From d57987d48dca8e7e19faabe9dbc28b64f6ee21d5 Mon Sep 17 00:00:00 2001 From: rcourtman Date: Thu, 23 Apr 2026 22:54:57 +0100 Subject: [PATCH] Govern Pulse Cloud control plane ownership --- .../v6/internal/subsystems/cloud-paid.md | 24 +++++++- .../subsystems/deployment-installability.md | 7 ++- .../v6/internal/subsystems/registry.json | 60 +++++++++++++++++++ .../internal/subsystems/security-privacy.md | 2 + .../release_control/subsystem_lookup_test.py | 16 ++++- 5 files changed, 103 insertions(+), 6 deletions(-) diff --git a/docs/release-control/v6/internal/subsystems/cloud-paid.md b/docs/release-control/v6/internal/subsystems/cloud-paid.md index a30d4f9f3..89e4dff85 100644 --- a/docs/release-control/v6/internal/subsystems/cloud-paid.md +++ b/docs/release-control/v6/internal/subsystems/cloud-paid.md @@ -16,7 +16,8 @@ ## Purpose Own cloud plan/version semantics, entitlement limits, hosted billing/runtime -agreement, and cloud-specific enforcement rules. +agreement, the Pulse Cloud control plane, hosted tenant lifecycle, and +cloud-specific enforcement rules. ## Canonical Files @@ -99,6 +100,15 @@ agreement, and cloud-specific enforcement rules. 77. `pkg/licensing/self_hosted_feature_catalog.go` 78. `frontend-modern/src/utils/selfHostedFeatureCatalog.generated.ts` 79. `pulse-pro:license-server/self_hosted_feature_catalog.generated.go` +80. `internal/cloudcp/server.go`, `internal/cloudcp/authz.go`, `internal/cloudcp/commercial_identity.go`, `internal/cloudcp/security.go` +81. `internal/cloudcp/health_monitor.go`, `internal/cloudcp/health_stuck_provisioning.go`, `internal/cloudcp/tenant_state_metrics.go`, `internal/cloudcp/ratelimit.go` +82. `internal/cloudcp/trial_signup_handlers.go`, `internal/cloudcp/trial_signup_store.go`, `internal/cloudcp/hosted_entitlement_handlers.go` +83. `internal/cloudcp/admin/handlers.go`, `internal/cloudcp/admin/status.go`, `internal/cloudcp/auditlog/auditlog.go` +84. `internal/cloudcp/cpmetrics/metrics.go`, `internal/cloudcp/cpsec/nonce.go`, `internal/cloudcp/static_assets.go`, `internal/cloudcp/favicon.svg` +85. `internal/cloudcp/email/sender.go`, `internal/cloudcp/email/templates.go` +86. `internal/cloudcp/handoff/handler.go`, `internal/cloudcp/handoff/handoff.go` +87. `internal/cloudcp/stripe/grace_enforcer.go`, `internal/cloudcp/stripe/helpers.go`, `internal/cloudcp/stripe/reconciler.go`, `internal/cloudcp/stripe/webhook.go` +88. `internal/hosted/hosted_metrics.go`, `internal/hosted/reaper.go` ## Shared Boundaries @@ -123,6 +133,11 @@ agreement, and cloud-specific enforcement rules. syntactically valid `/api/public/signup` requests resolve to one uniform `202 Accepted` Pulse Account response whether provisioning/email side effects ran or were suppressed by owner-email throttling. +6. `internal/cloudcp/auth/magiclink.go` shared with `security-privacy`: control-plane magic-link HMAC handling is both a Pulse Cloud account-access boundary and a security/privacy token-secrecy boundary. +7. `internal/cloudcp/auth/magiclink_store.go` shared with `security-privacy`: control-plane magic-link persistence is both a Pulse Cloud account-access boundary and a security/privacy storage-hardening boundary. +8. `internal/cloudcp/docker/labels.go` shared with `deployment-installability`: hosted tenant Docker labels are both a Pulse Cloud runtime contract boundary and a deployment-installability rollout boundary. +9. `internal/cloudcp/docker/manager.go` shared with `deployment-installability`: hosted tenant container management is both a Pulse Cloud runtime contract boundary and a deployment-installability rollout boundary. +10. `internal/cloudcp/tenant_runtime_rollout.go` shared with `deployment-installability`: hosted tenant runtime rollout is both a Pulse Cloud runtime contract boundary and a deployment-installability release-rollout boundary. The real `pulse-pro` license-server legacy checkout issuance, recurring renewals, manual issue, and legacy exchange flows are part of that same @@ -319,6 +334,13 @@ Community limit enforcement. builds may keep the local override path, but release builds must resolve the verifier from the embedded build-time source of truth instead of honoring `PULSE_HOSTED_MODE` or other runtime wiring. +27. Add or change the Cloud control-plane runtime, public signup lifecycle, + tenant health/reconciliation, control-plane metrics, email delivery, + hosted handoff, hosted entitlement refresh, or hosted tenant reaping through + `internal/cloudcp/` and `internal/hosted/`. Those paths must stay governed + by the Cloud paid subsystem even when a narrower support subsystem also + owns a deployment, security, or relay-specific file in the same package + tree. ## Forbidden Paths diff --git a/docs/release-control/v6/internal/subsystems/deployment-installability.md b/docs/release-control/v6/internal/subsystems/deployment-installability.md index c41e04e02..786183b35 100644 --- a/docs/release-control/v6/internal/subsystems/deployment-installability.md +++ b/docs/release-control/v6/internal/subsystems/deployment-installability.md @@ -97,8 +97,11 @@ server-side update execution surfaces. 1. `frontend-modern/src/api/updates.ts` shared with `api-contracts`: the updates frontend client is both a deployment-installability control surface and a canonical API payload contract boundary. 2. `internal/api/updates.go` shared with `api-contracts`: update handlers are both a deployment-installability control surface and a canonical API payload contract boundary. -3. `scripts/install.ps1` shared with `agent-lifecycle`: the Windows installer is both a deployment installability entry point and a canonical agent lifecycle runtime continuity boundary. -4. `scripts/install.sh` shared with `agent-lifecycle`: the shell installer is both a deployment installability entry point and a canonical agent lifecycle runtime continuity boundary. +3. `internal/cloudcp/docker/labels.go` shared with `cloud-paid`: hosted tenant Docker labels are both a Pulse Cloud runtime contract boundary and a deployment-installability rollout boundary. +4. `internal/cloudcp/docker/manager.go` shared with `cloud-paid`: hosted tenant container management is both a Pulse Cloud runtime contract boundary and a deployment-installability rollout boundary. +5. `internal/cloudcp/tenant_runtime_rollout.go` shared with `cloud-paid`: hosted tenant runtime rollout is both a Pulse Cloud runtime contract boundary and a deployment-installability release-rollout boundary. +6. `scripts/install.ps1` shared with `agent-lifecycle`: the Windows installer is both a deployment installability entry point and a canonical agent lifecycle runtime continuity boundary. +7. `scripts/install.sh` shared with `agent-lifecycle`: the shell installer is both a deployment installability entry point and a canonical agent lifecycle runtime continuity boundary. ## Extension Points diff --git a/docs/release-control/v6/internal/subsystems/registry.json b/docs/release-control/v6/internal/subsystems/registry.json index fbe55553c..c0e00f861 100644 --- a/docs/release-control/v6/internal/subsystems/registry.json +++ b/docs/release-control/v6/internal/subsystems/registry.json @@ -553,6 +553,46 @@ "deployment-installability" ] }, + { + "path": "internal/cloudcp/auth/magiclink.go", + "rationale": "control-plane magic-link HMAC handling is both a Pulse Cloud account-access boundary and a security/privacy token-secrecy boundary", + "subsystems": [ + "cloud-paid", + "security-privacy" + ] + }, + { + "path": "internal/cloudcp/auth/magiclink_store.go", + "rationale": "control-plane magic-link persistence is both a Pulse Cloud account-access boundary and a security/privacy storage-hardening boundary", + "subsystems": [ + "cloud-paid", + "security-privacy" + ] + }, + { + "path": "internal/cloudcp/docker/labels.go", + "rationale": "hosted tenant Docker labels are both a Pulse Cloud runtime contract boundary and a deployment-installability rollout boundary", + "subsystems": [ + "cloud-paid", + "deployment-installability" + ] + }, + { + "path": "internal/cloudcp/docker/manager.go", + "rationale": "hosted tenant container management is both a Pulse Cloud runtime contract boundary and a deployment-installability rollout boundary", + "subsystems": [ + "cloud-paid", + "deployment-installability" + ] + }, + { + "path": "internal/cloudcp/tenant_runtime_rollout.go", + "rationale": "hosted tenant runtime rollout is both a Pulse Cloud runtime contract boundary and a deployment-installability release-rollout boundary", + "subsystems": [ + "cloud-paid", + "deployment-installability" + ] + }, { "path": "scripts/install.ps1", "rationale": "the Windows installer is both a deployment installability entry point and a canonical agent lifecycle runtime continuity boundary", @@ -1676,7 +1716,9 @@ "internal/api/licensing_", "internal/api/payments_", "internal/api/stripe_", + "internal/cloudcp/", "internal/cloudcp/portal/", + "internal/hosted/", "pkg/licensing/" ], "owned_files": [ @@ -1973,6 +2015,24 @@ "internal/cloudcp/stripe/msp_lifecycle_integration_test.go" ] }, + { + "id": "hosted-control-plane-runtime", + "label": "hosted control-plane runtime proof", + "match_prefixes": [ + "internal/cloudcp/", + "internal/hosted/" + ], + "match_files": [], + "allow_same_subsystem_tests": false, + "test_prefixes": [ + "internal/cloudcp/", + "internal/hosted/" + ], + "exact_files": [ + "internal/api/relay_hosted_runtime_test.go", + "pkg/licensing/hosted_subscription_test.go" + ] + }, { "id": "entitlement-lease-boundary", "label": "hosted entitlement lease proof", diff --git a/docs/release-control/v6/internal/subsystems/security-privacy.md b/docs/release-control/v6/internal/subsystems/security-privacy.md index 086296297..9ae0990a9 100644 --- a/docs/release-control/v6/internal/subsystems/security-privacy.md +++ b/docs/release-control/v6/internal/subsystems/security-privacy.md @@ -71,6 +71,8 @@ visibility, and privacy controls to operators. 8. `internal/api/security.go` shared with `api-contracts`: the security handlers are both a security/privacy control surface and a canonical API payload contract boundary. 9. `internal/api/security_tokens.go` shared with `api-contracts`: the security token handlers are both a security/privacy control surface and a canonical API payload contract boundary. 10. `internal/api/system_settings.go` shared with `api-contracts`: the system settings telemetry and auth controls are both a security/privacy control surface and a canonical API payload contract boundary. +11. `internal/cloudcp/auth/magiclink.go` shared with `cloud-paid`: control-plane magic-link HMAC handling is both a Pulse Cloud account-access boundary and a security/privacy token-secrecy boundary. +12. `internal/cloudcp/auth/magiclink_store.go` shared with `cloud-paid`: control-plane magic-link persistence is both a Pulse Cloud account-access boundary and a security/privacy storage-hardening boundary. ## Extension Points diff --git a/scripts/release_control/subsystem_lookup_test.py b/scripts/release_control/subsystem_lookup_test.py index d2fe72a45..cb70e68a5 100644 --- a/scripts/release_control/subsystem_lookup_test.py +++ b/scripts/release_control/subsystem_lookup_test.py @@ -4443,15 +4443,25 @@ class SubsystemLookupTest(unittest.TestCase): self.assertEqual(result["unowned_runtime_files"], []) self.assertEqual( {item["subsystem"] for item in result["impacted_subsystems"]}, - {"security-privacy"}, + {"cloud-paid", "security-privacy"}, ) + expected_subsystems_by_path = { + "internal/cloudcp/auth/magiclink.go": {"cloud-paid", "security-privacy"}, + "internal/cloudcp/auth/magiclink_store.go": {"cloud-paid", "security-privacy"}, + "internal/crypto/crypto.go": {"security-privacy"}, + "internal/securityutil/secure_storage_dir.go": {"security-privacy"}, + } for file_entry in result["files"]: self.assertEqual(file_entry["classification"], "runtime") self.assertEqual( {match["subsystem"] for match in file_entry["matches"]}, - {"security-privacy"}, + expected_subsystems_by_path[file_entry["path"]], + ) + match = next( + match + for match in file_entry["matches"] + if match["subsystem"] == "security-privacy" ) - match = file_entry["matches"][0] self.assertEqual( match["contract"], "docs/release-control/v6/internal/subsystems/security-privacy.md",