From 6a611905be3be1cb504979e2bde00bf55a3dacc4 Mon Sep 17 00:00:00 2001
From: "pulse-triage[bot]"
 <249995291+pulse-triage[bot]@users.noreply.github.com>
Date: Tue, 15 Sep 2026 02:28:17 +0100
Subject: [PATCH] Scope the dedicated proof to quick security setup

Use an exact runtime-file policy before the general API fallback, so setup preservation evidence cannot substitute for unrelated API changes. Assert both setup routing and unchanged organization/RBAC verification requirements. Retain the original failed broader-registry test evidence.

Change-source: pulse-maintainer
---
 .../v6/internal/subsystems/api-contracts.md      |  6 +++---
 .../v6/internal/subsystems/registry.json         | 16 +++++++++++++++-
 .../canonical_completion_guard_test.py           | 11 +++++++++++
 3 files changed, 29 insertions(+), 4 deletions(-)

diff --git a/docs/release-control/v6/internal/subsystems/api-contracts.md b/docs/release-control/v6/internal/subsystems/api-contracts.md
index 6d9889e438..f53afc75fd 100644
--- a/docs/release-control/v6/internal/subsystems/api-contracts.md
+++ b/docs/release-control/v6/internal/subsystems/api-contracts.md
@@ -10859,6 +10859,6 @@ Regression coverage: `TestQuickSecuritySetupForcePreservesSystemSettings` and
 The dedicated `internal/api/security_setup_settings_preservation_test.go` is an
 explicit backend-payload verification artifact. It exercises authenticated force
 setup and checks persisted non-auth preferences, rather than substituting a
-status-only or unrelated test for the setup contract. The registry accepts this
-narrow file alongside existing API proof files; no runtime paths or required
-contract updates are exempted.
+status-only or unrelated test for the setup contract. The registry routes only `internal/api/security_setup_fix.go` to this narrow
+setup proof policy; unrelated API runtime paths retain their existing verification
+requirements. No runtime paths or required contract updates are exempted.
diff --git a/docs/release-control/v6/internal/subsystems/registry.json b/docs/release-control/v6/internal/subsystems/registry.json
index ccf0eac96a..d569008e3c 100644
--- a/docs/release-control/v6/internal/subsystems/registry.json
+++ b/docs/release-control/v6/internal/subsystems/registry.json
@@ -3239,6 +3239,21 @@
               "internal/config/persistence_metadata_test.go"
             ]
           },
+          {
+            "id": "quick-security-setup-contract",
+            "label": "local security setup and preference preservation proof",
+            "match_prefixes": [],
+            "match_files": [
+              "internal/api/security_setup_fix.go"
+            ],
+            "allow_same_subsystem_tests": false,
+            "test_prefixes": [],
+            "exact_files": [
+              "internal/api/contract_test.go",
+              "internal/api/security_setup_fix_test.go",
+              "internal/api/security_setup_settings_preservation_test.go"
+            ]
+          },
           {
             "id": "backend-payload-contracts",
             "label": "backend API payload proof",
@@ -3271,7 +3286,6 @@
               "internal/api/metadata_handlers_test.go",
               "internal/api/patrol_autopilot_test.go",
               "internal/api/runtime_inventory_sources_test.go",
-              "internal/api/security_setup_settings_preservation_test.go",
               "pulse-enterprise:test/extensions_contract_test.go"
             ]
           },
diff --git a/scripts/release_control/canonical_completion_guard_test.py b/scripts/release_control/canonical_completion_guard_test.py
index 4970cd5eee..03c476cb7e 100644
--- a/scripts/release_control/canonical_completion_guard_test.py
+++ b/scripts/release_control/canonical_completion_guard_test.py
@@ -1307,6 +1307,17 @@ class CanonicalCompletionGuardTest(unittest.TestCase):
             ],
         )
 
+    def test_quick_setup_preservation_proof_is_scoped_to_setup_runtime(self):
+        proof = "internal/api/security_setup_settings_preservation_test.go"
+        setup = infer_impacted_subsystems(["internal/api/security_setup_fix.go"])["api-contracts"]
+        requirements = setup["verification_requirements"]
+        self.assertEqual(len(requirements), 1)
+        self.assertEqual(requirements[0]["id"], "quick-security-setup-contract")
+        self.assertIn(proof, requirements[0]["exact_files"])
+        self.assertFalse(requirements[0]["allow_same_subsystem_tests"])
+        other = infer_impacted_subsystems(["internal/api/access_control_handlers.go"])["api-contracts"]
+        self.assertNotIn(proof, other["verification_requirements"][0]["exact_files"])
+
     def test_organization_rbac_backend_change_requires_organization_settings_and_api_contracts(self):
         required = infer_impacted_subsystems(["internal/api/access_control_handlers.go"])
         self.assertEqual(set(required), {"api-contracts", "organization-settings"})