The latest memory report is about a higher steady baseline, not a leak. Keep steady regressions actionable, separate unlike process ages and CPU savings from RSS recovery, and preserve existing evidence without another restart, downgrade or profile. Keep the shipped guides, optional intake and regression controls aligned.
Contract-Neutral: Clarifies interpretation of existing memory reports and documentation only; no runtime, API, route, collection recipe, label synchronizer or subsystem contract changes.
Change-source: pulse-maintainer
The current macOS CI drops its already provisioned GNU tools inside the connected updater fixture and reaches incompatible BSD tar. Capture only the needed supplied executables and require end-to-end tool use; keep the production harness environment scrubbed. Retain non-secret stage, file metadata and closed diagnostic markers for the actual hosted signer failure, without publishing signer output or inferring its cause.
Contract-Neutral: Confined native CI tool selection and additive non-secret failure observations only; no public installer, updater, signing, service, permission or customer contract changes.
Change-source: pulse-maintainer
Retain exact Delivery candidate 8cb66ef0f7. Allocate disposable native-CI scratch before child observation, preserving exclusive refusal and cleanup ownership. Related canonical fixture HOME correction is retained; no product, frontend or infrastructure change.
Change-source: pulse-maintainer
PR2817 completed CI at aebb17c9 with three frontend assertions that still required the superseded static age and TERM-grace log recipe. Assert the accepted shared clock and hard eight-second, 256-KiB bounds instead. Both macOS native-contract jobs also found the lab directory already present at admission; give tool startup an existing owned temporary HOME and require it in the confined manager, keeping NativeLab scratch ownership and cleanup refusal unchanged.
Contract-Neutral: Test-only integration reconciliation; preserve product source, public contracts, production deadlines, scratch admission and safety gates.
Change-source: pulse-maintainer
Current publisher CI fails both macOS installer controls with FileExistsError during scratch allocation. Allocate and record ownership before the first manager child can initialise HOME, retaining exclusive refusal of pre-existing directories and symlinks. Add discriminating allocation, early-refusal and cleanup controls; no systemd or platform result is manufactured.
Contract-Neutral: Correct disposable CI harness allocation ordering and regression controls; product updater, installer, signing, service and recovery contracts are unchanged.
Change-source: pulse-maintainer
Keep outbound telemetry disabled through the process environment, test the expected locked-field refusal, and save only the unrelated notification fields. Assert the lock on restart rather than attempting to persist it.
Contract-Neutral: Correct the CI-only synthetic journey and its controls; product settings, deployment restrictions, permissions and runtime contracts are unchanged.
Change-source: pulse-maintainer
Reuse the real-embed application to verify authenticated live startup, narrow destination admission, monitoring-only token scope, ordinary alert delivery, persisted sessions and saved policy across a real process restart. Keep source/binary identity, single-submission mutation rules and owned child/listener cleanup in a bounded receipt. This prevents component passes from hiding application-path regressions without another build or host capability.
Contract-Neutral: CI-only validation of existing authenticated notification and persistence behaviour; no product, permission, installer or release contract delta.
Change-source: pulse-maintainer
Separate a registered Docker reporting token from the scopes needed by the host module. Keep scope rejection distinct from HTTP 401 and identify the token-generation screen before changing credentials or reinstalling.
Contract-Neutral: Documentation and source-alignment controls only; no authentication, token authority, runtime or install contract changes.
Change-source: pulse-maintainer
A normal-host enrolment report supplies lookup and host-report 401s, repeated installs and an absent inventory record. Document one named server-side registration check before touching the affected agent, with separate limits for persistence, credential hand-off and accepted reports.
Contract-Neutral: Existing authentication help and its source-alignment controls only; no runtime, API, scope, route or credential-policy change.
Change-source: pulse-maintainer
Cap server and agent excerpts at 256 KiB before display or request-ID search. Buffer only a bounded owner-only temporary file, preserve reader failures, and apply the hard deadline to the complete read-only pipeline. Exercise exact-size, overflow, stream, privacy, cleanup and closed-pipe deadline controls without accessing a real journal, daemon or service.
Contract-Neutral: Documentation-only passive log recipe bounds and executable copied-recipe tests; no runtime, API, authentication, installer or monitoring contract change.
Change-source: pulse-maintainer
The latest daily advisory watch passes main and fails only retained release branches, then recommends backports that no longer have a delivery route. Keep the complete strict main audit, read-only/cache-free execution and security proof, remove obsolete line discovery and give accurate main repair and containing-release guidance. Add fixed-main recipe, retired-branch refusal and preserved strict-audit controls.
Change-source: pulse-maintainer
The checkout label alone cannot establish source bytes after frontend preparation. Require an unchanged tracked tree before compiling the private pair; the exact recipe control now rejects dirty source before either compiler or root command and preserves all existing failure propagation.
Contract-Neutral: Implements existing exact-source admission on tracked bytes; native runtime, input and completion contracts are unchanged.
Change-source: pulse-maintainer
Use the existing BIND_ADDRESS setting in the fixed fixture environment, alongside telemetry opt-out. The connected production-function control verifies this exact private profile and persistence across all seven phases; no product default or native manager safeguard changes.
Contract-Neutral: Fixed local fixture environment only; source/native admission and transaction-completion contracts are unchanged.
Change-source: pulse-maintainer
The unattended source requests LoadState and ActiveState as separate systemctl options; the fixture emitted only the first, and the production parser rightly refused its incomplete observation. Keep the refusal and make the private adapter implement both repeated and comma-separated fixed properties.
Contract-Neutral: Private fixture command-interface correction only; production manager admission and native completion contracts are unchanged.
Change-source: pulse-maintainer
The installer emits its unit in three heredocs: the base, non-default port and safeguards. Relocate all three exact writer commands in the explicit manager control, with counts that reject source drift; the actual native runner continues to use the unchanged system unit writer.
Contract-Neutral: Confined fixture unit-path correction only; native hosted service and safety contracts are unchanged.
Change-source: pulse-maintainer
Discriminate the pre-exec PID from the process serving health/version, changed running bytes, loss of active state after readiness and residual inactive processes without using the host manager or a real listener.
Contract-Neutral: Regression controls only; native updater source and completion contracts are unchanged.
Change-source: pulse-maintainer
The installer source returns before appended function overrides, so the connected control attempted useradd in the unprivileged proof VM and failed before archive staging. Keep the actual create_user function and intercept only exact fixture account/owned-path chown commands through the explicit test adapter.
Contract-Neutral: Confined test adapter correction only; hosted native admission and transaction contracts are unchanged.
Change-source: pulse-maintainer
Keep captured output private to the test process so connected controls reveal a failing setup without uploading native application logs.
Contract-Neutral: Confined fixture diagnostics only; native admission, transaction, signing and bounded receipt contracts are unchanged.
Change-source: pulse-maintainer
Exercise real systemd and signed local current-source replacement/recovery in the existing real-embed job for #2785. Preserve service masks, persistent bytes, backups and owned cleanup; source controls do not claim published or LXC recovery.
Change-source: pulse-maintainer
A completed E2E log read exceeded the enforced eight-million-byte output bound. Keep complete fixed-container stdout/stderr and exact source/run/hash receipts in short-lived artifacts, emit only bounded escaped console tails, and retain nonzero, timed-out and unavailable collection results without suppressing them. Preserve every test tier, retry policy and existing enforcement bound.
Contract-Neutral: CI-only diagnostic retention; product runtime, source-image admission and stable/probation test contracts are unchanged.
Change-source: pulse-maintainer
Drain the installer pipe after a failed log write, retain its first observed failure across later successes and collect an unterminated final line. Reuse the guarded restoration path without changing signed-input, service-state, mask or prior-activity safeguards; bind the regression controls to package acceptance.
Change-source: pulse-maintainer
The installed token manager is API Access in the Security group, not an API Tokens page, and it displays Created, Last used and Scopes rather than expiry. Keep dual lookup/report rejection separate from a proven cause; preserve credentials and avoid repeating failed installs.
Contract-Neutral: Existing documentation and passive source-alignment checks only; no authentication, credential issuance, agent reporting, navigation or runtime contract changes.
Change-source: pulse-maintainer
A TERM-resistant reader can survive the old timeout after its collection shell exits. Apply the eight-second hard deadline to the entire read-only group, buffer the complete sample and withhold raw reader errors on failure. Retain ordinary privileges, unavailable results and no workload mutation.
Contract-Neutral: Documentation and copied-recipe safety verification only; no runtime collection, memory accounting, service lifecycle or API contract changes.
Change-source: pulse-maintainer
Separate the source observation from printf so Bash propagates its failure. The existing same-checkout CI contract is unchanged; test the unavailable-identity case without claiming a compiler result.
Contract-Neutral: Preserve the existing exact-checkout real-embed contract by propagating its Git read failure; no source, graph, permissions, build, audit or deadline contract changes.
Change-source: pulse-maintainer
Use the assets already built in the Frontend job for a read-only backend compile and server/API vet. Require byte-equal embed copies, retain the existing audit/tests/deadline and fail on compiler errors; source controls do not stand in for a containing hosted build.
Change-source: pulse-maintainer
Capture both pipeline statuses before logging overwrites them. Keep recovery, signature and prior-service safeguards unchanged; cover installer, collector, simultaneous and successful observations without attributing a past host interruption.
Change-source: pulse-maintainer
Containing PR2795 CI rejects explicit failure propagation because its old half-removal wiring check requires a bare unit-repair call. Execute both production update paths with genuinely absent config and unit files, confined activation and ownership, and guard failed repair against timer/start/false completion. Keep the installer and unattended recovery runtime unchanged.
Refs: #2785
Change-source: pulse-maintainer
Contract-Neutral: Test-only correction to the existing half-removed update contract; no runtime, workflow, authority or installability behaviour changes.
Accept known-timer containment and preservation of evidence, masks and prior schedule states with retained copied-command and connected documentation controls.
Change-source: pulse-maintainer
Accept exact updater state and rollback guards with retained final-byte component, discovery and smoke evidence; full installtests and installed recovery remain separate follow-through.
Change-source: pulse-maintainer
Keep unattended update containment separate from cancellation, host-stop diagnosis and rollback. Preserve known timer ownership, masks, consent, prior enabled and active states, and the original failure evidence; exercise copied commands with an isolated unit-manager double and a real timeout.
Contract-Neutral: Documentation and confined recipe controls only; no installer, updater, service or recovery runtime behaviour changed.
Change-source: pulse-maintainer
Accept exact candidate 6809ca2b23. Keep attempted upgrades, failing runtimes and later recovery distinct while preserving passive, private evidence collection. No runtime or release outcome is asserted.
Change-source: pulse-maintainer
Read bounded, complete unit state before mutation and confirm inactive state before rollback replacement. Keep the verified backup and stop automatic recovery when service state cannot be reconciled; preserve prior-active restoration, masks, signatures and configuration.
Exercise failed/partial reads, deadlines, no-op stops and restoration through confined production-shell fixtures and the existing signed transaction controls. Fix fixture path and manager observations so registered Go controls execute the actual source.
Refs: #2785
Change-source: pulse-maintainer
Keep the failing runtime, intended release, original updater result, host stop and later recovery separate. Accept unknowns and existing redacted evidence without a repeat update, reboot, restore or loss of rollback backups. Guard both forms and preserve version classification when attempted and recovered versions differ.
Change-source: pulse-maintainer
Contract-Neutral: Community intake guidance and regression tests only; installer, updater, runtime and triage automation contracts are unchanged.
The helper selects and passes an explicit service name, bypassing installer discovery. Apply the same bounded exact-unit admission there and preserve its error before any prior-active query, backup, installer call or restart trap. Execute both producers and the real helper handoff in the registered unattended updater proof artifact.
Refs: #2785
Change-source: pulse-maintainer
Consume one bounded inventory of exact historical unit names without early pipe closure. Preserve legacy and explicit-instance selection, and stop replacement, unit creation, reset and removal after unknown inventory even when Bash errexit is disabled. Distinguish this source defect from the unconfirmed cause of the reported LXC stop.
Refs: #2785
Change-source: pulse-maintainer
Existing forms warn against uploading secrets but stop at prevention. Explain issuer revocation, separate attachment removal, surviving copies, private follow-up and independent monitoring coverage without asking for another diagnostic or credential test.
Change-source: pulse-maintainer
Contract-Neutral: Documentation and guidance coverage only; runtime, API, storage and deployment contracts are unchanged.
The full documentation proof counted all 18 current recipes, including the newly documented standalone action runner removal. Keep the exact inventory assertion and shell parsing rather than retaining the old 17-command expectation.
Contract-Neutral: Test inventory correction for the documented runner-only recipe; no runtime, lifecycle, API or authority behaviour changes.
Change-source: pulse-maintainer
Explain evidence loss, saved-state trust, platform differences and partial removal before administrators act. Keep whole-agent removal separate from the Linux action runner, preserve deliberate path protections, and exercise copied commands with bounded synthetic recorders.
Contract-Neutral: Documentation and synthetic source-bound recipe checks only; no runtime, lifecycle, authority, platform or API behaviour changes.
Change-source: pulse-maintainer
Separate a rejected lookup credential from a missing reporting scope, missing host and ordinary reporting failure. Distinguish the normal silent-token install from bootstrap enrolment, reuse the bounded private log reader and preserve credentials and identity while finding the failing stage.
Contract-Neutral: Documentation-only authentication triage; no runtime, API, authorization or installer behaviour changes.
Change-source: pulse-maintainer
Use an exclusive mode-0600 temporary file before writing the fixed non-credential body marker. Keep copied-command, redaction, redirect, denial and partial-response assertions unchanged; no CodeQL rule or security gate is suppressed.
Contract-Neutral: Documentation-test fixture creation only; no shipped API, authentication, permission or guide contract changes.
Change-source: pulse-maintainer
Preserve the exact reviewed Delivery commits and their source-bound proofs; retain existing test tiers, waits and verdict.
Change-source: pulse-maintainer
The smoke runner invokes shell recipes directly. Preserve the tested admission bytes and set the new recipe's executable bit, then validate the final-source entrypoint through that actual runner rather than relying only on direct Node checks.
Change-source: pulse-maintainer
Contract-Neutral: Test recipe execute permission only; source bytes and readiness and workflow contracts are unchanged.
Replace installer-rerun and unchecked capability advice with bounded private property checks, a narrow existing-ceiling override and deliberate prior-active maintenance. Distinguish configured settings, process startup and ordinary ICMP recovery without weakening sandbox policy.
Contract-Neutral: Existing ICMP administration guidance and copied-command controls only; no availability runtime, privilege, API or frontend behaviour changes.
Change-source: pulse-maintainer
Main E2E 38020587365 exhausted twenty shared-readiness/login failures over 47 minutes, then probation hit the job limit before stable report uploads. Admit the same authenticated inventory and pool/disk history once before either tier, without retries or ignored failures, and upload completed stable failures before observational work. Share the existing readiness predicates and cover every identity/history requirement, actual spec cleanup and the workflow fail-fast command. Preserve phase thresholds, test tiers, pins and the stable verdict. This does not diagnose the hosted runtime failure.
Change-source: pulse-maintainer
Accept Product Intelligence candidate 20261010T034626Z-product-intelligence with both original commits preserved. Retain source-20heiox1 documentation and copied-command proof; no product runtime or new surface changes.
Contract-Neutral: Merge reviewed documentation guidance and regression controls without runtime contract changes.
Change-source: pulse-maintainer
pulse-triage[bot]