Require bounded diagnostic-free service and all-runlevel readback before server removal or local mutation, and reconcile again after remote confirmation while recovery state still exists. Refused stops, disable failures, unknown reads and unexpected init paths retain local material; absent and repeated removal need independent manager/process absence. Add executable confined refusal, ordering, custom-runlevel and timeout-child controls to the registered installer hook and owning contracts. Native OpenRC, Windows, other-manager and installed acceptance remain separate.
Change-source: pulse-maintainer
Run the accepted Unix teardown functions on fresh public Linux x64 and ARM64 CI, with real stop refusal, socket activation, batch reactivation and independent process/file readback. Retain bounded source-bound phase and owned-cleanup receipts; keep synthetic revocation separate from installed TLS, signed-agent and Windows acceptance.
Change-source: pulse-maintainer
Load the production quiescence helpers in the existing failed-revocation fixture and provide complete closed systemd observations. Continue testing the actual revocation refusal after verified stop/disable rather than replacing or bypassing the new safety boundary.
Change-source: pulse-maintainer
Replace ignored stop and disable failures with bounded complete state observations and independent inactive/non-enabled readback. Reconcile helper socket and service together, and quiesce the full uninstall activation set before remote or local mutation. Preserve failed runner revocation material and existing saved-state, token, trust and platform boundaries. Add executable production-shell refusal, reactivation, timeout and owned-cleanup controls.
Change-source: pulse-maintainer
Non-interactive token-file reading currently erases the supplied credential before permission checks and authenticated removal, including when removal is refused or its result is unknown. Treat token-file ingress as read-only: callers own their bootstrap cleanup, and confirmed removal still deletes only authorised runtime state. Keep token validation, TLS policy, exact record confirmation and credential-free local removal unchanged.
Extend the existing portable removal fixture through the actual parser and token ingress, root refusal and post-confirmation owned cleanup. Parent proof records thirty premature-erasure failures; a separate no-TTY harness control remains distinct. Update both owning contracts and the registered Go inventory hook together. Native Windows, compiled TLS and installed whole-job acceptance remain separate.
Change-source: pulse-maintainer
Adapt rcourtman’s Pulse PR2855 (aef53d0d3e), which diagnosed systemd’s silent exit-one absence. The original contributor commit is unchanged and explicitly credited, not imported, amended or re-parented in this maintainer candidate.
One bounded stdout/stderr observation accepts genuine absence but retains failed first reads, other statuses and blank-line output. Include the existing registered installer/updater verification hooks, real-empty-root controls and missing-unit recovery double in this same source commit. This replaces the rejected foreign-history composition with a normal maintainer-reviewed implementation; no provenance policy, credential or host installation changes.
Source-attribution: rcourtman, https://github.com/rcourtman/Pulse/pull/2855, aef53d0d3e
Change-source: pulse-maintainer
Credential-bearing removal currently short-circuits its confirmation gate when connection recovery leaves no URL, allowing local teardown without durably removing the server record. Check credential presence first and stop with same-instance recovery guidance before any process, service or state teardown. Keep credential-free local-only removal and existing exact-record/path authority intact.
Execute the real admission and initial teardown with private transport/service doubles, including every saved credential form, refusal, unknown response, identity mismatch and authorised cleanup. Register the portable Python controls in the installer inventory and describe the boundary in both owning contracts. Native Windows/TLS and whole installed lifecycle acceptance remain separate.
Change-source: pulse-maintainer
Compose the exact observed upstream additively without rewriting reviewed tip 805ea6d712 or any accepted ancestry. The new Go 1.26.9 and x/net graph need matching final-source evidence before this batch can be proposed.
Change-source: pulse-maintainer
govulncheck on the pinned 1.26.8 toolchain reports twelve reachable
standard library vulnerabilities in Pulse (net/http, crypto/tls,
html/template, os, net/textproto), published on 2026-10-08 and fixed in
Go 1.26.9. golang.org/x/net v0.58.0 carries further advisories fixed in
v0.60.0. With 1.26.9 and x/net v0.60.0 the scan reports no affecting
vulnerabilities under both govulncheck v1.1.4 and v1.7.0.
Pulse's own govulncheck job last ran on 2026-10-05, so nothing flagged
this. The private Enterprise build and test job notices it: once the scan
finds reachable advisories it needs more than the 4 GiB CI VM holds, the
guest kernel kills govulncheck, and the job is cancelled. That has failed
every Enterprise pair check since 2026-10-08, including the first
beta's.
Move every release builder and local toolchain guard together, as 1.26.8
did, so no candidate artifact keeps an older compiler: go.mod, the
builder image digests (index digest for 1.26.9-alpine), the release and
dev scripts, the devcontainer, and the root pair diagnostic. Only x/net
is raised in the module graph; go mod tidy is deliberately not run, so
unrelated indirect requirements stay as they were.
Contract-Neutral: Toolchain and indirect dependency patch update that clears reported advisories; no product or runtime contract changed.
Preserve Delivery tip 00680c9c5a exactly in merge ancestry. Resolve the overlapping startup helper to the candidate implementation and retain the canonical diagnostic controls and existing documentation. Frontend test formatting is already present; no runtime UI or workflow changes.
Change-source: pulse-maintainer
Completed PR2825 CI reports Windows Unix-type compilation failures and three Prettier fixture failures. Compile the existing Linux-only MSP daemon fixture only on Linux and format the unchanged frontend assertions. Separate successful CLI stdout from retained stderr diagnostics so Compose warnings cannot corrupt container identities, ports or bootstrap facts; add three executable controls without changing deadlines or acceptance gates.
Change-source: pulse-maintainer
The release train now cuts a beta every two days before the release
candidate. Its first beta, v6.6.0-beta.1, failed its preparation checks
twice: the governance test that maps VERSION to its release packet only
matched -rc.N, and two tests required the release index to say "current
v6 release candidate packet" while the metadata tool writes "current v6
beta packet" for a beta.
Accept -beta.N where the packet paths are derived and derive the expected
index wording from the version. Release candidates and stable releases
are checked exactly as before.
Contract-Neutral: Release metadata tests only; no runtime, API, install or customer contract change.
The refreshed proposal compiles the Linux-only control-plane startup fixture during Windows installer tests, failing on Unix-only dependencies before lifecycle assertions run. Exclude the fixture and its controls at compile time outside Linux, check Go file selection, and preserve required native Windows/macOS execution. Format only the three test files rejected by the exact containing CI, with Prettier AST-equivalence checks; no assertion, timeout, production source or workflow gate changes.
Change-source: pulse-maintainer
The exact-head hosted startup check reaches Docker exec with readback taken from CombinedOutput. Separate stdout from successful stderr warnings for identities, endpoints, mount hashes, bootstrap facts and cleanup, while retaining warnings and both failed-command streams. Add real-child-process controls and the matching deployment acceptance contract; hosted Compose acceptance remains required.
Change-source: pulse-maintainer
The native Unix inventory tests the root installer, unattended updater and their Python service/readback fixtures, but the workflow's event filters omit those inputs. Include each on push and pull_request, preserving all jobs, tools and deadlines. Decode both events in regression controls and reject removal or exclusion of each input.
Contract-Neutral: Native CI admission coverage only; installer/updater behaviour, agent and Windows lifecycle, service authority and recovery contracts are unchanged.
Change-source: pulse-maintainer
Use a counted-NUL shell logger double instead of starting Python for every installer line. Keep production log(), complete pipe draining, all eight first/later/final-error recovery cases and the existing 45-second bound. Require exact argument-frame and failure-sequence controls in the Go acceptance wrapper.
Change-source: pulse-maintainer
Contract-Neutral: Confined installer test fixture optimisation only; production updater, signing, native oracle, recovery matrix and safety deadlines are unchanged.
Preserve the exact Delivery candidate and its parent-bound source proof. The repaired acceptance oracle requires stable managed process identity and independent authenticated executable hashes; portable validation does not establish native or customer recovery.
Change-source: pulse-maintainer
The current native acceptance oracle can return success without a manager observation after comparing running executable bytes. Bracket the comparison with stable active process identity and compare both executables independently to the authenticated fixture, so a changing PID or equally wrong destinations cannot pass. Add required portable drift/refusal controls without changing installer authority or hosted admission.
Change-source: pulse-maintainer
The sourced installer deliberately uses newline/tab IFS. Assert the three Docker arguments separately rather than joining them with the installer's separator. Runtime source and refusal bounds remain unchanged.
Contract-Neutral: Test-only argument-vector assertion repair; no runtime or operator contract changes.
Change-source: pulse-maintainer
Use the same Compose configuration before and after best-effort evaluation issuance. Preserve two-client unsigned evaluation, signed renewal restarts, explicit invalid-file refusal and the Pulse-hosted licence requirement.
Add real release-daemon restart/readback controls and secret-free hosted Compose acceptance for the actual placeholder and licensed mounts.
Change-source: pulse-maintainer
Keep simulated process acceptance explicit in portable discovery and URL controls. Require the running-executable callback to receive the same selected service; refused and prior-inactive URL cases must not invoke it. Actual owned process identity remains covered independently.
Change-source: pulse-maintainer
Contract-Neutral: Portable fixture adapters and assertions only; no change to production acceptance or deployment contract.
Supply the connected manager double's fixed comparator and keep its simulated process readback explicit. Separate mandatory real-sink controls from service-state deadlines without removing cases or extending either 45-second bound.
Change-source: pulse-maintainer
Contract-Neutral: Test fixture correction only; the running-executable acceptance contract added by the parent is unchanged.
An installed target version and active service can conceal an old managed executable. Compare the actual process bytes between complete bounded MainPID observations before accepting an update or restored active service. Retain the backup and current service on uncertainty without an automatic restart or rollback grant. Register real owned-process and conditional transaction controls; keep synthetic/native and customer acceptance distinct.
Change-source: pulse-maintainer
Conditional Bash callers hid a failed logger write behind successful stdout. Attempt both sinks, return the first failed sink, and exercise the unchanged draining collector and recovery path with the real log primitive and confined external logger. Preserve the distinction between observed pipeline completion and native or customer recovery.
Change-source: pulse-maintainer
The exact-source installer suite exposed a result-reader defect: successful unittest methods emit phase markers before their final ok verdict. Retain complete unique method results across that output, reject missing/duplicate/mismatched identities, and keep the required Linux and portable-control verdicts unchanged.
Contract-Neutral: Test-result parsing only; no native fixture, platform admission, signing, installer, updater, recovery or customer contract delta.
Change-source: pulse-maintainer
The source-bound hosted receipt stops before any native phase because its new ephemeral signer is mode 0644. Establish owned regular-file and verified 0600 mode before signing, without adopting existing keys or relaxing OpenSSH. Keep Linux ELF execution in both native Linux jobs; macOS still runs the portable signer/admission/recovery controls, and the bridge requires the exact platform verdict instead of staging Mach-O as Linux.
Change-source: pulse-maintainer
The current macOS CI drops its already provisioned GNU tools inside the connected updater fixture and reaches incompatible BSD tar. Capture only the needed supplied executables and require end-to-end tool use; keep the production harness environment scrubbed. Retain non-secret stage, file metadata and closed diagnostic markers for the actual hosted signer failure, without publishing signer output or inferring its cause.
Contract-Neutral: Confined native CI tool selection and additive non-secret failure observations only; no public installer, updater, signing, service, permission or customer contract changes.
Change-source: pulse-maintainer
Current publisher CI fails both macOS installer controls with FileExistsError during scratch allocation. Allocate and record ownership before the first manager child can initialise HOME, retaining exclusive refusal of pre-existing directories and symlinks. Add discriminating allocation, early-refusal and cleanup controls; no systemd or platform result is manufactured.
Contract-Neutral: Correct disposable CI harness allocation ordering and regression controls; product updater, installer, signing, service and recovery contracts are unchanged.
Change-source: pulse-maintainer
Use the existing BIND_ADDRESS setting in the fixed fixture environment, alongside telemetry opt-out. The connected production-function control verifies this exact private profile and persistence across all seven phases; no product default or native manager safeguard changes.
Contract-Neutral: Fixed local fixture environment only; source/native admission and transaction-completion contracts are unchanged.
Change-source: pulse-maintainer
A Type=simple start may return before exec. Read and hash the managed PID only after the served health/version pass; retain strict active/inactive process readback rather than accepting a launch race.
Contract-Neutral: Native receipt identity and safety contracts are unchanged; this orders the existing readiness and executable observations and rejects inactive residual processes.
Change-source: pulse-maintainer
Keep captured output private to the test process so connected controls reveal a failing setup without uploading native application logs.
Contract-Neutral: Confined fixture diagnostics only; native admission, transaction, signing and bounded receipt contracts are unchanged.
Change-source: pulse-maintainer
Exercise real systemd and signed local current-source replacement/recovery in the existing real-embed job for #2785. Preserve service masks, persistent bytes, backups and owned cleanup; source controls do not claim published or LXC recovery.
Change-source: pulse-maintainer
Drain the installer pipe after a failed log write, retain its first observed failure across later successes and collect an unterminated final line. Reuse the guarded restoration path without changing signed-input, service-state, mask or prior-activity safeguards; bind the regression controls to package acceptance.
Change-source: pulse-maintainer
Terminal native CI 38058763364 reaches unsupported BSD tar --no-overwrite-dir and mv -T in both macOS discovery fixtures. Verify Homebrew GNU tar and coreutils mv and expose them only to the existing Linux server installer test step. Exercise real archive and rename bytes, missing/non-GNU tools, fixed package identities and containing-suite failure propagation; native macOS runtime remains untouched.
Contract-Neutral: Native CI fixture environment repair only; product installers, service-state admission, signatures, recovery, native runtime and safety deadlines are unchanged.
Change-source: pulse-maintainer
Current PR2795 native CI fails on all four Unix runners, and Build rest-0 fails, because the extracted URL fixture omits read_update_service_state. Source the complete helper with bounded confined transport/manager doubles and a real versioned executable fixture. Verify exact paired target URLs, one installer handoff, prior-active/inactive reads and fail-closed refusal before downloads or backup for failed, partial and duplicate observations.
Contract-Neutral: Repair an incomplete updater test fixture against the existing service-state, versioned-installer and restoration contract; no production or contract delta.
Change-source: pulse-maintainer
Use the assets already built in the Frontend job for a read-only backend compile and server/API vet. Require byte-equal embed copies, retain the existing audit/tests/deadline and fail on compiler errors; source controls do not stand in for a containing hosted build.
Change-source: pulse-maintainer
Capture both pipeline statuses before logging overwrites them. Keep recovery, signature and prior-service safeguards unchanged; cover installer, collector, simultaneous and successful observations without attributing a past host interruption.
Change-source: pulse-maintainer
Containing PR2795 CI rejects explicit failure propagation because its old half-removal wiring check requires a bare unit-repair call. Execute both production update paths with genuinely absent config and unit files, confined activation and ownership, and guard failed repair against timer/start/false completion. Keep the installer and unattended recovery runtime unchanged.
Refs: #2785
Change-source: pulse-maintainer
Contract-Neutral: Test-only correction to the existing half-removed update contract; no runtime, workflow, authority or installability behaviour changes.
Read bounded, complete unit state before mutation and confirm inactive state before rollback replacement. Keep the verified backup and stop automatic recovery when service state cannot be reconciled; preserve prior-active restoration, masks, signatures and configuration.
Exercise failed/partial reads, deadlines, no-op stops and restoration through confined production-shell fixtures and the existing signed transaction controls. Fix fixture path and manager observations so registered Go controls execute the actual source.
Refs: #2785
Change-source: pulse-maintainer
The helper selects and passes an explicit service name, bypassing installer discovery. Apply the same bounded exact-unit admission there and preserve its error before any prior-active query, backup, installer call or restart trap. Execute both producers and the real helper handoff in the registered unattended updater proof artifact.
Refs: #2785
Change-source: pulse-maintainer
Consume one bounded inventory of exact historical unit names without early pipe closure. Preserve legacy and explicit-instance selection, and stop replacement, unit creation, reset and removal after unknown inventory even when Bash errexit is disabled. Distinguish this source defect from the unconfirmed cause of the reported LXC stop.
Refs: #2785
Change-source: pulse-maintainer
Repair the deterministic PR2768 backend failure after the safe node guide added its ninth request. Exercise that private-file POST alongside the existing recipes without positional method/path assumptions, and reject missing, duplicate or unqualified examples while preserving privacy, trust, one-shot and real deadline controls.
Contract-Neutral: Copied-guidance regression test and synthetic fixture reconciliation only; no runtime, API, TLS, workflow, frontend or shipped documentation contract changes.
Change-source: pulse-maintainer
The completed PR2761 native run spent 243 runner-seconds acquiring and building frontend assets before its deterministic immutable-image source check failed in four Unix jobs. Execute the existing uncached bounded image checks immediately after Go setup, before Node and native runtime work. Keep real frontend assets, exhaustive installer groups, pins, all native gates and their deadlines unchanged; guard order, selection and terminal failures.
Contract-Neutral: Additional early execution of existing immutable-image source assertions only; no public contract, agent runtime/lifecycle, Windows behaviour, image pin, complete-suite coverage, existing gate or deadline changes.
Change-source: pulse-maintainer
Native Unix CI rejects the fixed compose override even though its local default remains digest-pinned. Recognise only that existing override or a literal complete governed pin, with malformed and mutable-default controls. Keep images, producer admission, required gates and deadlines unchanged.
Change-source: pulse-maintainer
The containing macOS Intel job exhausted its ten-minute package alarm with 500 general installer checks while an individual bounded guidance probe was still running. Interleave the complete discovered inventory across two general invocations and keep the reset matrix separate. Preserve exact-once selection, failure propagation, all fixture deadlines and the existing native platform matrix.
Contract-Neutral: Only partitions existing native Unix installer test inventory; runtime behaviour, per-invocation package alarms and fixture safety contracts are unchanged.
Change-source: pulse-maintainer
The shared private-response helper supports DELETE for reviewed RBAC recipes. Its older Go fixture still expected DELETE to stop before curl, failing the containing backend shard and all four native Unix jobs. Exercise unsupported PATCH instead; retain every credential, preparation, request and privacy fence without changing the documented helper.
Contract-Neutral: Test-only correction of a stale unsupported-method control; no runtime, API, installer, guide or frontend behaviour changes.
Change-source: pulse-maintainer
Load the real service-status enum in the mocked Windows SCM controls and check lifecycle statements independently of checkout line endings. Keep Linux-only server installer fixtures on supported Bash and GNU metadata tools within their macOS test step, after native agent runtime testing. Partition the discovered installer inventory so the expanded reset matrix retains its own existing package deadline; preserve every check, failure exit and per-fixture deadline.
Change-source: pulse-maintainer
Contract-Neutral: Native CI fixture environment and inventory repair only; product installers, native lifecycle, safety contracts and fixture deadlines are unchanged.
The complete installer package correctly stopped its old re-entry fixture at unavailable mask evidence. Admit exact unmasked fixture units and record the sole daemon-reload operation instead of depending on a real host manager. Exercise the actual CLI re-entry with both effective runtime masks as well; retain refusal and all assets unchanged.
Contract-Neutral: Confined test admission and CLI coverage only; no installer runtime or subsystem contract change.
Change-source: pulse-maintainer
Reconcile the returned timer-discovery repair: both exact units must have a successful bounded unmasked inventory before shared asset staging. Keep configured, runtime and off-destination persistent masks and all assets unchanged across every installer consumer, explicit setup and sandbox repair. Unknown or failed inventory stops replacement; enabled and disabled refresh remains consent-preserving.
Change-source: pulse-maintainer
pulse-triage[bot]