From 2ef2afef6a3593428e8eed9f933c3be86019a465 Mon Sep 17 00:00:00 2001
From: "pulse-triage[bot]"
 <249995291+pulse-triage[bot]@users.noreply.github.com>
Date: Fri, 2 Oct 2026 13:55:15 +0100
Subject: [PATCH] Bind all compiled install tests into rootful qualification

Include the four current install-test inputs omitted from the rootful source manifest and report exact missing paths on future drift. Product and qualification assertions are unchanged.

Contract-Neutral: Additive qualification source closure and diagnostic-only assertion message; no runtime or subsystem contract change.
Change-source: pulse-maintainer
---
 .../secure_runtime_rootful_attestation_v1_test.py           | 6 +++++-
 .../secure_runtime_rootful_source_manifest_v1.json          | 4 ++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/scripts/release_control/secure_runtime_rootful_attestation_v1_test.py b/scripts/release_control/secure_runtime_rootful_attestation_v1_test.py
index 8e38eaa2d..3dea9e9d9 100644
--- a/scripts/release_control/secure_runtime_rootful_attestation_v1_test.py
+++ b/scripts/release_control/secure_runtime_rootful_attestation_v1_test.py
@@ -506,7 +506,11 @@ if module.MAX_RECEIPT_BYTES <= 0:
             path.relative_to(repo_root).as_posix()
             for path in (repo_root / "scripts" / "installtests").glob("*_test.go")
         }
-        self.assertTrue(compiled_test_inputs.issubset(manifest["exact_paths"]))
+        self.assertFalse(
+            compiled_test_inputs - set(manifest["exact_paths"]),
+            "compiled installtests inputs outside the source manifest: "
+            + ", ".join(sorted(compiled_test_inputs - set(manifest["exact_paths"]))),
+        )
         recursive_roots = set(manifest["recursive_roots"])
         unbound_dependencies = set()
         for target, include_tests in (
diff --git a/scripts/release_control/secure_runtime_rootful_source_manifest_v1.json b/scripts/release_control/secure_runtime_rootful_source_manifest_v1.json
index f71a70683..7f70973ba 100644
--- a/scripts/release_control/secure_runtime_rootful_source_manifest_v1.json
+++ b/scripts/release_control/secure_runtime_rootful_source_manifest_v1.json
@@ -13,11 +13,14 @@
     "scripts/release_ldflags.sh",
     "scripts/installtests/agent_id_recovery_unix_test.go",
     "scripts/installtests/agent_state_dir_lifecycle_test.go",
+    "scripts/installtests/auto_update_intent_test.go",
     "scripts/installtests/backfill_release_assets_test.go",
     "scripts/installtests/build_release_assets_test.go",
     "scripts/installtests/container_dependency_contract_test.go",
+    "scripts/installtests/demo_reachability_test.go",
     "scripts/installtests/dependency_update_test.go",
     "scripts/installtests/docker_entrypoint_test.go",
+    "scripts/installtests/helm_openshift_docs_contract_test.go",
     "scripts/installtests/install_docker_sh_test.go",
     "scripts/installtests/install_mcp_test.go",
     "scripts/installtests/install_ps1_test.go",
@@ -25,6 +28,7 @@
     "scripts/installtests/install_sh_test.go",
     "scripts/installtests/integration_container_test.go",
     "scripts/installtests/native_pve_action_qualification_test.go",
+    "scripts/installtests/private_bootstrap_test.go",
     "scripts/installtests/provider_msp_deploy_test.go",
     "scripts/installtests/pulse_auto_update_test.go",
     "scripts/installtests/release_ldflags_test.go",