The completion-history validator materialises its completion tree with a shared clone. The proof sandbox strips the maintainer read config and a linked worktree's gitdir sits outside the checkout, so the clone failed with dubious ownership and the preflight reported a history failure instead of validating the registered pair. Give every git subprocess a private config carrying the fixed safe.directory policy, and register the rehearsal backend package-timeout runtime commit together with its deployment-installability contract follow-up as one completion unit. Change-source: pulse-maintainer
Change-source: pulse-maintainer
The accelerated rehearsal profile runs the backend as one serial 'go test -json -p 1 ./...', whose Go default per-package timeout is 10m. internal/api exceeded that under ordinary shared-worker load (606.9s at loadavg 5.55 on 2026-09-19) and the run failed with 'panic: test timed out after 10m0s' despite zero test assertions failing. The release profile already budgets 30m per package via run-release-backend-tests.sh. Add PULSE_RELEASE_PREFLIGHT_REHEARSAL_TIMEOUT (default 30m) and pass it as -timeout, and update the worker contract test that pins the exact rehearsal command. Change-source: pulse-maintainer
Change-source: pulse-maintainer
The canonical per-commit guard requires pkg/metrics/store.go changes to carry
an accepted proof file in the same commit. The proof for the rollup, retry,
upsert and auto-vacuum repair landed in the follow-up 087bbf8c20
(pkg/metrics/store_additional_test.go). Register the runtime commit e1d97b361e
and its completion commit as one reviewed completion unit so the candidate
preflight validates the pair instead of rewriting history.
Change-source: pulse-maintainer
The canonical completion history validator materialised the completion tree with 'git worktree add', which writes administrative files into the reviewed repository's git directory. That directory is read-only inside the maintainer proof sandbox, so the maintainer preflight could not consult the registry that canonical governance already honours. Materialise the tree with a shared local clone instead: it reads the reviewed objects through alternates and writes only inside the disposable temporary directory, so CI and the maintainer pipeline validate the same reviewed pair without relaxing the sandbox boundary.
Change-source: pulse-maintainer
release_preflight_test still asserted the retired PVE runner labels after 051ce81a72 moved every release channel to GitHub-hosted runners. Assert runs-on: ubuntu-24.04 and the absence of self-hosted/pulse-pve so the test matches the governing workflow contract.
Change-source: pulse-maintainer
Use an exact runtime-file policy before the general API fallback, so setup preservation evidence cannot substitute for unrelated API changes. Assert both setup routing and unchanged organization/RBAC verification requirements. Retain the original failed broader-registry test evidence.
Change-source: pulse-maintainer
Apply existing candidate content-drift validation to every future stable promotion, including v6.4 patches. Preserve patch and minor soak durations and the explicit hotfix reason path. Extend regression cases to maintenance releases and give historical unit fixtures explicit source paths rather than reading the live checkout.
Change-source: pulse-maintainer
Canonical Governance for PR2082 failed because the host-agent lifecycle lookup expectation omitted the registered physical-disk round-trip regression. Include that exact proof file while preserving strict list equality and the existing runtime implementation and registry.
Change-source: pulse-maintainer
Keep the canonical completion guard unit fixtures synchronized with the registered physical-disk runtime proof so governance validates the actual contract inventory.\n\nChange-source: pulse-maintainer
Change-source: pulse-maintainer
Use an explicit status guard while requiring successful preparation and qualification. Model the beta skipped-ancestor path and adverse direct prerequisites; retain immutable identity and all release gates.
Change-source: pulse-maintainer
Reject historical draft reuse before PATCH when its retained target is not the exact checkout SHA, including missing targets and moving refs. Preserve same-source recovery and activation guards.
Depends on PR2056 qualification-first workflow and immutable tag checks. Executable absent-tag fixtures fail before repair and pass on PR head 9e5e18f0 plus this patch; 53 policy, 6 immutability and 42 trust tests pass. Update the deployment contract in the same commit.
Change-source: pulse-maintainer
A draft GitHub release does not hide its public Git tag or registry
images. Publishing those before qualification consumed a beta identity
when the candidate later failed.
Stage drafts without Git refs, join exact-source checks before public
tag, Docker and Helm publication, and preserve exposed tag identities.
Keep final digest verification before release activation.
The following notification reliability patch needs an explicit branch binding before selection. Keep 6.4.4 frozen and preserve historical and unlisted patch mappings while testing beta, RC and stable workflow resolution.
Change-source: pulse-maintainer
Saved enrollment records can correlate with a live Proxmox host after a
reinstall. The continuity overlay then replaced its current agent payload
with an older offline identity, hiding metrics and marking the node offline.
Use canonical matching to add only absent continuity resources. Preserve
current identity, telemetry and provider links without deleting history or
changing token admission. Cover repeated reads and identity collisions.
Refs #1913
Manual checks previously bypassed only the browser cache, so a newly
published preview could remain hidden behind a fresh-looking server result.
Carry explicit freshness to the provider, retain prior evidence on failure,
and omit unknown dates instead of rendering year one.
Record clean, consistent releases as the highest current objective.
Keep release consistency explicitly unconfirmed until actual release
and recovery evidence establishes dependable delivery.
The grouped action upgrade leaves signing, network and publication consumer assertions on superseded pins. Align those contracts and check every consumer against reviewed immutable upstream manifests, retaining exact dispatch and release trust boundaries without claiming hosted execution.
Change-source: pulse-maintainer
The failed exact rehearsal buffered the store-history latency assertion, preventing resource telemetry from locating its actual test interval. Extend the existing exact API lifecycle allowlist and cover both targets with synthetic pass/fail fixtures without rerunning product qualification or changing thresholds. This is prospective observability, not clearance of the retained latency or crash evidence.
Change-source: pulse-maintainer
Buffered package logs cannot map the API stress-test failure to resource telemetry. Stream Go events and retain a bounded target lifecycle with distinct event, receipt and resource collection times, while preserving readable output and pipeline failure status. Synthetic decoder and worker tests cover pass, skip, failure and unavailable telemetry; this does not clear historical qualification or authorise a replay.
Change-source: pulse-maintainer
Scheduled reconciliation run 34264958741 aborted while listing releases after GitHub returned HTTP 504. Allow JSON API reads three attempts with bounded backoff so a transient gateway error need not strand this reconciliation until the next schedule. Discard partial pagination on failure and preserve terminal failure after exhaustion.
Only read helpers opt in; mutations, downloads, log reads and access failures retain their single-attempt behaviour. Focused reconciliation suite passes 42 tests, including new transient-read regressions that failed before the change.
Change-source: pulse-maintainer
The default-branch schedule rejected main before any product checks. Resolve the governed branch to one commit, check its VERSION against policy and retain exact event-source checks for manual dispatches. Report workflow and tested source separately and exercise selection against local Git fixtures in governance CI.
Change-source: pulse-maintainer
Incorporate protected PR #1973 while preserving every reviewed local alert and notification commit in history. Reconcile its failed-read state with per-request ownership and retain exact combined browser evidence.
Change-source: pulse-maintainer
Invalidate pending reads on reset and disposal, and gate success, failure and loading writes per resource. Convert the four reproductions to ordinary tests and retain reset/reopen and stale-failure controls. Qualify the real hook and panel with 14 Chromium lifecycle cases; register that exact browser surface proof without broadening path policies. This does not qualify installed delivery or PR1973's absent error accessor.
Change-source: pulse-maintainer
Filter canonical history before selecting occurrences, preserve source evidence
and expose bounded reads and failures. Reconcile duplicate saved shells without
splitting one alert lifecycle, and keep note identity and canonical risk intact.
Carry attributed operator notes into Assistant. Preserve mobile investigations
across layout changes, transfer composer focus on handoff and keep long event
text readable. Record scoped qualification and its unresolved wider limits.
Refs #1782
Incorporate the protected release-snapshot workflow landing while preserving every reviewed maintenance commit and the additive governance correction in local history.
Change-source: pulse-maintainer
# Conflicts:
# docs/release-control/v6/internal/subsystems/deployment-installability.md
A reviewed notification correction and its required contracts and API proof were accepted as separate immutable commits, leaving the protected per-commit governance check unable to pass without rewriting reviewed history. Add a fail-closed exact-pair validator that reconstructs the completion commit in a detached worktree and runs the normal guard over the combined file set; all unregistered commits continue through the unchanged per-commit path.
Change-source: pulse-maintainer
Continuous development must not change the source of an admitted release.
Allow the workflow to run at the qualified preparation PR head after its
normal merge, verifying exact source and workflow identity, canonical PR
provenance, and ancestry in the governed release line. Later branch commits
remain outside that release. Document the immutable-candidate contract and
verify source workflow compatibility before qualification.
Validation: snapshot identity and workflow contract tests passed, including
wrong-head, wrong-base, fork, unmerged and unbound dispatch rejection. The
existing release workflow promotion policy test also passed.
Incorporate the landed Patrol planning work while preserving every reviewed alert recovery, credential-redaction and release-evidence commit and its ancestry.
Change-source: pulse-maintainer
# Conflicts:
# docs/release-control/v6/internal/subsystems/agent-lifecycle.md
# docs/release-control/v6/internal/subsystems/api-contracts.md
# docs/release-control/v6/internal/subsystems/storage-recovery.md
# frontend-modern/browser-verification.json
Return persisted planning acceptance or refusal inside the investigation turn.
Keep model judgment separate from action authority and preserve accepted action
identity across provider failures. Enforce actor/request idempotency atomically
and retain complete approval and independent verification context.
Preserve unknown disk evidence, stream whitespace and historical resolution
timestamps. Keep conversation scrolling inside its own panel. Record real-model,
disposable-lab and browser qualification with explicit population limits.
Refs #1782
The held latency failure lacks contemporaneous resource context, and isolated passing samples do not explain it. Retain allowlisted backend boundary counters including cgroup ancestors in the existing durable log, preserving backend failures and unchanged qualification thresholds. Focused tests cover failure exits, unavailable telemetry, ancestor collection and environment filtering.
Change-source: pulse-maintainer
Expose confined, identity-bound filesystem observations through the shared
resource pipeline so investigations can distinguish an exhausted container
mount from unrelated host capacity. Keep unavailable measurements explicit.
Isolate alert-history reads from durable writes and reuse one chronological
fold across polling. Catch up through bounded durable event IDs so simultaneous
readers do not replay every retained snapshot. Retain expired actions when
investigation outcomes move back to needs attention, and keep attached
Assistant context focused.
Record live storage diagnosis, healthy and dependency controls, approved and
rejected Docker outcomes, source-bound browser proof and exact test limits.
Missing-access continuity, VM dispatch completion and remaining Assistant
orchestration defects stay open in the redesign plan.
The exact rehearsal passed its test suites and image build but its browser
could not enter the private bind mount. A host UID is remapped to an unrelated
subordinate identity inside rootless Docker. Use the daemon owner's container
identity for rootless Docker and the host UID/GID for rootful Docker.
Execute the locked Playwright CLI directly and probe it during integration
preparation, before expensive suites, so missing dependencies or inaccessible
mounts fail early without fetching an unqualified CLI version.
Refresh durable investigation lifecycle from authoritative actions while
preserving completed evidence. Keep resolved history reviewable and label
recorded plan facts separately from action outcomes. Follow all resource
pages during qualification and record live approval, rejection and storage
semantic-review results. Integrate current main and preserve its alert
ordering correction.
Live funded qualification found hidden tool results and misleading action
submission outcomes. Share the result-bearing transcript across stored chat
and product history, render the retained evidence, and distinguish captured
proposals from broker acceptance. Keep review usable while Patrol is paused.
Record Gemini route pricing and exact qualification limits. Integrate current
main and repeat browser proof for the incoming login flow. Approved/rejected
recovery remains unqualified without the development command agent.
The held regression candidate needs an honest forward beta above published 6.4.3-rc.1. Bind only 6.4.4 to release/v6.4 without capturing patch 40 or weakening candidate checks. Exercise the actual release and rehearsal branch-policy shell and retain historical rollback mapping.
Change-source: pulse-maintainer
Keep alert and inventory evidence together after container removal and
restart without rewriting retained events or transferring approval and
operator authority. Resolve exact source identities in the shared store
and preserve event replay idempotency across old and current records.
Verify actual retained homelab events, registered tool reads, lifecycle
callbacks, tenant isolation, race behaviour and responsive evidence views.
Docker can report tmpfs mounts only in HostConfig.Tmpfs. Preserve those
entries in shared inventory and retain type, options and canonical write
access in diagnostic queries. Configured size is not measured free space.
Record the failed ordinary storage diagnosis and independently verified
recovery without claiming autonomous or installed-collector qualification.
Missing block I/O and container image sizes could become false evidence
for diagnosis. Preserve per-direction counter presence and measured zero
through collection, resource conversion and browser rendering. Separate
new observed history from ambiguous retained disk series without deleting
old rows or changing public metric names.
Keep partial host rates distinct and persist a newly enabled Disk I/O
column across the first preference reload.
Integrate the latest alert, delivery and action-result changes with the
Patrol evidence conversation. Replace the conflicted browser receipt
with current source-bound qualification and fix shared warning-card
wrapping exposed by the intermediate-width check.
Real diagnostic and autonomous action outcome qualification stays open.
Tool-call totals do not establish diagnostic sufficiency. Preserve seed-only
and failed-read conclusions, remove count-based completion instructions from
evidence, and retain configured limits and authority checks.
Keep findings grouped under alerts selectable in the shared review panel so
their investigations and access limits remain available to Assistant.
Readable chart metadata does not prove that the public index serves the OCI-qualified package. Pull through the consumer repository and compare exact bytes before reporting convergence, with offline regression coverage for mismatched, missing and unavailable downloads. Activation and publication authority remain unchanged.
Change-source: pulse-maintainer
The scheduled reconciler can select a preview retry while silently excluding the mutable stable head. Report that concrete continuity debt in the existing log and job summary, without changing retry eligibility, credential containment or publication authority.
Validated with 37 reconciler and 47 release policy tests. New debt assertions fail against the original code; read-only live discovery reports v6.4.1 debt and preserves preview candidate 33674637446.
Change-source: pulse-maintainer
The open publication proposal exposed an earlier additive formatting correction that lacked a Contract-Neutral trailer and therefore could not pass per-commit governance without rewriting reviewed history. Infer neutrality only for immutable commits whose every governed runtime path is byte-for-byte the locked Prettier output of its parent; mixed, unreadable, added, deleted, or non-frontend changes continue to fail closed.
Change-source: pulse-maintainer
Reject mismatched image defaults before packaging; preserve equal and default versions. Reproduced four accepted mismatches before the fix. All 58 focused tests pass; no publication performed.
Change-source: pulse-maintainer
Reproduce draft and unknown publication states reaching the Pages index boundary. Require an explicitly non-draft existing release before uploading, editing or advertising its chart, without implicitly publishing operator drafts.
Exercise the actual publication shell with a fake GitHub CLI and wire its seven retry tests into canonical governance. Existing digest and maturity behaviour remains covered.
Change-source: pulse-maintainer
Fresh stable readback still shows mutable v6.4.1 alongside orphan v6.4.2. Explain forward supersession without deleting historical tags or treating frontier success as release admission. Cover that distinction with a focused recovery regression; publication authority and all existing gates remain unchanged.
Change-source: pulse-maintainer
pulse-triage[bot]