Stream ungrouped retained reads in the existing time-major index order,
avoiding temporary metric sorts without changing tier reconciliation or
chart samples. Extend query-plan and filtered-result coverage.
Add an explicit strict mode for the existing 90 ms API budget and an
optional fresh-worker CI proof with fixed executable identities and raw
capacity evidence. Keep ordinary hosted budgets and required gates intact.
Contract-Neutral: Chart payloads, retained-tier reconciliation, sampling, index layout and source/release gates are unchanged; the implementation removes an unnecessary sort and adds controlled verification of existing latency budgets.
Preserve selected memory freshness and the VM/LXC interpretation.
Retain both native tool contracts and current API concurrency controls.
Qualify this source separately from release and installed recovery.
Contract-Neutral: Integrate already-governed parents without a new contract change. Incoming verification files already match main. Fresh integration tests and source-bound browser proof cover the combined memory and installer surfaces.
The DSM Upstart removal path links its manual override and restores a
retired job config with GNU `ln -T --`, a hard link that never replaces
or descends into an existing target. Its Python harness executes those
production functions with the host's ln. On the macOS runners that is
BSD ln, which rejects -T ("illegal option -- T"), so 13 subtests of
TestInstallSHUpstartTeardownRequiresObservedQuiescence have failed on
both macOS jobs since the DSM retirement series landed on 12 Oct.
The production code is right: that path only runs on Synology DSM
(Linux), never on a macOS agent host. The gap is the macOS fixture
toolset, which already supplies GNU stat/chmod/chown/mv/tar for these
Linux-only installer contracts but not ln. Add ln to that step and make
the fixture-tool contract test bind it and exercise real `ln -T`
no-replacement semantics (file and directory targets).
Contract-Neutral: CI fixture tooling only; macOS runners gain the GNU ln the existing DSM Upstart harness already assumes, no installer or lifecycle contract change
Put published highlights and optional screenshot comparisons in the
post-update dialog, with grouped details available on demand.
Reuse inspected images from merged pull requests or capture fresh release
views, then publish versioned PNG sidecars. Serve screenshots through the
authenticated release endpoint to preserve the existing image policy.
Exact PR2888 smoke job 115991110826 exposes two coverage failures: the integrated .github/scripts npm lock was omitted from Dependabot and the weekly complete/production audit matrix. Include that existing module in both unchanged scan routes; retain all audit findings, review groups and immutable action pins.
Contract-Neutral: Scan coverage integration correction for an existing tooling module; no product runtime, dependencies, permission, audit threshold or release behavior changes.
Change-source: pulse-maintainer
Own PR2936's stale pin and download-admission failures at b7e774d4. Refresh all current workflow consumers, including the newer pre-token issue-label job, with their exact static expectations and lifecycle/deployment contracts. Preserve Node 24, scoped lockfile caching, credential isolation and artifact identity/retention; reject old, mutable and arbitrary download pins.
Contract-Neutral: Immutable Actions pin refresh and coupled consumer/trust expectations only; workflow inputs, permissions, cache and credential controls, artifact identities and application/runtime contracts are unchanged.
Change-source: pulse-maintainer
The stable source Actions record currently returns 404 even though the published release is immutable. Do not require that transient record for post-activation chart recovery: authenticate the exact consumed activation marker and its canonical hosted source provenance with the existing packet verifier, then retain release, source-run and chart bindings. OCI provenance and public package readback remain mandatory. Add executed offline admission/refusal regressions and the corresponding deployment contract.
Change-source: pulse-maintainer
Run the locked parser and silent triage policy on their complete input changes in a credential-free Build and Test job. Retain issue-event pre-token checks, existing runtime and strict dependency gates; exercise admission and original install/test failure exits.
Change-source: pulse-maintainer
Replace the repeatedly patched line scanner with the existing exact Marked 17.0.6 GFM lexer. Preserve real legacy values and silent current-thread label deltas while excluding quoted, nested, HTML and multiline-code declarations and upgrade-source title fallback. Install the complete one-package locked graph with scripts disabled and verify triage before minting its existing write token.
Contract-Neutral: Replace the issue metadata scanner within the existing silent classification contract; no product runtime, API, rendered Pulse UI, permissions, retest or disposition-authority change.
Change-source: pulse-maintainer
Run the existing credential-free diagnostic regressions in tier admission before dependency installation or image/shard work. Check the actual workflow wiring alongside the read-only collector and unchanged strict goldens.
Contract-Neutral: Invoke existing auth-renderer regression controls in CI; no public contract, dependency, golden or threshold changes.
Change-source: pulse-maintainer
Main Secret Scan job 115618327497 on 90a8b890 passed after scanning zero commits and bytes with --log-opts=-1. Bind the exact checkout, scan the complete introduced commit range plus first-parent merge resolution, and use full reachable history when the incremental base is unavailable or divergent. Preserve the pinned detector, checksum, redaction, fatal findings, ignore fingerprints and unconditional per-push admission. Real Git fixtures cover earlier removed bytes, merge-only changes, complete-history fallback and failure exits.
Contract-Neutral: Restore existing per-push secret-scanning coverage; detector rules, security exceptions, permissions, application and deployment contracts are unchanged.
Change-source: pulse-maintainer
Classify the complete tree diff before builds or browser setup. Only nonempty top-level browser receipt JSON changes are exempt; mixed source, graphs, controls, docs and unavailable diffs keep ordinary runtime checks. Keep per-push secret scanning, independent canonical receipt validation and a strict E2E verdict which never calls skipped tests passing. Exercise real Git ranges and both workflow admission/result paths.
Contract-Neutral: Only browser-evidence-only tree diffs omit redundant runtime CI; application, dependency, trust and required source-proof contracts are unchanged.
Change-source: pulse-maintainer
Keep the negative, partial-repair and nested-resolution controls beside the actual locked-graph check so future edits cannot silently disable the intended safeguard.
Contract-Neutral: Run the existing serialization regression suite in its pre-install CI check; no additional contract or user-visible runtime change.
Change-source: pulse-maintainer
Bind the existing qualified security override to its exact consumer and serializer pair instead of letting npm overrides silently carry it into a newer Solid runtime. Resolve nested lock edges, retain the strict complete audit and security floors, and cover the two stale dependencies actually present in PR 2759 with positive, partial-repair and nested-resolution controls.
Change-source: pulse-maintainer
Move the existing generated watchdog and collector contract to an early, fail-closed native CI phase. Discover the complete inventory in both phases, execute every check exactly once, and preserve the remaining group assignments, native runtime tools and safety deadlines. Exercise phase admission, omission, duplicate and failure controls.
Contract-Neutral: Native CI phase ordering and inventory partition only; production installers, runtime behaviour, required checks and safety deadlines are unchanged.
Change-source: pulse-maintainer
Both required CI and the local gate must treat the new subprocess owner as audit runtime, not an unchanged dependency graph. Carry the actual helper into the isolated local-gate fixture and test positive findings, missing results, large change lists and exact-path lookalikes through both consumers.
Contract-Neutral: Extend the existing strict audit-runtime path classification to its new owned helper; advisory rules, dependency graphs, public runtime, credentials and external permissions are unchanged.
Change-source: pulse-maintainer
The new macOS native jobs fail NAS boot-filter positive controls and never recognise the generated private collector. Supply binary-aware GNU awk only to the existing Linux server fixtures and retain real safe/NUL/control-byte probes plus missing/non-GNU-tool refusals. Recognise both Unix comm formats while keeping the exact owned executable argument and cleanup controls. No installer or service source, skipped test or native-appliance acceptance changes.
Contract-Neutral: CI prerequisites and test fixtures only; production install, removal, credential retention and process-owner safety contracts are unchanged.
Change-source: pulse-maintainer
The first beta's release workflow failed in create_release at "Locate
existing release". That step reads up to 100 releases with every asset,
about 25 MB, in one call, and GitHub answered it with an HTTP 504. The
step has no pipefail, so the failed read reached jq as empty input and
the job ended with exit code 5. Timing the call from a workstation, one
of three tries returned an error body, so this is not rare.
Retry the read up to five times with the same backoff the asset upload
uses, and accept only a complete listing of valid pages. A failed or
truncated read must never look like "no existing release": that answer
would stage a duplicate draft for a tag that already has one. Exhausting
the attempts fails the job with an explicit error. The listing call and
the downstream handling of an existing draft are unchanged.
Run the real step script in the release policy test against doubles for
gh and sleep: two 504s then a complete listing finds the draft after
backoff of 15s and 30s; a read that exits 0 but is truncated every time
fails after five attempts, with the capped backoff and no outputs; and a
complete listing without the tag still means no existing release. Against
the previous step the test fails with the production symptom, exit 5 and
the 504 message. The create-release pin list and the contract record the
retry.
Contract-Neutral: Release workflow reliability only; no published artifact, tag, signing, install or customer contract changes.
Run the accepted Unix teardown functions on fresh public Linux x64 and ARM64 CI, with real stop refusal, socket activation, batch reactivation and independent process/file readback. Retain bounded source-bound phase and owned-cleanup receipts; keep synthetic revocation separate from installed TLS, signed-agent and Windows acceptance.
Change-source: pulse-maintainer
Compose the exact observed upstream additively without rewriting reviewed tip 805ea6d712 or any accepted ancestry. The new Go 1.26.9 and x/net graph need matching final-source evidence before this batch can be proposed.
Change-source: pulse-maintainer
govulncheck on the pinned 1.26.8 toolchain reports twelve reachable
standard library vulnerabilities in Pulse (net/http, crypto/tls,
html/template, os, net/textproto), published on 2026-10-08 and fixed in
Go 1.26.9. golang.org/x/net v0.58.0 carries further advisories fixed in
v0.60.0. With 1.26.9 and x/net v0.60.0 the scan reports no affecting
vulnerabilities under both govulncheck v1.1.4 and v1.7.0.
Pulse's own govulncheck job last ran on 2026-10-05, so nothing flagged
this. The private Enterprise build and test job notices it: once the scan
finds reachable advisories it needs more than the 4 GiB CI VM holds, the
guest kernel kills govulncheck, and the job is cancelled. That has failed
every Enterprise pair check since 2026-10-08, including the first
beta's.
Move every release builder and local toolchain guard together, as 1.26.8
did, so no candidate artifact keeps an older compiler: go.mod, the
builder image digests (index digest for 1.26.9-alpine), the release and
dev scripts, the devcontainer, and the root pair diagnostic. Only x/net
is raised in the module graph; go mod tidy is deliberately not run, so
unrelated indirect requirements stay as they were.
Contract-Neutral: Toolchain and indirect dependency patch update that clears reported advisories; no product or runtime contract changed.
The native Unix inventory tests the root installer, unattended updater and their Python service/readback fixtures, but the workflow's event filters omit those inputs. Include each on push and pull_request, preserving all jobs, tools and deadlines. Decode both events in regression controls and reject removal or exclusion of each input.
Contract-Neutral: Native CI admission coverage only; installer/updater behaviour, agent and Windows lifecycle, service authority and recovery contracts are unchanged.
Change-source: pulse-maintainer
Use the same Compose configuration before and after best-effort evaluation issuance. Preserve two-client unsigned evaluation, signed renewal restarts, explicit invalid-file refusal and the Pulse-hosted licence requirement.
Add real release-daemon restart/readback controls and secret-free hosted Compose acceptance for the actual placeholder and licensed mounts.
Change-source: pulse-maintainer
Reuse the real-embed application to verify authenticated live startup, narrow destination admission, monitoring-only token scope, ordinary alert delivery, persisted sessions and saved policy across a real process restart. Keep source/binary identity, single-submission mutation rules and owned child/listener cleanup in a bounded receipt. This prevents component passes from hiding application-path regressions without another build or host capability.
Contract-Neutral: CI-only validation of existing authenticated notification and persistence behaviour; no product, permission, installer or release contract delta.
Change-source: pulse-maintainer
The latest daily advisory watch passes main and fails only retained release branches, then recommends backports that no longer have a delivery route. Keep the complete strict main audit, read-only/cache-free execution and security proof, remove obsolete line discovery and give accurate main repair and containing-release guidance. Add fixed-main recipe, retired-branch refusal and preserved strict-audit controls.
Change-source: pulse-maintainer
The checkout label alone cannot establish source bytes after frontend preparation. Require an unchanged tracked tree before compiling the private pair; the exact recipe control now rejects dirty source before either compiler or root command and preserves all existing failure propagation.
Contract-Neutral: Implements existing exact-source admission on tracked bytes; native runtime, input and completion contracts are unchanged.
Change-source: pulse-maintainer
Exercise real systemd and signed local current-source replacement/recovery in the existing real-embed job for #2785. Preserve service masks, persistent bytes, backups and owned cleanup; source controls do not claim published or LXC recovery.
Change-source: pulse-maintainer
A completed E2E log read exceeded the enforced eight-million-byte output bound. Keep complete fixed-container stdout/stderr and exact source/run/hash receipts in short-lived artifacts, emit only bounded escaped console tails, and retain nonzero, timed-out and unavailable collection results without suppressing them. Preserve every test tier, retry policy and existing enforcement bound.
Contract-Neutral: CI-only diagnostic retention; product runtime, source-image admission and stable/probation test contracts are unchanged.
Change-source: pulse-maintainer
Reuse the existing admitted cookie session only after a cookie-only request validates it against the current backend. Keep explicit session and token tests independent, reject revoked state, and propagate unexpected probe failures. The registration journey uses its documented cookie/CSRF authentication so removing a dedicated host token cannot invalidate its removal observer. Retain both the HTTP-success and removed-resource assertions, add behavioral adverse controls and run them in ordinary E2E CI.
Contract-Neutral: Test fixtures reuse validated cookie sessions and select documented cookie auth; production authentication budgets, token revocation, API and tenant contracts are unchanged.
Change-source: pulse-maintainer
Terminal native CI 38058763364 reaches unsupported BSD tar --no-overwrite-dir and mv -T in both macOS discovery fixtures. Verify Homebrew GNU tar and coreutils mv and expose them only to the existing Linux server installer test step. Exercise real archive and rename bytes, missing/non-GNU tools, fixed package identities and containing-suite failure propagation; native macOS runtime remains untouched.
Contract-Neutral: Native CI fixture environment repair only; product installers, service-state admission, signatures, recovery, native runtime and safety deadlines are unchanged.
Change-source: pulse-maintainer
Separate the source observation from printf so Bash propagates its failure. The existing same-checkout CI contract is unchanged; test the unavailable-identity case without claiming a compiler result.
Contract-Neutral: Preserve the existing exact-checkout real-embed contract by propagating its Git read failure; no source, graph, permissions, build, audit or deadline contract changes.
Change-source: pulse-maintainer
Use the assets already built in the Frontend job for a read-only backend compile and server/API vet. Require byte-equal embed copies, retain the existing audit/tests/deadline and fail on compiler errors; source controls do not stand in for a containing hosted build.
Change-source: pulse-maintainer
The close-event cleanup discovers only queued and running runs, leaving GitHub's requested, waiting and pending runs able to start obsolete checks later. Include those documented unfinished states without changing exclusive PR/head admission, fresh closure and branch-reuse checks, terminal-run protection or refusal handling.
The focused mocked-API suite passes all 52 controls; the same tests against the assigned parent fail ten, including each missing-state discovery and transition. Static workflow trust validation passes. No live cancellation or publication-latency saving is claimed.
Change-source: pulse-maintainer
Main E2E 38020587365 exhausted twenty shared-readiness/login failures over 47 minutes, then probation hit the job limit before stable report uploads. Admit the same authenticated inventory and pool/disk history once before either tier, without retries or ignored failures, and upload completed stable failures before observational work. Share the existing readiness predicates and cover every identity/history requirement, actual spec cleanup and the workflow fail-fast command. Preserve phase thresholds, test tiers, pins and the stable verdict. This does not diagnose the hosted runtime failure.
Change-source: pulse-maintainer
The current containing main run executes all 93 smoke suites sequentially for 679 seconds. Partition the discovered inventory without maintaining an allowlist or changing recipe deadlines, and keep the existing required build check fail-closed on every shard. Exercise complete coverage, discovery failure, child failure collection and actual workflow commands.
Contract-Neutral: Product CI smoke scheduling and exhaustive gating only; no installer, application, shipped guidance, dependency, release policy, safety deadline or subsystem contract delta.
Change-source: pulse-maintainer
Two complete containing runs spent 717 and 719 seconds in rest-1, with the installer binary near its end. Refresh whole-package costs from uncached passing rest-shard reports and emit heavier binaries first. Preserve both required checks, source-derived exhaustive coverage, race tests, failure propagation and internal/api ordering.
Contract-Neutral: Schedule existing independent CI package binaries only; no runtime, required-check, exhaustive coverage, race-test or dependency-admission contract changes.
Change-source: pulse-maintainer
The completed PR2761 native run spent 243 runner-seconds acquiring and building frontend assets before its deterministic immutable-image source check failed in four Unix jobs. Execute the existing uncached bounded image checks immediately after Go setup, before Node and native runtime work. Keep real frontend assets, exhaustive installer groups, pins, all native gates and their deadlines unchanged; guard order, selection and terminal failures.
Contract-Neutral: Additional early execution of existing immutable-image source assertions only; no public contract, agent runtime/lifecycle, Windows behaviour, image pin, complete-suite coverage, existing gate or deadline changes.
Change-source: pulse-maintainer
Replace nine identical image build pairs with one same-run artifact producer. Admit the producer's manifest, checkout, run, attempt, archive and loaded image identities before starting each isolated stack. Keep fixed registry pins, local seed defaults, every journey gate and existing browser budgets. Provider refusals remain terminal without mirrors, login, pull retries or rebuild fallbacks. Record the contract and narrowly scoped regression proof.
Change-source: pulse-maintainer
The current hosted failure fetched its index promptly but requested 116 MB of OS packages and continued downloading until the ten-minute setup alarm, before any test. Permit thirty minutes for the larger Chromium/WebKit setup only, with the sixty-minute job, transport timeouts, authentication and test gates unchanged. Retain controls against restoring the short setup cap or expanding the suite deadline.
Contract-Neutral: Hosted E2E acquisition budget and its regression controls only; no product runtime, installer, release contract or frontend-source delta.
Change-source: pulse-maintainer
The docs-only job kept twelve literal suites while thirty existing privacy, authentication, recovery and other guide suites were omitted. Discover the complete documentation inventory in four isolated bounded shards, trigger on every helper change, and preserve the required check as a fail-closed aggregate. Keep all-suite and explicit smoke execution, safety recipes and deadlines unchanged.
Contract-Neutral: Documentation CI admission and smoke-harness coverage only; no product runtime, installer behaviour, shipped guidance, release checks or subsystem contract changes.
Change-source: pulse-maintainer
Load the real service-status enum in the mocked Windows SCM controls and check lifecycle statements independently of checkout line endings. Keep Linux-only server installer fixtures on supported Bash and GNU metadata tools within their macOS test step, after native agent runtime testing. Partition the discovered installer inventory so the expanded reset matrix retains its own existing package deadline; preserve every check, failure exit and per-fixture deadline.
Change-source: pulse-maintainer
Contract-Neutral: Native CI fixture environment and inventory repair only; product installers, native lifecycle, safety contracts and fixture deadlines are unchanged.
Preserve the returned dependency setup repair and its original parents while qualifying it with current assigned main. This changes only disposable hosted browser acquisition; repositories, authentication, product/runtime bytes and test verdicts stay unchanged. Earlier pre-execution capacity failures remain unexecuted, not passing proof.
Change-source: pulse-maintainer
Read the live report and label set instead of a delayed event snapshot. Stop on failed or mismatched reads, skip closed issues and pull requests, and do not restore decomposition work from superseded events. Keep individual label deltas and community-owned retest decisions; remove the unrelated release lookup. Add six discriminating regressions and document the boundary.
Change-source: pulse-maintainer
Contract-Neutral: Repairs the existing metadata synchronizer without changing issue-form fields, supported labels, public contact or disposition authority, product APIs or subsystem contracts.
The retained PR2697 shard waited on apt indexes for the whole one-hour job without starting a test. Bound HTTP/HTTPS acquisition and retries, reject incomplete indexes, and cap only the browser setup phase at ten minutes in all three hosted journeys. Preserve the existing repositories, authentication, browser selections and test/verdict gates.
Contract-Neutral: Hosted CI dependency acquisition only; no product runtime, installer, release contract or browser-source change.
Change-source: pulse-maintainer
Distinguish global cancellation from quiet-hours holds, queued policy skips from provider receipt, and settings changes from recall or credential revocation. Add connected sender and persistent-queue controls, and run the existing notification guidance suites in docs-only CI.
Contract-Neutral: Documentation, mirrors, tests and documentation-only CI describe existing notification behaviour; no runtime, API, permission, schema, dependency or user-visible feature contract changes.
Change-source: pulse-maintainer
Reject missing Windows engines and pre-existing or unknown runner state. Independently verify first and repeated uninstall, propagate failed SCM/listener reads, preserve captured machine settings and fail unconfirmed owned server cleanup. Add actual-function controls alongside the unchanged production removal and native-exit checks.
Change-source: pulse-maintainer
rcourtman