Govern public v6 preview ops ownership

docs/release-control/v6/internal/subsystems/cloud-paid.md

@@ -290,6 +290,14 @@ The governed browser proof for that posture lives in
 `tests/integration/tests/53-demo-mode-commercial-boundary.spec.ts` and is
 expected to stay runnable through
 `tests/integration/scripts/run-tests.sh demo-contract`.
+That same public-demo boundary also owns the governed `pulse-pro` operational
+path for the live v6 preview. `pulse-pro/scripts/bootstrap-v6-demo-preview.sh`
+is the canonical preview runtime bootstrap/update entrypoint and
+`pulse-pro/scripts/audit_v6_preview_demo.sh` is the canonical public smoke
+proof. The bootstrap must fail closed unless the dedicated preview host is
+already the live public target and that public smoke audit passes; any
+`--skip-public-audit` escape hatch is only for pre-cutover replacement-host
+staging, never an ordinary live refresh.
 That same licensing/browser boundary now also owns authenticated commercial
 posture bootstrap and the prohibition on non-billing entitlement reads.
 `frontend-modern/src/useAppRuntimeState.ts` is the canonical authenticated

docs/release-control/v6/internal/subsystems/registry.json

@@ -1717,7 +1717,10 @@
         "internal/cloudcp/registry/registry.go",
         "internal/cloudcp/routes.go",
         "internal/cloudcp/stripe/provisioner.go",
-        "internal/hosted/provisioner.go"
+        "internal/hosted/provisioner.go",
+        "pulse-pro:scripts/audit_v6_preview_demo.sh",
+        "pulse-pro:scripts/audit_v6_preview_demo_browser.cjs",
+        "pulse-pro:scripts/bootstrap-v6-demo-preview.sh"
       ],
       "verification": {
         "allow_same_subsystem_tests": true,
@@ -2318,6 +2321,22 @@
               "frontend-modern/src/pages/__tests__/PricingHandoff.test.tsx",
               "frontend-modern/src/utils/__tests__/pricingHandoff.test.ts"
             ]
+          },
+          {
+            "id": "public-demo-preview-operations",
+            "label": "public demo preview operations proof",
+            "match_prefixes": [],
+            "match_files": [
+              "pulse-pro:scripts/audit_v6_preview_demo.sh",
+              "pulse-pro:scripts/audit_v6_preview_demo_browser.cjs",
+              "pulse-pro:scripts/bootstrap-v6-demo-preview.sh"
+            ],
+            "allow_same_subsystem_tests": false,
+            "test_prefixes": [],
+            "exact_files": [
+              "pulse-pro:scripts/audit_v6_preview_demo.sh",
+              "tests/integration/tests/53-demo-mode-commercial-boundary.spec.ts"
+            ]
           }
         ]
       }

scripts/release_control/subsystem_lookup.py

@@ -29,6 +29,13 @@ WORKSPACE_REPOS_ROOT = REPO_ROOT.parent
 
 def normalize_input_path(raw: str) -> str:
     candidate = Path(raw.strip())
+    parts = candidate.parts
+    if len(parts) >= 3 and parts[0] == "repos":
+        repo_id = parts[1]
+        rel = Path(*parts[2:]).as_posix()
+        if repo_id == REPO_ROOT.name:
+            return rel
+        return f"{repo_id}:{rel}"
     if candidate.is_absolute():
         candidate = candidate.resolve()
         try:

scripts/release_control/subsystem_lookup_test.py

@@ -127,6 +127,27 @@ class SubsystemLookupTest(unittest.TestCase):
         self.assertEqual(match["lane_context"]["lane_id"], "L7")
         self.assertEqual(match["verification_requirement"]["id"], "mobile-relay-runtime")
 
+    def test_lookup_paths_normalizes_workspace_relative_cross_repo_runtime_paths(self) -> None:
+        result = lookup_paths(["repos/pulse-pro/scripts/bootstrap-v6-demo-preview.sh"])
+        self.assertEqual(result["unowned_runtime_files"], [])
+        self.assertEqual(
+            {item["subsystem"] for item in result["impacted_subsystems"]},
+            {"cloud-paid"},
+        )
+        file_entry = result["files"][0]
+        self.assertEqual(file_entry["path"], "pulse-pro:scripts/bootstrap-v6-demo-preview.sh")
+        self.assertEqual(file_entry["classification"], "runtime")
+        self.assertEqual(
+            {match["subsystem"] for match in file_entry["matches"]},
+            {"cloud-paid"},
+        )
+        match = file_entry["matches"][0]
+        self.assertEqual(match["lane_context"]["lane_id"], "L3")
+        self.assertEqual(
+            match["verification_requirement"]["id"],
+            "public-demo-preview-operations",
+        )
+
     def test_lookup_paths_assigns_shared_tag_badges_to_frontend_primitives(self) -> None:
         result = lookup_paths(["frontend-modern/src/components/shared/TagBadges.tsx"])
         self.assertEqual(result["unowned_runtime_files"], [])