gsadmin/pulse
1
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-09-10 02:25:56 +00:00
Code Issues Packages Projects Releases Wiki Activity
10,165 Commits 199 Branches 582 Tags
6b5369bbfa67df14bd2ba7fc0b2ceb8826a7d495
Commit Graph

472 Commits

Author SHA1 Message Date
pulse-triage[bot] de41ea1883 Preserve workflow taint across branches 
Change-source: pulse-maintainer
 2026-09-01 17:34:30 +01:00
pulse-triage[bot] 4f7a3d0006 Close runner output alias bypasses 
Change-source: pulse-maintainer
 2026-09-01 16:54:07 +01:00
pulse-triage[bot] c55db584c1 Harden GitHub command file data boundaries 
Change-source: pulse-maintainer
 2026-09-01 16:32:15 +01:00
pulse-triage[bot] 9a5af6ff79 Keep Windows agent update signatures addressable 
Change-source: pulse-maintainer
 2026-09-01 16:11:04 +01:00
pulse-triage[bot] 9c307ed1e4 Continuously verify stable installs 
Change-source: pulse-maintainer
 2026-09-01 15:15:27 +01:00
pulse-triage[bot] 1ef5618190 Verify exact release activation bytes 
Change-source: pulse-maintainer
 2026-09-01 13:29:06 +01:00
pulse-triage[bot] dc4639460a Bind continuity checks to activation asset bytes 
Change-source: pulse-maintainer
 2026-09-01 12:47:16 +01:00
pulse-triage[bot] 168f52972a Expose complete stable release continuity failures 
Change-source: pulse-maintainer
 2026-09-01 12:26:46 +01:00
pulse-triage[bot] a34f3c752b Keep convergence evidence off sealed releases 
Change-source: pulse-maintainer
 2026-09-01 11:38:55 +01:00
rcourtman d28666c396 Guard shipped docs mirror sync at commit time 
Docs under frontend-modern/public/docs are byte-for-byte copies of repo
docs, but the only guard was a CI vitest the git hooks never run. On
2026-09-01 two commits (f4886c2dfb, f313882a7b) each edited a mirrored
doc without its copy, passed the hooks, and broke main's Frontend job.

Add scripts/check_docs_mirror.py with an index-blob --staged mode wired
into the pre-commit hook: a commit that stages either side of an
out-of-sync pair (or an orphan shipped copy) fails with the exact sync
command, while pre-existing drift from other commits only warns. The
worktree mode runs as a named step in the public-docs workflow, with
unit tests in scripts/tests picked up by the existing runner. The
docsLinks vitest stays as the CI backstop.

Build-time generation of public/docs was considered and rejected: the
shipped set is a curated subset (61 of 421 docs), so generation still
needs a hand-maintained manifest while adding build, dev-server, and
test-order coupling.
 2026-09-01 11:16:05 +01:00
pulse-triage[bot] faf69f76e6 Keep workflow outputs out of generated shell 
Change-source: pulse-maintainer
 2026-09-01 10:16:41 +01:00
pulse-triage[bot] f12c4007ab Serialize stable demo operations 
Change-source: pulse-maintainer
 2026-09-01 08:47:52 +01:00
pulse-triage[bot] ba727edf12 Refresh trusted checkout action 
Change-source: pulse-maintainer
 2026-09-01 02:31:08 +01:00
pulse-triage[bot] e1bce8b77f Build release payloads on ephemeral runners 
Change-source: pulse-maintainer
 2026-09-01 01:41:09 +01:00
pulse-triage[bot] bd146586e8 Make release continuity failures actionable 
Change-source: pulse-maintainer
 2026-08-31 21:20:30 +01:00
rcourtman 83cc5e5642 Give stable backend qualification full completion headroom 2026-08-31 19:05:32 +01:00
pulse-triage[bot] 0f7a8683c2 Block privileged workflow code ingress 
Change-source: pulse-maintainer
 2026-08-31 18:21:45 +01:00
rcourtman 5754d924d7 Add rootful Docker secure-runtime qualification 2026-08-31 18:13:22 +01:00
pulse-triage[bot] 8f877bee14 Bind privileged workflow runs to canonical code 
Change-source: pulse-maintainer
 2026-08-31 17:09:53 +01:00
pulse-triage[bot] 69cbe5f3b8 Enforce protected GitHub checkout baseline 2026-08-31 13:21:25 +01:00
rcourtman 2ddd12cb31 Repair v6.4.2 Helm provenance 2026-08-31 11:59:11 +01:00
rcourtman f47ac1f020 Define beta and RC release maturity 2026-08-31 11:42:03 +01:00
rcourtman 70c1d0a178 Authenticate RC artifacts before qualification 2026-08-31 09:49:41 +01:00
Richard Courtman 2ff027a743 Bind release candidate version explicitly 2026-08-31 09:37:28 +01:00
pulse-triage[bot] 445ebacf24 Restore delivery qualification trust 
Harden release workflow input transport and make native lifecycle proof honor each platform security boundary. Refresh stale telemetry and delivery qualifications.

Contract-Neutral: Formatting-only catalog updates and browser-verified alert copy; release compiler and native lifecycle changes update their owning contracts.
 2026-08-31 03:02:13 +01:00
pulse-triage[bot] fda955627f Bound GitHub Actions job runtimes 2026-08-31 02:00:09 +01:00
rcourtman 7650fdaba3 Wire secure runtime RC qualification 2026-08-31 01:50:48 +01:00
pulse-triage[bot] eb0d17c282 Restore trustworthy governance signals 2026-08-31 00:55:44 +01:00
pulse-triage[bot] 47c1cee895 Enforce least-privilege job tokens 2026-08-30 22:11:40 +01:00
pulse-triage[bot] cb079c9de0 Publish portable candidate build provenance 2026-08-30 20:34:04 +01:00
pulse-triage[bot] d732b5a9e8 Restore scoped governance audit signal 2026-08-30 17:01:44 +01:00
pulse-triage[bot] c3faa48973 Watch stable release locks continuously 2026-08-30 16:17:15 +01:00
pulse-triage[bot] a0dfdadc5e Close workflow trust policy gaps 2026-08-30 15:06:00 +01:00
pulse-triage[bot] 21007a8662 Isolate private governance from pull requests 2026-08-30 15:02:41 +01:00
pulse-triage[bot] 7d9e77ff32 Continuously verify stable container aliases 2026-08-30 13:55:41 +01:00
pulse-triage[bot] 8724f6b9e5 Continuously verify stable release delivery 2026-08-30 13:10:22 +01:00
pulse-triage[bot] 9393b710da Preflight immutable release publication 2026-08-30 12:55:51 +01:00
pulse-triage[bot] 2fca8c957b Authenticate published release sidecars 2026-08-30 09:38:23 +01:00
pulse-triage[bot] f70da05467 Bind Helm delivery to release provenance 2026-08-30 07:34:56 +01:00
pulse-triage[bot] 0d32dac16e Keep release toolchains within support 2026-08-30 06:40:25 +01:00
pulse-triage[bot] e66f6a26f7 Fail closed when installing MCP binaries 
Verify the signed release checksum manifest against Pulse's pinned SSH key before either MCP installer accepts a downloaded binary. Remove the unsigned bypass and require one exact digest entry.

Include bare Unix MCP executables in release checksum/signature assembly, cover unavailable, invalid, ambiguous, mismatched, and successful evidence paths with executable regression tests, and enforce MCP installer pins against the configured release key.
 2026-08-30 05:11:55 +01:00
pulse-triage[bot] d8986c139a Enforce workflow data trust boundaries 
Contract-Neutral: Moves workflow expressions into environment data flow without changing deployment interfaces or behavior.
 2026-08-30 04:56:34 +01:00
pulse-triage[bot] a2bfadba7b Enforce workflow execution trust boundaries 2026-08-30 04:44:25 +01:00
pulse-triage[bot] 560c2de026 Automate dependency trust maintenance 2026-08-30 04:02:27 +01:00
Pulse Test d607d5cf46 Separate agent remediation runtime 2026-08-29 23:48:28 +01:00
Pulse Test 1720fd635b Harden CodeQL-scanned input boundaries 2026-08-29 23:42:23 +01:00
pulse-triage[bot] e67e4a7c5f Bind container promotion to attested digests 2026-08-29 22:56:12 +01:00
Pulse Test 6d4ee48000 Add typed agent privilege helper 2026-08-29 22:51:58 +01:00
pulse-triage[bot] 7e7fb53911 Gate release publication on immutable setting 2026-08-29 22:41:04 +01:00
pulse-triage[bot] 1d170de364 Require immutable attested releases 2026-08-29 19:59:04 +01:00