Keep archive and sidecar downloads in owner-only staging, clean only owned leaves after handled failures and bootstrap exit, and preserve caller-provided inputs. Require the piped LXC installer signature before copying or execution instead of trusting PID-named files in shared tmp.
Exercise the actual download, prefetch and complete container bootstrap through confined offline doubles and real fixture SSH signatures. Preserve version, archive re-verification, staging-before-stop, service recovery, timer consent and removal boundaries; native acceptance remains separate.
Change-source: pulse-maintainer
Use the reviewed server-only selector in the existing-installation menu and bind automatic selection to available channel rows. A current selected release is a no-op; unavailable metadata or an automatic downgrade stops before mutations. Preview selection retains its channel, numeric beta/RC revisions compare correctly, and deliberate reinstall pins the actual current version.
Execute the actual menu through confined offline transport and stopped mutation boundaries. Preserve explicit version, interactive removal, signature and all-unit quiescence contracts; reconcile the inherited comment-only preview assertion with the real selector consumer.
Change-source: pulse-maintainer
Use one complete-metadata selector for installer URLs and server archives. Exclude chart and draft releases, reject unusable metadata and transport bodies, and preserve explicit pins, signed assets and downgrade refusal. Exercise the actual selectors with bounded offline controls and retain native installation as separate acceptance.
Change-source: pulse-maintainer
Contract-Neutral: Restore server-only discovery within existing stable/preview channels; installer authority, signatures, architecture admission, downgrade refusal and state contracts are unchanged.
Repair the candidate preflight failure without changing the PowerShell control tokens or runtime assertions. Validate whitespace across the complete candidate range.
Contract-Neutral: Removes one trailing ASCII space after a closed string literal in an existing test control; no runtime, assertion, coverage or subsystem contract delta.
Change-source: pulse-maintainer
Exercise removal of the actual preflight-to-environment wiring in the native acceptance contract, and accurately count the fourteen adverse structural controls.
Change-source: pulse-maintainer
Reject missing Windows engines and pre-existing or unknown runner state. Independently verify first and repeated uninstall, propagate failed SCM/listener reads, preserve captured machine settings and fail unconfirmed owned server cleanup. Add actual-function controls alongside the unchanged production removal and native-exit checks.
Change-source: pulse-maintainer
Replace suppressed stop/delete failures with bounded SCM stop and absence evidence before replacement or uninstall. Retain binary and agent state on uncertainty, and report incomplete local cleanup. Add production-function failure controls to the existing native Windows test route and pin both destructive callers.
Change-source: pulse-maintainer
Observe every timer, updater and server before mutation; refuse configuration deletion on uncertain quiescence and restore only prior-active servers and recorded timer states. Keep roles independent of accepted custom service names and never replay an interrupted updater. Exercise actual sourced paths and adverse controls. Move existing Windows native-exit assertions unchanged to their registry-named completion file without relaxing checks.
Change-source: pulse-maintainer
Contain destructive installer removal when systemd observation, stop or disable is uncertain. Stop the updater before the server, reconcile default aliases and local legacy units, and preserve files on refusal. Propagate failed legacy-key replacement even in conditional cleanup. Exercise both removal entrypoints and instance isolation in confined fixtures.
Change-source: pulse-maintainer
Preserve Delivery exact candidate 99d7b5e671 and both independently reviewed installability contract sections. The only conflict resolution combines documentation; runtime and verification bytes remain exactly as proved. Retained component suites pass while two enclosing assertions fail, and no native workload recovery is established.
Change-source: pulse-maintainer
Account for every byte in the root-boundary compatibility reader, preserving descriptor-first recovery and rejecting oversized valid prefixes, multiple identities and discarded NULs. Keep the original two-second fixture budget, contain descendant processes and report build/probe timing separately. Add real-agent, legacy and cancellation controls without claiming a cause for the retained timeout.
Change-source: pulse-maintainer
Require stopped-state readback before each LXC mutation, reject failed pct set fallback, preserve snapshot entries and only-prior-active restoration, and return incomplete cleanup without removing recovery files. Add isolated adverse lifecycle and completion controls.
Change-source: pulse-maintainer
Reject successful installers whose replacement cannot identify itself as the target community runtime. VERSION metadata and failed or unrecognised probes cannot establish acceptance; retain the existing verified rollback and prior-active restoration. Exercise the complete locally signed installer transaction and bounded executable read.
Change-source: pulse-maintainer
The installer rereads saved preferences without an explicit selector. Forward the parsed stable default as well as RC, and prove the containing installer's actual channel-selection functions against the same signed fixtures.
Change-source: pulse-maintainer
Stop the generated helper before downloads when saved channel evidence is malformed or unreadable. Preserve explicit selectors, source-marker precedence and signed-installer verification; exercise the actual helper with signed local fixtures.
Change-source: pulse-maintainer
The full installer race suite exposed report deletion despite the subshell-counter guard. Bind EXIT cleanup to the original process using the direct child shell parent PID, including before the inherited counter is initialised. Retain strict and unchanged-graph verdicts, exact arguments and parent cleanup. Align the stale channel-copy assertion with the existing non-stable message; executable consent controls remain unchanged.
Change-source: pulse-maintainer
Require a successful bounded executable identity probe before release discovery. Keep Pro and unknown runtime editions untouched even when VERSION offers a usable community version, and do not defer a broken primary binary to a legacy one. Exercise the real shell classifier and main boundary with adverse controls and a TERM-resistant deadline.
Change-source: pulse-maintainer
A TERM-only timeout relies on the child exiting. Keep a fixed five-second KILL backstop, preserve every timeout as a failure and bind the shell/Go command proofs to the actual bounded invocation.
Contract-Neutral: Internal build timeout containment; source graph, endpoints, checksum trust and artifact acceptance are unchanged.
Change-source: pulse-maintainer
Keep the same pinned Go graph and endpoint. Retry only the observed transport-only diagnostic, at most three attempts; stop on refusals, integrity errors, unknown output, timeouts and signals. Execute the actual Docker download command against controlled outcomes and retain its original-base rejection.
Contract-Neutral: Build-only transport recovery; source graph, endpoints, checksum trust and artifact acceptance are unchanged.
Change-source: pulse-maintainer
The broader installer race/vet VM attempt reached readiness but returned no command verdict at its observation deadline. Keep the same consent cases in the normal installer suite and make their committed file standalone, with only standard-library imports and the actual shell gate. This enables proportionate exact-source Bash regression proof without building unrelated application dependencies; the broader failed attempt remains retained.
Change-source: pulse-maintainer
Text matching admitted truncated configuration, nested opt-in and padded RC channels. Parse one configuration object with the installed jq dependency and fail closed before downloads when consent cannot be verified. Preserve the legacy no-config timer opt-in, manual updates and disabled-timer gate; add executed-shell regression cases and the deployment contract.
Change-source: pulse-maintainer
Admit a prepared executable and source revision before stopping Pulse. Keep the live binary in place until one same-filesystem rename, and restore only a previously active service after a failed rename. Preserve existing recovery files and exercise staging, stop, rename and recovery failures.
Change-source: pulse-maintainer
Reject signature, extraction, architecture, destination staging and version failures before the service outage. Keep the live executable until a same-filesystem rename succeeds, remove the destructive version retry, and recover only a previously active, confirmed-stopped service if rename fails. Exercise the real archive path with download/local inputs and retained byte/mode/state fault controls; preserve uncertain-stop restrictions and separate native acceptance.
Change-source: pulse-maintainer
Archive and source installs ignored stop failures, while the manual flows stopped Pulse before staging. Require bounded state reads and a confirmed inactive service before either replacement; keep prior-active attribution and installed metadata on refusal. Exercise both real paths, timeout and uncertain-state controls, and manual staging failures without native or production mutation.
Change-source: pulse-maintainer
Preserve f2b5080bcc and 580199f07c exactly. Resolve only the shared classifier working-directory comment in favour of main's wording, retaining its compilation assertions and the common checkout-root execution.
Change-source: pulse-maintainer
Completed PR2576 checks exposed a workflow-shell fixture running outside the checkout root, two unformatted test files, and the missing monitoring contract for accepted 26ae5b1aa2. Run the real classifier helper in its actual Actions context and assert Go compilation admission alongside strict dependency-audit decisions. Record collected metadata with empty series and retained-only exclusion without changing runtime or synthesizing samples. All reviewed commit identities remain unchanged; final source proof and exact-head hosted checks remain required.
Change-source: pulse-maintainer
The full committed-source installtests race run source-8gv7x0gy failed all code-bearing classification cases with exit 127: the extracted workflow invokes scripts/go-test-compile-required.sh relative to the checkout, while Go starts tests in scripts/installtests. Match the Actions working directory without stubbing the classifier, weakening strict audit or changing workflow behaviour.
Contract-Neutral: Verification-only working-directory repair; the existing real workflow cases, classifier and strict/inherited audit contract are unchanged.
Change-source: pulse-maintainer
Fail empty, malformed, truncated or substituted test streams even when the producer exits zero. Bind each existing CI shard to its source-derived selected names and package, retaining skips, diagnostics and bounded missing coverage alongside the unchanged timings. Preserve required checks, race/vet execution and timing weights; exercise real Go race JSON and parent failure controls.
Change-source: pulse-maintainer
The native matrix consumes the frontend manifests on every platform and uses their test runtime for Windows PowerShell command acceptance, but its event filters omit graph-only changes. Admit those two exact inputs on both PR and main while leaving UI-only changes and all existing native steps unchanged. Regression controls independently remove each input/event and exclude the graph.
Contract-Neutral: Native CI admission coverage only; installer inputs, runtime behaviour, service authority and recovery contracts are unchanged.
Change-source: pulse-maintainer
Publish failed and unfinished source-test names in the existing shard artifact without waiting for other workflow jobs. Keep logs, timings, test selection and failure exits unchanged; record unknown completion and omitted unsafe or excess identities explicitly. Pin privacy, bounds, pipefail and timing-refresh compatibility, and align the existing shard contract with current compile admission.
Change-source: pulse-maintainer
Compile all race-test binaries without execution only when source, graph, backend embeds or this admission path can affect Go. Preserve required check failures, docs/frontend-only skips and all full runtime/vet and frontend audit checks. Exercise inert and broken fixtures, diff classification and prerequisite propagation.
Change-source: pulse-maintainer
PR2576's deterministic mirror failure admitted expensive frontend, backend and browser work that could not land. Run the existing whole-tree checker before dependency work in the build admission job and all three E2E entrypoints, retaining every existing check, secret scan and test gate. Exercise the actual workflow commands with synced, stale and orphaned guides.
Change-source: pulse-maintainer
The declared 80-case trace reproduced a stopped watchdog running its inherited EXIT cleanup before classification, deleting a captured critical finding. Guard cleanup by Bash subshell ownership, including Bash 3.2, and exercise the actual hook with a deterministic child-exit control and a rejected legacy hook. Retain parent cleanup and every existing audit verdict and deadline.
Contract-Neutral: Repair captured-report lifetime only; advisory classification, strict and inherited verdicts, invocation scope, retry budgets and external permissions remain unchanged.
Change-source: pulse-maintainer
The native workflow did not admit helper/protocol/filesystem/signature-only edits and omitted their suites. Extend its existing Linux jobs with bounded uncached race coverage and an actual helper build, preserving ordinary-user execution and all installed/PVE acceptance boundaries. Regression controls reject missing triggers, platforms, packages and hidden failure.
Contract-Neutral: Native source-verification coverage only; installed helper authority, signed migration, isolation and guest-recovery contracts are unchanged.
Change-source: pulse-maintainer
Two completed PR runs put 24 minutes of overlapping package test time on rest-1 versus 14 on rest-0. Assign whole package binaries deterministically by recorded cost while deriving exhaustive coverage from the checked-out go list. Keep both required check names, every race test, failure propagation and the separate contiguous internal/api shards unchanged.
Contract-Neutral: Rebalance existing CI work only; no runtime, required-check, exhaustive coverage, race-test or dependency-admission contract changes.
Change-source: pulse-maintainer
Close the connected exit-propagation gap in the CI service harness: a version or sc.exe query that prints plausible text but exits nonzero must not become accepted evidence. Check each captured native exit before inspecting the text, retaining the existing checked installer invocation.
The workflow and harness regressions now cover twelve native boundaries. Controlled PowerShell execution remains required by native Windows CI and explicitly unavailable in the offline Linux guest; production installation, service operations and customer acceptance are not inferred.
Contract-Neutral: CI proof verdict propagation only; production agent, installer, service lifecycle and permission contracts are unchanged.
Change-source: pulse-maintainer
PowerShell steps containing multiple native commands only expose the last exit to Actions. Check all agent build/version/self-test and lifecycle build/invocation exits immediately, keeping the original status in the error. A later success can no longer conceal an earlier failure or start lifecycle mutation after a failed build.
The regression validates all seven workflow boundaries, rejects each missing guard and tolerant steps, and runs the actual guards against controlled native exits when PowerShell is available. Windows CI requires that runtime regression; offline Linux explicitly retains the unavailable runtime as a skip.
Contract-Neutral: Native CI verdict propagation only; production agent identity, installer behaviour, service lifecycle and authority are unchanged.
Change-source: pulse-maintainer
Consume the full change list so an early dependency-path match cannot make printf receive SIGPIPE under pipefail and select inherited-advisory warning mode. Exercise the actual workflow classifier and real audit runner with bounded offline controls, including a critical finding; exact paths and existing audit policy stay unchanged.
Contract-Neutral: Repair the existing complete-list classification obligation only; strict dependency paths, inherited-warning policy, audit verdicts, permissions and publication contracts are unchanged.
Change-source: pulse-maintainer
Keep the original archive-copy metadata semantics while checking every snapshot and restore. A content-only copy would lose extended attributes. Exercise that recovery and reject a non-regular restored destination before byte comparison or activation; qualify the restart backstop comments for incomplete recovery.
Change-source: pulse-maintainer
The first connected attempt failed before installer execution because the fixture expected .sshsig while ssh-keygen creates .sig. Require that real signed output and serve it under the simulated release URL. Production signature verification is unchanged; retain the original failed proof.
Contract-Neutral: Correct the test fixture signature filename only; production updater and trust contracts are unchanged.
Change-source: pulse-maintainer
A successful rename is not by itself the recovered-byte postcondition. Keep the snapshot and suppress activation when the recorded destination is still a link or no longer matches the saved bytes; connected no-op and changed-destination controls exercise that boundary.
Change-source: pulse-maintainer
Reject directory destinations before the same-directory file rename, use portable mode inspection in the connected transaction tests, and teach the existing service fakes that stopping and failed activation are separate operations. The recorded first candidate proof remains bound to its own source.
Contract-Neutral: Preserve the reviewed backup and rollback semantics; portable utility invocation and faithful test boundary only.
Change-source: pulse-maintainer
The conditional updater caller disables errexit, but binary and VERSION backups and restore copies were best-effort and their only backup was deleted even when recovery failed. Require a private verified snapshot before installer execution, consolidate the three rollback branches, stage exact original paths and absence, and retain the backup without automatic activation when recovery is incomplete. Exercise the complete signed offline path and prior-active-only service recovery.
Change-source: pulse-maintainer
The connected Docker-agent tests now import the API embed. Native jobs
previously ran their Go runtime suite before any frontend installation,
leaving that suite without its compile-time assets. Prepare the locked real
frontend build for every native runtime platform, reuse it for the Windows
command proof, and retain all existing runtime, installer and service
lifecycle checks.
The deployment documentation and ordered all-platform/stub-build regressions
describe the existing real-embed prerequisite. Source builds and Windows
cross-compilation remain distinct from native acceptance.
Contract-Neutral: CI asset preparation only; production agent identity, command authority, installer and service lifecycle contracts are unchanged.
Change-source: pulse-maintainer
Since 15:00 UTC on 5 October every paired benchmark run that was not
superseded has hit its 25-minute step timeout. Each step runs ten base
and ten candidate samples, so per-sample growth is multiplied by twenty.
BenchmarkRegistryProjectionSnapshot (#2518) rebuilt a registry behind
StopTimer on every cold iteration. Go sizes b.N from timed work only, so
the empty-registry cases ran hundreds of thousands of untimed ingests
and took 16 s of a 100 ms benchtime. With #2486's new owner-index and
metadata benchmarks, internal/unifiedresources went from 8 s to 38 s per
sample. Cold now invalidates the registry's derived state instead. The
refresh never reads its own output, so this repeats a fresh ingest's
first read with the same allocations, and the family drops from 22 s to
about 5 s per sample.
Paired runs also measured every package even when both trees compiled
identical code, as on frontend-only changes. They now sample only
packages whose in-module dependency closure the change reaches. Module
files, dirty or non-Git trees and an unreadable graph still select
everything.
A module or shared-model change still samples nearly every package,
about 24 minutes with warm-up. The step therefore gets a measured 30
minutes, and the script stops at a 28-minute projected budget with
per-package costs instead of meeting a bare timeout.
Replace the rejected global host-network proposal with the unchanged private namespace on every platform, including native linux-386. Carry successful rows and omitted VMIDs through operation v2 without clearing degraded health or renewing omitted measurements; retain strict complete-only v1 compatibility. Restart the installer-owned helper only after isolated-unit and socket checks, and document the unresolved pmxcfs IPC limitation rather than claiming PVE recovery.
Change-source: pulse-maintainer
Document host-capacity normalisation, version-qualified rounding and the difference between collected readings and delivered alerts. Keep comparisons on ordinary workload observations rather than forced load, threshold changes or diagnostic reruns.
Contract-Neutral: Existing container CPU semantics and safety guidance only; no runtime, API, threshold, permission or lifecycle contract changes.
Change-source: pulse-maintainer
pulse-triage[bot]