fix(ci): track restarted provider evidence

scripts/ql3-plugin-package-recovery-e2e-live-audit.cjs

@@ -5,10 +5,12 @@
 const fs = require('node:fs');
 const path = require('node:path');
 const {
+  postgresqlControlSchemaContract,
   postgresqlMainMigrationStream,
 } = require('../packages/ql3-cluster-postgres/dist/migration/migration.js');
 
 const FIXTURE = 'qinglong/plugin-package-recovery-e2e-live-contract@v3';
+const CONTRACT_VERSION = postgresqlControlSchemaContract.contractVersion;
 const MIGRATION_COUNT = postgresqlMainMigrationStream.migrations.length;
 const LIMITATIONS = Object.freeze([
   'isolated PostgreSQL uses explicit TLS disable; production manifests remain verify-full',
@@ -274,7 +276,7 @@ function validatePluginPackageRecoveryE2ELiveReport(report) {
   if (
     !exactKeys(database, databaseKeys) ||
     database?.migrationCount !== MIGRATION_COUNT ||
-    database?.capabilityVersion !== 64 ||
+    database?.capabilityVersion !== CONTRACT_VERSION ||
     database?.initialState !== 'active' ||
     database?.upgradeState !== 'failed' ||
     !SHA256.test(database?.initialActiveLockDigest ?? '') ||
@@ -488,6 +490,7 @@ if (require.main === module) {
 }
 
 module.exports = {
+  CONTRACT_VERSION,
   FIXTURE,
   GATE_KEYS,
   LIMITATIONS,

scripts/ql3-plugin-package-recovery-e2e-live-contract.cjs

@@ -15,6 +15,7 @@ const {
   createFixture,
 } = require('./ql3-plugin-package-recovery-e2e-fixture.cjs');
 const {
+  CONTRACT_VERSION,
   MIGRATION_COUNT,
 } = require('./ql3-plugin-package-recovery-e2e-live-audit.cjs');
 
@@ -1287,7 +1288,7 @@ SELECT json_build_object(
   ).stdout;
   const value = JSON.parse(output);
   assert.equal(value.migrationCount, MIGRATION_COUNT);
-  assert.equal(value.capabilityVersion, 64);
+  assert.equal(value.capabilityVersion, CONTRACT_VERSION);
   assert.equal(value.initialState, 'active');
   assert.equal(value.initialActiveLockDigest, fixture.initial.lock.lockDigest);
   assert.equal(value.upgradeState, 'failed');

scripts/ql3-provider-credential-test-kubernetes-live-contract.cjs

@@ -289,6 +289,18 @@ function providerPods(fixture) {
   ]).items;
 }
 
+function providerObservationKey(pod) {
+  assert.match(pod?.metadata?.uid ?? '', /^[A-Za-z0-9][A-Za-z0-9._-]+$/);
+  const provider = pod?.status?.containerStatuses?.find(
+    (container) => container.name === 'provider',
+  );
+  assert.ok(provider);
+  assert.ok(
+    Number.isSafeInteger(provider.restartCount) && provider.restartCount >= 0,
+  );
+  return `${pod.metadata.uid}:${provider.restartCount}`;
+}
+
 function applyExecutorNetworkPolicy(fixture, providerPodIp) {
   const egress = [
     {
@@ -1604,10 +1616,11 @@ async function main() {
         providerPodIp: pod.status.podIP,
       });
       const count = evidence.requestCount;
-      const previous = requestObservations.get(pod.metadata.uid) ?? 0;
+      const observationKey = providerObservationKey(pod);
+      const previous = requestObservations.get(observationKey) ?? 0;
       assert.ok(count >= previous);
       observedProviderRequests += count - previous;
-      requestObservations.set(pod.metadata.uid, count);
+      requestObservations.set(observationKey, count);
     };
 
     applyExecutorNetworkPolicy(fixture, null);
@@ -2049,6 +2062,7 @@ module.exports = {
   canI,
   deployProvider,
   executorJob,
+  providerObservationKey,
   providerServerSource,
   terminalJobSnapshot,
 };

test/back/ql3PluginPackageRecoveryE2ELiveAudit.test.cjs

@@ -11,6 +11,7 @@ const producerPath = path.join(
   'scripts/ql3-plugin-package-recovery-e2e-live-contract.cjs',
 );
 const {
+  CONTRACT_VERSION,
   FIXTURE,
   GATE_KEYS,
   MIGRATION_COUNT,
@@ -64,7 +65,7 @@ function validReport() {
     },
     database: {
       migrationCount: MIGRATION_COUNT,
-      capabilityVersion: 64,
+      capabilityVersion: CONTRACT_VERSION,
       initialState: 'active',
       initialActiveLockDigest: lock,
       upgradeState: 'failed',

test/back/ql3PluginPackageRecoveryE2ELiveContract.test.cjs

@@ -7,9 +7,11 @@ const {
   createFixture,
 } = require('../../scripts/ql3-plugin-package-recovery-e2e-fixture.cjs');
 const {
+  CONTRACT_VERSION,
   MIGRATION_COUNT,
 } = require('../../scripts/ql3-plugin-package-recovery-e2e-live-audit.cjs');
 const {
+  postgresqlControlSchemaContract,
   postgresqlMainMigrationStream,
 } = require('../../packages/ql3-cluster-postgres/dist/migration/migration.js');
 
@@ -64,6 +66,10 @@ test('fixture uses a real HTTPS and content-addressed OCI Distribution surface',
 
 test('report migration evidence follows the complete PostgreSQL stream', () => {
   assert.equal(MIGRATION_COUNT, postgresqlMainMigrationStream.migrations.length);
+  assert.equal(
+    CONTRACT_VERSION,
+    postgresqlControlSchemaContract.contractVersion,
+  );
 });
 
 test('fixture locks are bound to durable version-three approval dispatches', () => {
@@ -127,7 +133,7 @@ test('gate runs migration, healthy activation and a durable rejected upgrade', (
   assert.match(live, /initialSeed\.state, 'queued'/);
   assert.match(live, /upgradeSeed\.state, 'queued'/);
   assert.match(live, /value\.migrationCount, MIGRATION_COUNT/);
-  assert.match(live, /value\.capabilityVersion, 64/);
+  assert.match(live, /value\.capabilityVersion, CONTRACT_VERSION/);
   assert.match(live, /postgresEnvironment\(\s*'PACKAGE_EXECUTOR'/);
   assert.match(fixture, /assertPostgresPackageExecutorSchemaReady/);
   assert.match(live, /value\.initialState, 'active'/);

test/back/ql3ProviderCredentialTestKubernetesLiveContract.test.cjs

@@ -12,6 +12,7 @@ const {
   canI,
   deployProvider,
   executorJob,
+  providerObservationKey,
   providerServerSource,
   terminalJobSnapshot,
 } = require('../../scripts/ql3-provider-credential-test-kubernetes-live-contract.cjs');
@@ -349,6 +350,19 @@ test('reads provider evidence from the exact ready Pod with trusted TLS SNI', ()
   );
 });
 
+test('starts a fresh provider request baseline after a container restart', () => {
+  const pod = {
+    metadata: { uid: 'provider-uid' },
+    status: {
+      containerStatuses: [{ name: 'provider', restartCount: 0 }],
+    },
+  };
+
+  assert.equal(providerObservationKey(pod), 'provider-uid:0');
+  pod.status.containerStatuses[0].restartCount = 1;
+  assert.equal(providerObservationKey(pod), 'provider-uid:1');
+});
+
 test('provider fixture logs only generation and authorization decision', () => {
   const source = providerServerSource();
   assert.match(source, /event:'provider_request',generation,allowed/);