From c5bd6f1d99eecd49b5907c3091197dcbf55a6511 Mon Sep 17 00:00:00 2001
From: "pulse-triage[bot]"
 <249995291+pulse-triage[bot]@users.noreply.github.com>
Date: Sun, 4 Oct 2026 00:56:16 +0100
Subject: [PATCH] Align promotion controls with billing-safe demo profiles

PR2429 governance run 37161775883 still requires the removed demo entitlement rewrite and integrity clearing. Require the existing read-only capability gate instead, and reject billing writes or integrity removal. Keep all runtime profile, protected publication and exact-RC controls.

Contract-Neutral: Test-only alignment with the reviewed billing-preserving demo transaction; no runtime, API, deployment authority or release policy delta.
Change-source: pulse-maintainer
---
 .../release_promotion_policy_test.py               | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/scripts/release_control/release_promotion_policy_test.py b/scripts/release_control/release_promotion_policy_test.py
index 351a017957..343391ca2a 100644
--- a/scripts/release_control/release_promotion_policy_test.py
+++ b/scripts/release_control/release_promotion_policy_test.py
@@ -2643,15 +2643,23 @@ class ReleasePromotionPolicyTest(unittest.TestCase):
         self.assertIn("MOCK_SEED_DURATION=2h", demo_profile)
         self.assertIn("MOCK_SAMPLE_INTERVAL=5m", demo_profile)
         self.assertIn("MOCK_UPDATE_INTERVAL=15s", demo_profile)
-        # Profile application moved into the owned transaction; keep its
-        # runtime settings and entitlement, not the superseded shell snippets.
+        # The owned transaction adjusts only the demo runtime profile. It
+        # requires an existing entitlement; it must not grant one by rewriting
+        # signed billing state or clearing its integrity check.
         transaction = read(".github/scripts/demo-runtime-transaction.py")
         for required in ('"DEMO_MODE": "true"', '"PULSE_MOCK_MODE": "true"',
                          '"PULSE_MOCK_SEED_METRICS_STORE": "false"',
                          '"seed_duration": "trends_seed_duration"', '"sample_interval": "trends_sample_interval"',
-                         '"PULSE_MOCK_" + key.upper()', '["demo_fixtures"]', 'billing.pop("integrity", None)',
+                         '"PULSE_MOCK_" + key.upper()',
+                         'if "demo_fixtures" not in billing["capabilities"]:',
+                         'raise Failure("billing-demo-capability-required")',
+                         'os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK',
+                         'self.host.profile_admission()',
                          'self.host.profile(self.request, not healthy_baseline)', 'self.host.start()'):
             self.assertIn(required, transaction)
+        self.assertNotIn('billing.pop("integrity", None)', transaction)
+        self.assertNotIn('billing_file.write_text(', transaction)
+        self.assertNotIn('billing_file.write_bytes(', transaction)
         self.assertIn("MOCK_NODES: ${{ needs.resolve.outputs.mock_nodes }}", demo)
         self.assertIn("MOCK_UPDATE_INTERVAL: ${{ needs.resolve.outputs.mock_update_interval }}", demo)
         self.assertIn("/api/license/runtime-capabilities", demo)