Read only the selected feedback option rather than bug-like words in link destinations, titles, prose or withdrawn examples. Preserve all current dropdown choices, legacy Bug and Regression values, maintainer classifications and unrelated Community labels. Registered consumer controls exercise the silent label delta without contact or release inference.
Contract-Neutral: Silent issue-label metadata only; no product runtime, frontend, dependency, access or canonical subsystem contract delta.
Change-source: pulse-maintainer
Cold seven-day mock workload charts synthesized 914 values per series
before discarding most of them. Selecting the existing timestamp grid
before synthesis preserves the retained readings, newest point and
complete history window while bounding expensive work. The controlled
native request fell from 8.9 seconds to 1.3 seconds.
The strict chart query gate also exceeded its 90 ms p95 limit. Profiling
showed repeated SQLite row decoding, so raw fleet value reads now carry
the series and timestamp in one integer per observation. This
statement-local transport preserves exact values, negative-epoch
timestamps, tier reconciliation, resource scope and ordering, with
separate columns when a window could overflow. Full metrics-store tests
and targeted monitoring/API regressions pass, including boundary and
prepared-query cache controls. The 90 ms limit remains unchanged.
Organization browser fixtures arrange activated API fixtures before
their first workspace load. Explicit activation and deletion bounds
cover the existing server deadlines. Cleanup owns partial preparation,
attempts every tracked organization and retains failures. Native backend
teardown retains its final log. CI executes all 63 authentication,
organization and backend lifecycle controls before browser fanout.
Browser OS acquisition uses the hosted runner's existing signed Ubuntu
source definition. An unrelated Microsoft feed returning 403 can no
longer stop browser setup. Missing, unreadable or empty Ubuntu
definitions and incomplete Ubuntu index updates still fail. Existing
mirror, TLS, signature and cached archive hash checks remain in force.
Real apt acquisition controls, 17 package cache tests, 11 ownership
tests and normal commit/push checks pass.
The mock target lookup benchmark keeps fixture lifecycle logs out of
Go's result stream. A combined stdout/stderr control reproduces the lost
original observations and parses all ten corrected observations with
identical 4,731 lookups per operation. The benchmark work and comparison
thresholds remain unchanged.
Current-build browser verification covers
`/proxmox/workloads?type=vm&platform=proxmox-pve` at 1440×1000 and
390×844: seven-day trends, row drawer expansion, history range
selection, oldest/latest keyboard inspection and drawer dismissal.
Twelve organization-route cases cover organization settings, access,
sharing and billing across Chromium, mobile Chrome and mobile Safari
with retries disabled.
The [full stable/probation browser
run](https://github.com/rcourtman/Pulse/actions/runs/40160832317)
passed: 530 passed, 392 skipped, zero failures and no retry/flaky
markers in all eight shard logs. Agent registration and organization
provisioning also passed. This evidence covers product code at 64c0a3f9.
The later correction changes only a Go benchmark fixture and its
performance contract.
The [final-head stable E2E
run](https://github.com/rcourtman/Pulse/actions/runs/40163545118) also
passed all eight shards, agent registration and organization
provisioning: 186 passed, 183 skipped, zero failures.
All nine required source checks passed. The [final-head build and test
run](https://github.com/rcourtman/Pulse/actions/runs/40163545117)
passed, including benchmark comparison and strict chart qualification.
The chart result on valid hosted capacity was p50 38.31 ms, p95 51.01 ms
and p99 52.28 ms against the unchanged 90 ms p95 limit. The retained
artifact binds the measured binary to the tested synthetic merge commit.
The preceding runtime qualification also passed at p95 86.55 ms on its
runner. The benchmark comparison found no regression above the existing
10% and p<0.05 threshold. The corrected lookup fixture supplied all ten
observations without parser warnings.
After main advanced with scoped authentication and tenant runtime
changes, a native compatibility proof composed this exact head with
c809d3c93b. API, configuration API and
monitoring regressions passed. All twelve organization browser cases
passed again with retries disabled. A fresh embedded runtime passed the
desktop and phone seven-day chart matrix with both endpoints accessible.
The reviewed combined tree is 2e9a154b1c.
Read the visible text of a single inline-formatted paragraph before classifying explicit no-topic answers. Preserve qualifiers, images and block evidence, completed reviews and every genuine revised topic without public contact.
Contract-Neutral: Silent issue-label metadata only; no product runtime, frontend, dependency, access or canonical subsystem contract delta.
Change-source: pulse-maintainer
Bound reordered topic declarations at all four feature-request context
fields. Extend the registered form-derived parser and consumer controls
to every issue template, preserving cleared reviews on context edits and
restoring review only for a real revised topic.
Contract-Neutral: Silent issue-label metadata only; no product runtime,
frontend, dependency, access or canonical subsystem contract delta.
---
Fleet candidate `20261025T022031Z-product-intelligence` from the
`product-intelligence` lane. Reviewed tip
`b8e64d1fffe90d76a2cddbffd0cd1ba792ef8bc6` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Include the organization request-bound, owned-cleanup and native backend diagnostic controls in the existing fixture validation step. These tests must protect future changes in recurring CI as well as the focused native proof.
Contract-Neutral: CI wiring only: execute existing fixture controls in the existing validation job. Source-bound image distribution, fixture behavior and all runtime and test deadlines are unchanged.
Scrolling through a long platform drawer could unmount its owning row
and close the detail being read. REST resource projection also dropped
source provenance, hiding vCenter context and host placement from
owning-snapshot consumers. Diagnostic commands lacked keyboard
scrolling, and dark-theme text and several Patrol control names failed
accessibility checks.
Measure summary rows and inline details together in the shared bounded
window, preserve canonical resource sources, make diagnostic command
blocks focusable, and repair shared contrast and visible control naming.
Browser fixtures await mounted authentication and keep synthetic
provider inventory authoritative. Journey assertions follow current
read-only capabilities, technical disclosures and composed resource
queries. Long settings audits traverse the actual scroll extent; curated
estate checks use native inventory disclosures and search; disk proofs
follow canonical serial-bound shared history; the published
completed-restore-point calendar checks remain intact, including day
selection and filter reset. Update API proofs no longer mount an
unrelated dashboard before each request.
Fresh password login now waits for mounted bootstrap too. The
delayed-bootstrap regression owns and revokes its own token, so it runs
with cookie-only and primary-token fixtures without replacing the
fixture credential. Update API cases share an admitted cookie fixture.
Growth assertions use the current fixed-window header, LXC refresh
assertions use the fixture's canonical identity, and the gated-panel
observer follows actual gate readiness while still detecting visible
unlocked controls. The Docker browser stack explicitly opts into a
bounded development update budget for its shared bridge IP. Production
and login limits remain unchanged.
The remaining recovered failures exposed three test synchronization
defects. Alerts now leaves the whole editor before judging a staged
change and exercises its sibling-focus contract. Protected panel
assertions wait for mounted bootstrap before their existing readiness
timeout. The delayed-token regression uses its own page, avoiding
interception of reads from a departing setup document. CI retains
failed-attempt HTML diagnostics after a successful retry and small JUnit
results for each completed tier, including stable receipts before
probation starts.
Validation includes negative controls for the original drawer,
provenance and password-bootstrap defects, 335 focused frontend tests,
23 authentication-fixture tests, type-checking and a production build.
The cookie-only follow-up matrix passed 39 cases across Chromium, mobile
Chrome and mobile Safari with 18 existing skips. Twelve additional
onboarding cases passed with no retries, and the token-bootstrap matrix
passed 12 cases with cookies alone and 12 with a primary token. Native
Chromium and WebKit checks exercise the gated-panel detector's positive
and negative controls. The earlier remaining-failures matrix passed 31
cases with 10 existing skips, and both disk-history cases passed on
desktop.
Current-build browser verification covers onboarding, accessibility,
VMware context and exclusion boundaries, demo commercial isolation,
persisted Alerts settings, Patrol, availability and background refresh.
Pixel and interaction review covers infrastructure, Agent Doctor,
Patrol, Docker, Kubernetes and vSphere at desktop, tablet and phone
widths in both themes where applicable. Existing timeouts, skips,
mounted-row limits and the 90 ms chart budget remain in place.
The final recovered-failure matrix passed 27 cases with 14 existing
mobile skips using cookies alone, followed by 12 passes with a primary
token, all without retries. The forced desktop table control reproduces
the old focus failure and passes after leaving the editor. The preceding
qualified tree completed all required source checks and the full
stable/probation matrix. Its executed strict chart proof measured p95
61.1 ms against 90 ms with valid capacity. The updated head is being
qualified again before landing.
Governed work: L12 journey verification and the shared L10 windowing
proof. This source change does not publish a release.
Bound reordered topic declarations at all four feature-request context fields. Extend the registered form-derived parser and consumer controls to every issue template, preserving cleared reviews on context edits and restoring review only for a real revised topic.
Contract-Neutral: Silent issue-label metadata only; no product runtime, frontend, dependency, access or canonical subsystem contract delta.
Change-source: pulse-maintainer
Exercise Chromium and WebKit geometry once after browser installation,
before the first shard admits its runtime fixture. Content growth must
complete the new scroll extent and unchanged-extent resets must still fail.
Judge consuming panels after their protected document has mounted, and
give the delayed-token regression its own bootstrap page. Leave the whole
Alerts editor before checking for a staged change, including its desktop
focus and card Save contracts. Keep the existing panel timeouts.
Preserve failed-attempt HTML diagnostics when a first retry succeeds and
retain small JUnit results for every completed tier. Upload stable evidence
before probation starts. Integrate the published node disk observation
repair before qualification.
Bound edited topic declarations by all current form fields without discarding deeper topic subheadings. Prevent unrelated version, environment and recovery edits from inventing or reopening decomposition work; preserve genuine revisions and Community labels.
Contract-Neutral: Silent issue-topic classification and registered regression controls only; no Pulse runtime, rendered product surface, dependency, access or public-contact change.
Change-source: pulse-maintainer
The published native Pro archive and paid registry image currently become missing-version reports, unlike the Community server artifact. Accept those server naming shapes without mining unknown fields, link destinations, signatures or companion binaries. Exercise the actual silent label consumer and preserve Community-owned state and the live-read fence.
Contract-Neutral: Silent issue version classification and registered regression controls only; no Pulse runtime, rendered product surface, subsystem contract, dependency, access or public-contact change.
Change-source: pulse-maintainer
Retained hosted samples include both an over-budget failure and an
under-budget pass with one provisioning agent occupying about one
logical CPU. Attribute only that bounded Actions overhead; retain raw
CPU and absolute 90 ms latency, and keep other or unattributed CPU,
guest, steal and swap invalidating. Exercise the real CLI and workflow
shells with adverse controls; no timed workload or release acceptance is
claimed.
---
Fleet candidate `20261024T104012Z-delivery-trust` from the
`delivery-trust` lane. Reviewed tip
`fbe410e244f3d44b44de258c6f3db68dabd257da` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
The demo update and recovery workflows still joined the tailnet with
the July 2026 tag:infra OAuth client. That client was revoked on 30
September, when the private repositories moved to narrow clients, and
the public repository was missed. Since then every demo convergence
step has failed with an OAuth 401, so stable releases cannot converge
and the hourly reconcile keeps retrying v6.5.0.
Both workflows now use the TS_CI_DEPLOY_OAUTH_* binding that the
browser update qualification already expects, restricted to
tag:ci-deploy. The tailnet policy already grants that tag SSH to
pulse-relay, the demo host, so no policy change is needed. One narrow
client now serves all three workflows, and the broad tag:infra
identity is gone from this repository.
Treat a deleted convergence owner as terminal
The hourly "Reconcile release convergence debt" job has failed every run
since 13 Oct. The v6.5.0 activation marker names convergence run
37395942598 as its owner, and that run was deleted from Actions with the
rest of the 30 Sep - 8 Oct release history. The immutable marker
outlives
Actions history, so the reconciler and release-convergence.yml both
waited
forever on an owner that can no longer be read, and the permanently red
job hid real failures such as the rc.6 paid-broker miss.
GitHub only deletes a run that has completed or is older than two weeks,
which is beyond every convergence job timeout, so a definite 404 is a
terminal owner. Both the reconciler and the successor's adoption wait
now
proceed from the validated marker in that case. Any other read failure
still waits or fails.
Also remove the workflow_run retry job. Convergence runs are dispatched
with GITHUB_TOKEN, and GitHub does not deliver workflow_run for them:
the
job fired seven times ever, each for a run an operator started by hand,
and never after 29 Aug while dozens of bot-dispatched failures were
recovered by the hourly schedule. The schedule is documented as the
retry
mechanism.
v6.5.0 is served on every surface (Docker aliases at the marker digest,
Helm index entry, paid broker, demo /api/version), but no convergence
run
has proved it. The next scheduled pass dispatches a fresh v6.5.0
convergence; its demo surface will fail until the Tailscale OAuth client
behind TS_OAUTH_CLIENT_ID/TS_OAUTH_SECRET is rotated, as it returns 401.
The hourly "Reconcile release convergence debt" job has failed every run
since 13 Oct. The v6.5.0 activation marker names convergence run
37395942598 as its owner, and that run was deleted from Actions with the
rest of the 30 Sep - 8 Oct release history. The immutable marker outlives
Actions history, so the reconciler and release-convergence.yml both waited
forever on an owner that can no longer be read, and the permanently red
job hid real failures such as the rc.6 paid-broker miss.
GitHub only deletes a run that has completed or is older than two weeks,
which is beyond every convergence job timeout, so a definite 404 is a
terminal owner. Both the reconciler and the successor's adoption wait now
proceed from the validated marker in that case. Any other read failure
still waits or fails.
Also remove the workflow_run retry job. Convergence runs are dispatched
with GITHUB_TOKEN, and GitHub does not deliver workflow_run for them: the
job fired seven times ever, each for a run an operator started by hand,
and never after 29 Aug while dozens of bot-dispatched failures were
recovered by the hourly schedule. The schedule is documented as the retry
mechanism.
v6.5.0 is served on every surface (Docker aliases at the marker digest,
Helm index entry, paid broker, demo /api/version), but no convergence run
has proved it. The next scheduled pass dispatches a fresh v6.5.0
convergence; its demo surface will fail until the Tailscale OAuth client
behind TS_OAUTH_CLIENT_ID/TS_OAUTH_SECRET is rotated, as it returns 401.
pulse-pro gives a promotion run credentials only while that run is
still its current main. Any pulse-pro merge that lands while the run is
queued or validating, roughly 20 minutes, makes the refusal certain.
The convergence caller treated it like any other failure, so the
release stayed off the Pro broker until the hourly reconcile happened
to retry. That race caused five of the last six Pro promotion failures
(12, 17 and 24 October); on 24 October it held v6.6.0-rc.6 back from
Pro installs on the RC channel.
The refusal happens before credentials, so nothing was mutated. The
caller now re-dispatches on the new main when every failed job failed
only the source check and pulse-pro main has moved off the run's head,
up to five attempts in the existing one-hour budget. Every other
failure stays terminal, and only the terminal failure is annotated so
reconciliation still finds exactly one private run URL.
Retained hosted samples include both an over-budget failure and an under-budget pass with one provisioning agent occupying about one logical CPU. Attribute only that bounded Actions overhead; retain raw CPU and absolute 90 ms latency, and keep other or unattributed CPU, guest, steal and swap invalidating. Exercise the real CLI and workflow shells with adverse controls; no timed workload or release acceptance is claimed.
Change-source: pulse-maintainer
Keep modernc driver and runtime updates together while allowing unrelated minor and patch updates to progress independently. Preserve all security-update coverage and individual major updates. Add the current SQLite/libc and Prometheus grouping regression to the maintained smoke suite.
Change-source: pulse-maintainer
Isolate the retained PR3095 completion (7f4ec192 and 93d87118) without
importing unrelated history. Keep the exact proposed Python classifier
and maintained chart shells, real CLI/workflow controls and dependent
contracts. Inconclusive capacity never establishes the 90 ms budget;
child, cleanup and malformed-proof failures remain errors.
Source-PR: https://github.com/rcourtman/Pulse/pull/3095
Source-Commit: b31fabd778
Co-authored-by: rcourtman <8825017+rcourtman@users.noreply.github.com>
---
Fleet candidate `20261024T010002Z-delivery-trust` from the
`delivery-trust` lane. Reviewed tip
`7e7cea87a6bce2e7a2e00e888a676c571e141d92` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Compose retained 8478eac3 additively on current main. Preserve both independently appended contract sections at each of the three documentation conflicts; workflow, registered executable controls and classifier stay unchanged.
Change-source: pulse-maintainer
The existing synchronizer loses appended, replaced or revised topics after an earlier disposition because both field classifications remain true. Compare the current declared text while preserving quiet label deltas, Community ownership and stale-event/pre-write checks. Add registered regression controls, keep the served guide aligned, and record desktop/320px proof through the real documentation consumer.
Contract-Neutral: Repair the existing issue-topic queue and its guidance; no Pulse runtime, API, label ownership, navigation or subsystem contract change.
Change-source: pulse-maintainer
Isolate the retained PR3095 completion (7f4ec192 and 93d87118) without importing unrelated history. Keep the exact proposed Python classifier and maintained chart shells, real CLI/workflow controls and dependent contracts. Inconclusive capacity never establishes the 90 ms budget; child, cleanup and malformed-proof failures remain errors.
Source-PR: https://github.com/rcourtman/Pulse/pull/3095
Source-Commit: b31fabd778
Co-authored-by: rcourtman <8825017+rcourtman@users.noreply.github.com>
Change-source: pulse-maintainer
A version supplied as a Markdown release link currently becomes needs-version-info even though its visible label states the version. Read only that label and ordinary inline formatting; never mine destinations, image text or literal Markdown for a version. Keep current-report checks, silent metadata deltas and Community labels unchanged.
Contract-Neutral: Recognise visible inline version values within the existing issue metadata contract; no product runtime, API or label ownership changes.
Change-source: pulse-maintainer
Since 22 October the E2E jobs often time out installing browsers before
any test runs: 29 installs failed that day and 30 on 23 October, against
none in the week before. Each job downloads about 119 MB of Ubuntu
packages for Chromium and WebKit from the runner's Azure mirror, and
some GitHub-hosted runners now get tens of kB/s from it
(actions/runner-images#14823 and #15040). The same package set on the
same image versions installed in under a minute before then.
The three browser jobs now restore the newest saved .deb set with
actions/cache/restore and admit it through scripts/browser_os_packages.py.
apt reuses a file already in its archive directory after checking only
its size, so the helper refreshes the index and installs a private copy
of a cached file only when that copy's SHA256 matches a signed index
stanza for the package, version and architecture its filename names.
After a successful install, and before any journey can fail the job,
the helper rebuilds the cache from apt's archives and the job saves it
under a run-unique key only when the set changed, so Ubuntu updates
refresh the cache and an empty or unchanged set is never saved.
The transport bounds and install budgets are unchanged, and the jobs
hold no secrets or write tokens, as the workflow trust contract requires
for caches.
GitHub's Ubuntu runner image ships an apt source for
packages.microsoft.com. Every job that runs `apt-get update` therefore
fails when that server does. On 22 October it returned 403 Forbidden for
about an hour, failing the required Repo Boundary Audit on the
v6.6.0-rc.6 preparation twice, so the release train abandoned the
candidate and will only retry 12 hours later.
None of these jobs installs anything from that source: the audit needs
ripgrep, the release build zip/unzip, the dry run docker-compose and the
browser qualification jq/curl/ssh plus Playwright's dependencies, all
from Ubuntu. Before refreshing apt, remove only source files that name
packages.microsoft.com. A runner without one is left alone, and a
cleanup failure never fails the step.
Contract-Neutral: CI runner package-source hygiene only; no runtime, release artifact or public contract change.
Spec 10 skipped on every run: it issued and revoked real licences through
the production licence server and needed an admin token no workflow had.
Its selectors had also rotted against the current plan page ("Existing
purchases", "Activate Key", "No Pro license is active"), so licence
activation, the path every paying customer takes, had no running browser
coverage.
The in-memory Ed25519 issuer behind the Organization provisioning job now
mints a second ephemeral key whose grants carry the Pro plan. The spec
pastes that key into the plan page's license recovery field, checks the
Pro state in the UI and the entitlements API, and clears it back to
Community through the UI. The offline CI job runs it with the same
wrapper, so no production credentials or signing material are involved.
Spec 11's plan-panel matcher drops the labels that no longer exist.
Contract-Neutral: Adds a CI step running an existing spec through the existing offline issuer wrapper; E2E image distribution and installability are unchanged.
Go 1.26.10 (20 October) distrusts the compromised eMudhra intermediate
CAs in crypto/x509 (CVE-2026-111943). Binaries built with 1.26.9 still
accept chains through them, so every verified outbound TLS connection
Pulse makes (licence, updates, webhooks, AI providers) stays open to
interception by a holder of those keys. govulncheck does not flag a
trust-store change as a called symbol, so the scheduled scan stayed
green while the gap existed.
Advance the governed toolchain floor and every pin together: go.mod,
the toolchain installer and release-script guards, the source-built
container stages (manifest-list digests for golang:1.26.10-alpine and
the Debian dev container image), the root-pair diagnostic, and their
tests.
Vite 6.4.3 bundles a launch-editor with three advisories
(GHSA-587h-7wmj-h5pm, GHSA-r825-w8mm-5pxw, GHSA-698v-4r3x-3vcv) that
failed the daily advisory watch. 6.4.4 bundles the fixed launch-editor
and 6.4.5 adds the dev-server server.fs query check. Both reach only
the local dev server, not the built product. The lockfile changes only
the vite entry, and dependencySecurity.test.ts now pins the floor.
Memory grew release after release with nothing comparing it (#1803):
a 256 MB LXC that ran v5 for a year needed 1 GB by v6.3. The existing
memory test only checks growth within one run.
The daily watch builds the latest stable release and main from source,
runs both for 15 minutes against the same small mock estate, and splits
steady-state resident memory into the Go heap, memory outside Go and
file pages. It fails past both 15% and 16 MiB, uploads both heap
profiles with a per-function growth list, and keeps one issue open
while it fails. It runs on a schedule rather than in the pull request
benchmarks job because a 15-minute whole-server run is too slow and
noisy to gate every PR. Mock fixtures live in the heap, so the summary
says to check internal/mock first.
Checked end to end on pulse-dev: v6.5.0 against this branch measured
123.5 and 117.2 MiB, no regression; a synthetic 40% growth exits 1.
Related to #1803
Execute the fixed candidate directly at the existing 90 ms budget. Keep
relative comparisons in the paired benchmark job so an invalid baseline
cannot suppress the candidate check.
Retain per-process CPU and measurement I/O counters. Require quiet I/O
before admission while counting the test's own reads in its latency.
Preserve the rejected hosted measurement and inconclusive tier-pruning
experiment as adverse evidence.
Contract-Neutral: Only verification harness and evidence change; chart payloads, retained reconciliation, latency budgets and required source/release gates are unchanged.
Stream ungrouped retained reads in the existing time-major index order,
avoiding temporary metric sorts without changing tier reconciliation or
chart samples. Extend query-plan and filtered-result coverage.
Add an explicit strict mode for the existing 90 ms API budget and an
optional fresh-worker CI proof with fixed executable identities and raw
capacity evidence. Keep ordinary hosted budgets and required gates intact.
Contract-Neutral: Chart payloads, retained-tier reconciliation, sampling, index layout and source/release gates are unchanged; the implementation removes an unnecessary sort and adds controlled verification of existing latency budgets.
Preserve selected memory freshness and the VM/LXC interpretation.
Retain both native tool contracts and current API concurrency controls.
Qualify this source separately from release and installed recovery.
Contract-Neutral: Integrate already-governed parents without a new contract change. Incoming verification files already match main. Fresh integration tests and source-bound browser proof cover the combined memory and installer surfaces.
The DSM Upstart removal path links its manual override and restores a
retired job config with GNU `ln -T --`, a hard link that never replaces
or descends into an existing target. Its Python harness executes those
production functions with the host's ln. On the macOS runners that is
BSD ln, which rejects -T ("illegal option -- T"), so 13 subtests of
TestInstallSHUpstartTeardownRequiresObservedQuiescence have failed on
both macOS jobs since the DSM retirement series landed on 12 Oct.
The production code is right: that path only runs on Synology DSM
(Linux), never on a macOS agent host. The gap is the macOS fixture
toolset, which already supplies GNU stat/chmod/chown/mv/tar for these
Linux-only installer contracts but not ln. Add ln to that step and make
the fixture-tool contract test bind it and exercise real `ln -T`
no-replacement semantics (file and directory targets).
Contract-Neutral: CI fixture tooling only; macOS runners gain the GNU ln the existing DSM Upstart harness already assumes, no installer or lifecycle contract change
Put published highlights and optional screenshot comparisons in the
post-update dialog, with grouped details available on demand.
Reuse inspected images from merged pull requests or capture fresh release
views, then publish versioned PNG sidecars. Serve screenshots through the
authenticated release endpoint to preserve the existing image policy.
Exact PR2888 smoke job 115991110826 exposes two coverage failures: the integrated .github/scripts npm lock was omitted from Dependabot and the weekly complete/production audit matrix. Include that existing module in both unchanged scan routes; retain all audit findings, review groups and immutable action pins.
Contract-Neutral: Scan coverage integration correction for an existing tooling module; no product runtime, dependencies, permission, audit threshold or release behavior changes.
Change-source: pulse-maintainer
Own PR2936's stale pin and download-admission failures at b7e774d4. Refresh all current workflow consumers, including the newer pre-token issue-label job, with their exact static expectations and lifecycle/deployment contracts. Preserve Node 24, scoped lockfile caching, credential isolation and artifact identity/retention; reject old, mutable and arbitrary download pins.
Contract-Neutral: Immutable Actions pin refresh and coupled consumer/trust expectations only; workflow inputs, permissions, cache and credential controls, artifact identities and application/runtime contracts are unchanged.
Change-source: pulse-maintainer
The stable source Actions record currently returns 404 even though the published release is immutable. Do not require that transient record for post-activation chart recovery: authenticate the exact consumed activation marker and its canonical hosted source provenance with the existing packet verifier, then retain release, source-run and chart bindings. OCI provenance and public package readback remain mandatory. Add executed offline admission/refusal regressions and the corresponding deployment contract.
Change-source: pulse-maintainer
Failed-install forms accept attempted release asset names, but archive and platform suffixes currently become part of the affected-version label. Recognise the published server archive naming shapes, keep companion binaries and verification files out of server version evidence, and preserve unknown fields, bare prerelease qualifiers, Community-owned labels and the live-state fence. Reproduce the actual silent label consumer on five affected inputs and qualify archive, formatting and adverse controls without reporter collection or public contact.
Contract-Neutral: Silent issue classification and regression controls only; no product runtime, subsystem shape, rendered product surface, dependency, grant or public-contact behaviour change.
Change-source: pulse-maintainer
A corrected unknown, incomplete or removed version field currently retains old exact-version affects labels beside needs-version-info. Reconcile those synchronizer-owned assertions with the live bug report, preserving Community labels and the pre-write state fence. Verify corrected fields, delayed events, removals-only writes and no-op/non-bug controls without public contact.
Contract-Neutral: Issue classification metadata and regression controls only; no product runtime, subsystem shape, rendered surface, dependency, grant or public-contact behaviour change.
Change-source: pulse-maintainer
Preserve exact candidate 2ffacbaf1a. Retained source-zy0ifepj covers six stale-preparation controls and the full 109-test triage suite; canonical script, tests and dependency graph have no intervening changes.
Change-source: pulse-maintainer
Label lookup and creation can outlive a report edit, closure or Community review. Abandon the prepared issue-label delta when a fresh pre-write read no longer matches its report and label snapshot; failed reads have no stale fallback. Keep no-op work to one read, preserve per-label mutations and make no public contact.
Contract-Neutral: Issue metadata synchronizer and its regression controls only; no product runtime, subsystem contract, rendered surface, grants, dependencies or public-contact behavior changes.
Change-source: pulse-maintainer
Run the locked parser and silent triage policy on their complete input changes in a credential-free Build and Test job. Retain issue-event pre-token checks, existing runtime and strict dependency gates; exercise admission and original install/test failure exits.
Change-source: pulse-maintainer
Replace the repeatedly patched line scanner with the existing exact Marked 17.0.6 GFM lexer. Preserve real legacy values and silent current-thread label deltas while excluding quoted, nested, HTML and multiline-code declarations and upgrade-source title fallback. Install the complete one-package locked graph with scripts disabled and verify triage before minting its existing write token.
Contract-Neutral: Replace the issue metadata scanner within the existing silent classification contract; no product runtime, API, rendered Pulse UI, permissions, retest or disposition-authority change.
Change-source: pulse-maintainer
Run the existing credential-free diagnostic regressions in tier admission before dependency installation or image/shard work. Check the actual workflow wiring alongside the read-only collector and unchanged strict goldens.
Contract-Neutral: Invoke existing auth-renderer regression controls in CI; no public contract, dependency, golden or threshold changes.
Change-source: pulse-maintainer
Main Secret Scan job 115618327497 on 90a8b890 passed after scanning zero commits and bytes with --log-opts=-1. Bind the exact checkout, scan the complete introduced commit range plus first-parent merge resolution, and use full reachable history when the incremental base is unavailable or divergent. Preserve the pinned detector, checksum, redaction, fatal findings, ignore fingerprints and unconditional per-push admission. Real Git fixtures cover earlier removed bytes, merge-only changes, complete-history fallback and failure exits.
Contract-Neutral: Restore existing per-push secret-scanning coverage; detector rules, security exceptions, permissions, application and deployment contracts are unchanged.
Change-source: pulse-maintainer
Classify the complete tree diff before builds or browser setup. Only nonempty top-level browser receipt JSON changes are exempt; mixed source, graphs, controls, docs and unavailable diffs keep ordinary runtime checks. Keep per-push secret scanning, independent canonical receipt validation and a strict E2E verdict which never calls skipped tests passing. Exercise real Git ranges and both workflow admission/result paths.
Contract-Neutral: Only browser-evidence-only tree diffs omit redundant runtime CI; application, dependency, trust and required source-proof contracts are unchanged.
Change-source: pulse-maintainer
pulse-triage[bot]