Scope the dedicated proof to quick security setup

Use an exact runtime-file policy before the general API fallback, so setup preservation evidence cannot substitute for unrelated API changes. Assert both setup routing and unchanged organization/RBAC verification requirements. Retain the original failed broader-registry test evidence.

Change-source: pulse-maintainer

docs/release-control/v6/internal/subsystems/api-contracts.md

@@ -10859,6 +10859,6 @@ Regression coverage: `TestQuickSecuritySetupForcePreservesSystemSettings` and
 The dedicated `internal/api/security_setup_settings_preservation_test.go` is an
 explicit backend-payload verification artifact. It exercises authenticated force
 setup and checks persisted non-auth preferences, rather than substituting a
-status-only or unrelated test for the setup contract. The registry accepts this
-narrow file alongside existing API proof files; no runtime paths or required
-contract updates are exempted.
+status-only or unrelated test for the setup contract. The registry routes only `internal/api/security_setup_fix.go` to this narrow
+setup proof policy; unrelated API runtime paths retain their existing verification
+requirements. No runtime paths or required contract updates are exempted.

docs/release-control/v6/internal/subsystems/registry.json

@@ -3239,6 +3239,21 @@
               "internal/config/persistence_metadata_test.go"
             ]
           },
+          {
+            "id": "quick-security-setup-contract",
+            "label": "local security setup and preference preservation proof",
+            "match_prefixes": [],
+            "match_files": [
+              "internal/api/security_setup_fix.go"
+            ],
+            "allow_same_subsystem_tests": false,
+            "test_prefixes": [],
+            "exact_files": [
+              "internal/api/contract_test.go",
+              "internal/api/security_setup_fix_test.go",
+              "internal/api/security_setup_settings_preservation_test.go"
+            ]
+          },
           {
             "id": "backend-payload-contracts",
             "label": "backend API payload proof",
@@ -3271,7 +3286,6 @@
               "internal/api/metadata_handlers_test.go",
               "internal/api/patrol_autopilot_test.go",
               "internal/api/runtime_inventory_sources_test.go",
-              "internal/api/security_setup_settings_preservation_test.go",
               "pulse-enterprise:test/extensions_contract_test.go"
             ]
           },

scripts/release_control/canonical_completion_guard_test.py

@@ -1307,6 +1307,17 @@ class CanonicalCompletionGuardTest(unittest.TestCase):
             ],
         )
 
+    def test_quick_setup_preservation_proof_is_scoped_to_setup_runtime(self):
+        proof = "internal/api/security_setup_settings_preservation_test.go"
+        setup = infer_impacted_subsystems(["internal/api/security_setup_fix.go"])["api-contracts"]
+        requirements = setup["verification_requirements"]
+        self.assertEqual(len(requirements), 1)
+        self.assertEqual(requirements[0]["id"], "quick-security-setup-contract")
+        self.assertIn(proof, requirements[0]["exact_files"])
+        self.assertFalse(requirements[0]["allow_same_subsystem_tests"])
+        other = infer_impacted_subsystems(["internal/api/access_control_handlers.go"])["api-contracts"]
+        self.assertNotIn(proof, other["verification_requirements"][0]["exact_files"])
+
     def test_organization_rbac_backend_change_requires_organization_settings_and_api_contracts(self):
         required = infer_impacted_subsystems(["internal/api/access_control_handlers.go"])
         self.assertEqual(set(required), {"api-contracts", "organization-settings"})