Commit Graph

1527 Commits

Author SHA1 Message Date
pulse-triage[bot] c10e93943b Parse workflow job trust boundaries structurally
Change-source: pulse-maintainer
2026-09-01 19:46:57 +01:00
pulse-triage[bot] bc301daf5a Merge remote-tracking branch 'origin/main'
Change-source: pulse-maintainer
2026-09-01 19:46:57 +01:00
rcourtman e89eaac9d4 Require VCS metadata in rootless packet builds 2026-09-01 19:37:23 +01:00
pulse-triage[bot] 264ad97302 Merge remote-tracking branch 'origin/main'
Change-source: pulse-maintainer
2026-09-01 19:36:12 +01:00
pulse-triage[bot] 5c26a8f6d1 Close privileged workflow cache audit bypasses
Change-source: pulse-maintainer
2026-09-01 19:31:06 +01:00
pulse-triage[bot] f61815839f Keep unsigned caches out of privileged workflows
Change-source: pulse-maintainer
2026-09-01 19:29:37 +01:00
rcourtman 67dce69e73 Remove safe profile state on uninstall 2026-09-01 19:28:01 +01:00
pulse-triage[bot] e268194305 Merge remote-tracking branch 'origin/main'
Change-source: pulse-maintainer
2026-09-01 19:14:57 +01:00
rcourtman 3d6116d17f Handle unloaded user manager cleanup 2026-09-01 19:08:53 +01:00
pulse-triage[bot] 4219472fdd Merge remote-tracking branch 'origin/main'
Change-source: pulse-maintainer
2026-09-01 19:05:13 +01:00
pulse-triage[bot] aee0ba5594 Merge remote-tracking branch 'origin/main'
Change-source: pulse-maintainer
2026-09-01 19:01:54 +01:00
rcourtman 4db44f7a26 Handle unloaded user manager teardown 2026-09-01 18:59:01 +01:00
rcourtman 5c276d1037 Use portable helper network canary 2026-09-01 18:48:52 +01:00
pulse-triage[bot] b658a8361f Align release policy with safe workflow outputs
Change-source: pulse-maintainer
2026-09-01 18:32:39 +01:00
pulse-triage[bot] 6b5369bbfa Align TrueNAS guidance with JSON-RPC runtime
Change-source: pulse-maintainer
2026-09-01 18:32:39 +01:00
rcourtman 5b47049e3f Exercise ambiguity through typed helper boundary 2026-09-01 18:27:53 +01:00
rcourtman 296d04fffa Make rootless ambiguity proof deterministic 2026-09-01 18:15:20 +01:00
pulse-triage[bot] 4705a18188 Merge remote-tracking branch 'origin/main'
Change-source: pulse-maintainer
2026-09-01 18:06:53 +01:00
rcourtman 0726312e5c Bound rootless ambiguity probe cancellation 2026-09-01 18:00:26 +01:00
pulse-triage[bot] 7d733a666a Merge remote-tracking branch 'origin/main'
Change-source: pulse-maintainer
2026-09-01 17:46:25 +01:00
rcourtman 0e944562e9 Restore telemetry parity after rootless daemon restart 2026-09-01 17:36:08 +01:00
pulse-triage[bot] de41ea1883 Preserve workflow taint across branches
Change-source: pulse-maintainer
2026-09-01 17:34:30 +01:00
rcourtman 6a45460aff Handle collected transient units in rootless qualification 2026-09-01 17:28:05 +01:00
pulse-triage[bot] f8de8b90ce Merge remote-tracking branch 'origin/main'
Change-source: pulse-maintainer
2026-09-01 17:24:14 +01:00
rcourtman 7d7cb44855 Canonicalize rootless telemetry parity hashing 2026-09-01 17:16:30 +01:00
rcourtman bfd53cd7bd Remove privileged helper state on full uninstall 2026-09-01 17:05:49 +01:00
pulse-triage[bot] 8d9b07905c Merge remote-tracking branch 'origin/main'
Change-source: pulse-maintainer
2026-09-01 17:04:10 +01:00
pulse-triage[bot] 7fd93457f1 Harden workflow alias taint tracking
Change-source: pulse-maintainer
2026-09-01 16:58:55 +01:00
rcourtman 69a300827f Model durable collector teardown in rootless qualification 2026-09-01 16:54:50 +01:00
pulse-triage[bot] 4f7a3d0006 Close runner output alias bypasses
Change-source: pulse-maintainer
2026-09-01 16:54:07 +01:00
pulse-triage[bot] 7ead40fe5b Merge remote-tracking branch 'origin/main'
Change-source: pulse-maintainer
2026-09-01 16:54:07 +01:00
rcourtman f44968e6c6 Isolate rootless qualification cgroups 2026-09-01 16:37:11 +01:00
pulse-triage[bot] c55db584c1 Harden GitHub command file data boundaries
Change-source: pulse-maintainer
2026-09-01 16:32:15 +01:00
pulse-triage[bot] c1c0e5c6f1 Merge remote-tracking branch 'origin/main'
Change-source: pulse-maintainer
2026-09-01 16:31:15 +01:00
rcourtman 5e471c1dd5 Use supported rootless Docker qualification networking 2026-09-01 16:25:18 +01:00
rcourtman 63d1aca4c0 Fix rootless qualification packet staging 2026-09-01 16:15:21 +01:00
pulse-triage[bot] 9a5af6ff79 Keep Windows agent update signatures addressable
Change-source: pulse-maintainer
2026-09-01 16:11:04 +01:00
pulse-triage[bot] 91d120ea5d Merge remote-tracking branch 'origin/main'
Change-source: pulse-maintainer
2026-09-01 16:03:53 +01:00
rcourtman 53267e149d Harden least-privilege installer lifecycle state 2026-09-01 15:53:02 +01:00
pulse-triage[bot] 9c307ed1e4 Continuously verify stable installs
Change-source: pulse-maintainer
2026-09-01 15:15:27 +01:00
pulse-triage[bot] 97a39e8819 Block dispatch payload shell injection
Change-source: pulse-maintainer
2026-09-01 14:35:07 +01:00
pulse-triage[bot] 1ef5618190 Verify exact release activation bytes
Change-source: pulse-maintainer
2026-09-01 13:29:06 +01:00
pulse-triage[bot] dc4639460a Bind continuity checks to activation asset bytes
Change-source: pulse-maintainer
2026-09-01 12:47:16 +01:00
pulse-triage[bot] af2fcabe7a Merge remote-tracking branch 'origin/main'
Change-source: pulse-maintainer
2026-09-01 12:47:15 +01:00
rcourtman 11aadbfb1b Add rootless runtime qualification harness 2026-09-01 12:29:44 +01:00
pulse-triage[bot] 168f52972a Expose complete stable release continuity failures
Change-source: pulse-maintainer
2026-09-01 12:26:46 +01:00
rcourtman dcbdf86a80 Keep the docs guard out of the branch-tip link scan
The new commit-time docs-mirror guard carries the forbidden branch-tip
docs URL as a scan constant, and the repo-wide link-drift smoke test
flagged the guard's own source for containing it, failing Script smoke
tests on main. Assemble the constant from parts so the runtime value is
unchanged while the literal never appears in the file. Both the drift
test and the mirror check pass locally at head.
2026-09-01 12:17:00 +01:00
pulse-triage[bot] b766210c02 Align release contract tests with hardened workflows
Change-source: pulse-maintainer
2026-09-01 12:11:50 +01:00
pulse-triage[bot] a34f3c752b Keep convergence evidence off sealed releases
Change-source: pulse-maintainer
2026-09-01 11:38:55 +01:00
rcourtman d28666c396 Guard shipped docs mirror sync at commit time
Docs under frontend-modern/public/docs are byte-for-byte copies of repo
docs, but the only guard was a CI vitest the git hooks never run. On
2026-09-01 two commits (f4886c2dfb, f313882a7b) each edited a mirrored
doc without its copy, passed the hooks, and broke main's Frontend job.

Add scripts/check_docs_mirror.py with an index-blob --staged mode wired
into the pre-commit hook: a commit that stages either side of an
out-of-sync pair (or an orphan shipped copy) fails with the exact sync
command, while pre-existing drift from other commits only warns. The
worktree mode runs as a named step in the public-docs workflow, with
unit tests in scripts/tests picked up by the existing runner. The
docsLinks vitest stays as the CI backstop.

Build-time generation of public/docs was considered and rejected: the
shipped set is a curated subset (61 of 421 docs), so generation still
needs a hand-maintained manifest while adding build, dev-server, and
test-order coupling.
2026-09-01 11:16:05 +01:00