Incorporate batch-start published security guidance

Preserve the exact published frontier alongside reviewed canonical work. No publication or deployment is performed by this merge.

Change-source: pulse-maintainer

docs/release-control/v6/internal/subsystems/security-privacy.md

@@ -859,6 +859,10 @@ tokens, and path-normalization variants.
    placeholders on the shared `SettingsLoadingSkeleton` primitive. This
    subsystem owns the security/privacy posture semantics; frontend-primitives
    owns skeleton animation, fill tokens, and placeholder shell consistency.
+   Posture severity is one rule across the Security Overview: the HTTPS tile
+   counts as critical, in its label and in the posture score, only when the
+   instance is publicly reachable, matching the hardening step that calls
+   HTTPS critical for public access and recommended on a private network.
 6a. Keep API token refresh/loading indicators on the shared `LoadingSpinner`
     primitive. Security/privacy owns the token-management trust copy and
     refresh semantics; frontend-primitives owns spinner shell, tone, and

frontend-modern/browser-verification/bc41850a607c7eb3.json

@@ -0,0 +1,33 @@
+{
+  "version": 1,
+  "base_sha": "fdcffc64114bd9d7ff7a92324391a09702c3c26a",
+  "verified_at": "2026-10-05T06:03:02Z",
+  "result": "passed",
+  "changed_paths": [
+    "frontend-modern/src/utils/securityScorePresentation.ts"
+  ],
+  "content_sha256": {
+    "frontend-modern/src/utils/securityScorePresentation.ts": "8a49852f591edd3e75bf4a2b1288a6ba71bf54259feffddbc0b3659d06ce6e0c"
+  },
+  "routes": [
+    "/settings/security-overview"
+  ],
+  "viewports": [
+    {
+      "width": 1440,
+      "height": 1000
+    },
+    {
+      "width": 390,
+      "height": 1000
+    }
+  ],
+  "states": [
+    "Private-network instance at 1440: the HTTPS tile is neutral with no Critical tag, matching the Plan HTTPS before live use card below it marked Recommended. Before, the tile was red and tagged Critical above that same Recommended card",
+    "Posture score reads 79 percent Moderate (password and export protection on, plain HTTP on a private network), where before plain HTTP pulled it to 55 percent",
+    "Phone at 390: the same neutral HTTPS tile and 79 percent Moderate header"
+  ],
+  "interactions": [
+    "Compared the posture grid with the hardening steps on the same page"
+  ]
+}

frontend-modern/src/components/Settings/__tests__/SecurityPostureSummary.test.tsx

@@ -47,4 +47,32 @@ describe('SecurityPostureSummary', () => {
 
     expect(screen.getByText('Weak')).toBeInTheDocument();
   });
+
+  it('only calls plain HTTP critical once the instance is publicly reachable', () => {
+    const status = {
+      hasAuthentication: true,
+      ssoEnabled: false,
+      hasProxyAuth: false,
+      apiTokenConfigured: false,
+      exportProtected: true,
+      unprotectedExportAllowed: false,
+      hasHTTPS: false,
+      hasAuditLogging: false,
+      requiresAuth: true,
+    };
+    const { unmount } = render(() => (
+      <SecurityPostureSummary status={{ ...status, publicAccess: false, isPrivateNetwork: true }} />
+    ));
+    // Private network: HTTPS is a recommended step, so no Critical tag and the
+    // critical share of the score is complete (0.7 + 2 of 7 x 0.3 = 79).
+    expect(screen.queryByText('Critical')).toBeNull();
+    expect(screen.getByText('79%')).toBeInTheDocument();
+    unmount();
+
+    render(() => (
+      <SecurityPostureSummary status={{ ...status, publicAccess: true, isPrivateNetwork: false }} />
+    ));
+    expect(screen.getByText('Critical')).toBeInTheDocument();
+    expect(screen.getByText('55%')).toBeInTheDocument();
+  });
 });

frontend-modern/src/utils/__tests__/securityScorePresentation.branchcov0718.test.ts

@@ -271,11 +271,12 @@ describe('securityScorePresentation — branch coverage (batch 0718)', () => {
         description: 'Token + passphrase required',
         critical: true,
       });
+      // Private network (publicAccess false): HTTPS is recommended, not critical.
       expect(byKey.https).toMatchObject({
         label: 'HTTPS',
         enabled: false,
         description: 'HTTP only',
-        critical: true,
+        critical: false,
       });
       expect(byKey.audit).toMatchObject({
         label: 'Audit log',

frontend-modern/src/utils/__tests__/securityScorePresentation.test.ts

@@ -271,6 +271,8 @@ describe('securityScorePresentation', () => {
           key: 'export',
           description: 'Token + passphrase required',
         }),
+        // Publicly reachable, so HTTPS counts as critical.
+        expect.objectContaining({ key: 'https', critical: true }),
       ]),
     );
 

frontend-modern/src/utils/securityScorePresentation.ts

@@ -394,7 +394,11 @@ export function getSecurityPostureItems(status: SecurityPostureStatus): Security
       label: 'HTTPS',
       enabled: Boolean(status.hasHTTPS),
       description: status.hasHTTPS ? 'Encrypted' : 'HTTP only',
-      critical: true,
+      // Same rule as the hardening steps below the grid: plain HTTP is
+      // critical once the instance is publicly reachable, and a recommended
+      // step on a private network. Marking it critical there put a red
+      // Critical tile above a Recommended card for the same control.
+      critical: Boolean(status.publicAccess),
     },
     {
       key: 'audit',