Govern Pulse Cloud control plane ownership

docs/release-control/v6/internal/subsystems/cloud-paid.md

@@ -16,7 +16,8 @@
 ## Purpose
 
 Own cloud plan/version semantics, entitlement limits, hosted billing/runtime
-agreement, and cloud-specific enforcement rules.
+agreement, the Pulse Cloud control plane, hosted tenant lifecycle, and
+cloud-specific enforcement rules.
 
 ## Canonical Files
 
@@ -99,6 +100,15 @@ agreement, and cloud-specific enforcement rules.
 77. `pkg/licensing/self_hosted_feature_catalog.go`
 78. `frontend-modern/src/utils/selfHostedFeatureCatalog.generated.ts`
 79. `pulse-pro:license-server/self_hosted_feature_catalog.generated.go`
+80. `internal/cloudcp/server.go`, `internal/cloudcp/authz.go`, `internal/cloudcp/commercial_identity.go`, `internal/cloudcp/security.go`
+81. `internal/cloudcp/health_monitor.go`, `internal/cloudcp/health_stuck_provisioning.go`, `internal/cloudcp/tenant_state_metrics.go`, `internal/cloudcp/ratelimit.go`
+82. `internal/cloudcp/trial_signup_handlers.go`, `internal/cloudcp/trial_signup_store.go`, `internal/cloudcp/hosted_entitlement_handlers.go`
+83. `internal/cloudcp/admin/handlers.go`, `internal/cloudcp/admin/status.go`, `internal/cloudcp/auditlog/auditlog.go`
+84. `internal/cloudcp/cpmetrics/metrics.go`, `internal/cloudcp/cpsec/nonce.go`, `internal/cloudcp/static_assets.go`, `internal/cloudcp/favicon.svg`
+85. `internal/cloudcp/email/sender.go`, `internal/cloudcp/email/templates.go`
+86. `internal/cloudcp/handoff/handler.go`, `internal/cloudcp/handoff/handoff.go`
+87. `internal/cloudcp/stripe/grace_enforcer.go`, `internal/cloudcp/stripe/helpers.go`, `internal/cloudcp/stripe/reconciler.go`, `internal/cloudcp/stripe/webhook.go`
+88. `internal/hosted/hosted_metrics.go`, `internal/hosted/reaper.go`
 
 ## Shared Boundaries
 
@@ -123,6 +133,11 @@ agreement, and cloud-specific enforcement rules.
    syntactically valid `/api/public/signup` requests resolve to one uniform
    `202 Accepted` Pulse Account response whether provisioning/email side
    effects ran or were suppressed by owner-email throttling.
+6. `internal/cloudcp/auth/magiclink.go` shared with `security-privacy`: control-plane magic-link HMAC handling is both a Pulse Cloud account-access boundary and a security/privacy token-secrecy boundary.
+7. `internal/cloudcp/auth/magiclink_store.go` shared with `security-privacy`: control-plane magic-link persistence is both a Pulse Cloud account-access boundary and a security/privacy storage-hardening boundary.
+8. `internal/cloudcp/docker/labels.go` shared with `deployment-installability`: hosted tenant Docker labels are both a Pulse Cloud runtime contract boundary and a deployment-installability rollout boundary.
+9. `internal/cloudcp/docker/manager.go` shared with `deployment-installability`: hosted tenant container management is both a Pulse Cloud runtime contract boundary and a deployment-installability rollout boundary.
+10. `internal/cloudcp/tenant_runtime_rollout.go` shared with `deployment-installability`: hosted tenant runtime rollout is both a Pulse Cloud runtime contract boundary and a deployment-installability release-rollout boundary.
 
 The real `pulse-pro` license-server legacy checkout issuance, recurring
 renewals, manual issue, and legacy exchange flows are part of that same
@@ -319,6 +334,13 @@ Community limit enforcement.
     builds may keep the local override path, but release builds must resolve
     the verifier from the embedded build-time source of truth instead of
     honoring `PULSE_HOSTED_MODE` or other runtime wiring.
+27. Add or change the Cloud control-plane runtime, public signup lifecycle,
+    tenant health/reconciliation, control-plane metrics, email delivery,
+    hosted handoff, hosted entitlement refresh, or hosted tenant reaping through
+    `internal/cloudcp/` and `internal/hosted/`. Those paths must stay governed
+    by the Cloud paid subsystem even when a narrower support subsystem also
+    owns a deployment, security, or relay-specific file in the same package
+    tree.
 
 ## Forbidden Paths
 

docs/release-control/v6/internal/subsystems/deployment-installability.md

@@ -97,8 +97,11 @@ server-side update execution surfaces.
 
 1. `frontend-modern/src/api/updates.ts` shared with `api-contracts`: the updates frontend client is both a deployment-installability control surface and a canonical API payload contract boundary.
 2. `internal/api/updates.go` shared with `api-contracts`: update handlers are both a deployment-installability control surface and a canonical API payload contract boundary.
-3. `scripts/install.ps1` shared with `agent-lifecycle`: the Windows installer is both a deployment installability entry point and a canonical agent lifecycle runtime continuity boundary.
-4. `scripts/install.sh` shared with `agent-lifecycle`: the shell installer is both a deployment installability entry point and a canonical agent lifecycle runtime continuity boundary.
+3. `internal/cloudcp/docker/labels.go` shared with `cloud-paid`: hosted tenant Docker labels are both a Pulse Cloud runtime contract boundary and a deployment-installability rollout boundary.
+4. `internal/cloudcp/docker/manager.go` shared with `cloud-paid`: hosted tenant container management is both a Pulse Cloud runtime contract boundary and a deployment-installability rollout boundary.
+5. `internal/cloudcp/tenant_runtime_rollout.go` shared with `cloud-paid`: hosted tenant runtime rollout is both a Pulse Cloud runtime contract boundary and a deployment-installability release-rollout boundary.
+6. `scripts/install.ps1` shared with `agent-lifecycle`: the Windows installer is both a deployment installability entry point and a canonical agent lifecycle runtime continuity boundary.
+7. `scripts/install.sh` shared with `agent-lifecycle`: the shell installer is both a deployment installability entry point and a canonical agent lifecycle runtime continuity boundary.
 
 ## Extension Points
 

docs/release-control/v6/internal/subsystems/registry.json

@@ -553,6 +553,46 @@
         "deployment-installability"
       ]
     },
+    {
+      "path": "internal/cloudcp/auth/magiclink.go",
+      "rationale": "control-plane magic-link HMAC handling is both a Pulse Cloud account-access boundary and a security/privacy token-secrecy boundary",
+      "subsystems": [
+        "cloud-paid",
+        "security-privacy"
+      ]
+    },
+    {
+      "path": "internal/cloudcp/auth/magiclink_store.go",
+      "rationale": "control-plane magic-link persistence is both a Pulse Cloud account-access boundary and a security/privacy storage-hardening boundary",
+      "subsystems": [
+        "cloud-paid",
+        "security-privacy"
+      ]
+    },
+    {
+      "path": "internal/cloudcp/docker/labels.go",
+      "rationale": "hosted tenant Docker labels are both a Pulse Cloud runtime contract boundary and a deployment-installability rollout boundary",
+      "subsystems": [
+        "cloud-paid",
+        "deployment-installability"
+      ]
+    },
+    {
+      "path": "internal/cloudcp/docker/manager.go",
+      "rationale": "hosted tenant container management is both a Pulse Cloud runtime contract boundary and a deployment-installability rollout boundary",
+      "subsystems": [
+        "cloud-paid",
+        "deployment-installability"
+      ]
+    },
+    {
+      "path": "internal/cloudcp/tenant_runtime_rollout.go",
+      "rationale": "hosted tenant runtime rollout is both a Pulse Cloud runtime contract boundary and a deployment-installability release-rollout boundary",
+      "subsystems": [
+        "cloud-paid",
+        "deployment-installability"
+      ]
+    },
     {
       "path": "scripts/install.ps1",
       "rationale": "the Windows installer is both a deployment installability entry point and a canonical agent lifecycle runtime continuity boundary",
@@ -1676,7 +1716,9 @@
         "internal/api/licensing_",
         "internal/api/payments_",
         "internal/api/stripe_",
+        "internal/cloudcp/",
         "internal/cloudcp/portal/",
+        "internal/hosted/",
         "pkg/licensing/"
       ],
       "owned_files": [
@@ -1973,6 +2015,24 @@
               "internal/cloudcp/stripe/msp_lifecycle_integration_test.go"
             ]
           },
+          {
+            "id": "hosted-control-plane-runtime",
+            "label": "hosted control-plane runtime proof",
+            "match_prefixes": [
+              "internal/cloudcp/",
+              "internal/hosted/"
+            ],
+            "match_files": [],
+            "allow_same_subsystem_tests": false,
+            "test_prefixes": [
+              "internal/cloudcp/",
+              "internal/hosted/"
+            ],
+            "exact_files": [
+              "internal/api/relay_hosted_runtime_test.go",
+              "pkg/licensing/hosted_subscription_test.go"
+            ]
+          },
           {
             "id": "entitlement-lease-boundary",
             "label": "hosted entitlement lease proof",

docs/release-control/v6/internal/subsystems/security-privacy.md

@@ -71,6 +71,8 @@ visibility, and privacy controls to operators.
 8. `internal/api/security.go` shared with `api-contracts`: the security handlers are both a security/privacy control surface and a canonical API payload contract boundary.
 9. `internal/api/security_tokens.go` shared with `api-contracts`: the security token handlers are both a security/privacy control surface and a canonical API payload contract boundary.
 10. `internal/api/system_settings.go` shared with `api-contracts`: the system settings telemetry and auth controls are both a security/privacy control surface and a canonical API payload contract boundary.
+11. `internal/cloudcp/auth/magiclink.go` shared with `cloud-paid`: control-plane magic-link HMAC handling is both a Pulse Cloud account-access boundary and a security/privacy token-secrecy boundary.
+12. `internal/cloudcp/auth/magiclink_store.go` shared with `cloud-paid`: control-plane magic-link persistence is both a Pulse Cloud account-access boundary and a security/privacy storage-hardening boundary.
 
 ## Extension Points
 

scripts/release_control/subsystem_lookup_test.py

@@ -4443,15 +4443,25 @@ class SubsystemLookupTest(unittest.TestCase):
         self.assertEqual(result["unowned_runtime_files"], [])
         self.assertEqual(
             {item["subsystem"] for item in result["impacted_subsystems"]},
-            {"security-privacy"},
+            {"cloud-paid", "security-privacy"},
         )
+        expected_subsystems_by_path = {
+            "internal/cloudcp/auth/magiclink.go": {"cloud-paid", "security-privacy"},
+            "internal/cloudcp/auth/magiclink_store.go": {"cloud-paid", "security-privacy"},
+            "internal/crypto/crypto.go": {"security-privacy"},
+            "internal/securityutil/secure_storage_dir.go": {"security-privacy"},
+        }
         for file_entry in result["files"]:
             self.assertEqual(file_entry["classification"], "runtime")
             self.assertEqual(
                 {match["subsystem"] for match in file_entry["matches"]},
-                {"security-privacy"},
+                expected_subsystems_by_path[file_entry["path"]],
+            )
+            match = next(
+                match
+                for match in file_entry["matches"]
+                if match["subsystem"] == "security-privacy"
             )
-            match = file_entry["matches"][0]
             self.assertEqual(
                 match["contract"],
                 "docs/release-control/v6/internal/subsystems/security-privacy.md",