From 7587bdff8a0c51d69ccacf454e58721673fbd4af Mon Sep 17 00:00:00 2001
From: "pulse-triage[bot]"
 <249995291+pulse-triage[bot]@users.noreply.github.com>
Date: Tue, 6 Oct 2026 03:40:10 +0100
Subject: [PATCH] Bind native-agent frontend tests into installer attestation

Final combined-source proof source-hh5q6qzp exposed the new compiled native-agent frontend test outside the rootful source manifest. Add its exact source binding and explicit regression requirement, retaining complete compiled-test coverage and all production roots. Existing runtime, isolation and qualification authority are unchanged.

Change-source: pulse-maintainer
---
 .../v6/internal/subsystems/deployment-installability.md        | 3 ++-
 .../secure_runtime_rootful_attestation_v1_test.py              | 1 +
 .../secure_runtime_rootful_source_manifest_v1.json             | 1 +
 3 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/docs/release-control/v6/internal/subsystems/deployment-installability.md b/docs/release-control/v6/internal/subsystems/deployment-installability.md
index 1778128b88..9f3ed27c06 100644
--- a/docs/release-control/v6/internal/subsystems/deployment-installability.md
+++ b/docs/release-control/v6/internal/subsystems/deployment-installability.md
@@ -2091,7 +2091,8 @@ artifact-selection behaviour.
    The rootful qualification source manifest retains the complete compiled
    install-test package, including the release-notes helper and its exact
    authored-copy fixture, copied-API/temperature/MSP/container-CPU guidance,
-   native guidance tools and demo transaction tests. Every compiled installer
+   native guidance tools, native-agent frontend prerequisite controls and demo
+   transaction tests. Every compiled installer
    test must appear in the manifest's exact paths even though recursive
    production roots exclude `_test.go`; the real manifest reader must hash
    each of those files. Accepting new installer tests must not silently narrow
diff --git a/scripts/release_control/secure_runtime_rootful_attestation_v1_test.py b/scripts/release_control/secure_runtime_rootful_attestation_v1_test.py
index 2c2afc36c4..5cf4d7d860 100644
--- a/scripts/release_control/secure_runtime_rootful_attestation_v1_test.py
+++ b/scripts/release_control/secure_runtime_rootful_attestation_v1_test.py
@@ -499,6 +499,7 @@ if module.MAX_RECEIPT_BYTES <= 0:
     def test_manifest_contract_binds_transitive_harness_and_production_boundary(self) -> None:
         manifest = json.loads((Path(__file__).with_name("secure_runtime_rootful_source_manifest_v1.json")).read_text(encoding="utf-8"))
         required = {
+            "scripts/installtests/native_agent_frontend_test.go",
             "scripts/installtests/release_notes_contract_test.go",
             "scripts/installtests/testdata/release-notes-v6.4.5-authored.md",
             "scripts/installtests/secure_runtime_rootful_qualification_test.go",
diff --git a/scripts/release_control/secure_runtime_rootful_source_manifest_v1.json b/scripts/release_control/secure_runtime_rootful_source_manifest_v1.json
index 93edde0dce..48ae7c1221 100644
--- a/scripts/release_control/secure_runtime_rootful_source_manifest_v1.json
+++ b/scripts/release_control/secure_runtime_rootful_source_manifest_v1.json
@@ -32,6 +32,7 @@
     "scripts/installtests/install_sh_test.go",
     "scripts/installtests/integration_container_test.go",
     "scripts/installtests/msp_diagnostic_guidance_test.go",
+    "scripts/installtests/native_agent_frontend_test.go",
     "scripts/installtests/native_guidance_tools_test.go",
     "scripts/installtests/native_pve_action_qualification_test.go",
     "scripts/installtests/pbs_api_guidance_test.go",