Count all activation marker names before validating their metadata so a malformed duplicate cannot pass the immutable packet boundary. Reproduced acceptance with a valid uploaded marker plus a zero-size pending duplicate; both valid and malformed duplicates now fail before attestation or download.
Validation: 13 focused integrity tests and 46 promotion policy tests pass; bash syntax and git diff checks pass. No publication or deployment performed.
Change-source: pulse-maintainer
Exercise all three reconciliation recovery paths through the mocked transport for accepted and rejected POSTs. Assert rejected submissions raise without emitting a success receipt.
Validation: 30 reconciliation tests and 46 release promotion policy tests pass. No remote mutations performed.
Change-source: pulse-maintainer
The dry-run receipt repair made submitted messages dynamic, hiding the literal
pre-commit renewal contract from canonical governance. Keep submitted and
non-mutating output distinct while spelling each receipt explicitly so the
existing release-policy guard continues to verify the recovery handoff.
Validation: 29 reconciliation tests and 46 release promotion policy tests
pass, including the check that failed on pull request 1904.
Change-source: pulse-maintainer
An outgoing admission refresh could restore platform navigation after an organisation switch. Accept only the latest request response, including when a newer request fails or is still pending. Preserve authoritative successful empty admission and subsequent navigation recovery.
Reproduced at 390px and 1440px; six repaired synthetic full-app browser cases and 59 focused tests pass. Typecheck passes. This does not qualify backend isolation, a released artifact or external alert delivery.
Change-source: pulse-maintainer
Contract-Neutral: Restore existing latest-organisation admission semantics only; no API, entitlement, navigation surface or subsystem contract changes. Focused ordering regressions and desktop/narrow browser proof cover the repair.
A read-only reconciliation of current release debt printed Dispatched despite suppressing the POST. Return submission status from the transport and qualify all three mutation receipts. Preserve retry and containment policy unchanged.
Verified 29 reconciliation and 41 workflow-trust tests; new dry-run regression rejects all three baseline paths. Live --latest --dry-run now reports Would dispatch without mutation.
Change-source: pulse-maintainer
The stable-install smoke body is intentionally workflow_call-only so its read-only continuity caller and draft-capable release caller can supply different explicit token budgets. Treat that exact no-override shape as an auditable permission boundary while continuing to reject independent triggers and job permission overrides.
Validation: 41 workflow-trust tests, repository workflow audit, focused install-smoke contract tests, Python compilation and diff checks pass.
Change-source: pulse-maintainer
Scheduled reconciliation fails when gh api refuses ANSI-bearing Actions logs. Use the dedicated sanitising log reader without disabling terminal protection, preserving private authentication and fail-closed evidence handling. Focused reconciliation and policy tests pass; a read-only live job probe retains failure evidence without ESC bytes.
Change-source: pulse-maintainer
Stable continuity run 33592377446 was rejected before any job ran: its read-only caller invoked a reusable job requesting contents:write. Extract the unchanged smoke execution into a body that inherits the caller budget, keeping the existing draft-capable entry point and its write-level draft GET access. Continuity now calls the shared body directly without broadening its token. Pin the permission boundary in regression coverage; do not relax immutable-release admission.
Change-source: pulse-maintainer
The isolated Coverage fixture cannot establish whether resource-provider and WebSocket replacement preserves application interaction in issue #1869. Exercise the actual shell, scoped paginated resources, windowed Coverage and By date, and the real PBS History drawer with synthetic snapshots. Retain desktop and narrow evidence without claiming a deployed-release or Brave fix.
Change-source: pulse-maintainer
Git tag creation can precede candidate publication, allowing stable promotion before the required observation period. Read the exact published prerelease and fail closed when publication evidence is unavailable. Cover repaired-candidate minor and patch boundaries.
Change-source: pulse-maintainer
Reconcile coverage rows by logical keys before windowing. Isolated Chromium checks at desktop and narrow widths preserve keyboard focus, expanded evidence, route and scroll across replacement HTTP snapshots. Include subsystem completion obligations and a content-bound browser receipt.
Does not qualify the full application scroll-jump report in #1869 or reporter resolution.
Change-source: pulse-maintainer
Issue #1890 reports macOS agent updates stopping because the root group does not exist. Use numeric superuser ownership in the two shared lifecycle writes without relaxing failure handling or the least-privilege group boundary. Add a regression fixture that rejects named root ownership and checks that chown failures still prevent replacement.
Change-source: pulse-maintainer
Reapply the reviewed Go 1.26.8, OCI Helm recovery, and non-login-shell test expectations that later upstream merges accidentally replaced while retaining the corresponding implementations.
Contract-Neutral: test-only reconciliation; no product or runtime behavior changed
Change-source: pulse-maintainer
A published release packet is a customer-visible surface in its own right. Deriving newer published versions only from matching Git refs lets that surface escape continuity validation when the corresponding ref is absent. Evaluate every stable-shaped release record independently and pin the detached-ref case with a regression test.
Change-source: pulse-maintainer
Update the retained canonical Python contract for the upstream wall-clock timeout mechanism and the single complete per-PR audit, while preserving the two-view scheduled audit expectations.\n\nChange-source: pulse-maintainer
Change-source: pulse-maintainer
A failed v6.4.2 release left newer stable-shaped source and public container tags behind after its GitHub Release packet was removed. Extend the scheduled continuity audit across the stable tag and public registry frontier so this partial publication cannot remain hidden behind an older latest release.
Change-source: pulse-maintainer
The security workflow moved to the scoped npm audit retry runner, but its
dependency-policy test still asserted the retired direct invocation. Assert the
checked-in all and production modes so the script suite tests the active
scheduled scan.
Contract-Neutral: test expectation only; scheduled audit behaviour is unchanged
Change-source: pulse-maintainer
The benchmark gate compared five-sample PR results with a cache produced on
another hosted VM. Two unrelated changes failed today while the same main code
passed, and benchstat reports infinite 95% confidence intervals for that sample
size.
Collect ten base and candidate samples on the PR runner in alternating order,
retain both inputs and the comparison, and reject under-sampled verdicts. Keep
non-PR benchmark evidence without the cross-run baseline cache.
Contract-Neutral: CI performance evidence collection only; no product or release contract changes
Change-source: pulse-maintainer
The retry hardening added in #1885 bounded attempts but not time. npm's own
fetch-timeout defaults to five minutes and it retries internally, so three
"attempts" against a hanging advisory endpoint ran for 10m56s on job
100986651307, and a second audit step added 3m36s. The Frontend job was
cancelled 31s into type-check with all 1183 test files already passing, and a
cancelled job reports as a failed required check, so a green run blocked every
pull request. #1888 raised the job timeout to 40 minutes to unblock delivery;
this decides the policy instead.
Each attempt now runs under a hard wall-clock bound and the sequence stops at
a total deadline (60s and 240s by default). npm's internal retry loop is
disabled in favour of this one, since it was the hidden multiplier. The bound
is enforced by a watchdog subshell rather than timeout(1), which is not
present on every developer machine.
What happens when the endpoint stays unreachable is unchanged, because that
split was already right: the run fails when the change touches the dependency
graph and the answer is genuinely unknown, and warns without failing when it
does not, because the graph is then identical to a base commit that already
produced a passing answer. Any advisory at any severity still fails.
Also drops the production-only audit from the per-pull-request path. It audits
a subset of the same packages, so it reports a subset of the same advisories,
and because the complete audit fails the job on any finding, the production
step could only ever execute in the cases where it was already guaranteed
clean. The dev-versus-production split still runs for every npm workspace in
the scheduled security-scan job, where it informs rather than blocks delivery,
and Dependabot security updates remain the route for advisories published
against unchanged dependencies.
With the audit bounded to 4 minutes against an ~11 minute baseline, the job
timeout returns to 30: a stalled endpoint should surface as a warning, not be
absorbed by a budget large enough to hide it.
Replace the remaining Node 20 action pins before GitHub removes that runtime, and make the reviewed Node 24 pins a workflow trust invariant.
Change-source: pulse-maintainer
Retire the unused self-hosted live qualification workflow and reject future secret- or write-capable jobs on persistent or dynamically selected runners. Keep live Patrol qualification as a disposable lab operation.
Change-source: pulse-maintainer
On 2026-09-03 registry.npmjs.org returned 503s and then timeouts from its
bulk advisory endpoint for over an hour. `npm audit` exits non-zero both
for a real advisory and for an endpoint it cannot reach, so the Frontend
job failed four times running and, because it is a required check, no
pull request could land at all - including Go-only ones that touch no
JavaScript. Every one of those failures was the outage. In two of the
runs the other audit call in the same job succeeded and reported zero
vulnerabilities.
The audits now run through scripts/npm-audit-retry.sh, which separates
the two cases and does nothing else. A conclusive result is acted on
immediately, and the gate stays exactly as strict as before: any
vulnerability at any severity still fails, and no severity threshold is
introduced. Only an unreachable endpoint is retried, with backoff.
When retries are exhausted the outcome depends on whether the answer is
actually unknown. A change that touches frontend-modern/package.json,
frontend-modern/package-lock.json, or the runner itself fails, because
the dependency graph moved and no result means no answer. A change that
touches none of them warns and continues, because the graph is then
identical to the base commit that already produced a passing answer.
Advisories published later against unchanged dependencies are what
Dependabot security updates are for, not a per-pull-request audit.
Deliberately not done: relaxing the severity threshold. That was my first
instinct, but the evidence does not support it. None of the four failures
was an advisory, the lockfile reports zero vulnerabilities at every
severity, and a threshold would have weakened the gate without fixing
anything. The contract's rule that audit suppression is not a valid
closure stands.
The pinning test now requires the runner's invocation and the dependency
detection wiring, and additionally asserts the runner carries no
--audit-level flag, so the strictness cannot be quietly traded away
later.
Go 1.26.8 supersedes the prior patch release, so every release builder and local toolchain guard must move together to prevent candidate artifacts from retaining an older compiler and runtime.
Contract-Neutral: toolchain-only patch update; no product or runtime contract changed
Change-source: pulse-maintainer
An unchanged control revision cannot repair release-convergence debt after its
bounded retry budget is spent. Continuing to raise from the scheduled
reconciler only creates a recurring controller failure while the original
failed run already preserves the actionable debt signal.
Treat that exhausted current revision as a stable no-op, but let a newer
control revision dispatch again so repaired controls are not stranded behind
stale attempts.
Contract-Neutral: release-control automation only; no runtime or public API contract changed
Change-source: pulse-maintainer
Move x/crypto to v0.56.0 after the upstream SSH connection deadlock advisories, and keep the local dependency-floor check from accepting a downgrade.
Contract-Neutral: dependency-only security floor update; no runtime contract changed
Change-source: pulse-maintainer
Retry only explicit registry failures with bounded one-minute attempts while preserving immediate advisory failures. Defer the aggregate audit verdict so frontend tests and builds still report during npm service incidents.
Credential-containment suppression could otherwise hide failed, cancelled, or incomplete public release jobs and strand recoverable convergence debt without an unattended retry. Require complete job evidence and limit suppression to the paid-runtime failure plus its aggregate verdict.
Keep convergence recoverable after short-lived Actions artifacts expire by preserving the exact digest-bound package already verified from GHCR.
Change-source: pulse-maintainer
A committed release with an unchanged operator-owned containment failure cannot converge through unattended retries. Classify that evidence without weakening the block, and rearm only when the relevant private inputs or public controls change.
Change-source: pulse-maintainer
GitHub reruns preserve the failed workflow SHA, so a repaired convergence control cannot resolve an already committed release. A missed workflow_run event can also leave mutable aliases stranded without another attempt.
Change-source: pulse-maintainer
Integrate the reviewed delivery-trust candidate while preserving commits af0e8f8d39 and 6575ebd928 unchanged in history.
Change-source: pulse-maintainer
Reject job-level permission expansion and unsafe checkout selection in the closed-PR capacity workflow, and report cancellation requests separately from runs that completed during the API race.
Change-source: pulse-maintainer
Cancel queued and running validation workflows for a closed pull request head so obsolete matrices cannot hold the hosted-runner limit and delay required checks. Keep the privileged close hook bound to reviewed default-branch code and cover reopen, branch-reuse, identity, and API-race boundaries.
Change-source: pulse-maintainer
test_staged_root_sourced_doc_with_stale_mirror_fails errored in the
"Script smoke tests & backend build" job on PR #1857 (run 33609703555)
with OSError [Errno 39] Directory not empty: '.git' raised from
TemporaryDirectory cleanup. The test body passed; a background git
process spawned by init/add/commit (auto-gc, fsmonitor, or maintenance)
was still writing under .git when shutil.rmtree ran. The suite passes on
main most of the time and locally, so this is a race, not a logic bug.
Disable gc.auto, core.fsmonitor and maintenance.auto for the throwaway
repos, and point GIT_CONFIG_GLOBAL/GIT_CONFIG_SYSTEM at os.devnull so a
runner's host config cannot re-enable them. Construct both temp
directories with ignore_cleanup_errors=True as a belt-and-braces fallback
so a straggler can never fail a test whose assertions already passed.
Three defects that the v6.4.3-rc.1 cut exposed, each with its contract note
and proof:
1. scripts/release-preflight-worker.sh published the smoke stack on host port
7655 and probed it directly. pulse-dev also hosts the maintainer's dogfood
Pulse instance on 127.0.0.1:7655 and a second instance on 17655, so the
release smoke failed to start after every other stage had passed on the
qualified head. The worker now honours PULSE_RELEASE_PREFLIGHT_E2E_PORT,
otherwise takes the first candidate host port pair it verifies free and
fails fast when none is, probes health and update status on that port, and
hands Playwright the same base URL.
2. .github/workflows/publish-helm-chart.yml resolved the chart version before
checking out the repository, but de41ea1883 made that step call
scripts/write_github_output.py, so every chart publish since failed with
"can't open file". Run 33580123246 hit it after all other staging passed;
the checkout now precedes the resolver.
3. docs/release-control/control_plane.json maps the 6.4.3 version prefix to
release/v6.4. Run 33579042375, dispatched from main, failed inside the
compiler dispatch because main advanced one minute after the pipeline
pinned its source SHA; with pull requests landing every few minutes a
candidate cannot hold its SHA between prepare and compile. release/v6.4
was created from main at the exact-SHA-qualified commit 56e51e622e and
carries these same fixes; v6.4.3-rc.1 published from it.
The deployment-installability contract records the worker port and toolchain
rules and the Helm checkout order; release_preflight_test.py and
build_release_assets_test.go pin them.
Rootful evidence must reject non-running systemd states and prove no unrelated container runtime survives. Require exact manager state, mask distro containerd, recheck readiness after scenarios, and remove the complete Podman socket boundary.
The disposable host reached multi-user.target in a degraded state because distro Podman housekeeping used overlay storage inside the outer container. Mask unused units, force VFS for explicit daemons, and fail closed on systemd unit failures so retained rootful evidence remains trustworthy.
pulse-triage[bot]