Merge branch 'maintainer-async/20260909T192026Z-delivery-trust/pulse'

Change-source: pulse-maintainer

docs/MSP.md

@@ -271,7 +271,7 @@ before money changes hands.
 ### Evaluating without a licence
 
 Self-service evaluation is available from the signed provider bundle published
-with Pulse v6.2.1. Use this exact release asset and its integrity sidecars; do
+with Pulse v6.4.1. Use this exact release asset and its integrity sidecars; do
 **not** download the moving `main` branch archive or run its `setup.sh` as
 root. For a later release, first confirm its release page contains the
 versioned provider archive, checksum, and SSH signature before changing the
@@ -281,7 +281,7 @@ Download the versioned asset, verify it with Pulse's pinned release key, and
 only then extract and run the guided setup:
 
 ```bash
-export PULSE_VERSION=v6.2.1
+export PULSE_VERSION=v6.4.1
 export PULSE_MSP_BUNDLE="pulse-provider-msp-${PULSE_VERSION}.tar.gz"
 export PULSE_RELEASE_BASE="https://github.com/rcourtman/Pulse/releases/download/${PULSE_VERSION}"
 
@@ -301,8 +301,11 @@ cd "pulse-provider-msp-${PULSE_VERSION}"
 sudo -E bash ./setup.sh
 ```
 
-The v6.2.1 evaluation request is anonymous. If you want setup help, start from
-the [Pulse MSP evaluation page](https://pulserelay.pro/msp.html#evaluate) first;
+The licence request omits an email address unless you export
+`PULSE_PROVIDER_MSP_EVAL_EMAIL` before running `setup.sh`, in which case that
+address is included in the request. If you
+want setup help, start from the
+[Pulse MSP evaluation page](https://pulserelay.pro/msp.html#evaluate) first;
 that contact request remains separate from the licence activation.
 
 The host needs Ubuntu 24.04 or similar, a domain you can point at it, and
@@ -313,9 +316,11 @@ Traefik dnsChallenge provider works by setting `ACME_DNS_PROVIDER` in `.env`
 and putting that provider's credential variables in `dns-credentials.env`.
 
 Leave `CP_PROVIDER_MSP_LICENSE_FILE` blank and `setup.sh` self-issues a
-2-client evaluation licence. The v6.2.1 bundle sends only the public half of
-the signing key generated on your host. The private key, client inventory,
-credentials, and contact details never leave the machine. You can then onboard
+2-client evaluation licence. The v6.4.1 bundle sends the public half of the
+signing key generated on your host, a setup-stage marker, and a signup-source
+label, plus the optional email address. This licence-request payload does not
+include the private key, client inventory or credentials; this is not a claim
+that setup makes no other network requests. You can then onboard
 two real clients and confirm the isolation boundary on your own infrastructure
 before buying.
 

docs/release-control/v6/internal/subsystems/deployment-installability.md

@@ -5373,3 +5373,20 @@ trust suite verifies every consumer pin, absence of the affected auth assumption
 workflow trust controls and the retained native Windows command/lifecycle proof
 steps. Native Windows execution remains a hosted check, not a local Linux claim.
 This upgrade is independent of the grouped signing/Docker/Tailscale updates.
+
+### Published MSP evaluation bundle guidance
+
+The MSP guide and its shipped mirror select the signed v6.4.1 provider archive,
+not a moving source archive. Verification of the pinned SSH identity/namespace
+and checksum precedes extraction and privileged setup. The licence request
+contains the generated public key, setup-stage and signup-source fields, plus
+email only when explicitly supplied. Describe that request rather than asserting
+anonymous setup or absence of all outbound credentials/network traffic.
+
+`TestProviderMSPEvaluationDocsUsePublishedSignedBundle` checks the synchronized
+guides, exact version, verification commands and bounded payload disclosure.
+Retained provider delivery verification establishes archive SHA256
+`a2f3f6df98385e7dbc47e5df9ca014046b8d81eba353420d8f22a668de621b88`,
+a valid pinned SSH signature and the extracted request expression with absent
+and synthetic email. It does not establish installed onboarding, server acceptance
+or legal identity. See the qualification evidence below.

frontend-modern/public/docs/MSP.md

@@ -271,7 +271,7 @@ before money changes hands.
 ### Evaluating without a licence
 
 Self-service evaluation is available from the signed provider bundle published
-with Pulse v6.2.1. Use this exact release asset and its integrity sidecars; do
+with Pulse v6.4.1. Use this exact release asset and its integrity sidecars; do
 **not** download the moving `main` branch archive or run its `setup.sh` as
 root. For a later release, first confirm its release page contains the
 versioned provider archive, checksum, and SSH signature before changing the
@@ -281,7 +281,7 @@ Download the versioned asset, verify it with Pulse's pinned release key, and
 only then extract and run the guided setup:
 
 ```bash
-export PULSE_VERSION=v6.2.1
+export PULSE_VERSION=v6.4.1
 export PULSE_MSP_BUNDLE="pulse-provider-msp-${PULSE_VERSION}.tar.gz"
 export PULSE_RELEASE_BASE="https://github.com/rcourtman/Pulse/releases/download/${PULSE_VERSION}"
 
@@ -301,8 +301,11 @@ cd "pulse-provider-msp-${PULSE_VERSION}"
 sudo -E bash ./setup.sh
 ```
 
-The v6.2.1 evaluation request is anonymous. If you want setup help, start from
-the [Pulse MSP evaluation page](https://pulserelay.pro/msp.html#evaluate) first;
+The licence request omits an email address unless you export
+`PULSE_PROVIDER_MSP_EVAL_EMAIL` before running `setup.sh`, in which case that
+address is included in the request. If you
+want setup help, start from the
+[Pulse MSP evaluation page](https://pulserelay.pro/msp.html#evaluate) first;
 that contact request remains separate from the licence activation.
 
 The host needs Ubuntu 24.04 or similar, a domain you can point at it, and
@@ -313,9 +316,11 @@ Traefik dnsChallenge provider works by setting `ACME_DNS_PROVIDER` in `.env`
 and putting that provider's credential variables in `dns-credentials.env`.
 
 Leave `CP_PROVIDER_MSP_LICENSE_FILE` blank and `setup.sh` self-issues a
-2-client evaluation licence. The v6.2.1 bundle sends only the public half of
-the signing key generated on your host. The private key, client inventory,
-credentials, and contact details never leave the machine. You can then onboard
+2-client evaluation licence. The v6.4.1 bundle sends the public half of the
+signing key generated on your host, a setup-stage marker, and a signup-source
+label, plus the optional email address. This licence-request payload does not
+include the private key, client inventory or credentials; this is not a claim
+that setup makes no other network requests. You can then onboard
 two real clients and confirm the isolation boundary on your own infrastructure
 before buying.
 

scripts/installtests/provider_msp_deploy_test.go

@@ -498,20 +498,27 @@ func TestProviderMSPEvaluationDocsUsePublishedSignedBundle(t *testing.T) {
 	doc := string(repoDocBytes)
 	assertContainsAll(t, doc,
 		"signed provider bundle published",
-		"with Pulse v6.2.1",
+		"with Pulse v6.4.1",
 		"**not** download the moving `main` branch archive",
-		`export PULSE_VERSION=v6.2.1`,
+		`export PULSE_VERSION=v6.4.1`,
 		`PULSE_MSP_BUNDLE="pulse-provider-msp-${PULSE_VERSION}.tar.gz"`,
 		`releases/download/${PULSE_VERSION}`,
 		"ssh-keygen -Y verify",
 		`-s "${PULSE_MSP_BUNDLE}.sshsig" < "${PULSE_MSP_BUNDLE}"`,
 		`sha256sum -c "${PULSE_MSP_BUNDLE}.sha256"`,
-		"The v6.2.1 evaluation request is anonymous",
+		"The licence request omits an email address unless you export",
+		"`PULSE_PROVIDER_MSP_EVAL_EMAIL` before running `setup.sh`",
+		"address is included in the request",
+		"a setup-stage marker, and a signup-source",
+		"this is not a claim",
+		"that setup makes no other network requests",
 		"contact request remains separate from the licence activation",
 		`sudo -E bash ./setup.sh`,
 	)
 	assertNotContainsAny(t, doc,
 		"Pulse/archive/refs/heads/main.tar.gz",
+		"evaluation request is anonymous",
+		"credentials never leave the",
 		"cd Pulse-main/deploy/provider-msp",
 		"sudo -E ./setup.sh",
 	)

tests/qualification/provider-delivery/README.md

@@ -0,0 +1,19 @@
+# Provider bundle delivery verification — 9 September 2026
+
+The public v6.4.1 release delivered `pulse-provider-msp-v6.4.1.tar.gz` and its
+`.sha256` and `.sshsig` sidecars. Retained verification:
+- SHA256: a2f3f6df98385e7dbc47e5df9ca014046b8d81eba353420d8f22a668de621b88
+- Checksum verification passed.
+- SSH signature verification passed using identity `pulse-installer`,
+  namespace `pulse-install`, fingerprint
+  `SHA256:WjzDnbyb4fF3hPGRE1ZLtYcXzLimGpJq6Ou4opquTV0`.
+- Extracted setup.sh lines 23–24 default email empty and source
+  `provider_msp_setup`; lines 410–419 form the licence request.
+- Offline execution of that exact jq expression passed with absent email and
+  synthetic .invalid email, checking the complete field allowlist.
+
+These are retained delivery and offline payload results, not a new installation
+test. Setup, key generation, licence activation and customer lookup were not run.
+The current documentation regression checks version selection, signature/checksum
+commands, request-specific disclosure and byte-identical shipped documentation.
+This does not qualify later provider archives or prove server-side acceptance.