Reuse the existing private-response API helper for all role and user operations, preserving exact methods, bodies, privileges and targets. Document independent decisions and uncertain mutation readback; exercise copied commands against synthetic private success, denial, redirect and incomplete responses without exposing credentials or retrying.
Contract-Neutral: Documentation, mirrored guides and copied-recipe regression tests only; no runtime authentication, RBAC, API or frontend behaviour changes.
Change-source: pulse-maintainer
Share existing list time validation across audit reads so malformed, empty or non-increasing supplied bounds cannot silently widen an investigation. Preserve absent filters, access and tenant gates, export formats and existing pagination boundaries; reject invalid export success booleans before reading events. Pin actual handlers and exporter with fake persistent loggers, including no-query rejection and tenant isolation, and update both copies of the audit guide.
Change-source: pulse-maintainer
Use the existing API helper for list, summary, export and verify examples. Explain list pagination versus export scope and preserve partial/error evidence. Exercise the copied recipes with private synthetic bodies, both auth headers, HTTP errors, redirects and incomplete transfers.
Contract-Neutral: Documentation and copied-recipe safety tests only; no audit runtime, API or frontend behaviour changes.
Change-source: pulse-maintainer
Keep RBAC, audit and organisation tokens out of process arguments. Use signed-in organisation mutations, actual schemas and acceptance rules, a custom role ID, and private audit exports. Exercise copied commands and handler lifecycles without changing runtime authority.
Contract-Neutral: Documentation and documentation tests only; authentication, RBAC, tenant isolation, licensing and API runtime contracts are unchanged.
Change-source: pulse-maintainer
pulse-triage[bot]