The installer source returns before appended function overrides, so the connected control attempted useradd in the unprivileged proof VM and failed before archive staging. Keep the actual create_user function and intercept only exact fixture account/owned-path chown commands through the explicit test adapter.
Contract-Neutral: Confined test adapter correction only; hosted native admission and transaction contracts are unchanged.
Change-source: pulse-maintainer
Keep captured output private to the test process so connected controls reveal a failing setup without uploading native application logs.
Contract-Neutral: Confined fixture diagnostics only; native admission, transaction, signing and bounded receipt contracts are unchanged.
Change-source: pulse-maintainer
Exercise real systemd and signed local current-source replacement/recovery in the existing real-embed job for #2785. Preserve service masks, persistent bytes, backups and owned cleanup; source controls do not claim published or LXC recovery.
Change-source: pulse-maintainer
A completed E2E log read exceeded the enforced eight-million-byte output bound. Keep complete fixed-container stdout/stderr and exact source/run/hash receipts in short-lived artifacts, emit only bounded escaped console tails, and retain nonzero, timed-out and unavailable collection results without suppressing them. Preserve every test tier, retry policy and existing enforcement bound.
Contract-Neutral: CI-only diagnostic retention; product runtime, source-image admission and stable/probation test contracts are unchanged.
Change-source: pulse-maintainer
Drain the installer pipe after a failed log write, retain its first observed failure across later successes and collect an unterminated final line. Reuse the guarded restoration path without changing signed-input, service-state, mask or prior-activity safeguards; bind the regression controls to package acceptance.
Change-source: pulse-maintainer
Terminal native CI 38058763364 reaches unsupported BSD tar --no-overwrite-dir and mv -T in both macOS discovery fixtures. Verify Homebrew GNU tar and coreutils mv and expose them only to the existing Linux server installer test step. Exercise real archive and rename bytes, missing/non-GNU tools, fixed package identities and containing-suite failure propagation; native macOS runtime remains untouched.
Contract-Neutral: Native CI fixture environment repair only; product installers, service-state admission, signatures, recovery, native runtime and safety deadlines are unchanged.
Change-source: pulse-maintainer
Review accepts the exact documentation candidate and its retained focused checks and desktop/phone proof. The separate unqualified memory-reader candidate remains excluded; no authentication or credential-use recovery is inferred.
Contract-Neutral: Existing agent documentation and source-alignment tests only; no runtime, navigation, credential or API changes.
Change-source: pulse-maintainer
The installed token manager is API Access in the Security group, not an API Tokens page, and it displays Created, Last used and Scopes rather than expiry. Keep dual lookup/report rejection separate from a proven cause; preserve credentials and avoid repeating failed installs.
Contract-Neutral: Existing documentation and passive source-alignment checks only; no authentication, credential issuance, agent reporting, navigation or runtime contract changes.
Change-source: pulse-maintainer
Current PR2795 native CI fails on all four Unix runners, and Build rest-0 fails, because the extracted URL fixture omits read_update_service_state. Source the complete helper with bounded confined transport/manager doubles and a real versioned executable fixture. Verify exact paired target URLs, one installer handoff, prior-active/inactive reads and fail-closed refusal before downloads or backup for failed, partial and duplicate observations.
Contract-Neutral: Repair an incomplete updater test fixture against the existing service-state, versioned-installer and restoration contract; no production or contract delta.
Change-source: pulse-maintainer
Separate the source observation from printf so Bash propagates its failure. The existing same-checkout CI contract is unchanged; test the unavailable-identity case without claiming a compiler result.
Contract-Neutral: Preserve the existing exact-checkout real-embed contract by propagating its Git read failure; no source, graph, permissions, build, audit or deadline contract changes.
Change-source: pulse-maintainer
Use the assets already built in the Frontend job for a read-only backend compile and server/API vet. Require byte-equal embed copies, retain the existing audit/tests/deadline and fail on compiler errors; source controls do not stand in for a containing hosted build.
Change-source: pulse-maintainer
Capture both pipeline statuses before logging overwrites them. Keep recovery, signature and prior-service safeguards unchanged; cover installer, collector, simultaneous and successful observations without attributing a past host interruption.
Change-source: pulse-maintainer
Containing PR2795 CI rejects explicit failure propagation because its old half-removal wiring check requires a bare unit-repair call. Execute both production update paths with genuinely absent config and unit files, confined activation and ownership, and guard failed repair against timer/start/false completion. Keep the installer and unattended recovery runtime unchanged.
Refs: #2785
Change-source: pulse-maintainer
Contract-Neutral: Test-only correction to the existing half-removed update contract; no runtime, workflow, authority or installability behaviour changes.
Accept known-timer containment and preservation of evidence, masks and prior schedule states with retained copied-command and connected documentation controls.
Change-source: pulse-maintainer
Accept exact updater state and rollback guards with retained final-byte component, discovery and smoke evidence; full installtests and installed recovery remain separate follow-through.
Change-source: pulse-maintainer
Keep unattended update containment separate from cancellation, host-stop diagnosis and rollback. Preserve known timer ownership, masks, consent, prior enabled and active states, and the original failure evidence; exercise copied commands with an isolated unit-manager double and a real timeout.
Contract-Neutral: Documentation and confined recipe controls only; no installer, updater, service or recovery runtime behaviour changed.
Change-source: pulse-maintainer
Accept exact candidate 6809ca2b23. Keep attempted upgrades, failing runtimes and later recovery distinct while preserving passive, private evidence collection. No runtime or release outcome is asserted.
Change-source: pulse-maintainer
Read bounded, complete unit state before mutation and confirm inactive state before rollback replacement. Keep the verified backup and stop automatic recovery when service state cannot be reconciled; preserve prior-active restoration, masks, signatures and configuration.
Exercise failed/partial reads, deadlines, no-op stops and restoration through confined production-shell fixtures and the existing signed transaction controls. Fix fixture path and manager observations so registered Go controls execute the actual source.
Refs: #2785
Change-source: pulse-maintainer
Keep the failing runtime, intended release, original updater result, host stop and later recovery separate. Accept unknowns and existing redacted evidence without a repeat update, reboot, restore or loss of rollback backups. Guard both forms and preserve version classification when attempted and recovered versions differ.
Change-source: pulse-maintainer
Contract-Neutral: Community intake guidance and regression tests only; installer, updater, runtime and triage automation contracts are unchanged.
The helper selects and passes an explicit service name, bypassing installer discovery. Apply the same bounded exact-unit admission there and preserve its error before any prior-active query, backup, installer call or restart trap. Execute both producers and the real helper handoff in the registered unattended updater proof artifact.
Refs: #2785
Change-source: pulse-maintainer
Consume one bounded inventory of exact historical unit names without early pipe closure. Preserve legacy and explicit-instance selection, and stop replacement, unit creation, reset and removal after unknown inventory even when Bash errexit is disabled. Distinguish this source defect from the unconfirmed cause of the reported LXC stop.
Refs: #2785
Change-source: pulse-maintainer
Existing forms warn against uploading secrets but stop at prevention. Explain issuer revocation, separate attachment removal, surviving copies, private follow-up and independent monitoring coverage without asking for another diagnostic or credential test.
Change-source: pulse-maintainer
Contract-Neutral: Documentation and guidance coverage only; runtime, API, storage and deployment contracts are unchanged.
The full documentation proof counted all 18 current recipes, including the newly documented standalone action runner removal. Keep the exact inventory assertion and shell parsing rather than retaining the old 17-command expectation.
Contract-Neutral: Test inventory correction for the documented runner-only recipe; no runtime, lifecycle, API or authority behaviour changes.
Change-source: pulse-maintainer
Settings > Assistant offered a Protected guests list (protected_guests)
that was saved and pushed into the Assistant tool executor, but its only
reader was executeControlGuest, which nothing calls. pulse_control plans
through the shared action lifecycle and never consulted the list, so a
guest named in it (by VMID and by name) was planned like any other. The
"legacy" label added in #2765 states that limit; this removes the
setting instead of keeping a field that cannot do its job.
The canonical way to keep Pulse off a resource is its operator lock
(Never auto-remediate, or a Retired lifecycle). It is keyed by canonical
resource id, applies to every platform, and the action lifecycle refuses
dispatch for it even for approved plans. The one gap was planning: the
lifecycle plans without reading operator state, so the Assistant could
leave a plan in Actions that can never run. assistantTypedActionPlanner
now reads the state through the tenant-scoped lifecycle store (the same
read Patrol's broker uses) and declines before Plan, and pulse_control
reports the block with how to clear it. A state that cannot be read does
not refuse planning, because dispatch re-checks.
Removed: AIConfig.ProtectedGuests and its getter, the settings API
field, the executor field/setter/config, the chat service plumbing, the
Settings field and form state, and the legacy copy, pins and prose from
#2765. A stored value still loads (tolerant decode) and is dropped the
next time the settings are written; older PUT bodies that send the key
are ignored. The Settings panel points at the guest's Manage tab.
Preserve exact Delivery candidate 13206d2fa7 and use its fully qualified nine-request catalogue in place of the earlier narrower section-boundary integration fix. Resolve the sole test-file conflict to the candidate bytes already covered by full-package and race source receipts; no frontend resolution or runtime change.
Change-source: pulse-maintainer
Explain evidence loss, saved-state trust, platform differences and partial removal before administrators act. Keep whole-agent removal separate from the Linux action runner, preserve deliberate path protections, and exercise copied commands with bounded synthetic recorders.
Contract-Neutral: Documentation and synthetic source-bound recipe checks only; no runtime, lifecycle, authority, platform or API behaviour changes.
Change-source: pulse-maintainer
PR2768 run 38026567559 failed four guidance roots because the newly reviewed node request became a ninth action recipe. Scope the existing eight action/authentication specimens to their reference section, retaining unexpected-request and curl-bypass rejection controls. The dedicated node suite still executes the node recipe and private request preparation.
Contract-Neutral: Integration-only documentation-test boundary repair; no shipped API, authentication, action or node-setup contract change.
Change-source: pulse-maintainer
Repair the deterministic PR2768 backend failure after the safe node guide added its ninth request. Exercise that private-file POST alongside the existing recipes without positional method/path assumptions, and reject missing, duplicate or unqualified examples while preserving privacy, trust, one-shot and real deadline controls.
Contract-Neutral: Copied-guidance regression test and synthetic fixture reconciliation only; no runtime, API, TLS, workflow, frontend or shipped documentation contract changes.
Change-source: pulse-maintainer
Separate a rejected lookup credential from a missing reporting scope, missing host and ordinary reporting failure. Distinguish the normal silent-token install from bootstrap enrolment, reuse the bounded private log reader and preserve credentials and identity while finding the failing stage.
Contract-Neutral: Documentation-only authentication triage; no runtime, API, authorization or installer behaviour changes.
Change-source: pulse-maintainer
Use an exclusive mode-0600 temporary file before writing the fixed non-credential body marker. Keep copied-command, redaction, redirect, denial and partial-response assertions unchanged; no CodeQL rule or security gate is suppressed.
Contract-Neutral: Documentation-test fixture creation only; no shipped API, authentication, permission or guide contract changes.
Change-source: pulse-maintainer
Preserve the exact reviewed Delivery commits and their source-bound proofs; retain existing test tiers, waits and verdict.
Change-source: pulse-maintainer
The smoke runner invokes shell recipes directly. Preserve the tested admission bytes and set the new recipe's executable bit, then validate the final-source entrypoint through that actual runner rather than relying only on direct Node checks.
Change-source: pulse-maintainer
Contract-Neutral: Test recipe execute permission only; source bytes and readiness and workflow contracts are unchanged.
Replace installer-rerun and unchecked capability advice with bounded private property checks, a narrow existing-ceiling override and deliberate prior-active maintenance. Distinguish configured settings, process startup and ordinary ICMP recovery without weakening sandbox policy.
Contract-Neutral: Existing ICMP administration guidance and copied-command controls only; no availability runtime, privilege, API or frontend behaviour changes.
Change-source: pulse-maintainer
Main E2E 38020587365 exhausted twenty shared-readiness/login failures over 47 minutes, then probation hit the job limit before stable report uploads. Admit the same authenticated inventory and pool/disk history once before either tier, without retries or ignored failures, and upload completed stable failures before observational work. Share the existing readiness predicates and cover every identity/history requirement, actual spec cleanup and the workflow fail-fast command. Preserve phase thresholds, test tiers, pins and the stable verdict. This does not diagnose the hosted runtime failure.
Change-source: pulse-maintainer
Accept Product Intelligence candidate 20261010T034626Z-product-intelligence with both original commits preserved. Retain source-20heiox1 documentation and copied-command proof; no product runtime or new surface changes.
Contract-Neutral: Merge reviewed documentation guidance and regression controls without runtime contract changes.
Change-source: pulse-maintainer
The npm Playwright entrypoint exited inside setup and bypassed its finally block, leaving a partial managed runtime and verification lock behind. Keep the setup failure, skip tests, attempt existing teardown once, and release only the handoff this invocation wrote when its contents still match. Preserve primary failures through teardown errors and do not stop a runtime after lock preparation fails. Add real child-process controls to exhaustive script smoke; test tiers, acquisition deadlines and browser coverage are unchanged.
Change-source: pulse-maintainer
The first exact documentation run found two fixture-selection failures: the Nodes and Config section also contains export/import JSON. Read only the existing Add Node subsection for its single configuration specimen; retain all transport, trust and original-document controls.
Contract-Neutral: Documentation recipe test extraction only; no product runtime, subsystem contract or guide content change.
Change-source: pulse-maintainer
Replace root-password and implicit-TLS examples with a private JSON-file recipe using the existing bounded helper. Distinguish live tests, persisted changes, platform credentials and uncertain results; exercise copied commands with synthetic success, denial, redirect and incomplete responses.
Contract-Neutral: Documentation, mirrored guidance and copied-recipe regression tests only; no runtime API, authentication, TLS or frontend contract changes.
Change-source: pulse-maintainer
Canonical Governance run 38016670825 passed browser admission but failed strict temporary .git cleanup during the two-order receipt-pruning test. Isolate both disposable fixture builders from runner configuration and disable automatic GC, maintenance and fsmonitor locally, including bare Git calls made by the guard. Trace real pruning merges and test hostile ambient configuration without suppressing cleanup errors or weakening receipt checks.
Change-source: pulse-maintainer
Merge exact Delivery tip c592c69b4d, including 82f6257d45. Resolve the overlapping formatter guard by retaining canonical main's stronger GuestMemoryEvidence assertion. Preserve automatic complete suite discovery, existing recipe deadlines and the fail-closed required backend check. Retained source-bk4g0rip covers 93 available suites; historical Git context and hosted timing remain explicit limits.
Contract-Neutral: CI scheduling and assertions only; no application, shipped guidance, dependencies or release policy change.
Change-source: pulse-maintainer
Merge exact Web tip b908be2e55 with launch upstream 0289e8b648. Preserve both independent memory-evidence and Assistant-control contract sections in two internal documentation conflicts; all reviewed frontend content remains byte-identical. Retained sensitive race, browser, build and completed source observations are adequate for the changed control boundary. Broad affected-package race remains unproved after its recorded observation timeout; no aggregate pass or publication is claimed.
Change-source: pulse-maintainer
The first complete smoke-shard proof exposed the old inline-Patrol wording assumption after the reviewed query/observer qualifier move. Keep the unknown and unavailable safety assertions and verify the real caller-to-qualifier-to-formatter chain instead. Guidance and runtime source are unchanged.
Contract-Neutral: CI assertion follows the existing reviewed formatter; no guidance, runtime, memory semantics, dependency, release or subsystem contract delta.
Change-source: pulse-maintainer
The reviewed guest-memory consumer repair moved warning strings out of Patrol into unifiedresources. Preserve the documentation assertions and verify Patrol still delegates qualification and display to that shared formatter. This reconciles the combined batch without changing runtime or guidance.
Contract-Neutral: Test-only integration reconciliation; guest memory, documentation, access and collection contracts are unchanged.
Change-source: pulse-maintainer
The current containing main run executes all 93 smoke suites sequentially for 679 seconds. Partition the discovered inventory without maintaining an allowlist or changing recipe deadlines, and keep the existing required build check fail-closed on every shard. Exercise complete coverage, discovery failure, child failure collection and actual workflow commands.
Contract-Neutral: Product CI smoke scheduling and exhaustive gating only; no installer, application, shipped guidance, dependency, release policy, safety deadline or subsystem contract delta.
Change-source: pulse-maintainer
The current canonical resource planner does not consult the retained guest list. Label that compatibility data honestly and link its accessible limitation without discarding saved policy. Keep the review-only mode menu within the composer on phones, with geometry and resize controls.
Reconcile the old autonomous-mode test with the explicit core-owned investigation flag, preserving saved preferences and legacy approvals. Mounted settings, parent-discriminating copy/menu checks, help mirrors and final-byte browser receipts cover the existing flow.
Change-source: pulse-maintainer
pulse-triage[bot]