The generated manual helper currently permits an HTTPS asset redirect to plaintext HTTP, unlike the unattended downloader. Restrict initial and redirect protocols for both signed inputs, without weakening deadlines, signature verification or cleanup. Exercise the actual helper with real curl and authenticated local TLS, including downgrade refusals and permitted HTTPS redirects; keep the native systemd fixture on the exact envelope.
Change-source: pulse-maintainer
Admit only the manual helper's exact new curl envelope in the existing closed transport fixture. Require a signed emitted-helper round trip and reject altered deadlines, retries and TLS flags through the registered installer suite; do not widen the adapter or execute a native journey.
Change-source: pulse-maintainer
Keep the original failed transaction command distinct from any later cleanup command. Retain fixed operation labels and require portable controls for command, timeout, assertion, cleanup-only and successful receipts, without changing update transactions or disclosing command output.
Change-source: pulse-maintainer
Current exact-head CI exposes outdated PBS proof inventory, omitted bounded-download helper extraction, closed transport rejecting the production HTTPS flags, and Darwin's truncated comm column in Linux NAS fixtures. Preserve exact transport and process ownership, restoration and migration safety assertions while binding the controls to the actual producer.
Contract-Neutral: Test and offline CI-fixture alignment only; no installed runtime, trust, credentials, deadlines, source safety or public contract changes.
Change-source: pulse-maintainer
The current native acceptance oracle can return success without a manager observation after comparing running executable bytes. Bracket the comparison with stable active process identity and compare both executables independently to the authenticated fixture, so a changing PID or equally wrong destinations cannot pass. Add required portable drift/refusal controls without changing installer authority or hosted admission.
Change-source: pulse-maintainer
Supply the connected manager double's fixed comparator and keep its simulated process readback explicit. Separate mandatory real-sink controls from service-state deadlines without removing cases or extending either 45-second bound.
Change-source: pulse-maintainer
Contract-Neutral: Test fixture correction only; the running-executable acceptance contract added by the parent is unchanged.
An installed target version and active service can conceal an old managed executable. Compare the actual process bytes between complete bounded MainPID observations before accepting an update or restored active service. Retain the backup and current service on uncertainty without an automatic restart or rollback grant. Register real owned-process and conditional transaction controls; keep synthetic/native and customer acceptance distinct.
Change-source: pulse-maintainer
The source-bound hosted receipt stops before any native phase because its new ephemeral signer is mode 0644. Establish owned regular-file and verified 0600 mode before signing, without adopting existing keys or relaxing OpenSSH. Keep Linux ELF execution in both native Linux jobs; macOS still runs the portable signer/admission/recovery controls, and the bridge requires the exact platform verdict instead of staging Mach-O as Linux.
Change-source: pulse-maintainer
The current macOS CI drops its already provisioned GNU tools inside the connected updater fixture and reaches incompatible BSD tar. Capture only the needed supplied executables and require end-to-end tool use; keep the production harness environment scrubbed. Retain non-secret stage, file metadata and closed diagnostic markers for the actual hosted signer failure, without publishing signer output or inferring its cause.
Contract-Neutral: Confined native CI tool selection and additive non-secret failure observations only; no public installer, updater, signing, service, permission or customer contract changes.
Change-source: pulse-maintainer
Retain exact Delivery candidate 8cb66ef0f7. Allocate disposable native-CI scratch before child observation, preserving exclusive refusal and cleanup ownership. Related canonical fixture HOME correction is retained; no product, frontend or infrastructure change.
Change-source: pulse-maintainer
PR2817 completed CI at aebb17c9 with three frontend assertions that still required the superseded static age and TERM-grace log recipe. Assert the accepted shared clock and hard eight-second, 256-KiB bounds instead. Both macOS native-contract jobs also found the lab directory already present at admission; give tool startup an existing owned temporary HOME and require it in the confined manager, keeping NativeLab scratch ownership and cleanup refusal unchanged.
Contract-Neutral: Test-only integration reconciliation; preserve product source, public contracts, production deadlines, scratch admission and safety gates.
Change-source: pulse-maintainer
Current publisher CI fails both macOS installer controls with FileExistsError during scratch allocation. Allocate and record ownership before the first manager child can initialise HOME, retaining exclusive refusal of pre-existing directories and symlinks. Add discriminating allocation, early-refusal and cleanup controls; no systemd or platform result is manufactured.
Contract-Neutral: Correct disposable CI harness allocation ordering and regression controls; product updater, installer, signing, service and recovery contracts are unchanged.
Change-source: pulse-maintainer
The checkout label alone cannot establish source bytes after frontend preparation. Require an unchanged tracked tree before compiling the private pair; the exact recipe control now rejects dirty source before either compiler or root command and preserves all existing failure propagation.
Contract-Neutral: Implements existing exact-source admission on tracked bytes; native runtime, input and completion contracts are unchanged.
Change-source: pulse-maintainer
Use the existing BIND_ADDRESS setting in the fixed fixture environment, alongside telemetry opt-out. The connected production-function control verifies this exact private profile and persistence across all seven phases; no product default or native manager safeguard changes.
Contract-Neutral: Fixed local fixture environment only; source/native admission and transaction-completion contracts are unchanged.
Change-source: pulse-maintainer
The unattended source requests LoadState and ActiveState as separate systemctl options; the fixture emitted only the first, and the production parser rightly refused its incomplete observation. Keep the refusal and make the private adapter implement both repeated and comma-separated fixed properties.
Contract-Neutral: Private fixture command-interface correction only; production manager admission and native completion contracts are unchanged.
Change-source: pulse-maintainer
The installer emits its unit in three heredocs: the base, non-default port and safeguards. Relocate all three exact writer commands in the explicit manager control, with counts that reject source drift; the actual native runner continues to use the unchanged system unit writer.
Contract-Neutral: Confined fixture unit-path correction only; native hosted service and safety contracts are unchanged.
Change-source: pulse-maintainer
Discriminate the pre-exec PID from the process serving health/version, changed running bytes, loss of active state after readiness and residual inactive processes without using the host manager or a real listener.
Contract-Neutral: Regression controls only; native updater source and completion contracts are unchanged.
Change-source: pulse-maintainer
The installer source returns before appended function overrides, so the connected control attempted useradd in the unprivileged proof VM and failed before archive staging. Keep the actual create_user function and intercept only exact fixture account/owned-path chown commands through the explicit test adapter.
Contract-Neutral: Confined test adapter correction only; hosted native admission and transaction contracts are unchanged.
Change-source: pulse-maintainer
Keep captured output private to the test process so connected controls reveal a failing setup without uploading native application logs.
Contract-Neutral: Confined fixture diagnostics only; native admission, transaction, signing and bounded receipt contracts are unchanged.
Change-source: pulse-maintainer
Exercise real systemd and signed local current-source replacement/recovery in the existing real-embed job for #2785. Preserve service masks, persistent bytes, backups and owned cleanup; source controls do not claim published or LXC recovery.
Change-source: pulse-maintainer
pulse-triage[bot]