModelInvocationFeatureHead" (feature_id TEXT PRIMARY KEY)',
);
client.close();
assert.equal((await auditLocalSqlitePath(options)).tableCount, 80);
assert.equal((await auditLocalSqlitePath(options)).tableCount, 81);
const unknownClient = new DatabaseSync(databasePath);
unknownClient.exec('CREATE TABLE "UserExtensionData" (id TEXT PRIMARY KEY)');
unknownClient.close();
assert.equal((await auditLocalSqlitePath(options)).tableCount, 81);
assert.equal((await auditLocalSqlitePath(options)).tableCount, 82);
const triggerClient = new DatabaseSync(databasePath);
triggerClient.exec(`