fix(ci): restore ql3 multi-profile gates

test/back/ql3CloudNativePgBarmanLiveContract.test.cjs

@@ -47,6 +47,7 @@ const POSTGRES_ROLES = [
   'ql3_migration',
   'ql3_package_executor',
   'ql3_package_manager',
+  'ql3_run_manager',
   'ql3_runtime',
   'ql3_worker_credential_executor',
   'ql3_worker_credential_manager',

test/back/ql3ClusterOciLayoutAudit.test.cjs

@@ -248,18 +248,20 @@ function createFixture(t, options = {}) {
     const attestationLayers = options.omitProvenance
       ? [spdx]
       : [spdx, provenance];
-    const attestationConfig = blob(
-      {
-        architecture: 'unknown',
-        os: 'unknown',
-        config: {},
-        rootfs: {
-          type: 'layers',
-          diff_ids: attestationLayers.map((layer) => layer.digest),
-        },
-      },
-      'application/vnd.oci.image.config.v1+json',
-    );
+    const attestationConfig = options.modernAttestationConfig
+      ? blob({}, 'application/vnd.oci.empty.v1+json')
+      : blob(
+          {
+            architecture: 'unknown',
+            os: 'unknown',
+            config: {},
+            rootfs: {
+              type: 'layers',
+              diff_ids: attestationLayers.map((layer) => layer.digest),
+            },
+          },
+          'application/vnd.oci.image.config.v1+json',
+        );
     const attestationManifest = blob(
       {
         schemaVersion: 2,
@@ -325,6 +327,15 @@ test('accepts two exact images with bound SBOM and provenance', (t) => {
   );
 });
 
+test('accepts OCI 1.1 empty attestation configs emitted by current BuildKit', (t) => {
+  const report = auditClusterOciLayout({
+    root,
+    layoutRoot: createFixture(t, { modernAttestationConfig: true }),
+    expectedRevision: revision,
+  });
+  assert.equal(report.platforms.length, 2);
+});
+
 test('accepts the independent cluster-admin image and attestation closure', (t) => {
   const report = auditClusterOciLayout({
     root,

test/back/ql3LocalOwnerReadonlyContract.test.cjs

@@ -0,0 +1,45 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const { test } = require('node:test');
+
+const {
+  HOST_BOUND_TESTS,
+  collectReadonlyOwnerTests,
+} = require('../../scripts/ql3-local-owner-readonly-contract.cjs');
+
+const repositoryRoot = path.resolve(__dirname, '../..');
+const workflowPath = path.join(repositoryRoot, '.github/workflows/ql3-ci.yml');
+
+test('classifies only reviewed host-bound Owner tests outside the read-only gate', () => {
+  const plan = collectReadonlyOwnerTests(repositoryRoot);
+  assert.deepEqual(Object.keys(HOST_BOUND_TESTS).sort(), [
+    'packages/ql3-local-owner-cli/test/adoptedDeploymentBundle.test.cjs',
+    'packages/ql3-local-owner-cli/test/localDeployment.test.cjs',
+    'packages/ql3-local-owner-cli/test/reconciliationCapturePrepare.test.cjs',
+    'packages/ql3-local-owner-cli/test/serviceBridgeRoot.test.cjs',
+  ]);
+  assert.equal(plan.tests.length > 0, true);
+  for (const file of plan.tests) {
+    assert.equal(fs.existsSync(path.join(repositoryRoot, file)), true);
+    assert.equal(file in HOST_BOUND_TESTS, false);
+  }
+});
+
+test('runs the reviewed Owner contract as root and non-root in read-only containers', () => {
+  const workflow = fs.readFileSync(workflowPath, 'utf8');
+  const job = workflow.match(
+    /  local-profiles:\n([\s\S]*?)\n  cluster-postgres:/,
+  )?.[1];
+  assert.ok(job, 'local-profiles job is missing');
+  assert.equal(job.match(/docker run --rm --read-only/g)?.length, 2);
+  assert.equal(
+    job.match(/scripts\/ql3-local-owner-readonly-contract\.cjs/g)?.length,
+    2,
+  );
+  assert.match(job, /--mode=root/);
+  assert.match(job, /--user 65532:65532[\s\S]*--mode=nonroot/);
+  assert.doesNotMatch(job, /packages\/ql3-local-owner-\*\/test\/\*\.test\.cjs/);
+});

test/back/ql3PostgresHaEvidenceAudit.test.cjs

@@ -6,7 +6,7 @@ const {
   auditPostgresHaEvidence,
 } = require('../../scripts/ql3-postgres-ha-evidence-audit.cjs');
 
-function fixture() {
+function fixture(architecture = 'arm64') {
   const gates = { passed: true };
   for (let index = 0; index < 100; index += 1) gates[`gate${index}`] = true;
   return {
@@ -16,7 +16,7 @@ function fixture() {
       image: 'postgres:18',
       imageId: `sha256:${'a'.repeat(64)}`,
       repoDigests: [`postgres@sha256:${'b'.repeat(64)}`],
-      architecture: 'arm64',
+      architecture,
       version: '18.4',
       versionNumber: 180004,
     },
@@ -85,6 +85,7 @@ test('accepts complete PostgreSQL HA evidence', () => {
     compatible: true,
     findings: [],
   });
+  assert.equal(auditPostgresHaEvidence(fixture('amd64')).compatible, true);
 });
 
 test('rejects false gates, promotion drift and hidden private material', () => {