The source-bound hosted receipt stops before any native phase because its new ephemeral signer is mode 0644. Establish owned regular-file and verified 0600 mode before signing, without adopting existing keys or relaxing OpenSSH. Keep Linux ELF execution in both native Linux jobs; macOS still runs the portable signer/admission/recovery controls, and the bridge requires the exact platform verdict instead of staging Mach-O as Linux.
Change-source: pulse-maintainer
The current macOS CI drops its already provisioned GNU tools inside the connected updater fixture and reaches incompatible BSD tar. Capture only the needed supplied executables and require end-to-end tool use; keep the production harness environment scrubbed. Retain non-secret stage, file metadata and closed diagnostic markers for the actual hosted signer failure, without publishing signer output or inferring its cause.
Contract-Neutral: Confined native CI tool selection and additive non-secret failure observations only; no public installer, updater, signing, service, permission or customer contract changes.
Change-source: pulse-maintainer
Retain exact Delivery candidate 8cb66ef0f7. Allocate disposable native-CI scratch before child observation, preserving exclusive refusal and cleanup ownership. Related canonical fixture HOME correction is retained; no product, frontend or infrastructure change.
Change-source: pulse-maintainer
PR2817 completed CI at aebb17c9 with three frontend assertions that still required the superseded static age and TERM-grace log recipe. Assert the accepted shared clock and hard eight-second, 256-KiB bounds instead. Both macOS native-contract jobs also found the lab directory already present at admission; give tool startup an existing owned temporary HOME and require it in the confined manager, keeping NativeLab scratch ownership and cleanup refusal unchanged.
Contract-Neutral: Test-only integration reconciliation; preserve product source, public contracts, production deadlines, scratch admission and safety gates.
Change-source: pulse-maintainer
Current publisher CI fails both macOS installer controls with FileExistsError during scratch allocation. Allocate and record ownership before the first manager child can initialise HOME, retaining exclusive refusal of pre-existing directories and symlinks. Add discriminating allocation, early-refusal and cleanup controls; no systemd or platform result is manufactured.
Contract-Neutral: Correct disposable CI harness allocation ordering and regression controls; product updater, installer, signing, service and recovery contracts are unchanged.
Change-source: pulse-maintainer
Keep outbound telemetry disabled through the process environment, test the expected locked-field refusal, and save only the unrelated notification fields. Assert the lock on restart rather than attempting to persist it.
Contract-Neutral: Correct the CI-only synthetic journey and its controls; product settings, deployment restrictions, permissions and runtime contracts are unchanged.
Change-source: pulse-maintainer
Reuse the real-embed application to verify authenticated live startup, narrow destination admission, monitoring-only token scope, ordinary alert delivery, persisted sessions and saved policy across a real process restart. Keep source/binary identity, single-submission mutation rules and owned child/listener cleanup in a bounded receipt. This prevents component passes from hiding application-path regressions without another build or host capability.
Contract-Neutral: CI-only validation of existing authenticated notification and persistence behaviour; no product, permission, installer or release contract delta.
Change-source: pulse-maintainer
Separate a registered Docker reporting token from the scopes needed by the host module. Keep scope rejection distinct from HTTP 401 and identify the token-generation screen before changing credentials or reinstalling.
Contract-Neutral: Documentation and source-alignment controls only; no authentication, token authority, runtime or install contract changes.
Change-source: pulse-maintainer
A normal-host enrolment report supplies lookup and host-report 401s, repeated installs and an absent inventory record. Document one named server-side registration check before touching the affected agent, with separate limits for persistence, credential hand-off and accepted reports.
Contract-Neutral: Existing authentication help and its source-alignment controls only; no runtime, API, scope, route or credential-policy change.
Change-source: pulse-maintainer
Cap server and agent excerpts at 256 KiB before display or request-ID search. Buffer only a bounded owner-only temporary file, preserve reader failures, and apply the hard deadline to the complete read-only pipeline. Exercise exact-size, overflow, stream, privacy, cleanup and closed-pipe deadline controls without accessing a real journal, daemon or service.
Contract-Neutral: Documentation-only passive log recipe bounds and executable copied-recipe tests; no runtime, API, authentication, installer or monitoring contract change.
Change-source: pulse-maintainer
The latest daily advisory watch passes main and fails only retained release branches, then recommends backports that no longer have a delivery route. Keep the complete strict main audit, read-only/cache-free execution and security proof, remove obsolete line discovery and give accurate main repair and containing-release guidance. Add fixed-main recipe, retired-branch refusal and preserved strict-audit controls.
Change-source: pulse-maintainer
Repair candidate preflight's two registry failures without weakening the audit: declare the native harness as deployment-installability runtime and order its exact dedicated proof paths. Add live-route and adverse drift regression controls, and record canonical ownership in the contract.
Change-source: pulse-maintainer
The checkout label alone cannot establish source bytes after frontend preparation. Require an unchanged tracked tree before compiling the private pair; the exact recipe control now rejects dirty source before either compiler or root command and preserves all existing failure propagation.
Contract-Neutral: Implements existing exact-source admission on tracked bytes; native runtime, input and completion contracts are unchanged.
Change-source: pulse-maintainer
Use the existing BIND_ADDRESS setting in the fixed fixture environment, alongside telemetry opt-out. The connected production-function control verifies this exact private profile and persistence across all seven phases; no product default or native manager safeguard changes.
Contract-Neutral: Fixed local fixture environment only; source/native admission and transaction-completion contracts are unchanged.
Change-source: pulse-maintainer
The unattended source requests LoadState and ActiveState as separate systemctl options; the fixture emitted only the first, and the production parser rightly refused its incomplete observation. Keep the refusal and make the private adapter implement both repeated and comma-separated fixed properties.
Contract-Neutral: Private fixture command-interface correction only; production manager admission and native completion contracts are unchanged.
Change-source: pulse-maintainer
The installer emits its unit in three heredocs: the base, non-default port and safeguards. Relocate all three exact writer commands in the explicit manager control, with counts that reject source drift; the actual native runner continues to use the unchanged system unit writer.
Contract-Neutral: Confined fixture unit-path correction only; native hosted service and safety contracts are unchanged.
Change-source: pulse-maintainer
Discriminate the pre-exec PID from the process serving health/version, changed running bytes, loss of active state after readiness and residual inactive processes without using the host manager or a real listener.
Contract-Neutral: Regression controls only; native updater source and completion contracts are unchanged.
Change-source: pulse-maintainer
A Type=simple start may return before exec. Read and hash the managed PID only after the served health/version pass; retain strict active/inactive process readback rather than accepting a launch race.
Contract-Neutral: Native receipt identity and safety contracts are unchanged; this orders the existing readiness and executable observations and rejects inactive residual processes.
Change-source: pulse-maintainer
The installer source returns before appended function overrides, so the connected control attempted useradd in the unprivileged proof VM and failed before archive staging. Keep the actual create_user function and intercept only exact fixture account/owned-path chown commands through the explicit test adapter.
Contract-Neutral: Confined test adapter correction only; hosted native admission and transaction contracts are unchanged.
Change-source: pulse-maintainer
Keep captured output private to the test process so connected controls reveal a failing setup without uploading native application logs.
Contract-Neutral: Confined fixture diagnostics only; native admission, transaction, signing and bounded receipt contracts are unchanged.
Change-source: pulse-maintainer
Exercise real systemd and signed local current-source replacement/recovery in the existing real-embed job for #2785. Preserve service masks, persistent bytes, backups and owned cleanup; source controls do not claim published or LXC recovery.
Change-source: pulse-maintainer
A completed E2E log read exceeded the enforced eight-million-byte output bound. Keep complete fixed-container stdout/stderr and exact source/run/hash receipts in short-lived artifacts, emit only bounded escaped console tails, and retain nonzero, timed-out and unavailable collection results without suppressing them. Preserve every test tier, retry policy and existing enforcement bound.
Contract-Neutral: CI-only diagnostic retention; product runtime, source-image admission and stable/probation test contracts are unchanged.
Change-source: pulse-maintainer
Drain the installer pipe after a failed log write, retain its first observed failure across later successes and collect an unterminated final line. Reuse the guarded restoration path without changing signed-input, service-state, mask or prior-activity safeguards; bind the regression controls to package acceptance.
Change-source: pulse-maintainer
Terminal native CI 38058763364 reaches unsupported BSD tar --no-overwrite-dir and mv -T in both macOS discovery fixtures. Verify Homebrew GNU tar and coreutils mv and expose them only to the existing Linux server installer test step. Exercise real archive and rename bytes, missing/non-GNU tools, fixed package identities and containing-suite failure propagation; native macOS runtime remains untouched.
Contract-Neutral: Native CI fixture environment repair only; product installers, service-state admission, signatures, recovery, native runtime and safety deadlines are unchanged.
Change-source: pulse-maintainer
Review accepts the exact documentation candidate and its retained focused checks and desktop/phone proof. The separate unqualified memory-reader candidate remains excluded; no authentication or credential-use recovery is inferred.
Contract-Neutral: Existing agent documentation and source-alignment tests only; no runtime, navigation, credential or API changes.
Change-source: pulse-maintainer
The installed token manager is API Access in the Security group, not an API Tokens page, and it displays Created, Last used and Scopes rather than expiry. Keep dual lookup/report rejection separate from a proven cause; preserve credentials and avoid repeating failed installs.
Contract-Neutral: Existing documentation and passive source-alignment checks only; no authentication, credential issuance, agent reporting, navigation or runtime contract changes.
Change-source: pulse-maintainer
Current PR2795 native CI fails on all four Unix runners, and Build rest-0 fails, because the extracted URL fixture omits read_update_service_state. Source the complete helper with bounded confined transport/manager doubles and a real versioned executable fixture. Verify exact paired target URLs, one installer handoff, prior-active/inactive reads and fail-closed refusal before downloads or backup for failed, partial and duplicate observations.
Contract-Neutral: Repair an incomplete updater test fixture against the existing service-state, versioned-installer and restoration contract; no production or contract delta.
Change-source: pulse-maintainer
A TERM-resistant reader can survive the old timeout after its collection shell exits. Apply the eight-second hard deadline to the entire read-only group, buffer the complete sample and withhold raw reader errors on failure. Retain ordinary privileges, unavailable results and no workload mutation.
Contract-Neutral: Documentation and copied-recipe safety verification only; no runtime collection, memory accounting, service lifecycle or API contract changes.
Change-source: pulse-maintainer
Separate the source observation from printf so Bash propagates its failure. The existing same-checkout CI contract is unchanged; test the unavailable-identity case without claiming a compiler result.
Contract-Neutral: Preserve the existing exact-checkout real-embed contract by propagating its Git read failure; no source, graph, permissions, build, audit or deadline contract changes.
Change-source: pulse-maintainer
Use the assets already built in the Frontend job for a read-only backend compile and server/API vet. Require byte-equal embed copies, retain the existing audit/tests/deadline and fail on compiler errors; source controls do not stand in for a containing hosted build.
Change-source: pulse-maintainer
Capture both pipeline statuses before logging overwrites them. Keep recovery, signature and prior-service safeguards unchanged; cover installer, collector, simultaneous and successful observations without attributing a past host interruption.
Change-source: pulse-maintainer
Containing PR2795 CI rejects explicit failure propagation because its old half-removal wiring check requires a bare unit-repair call. Execute both production update paths with genuinely absent config and unit files, confined activation and ownership, and guard failed repair against timer/start/false completion. Keep the installer and unattended recovery runtime unchanged.
Refs: #2785
Change-source: pulse-maintainer
Contract-Neutral: Test-only correction to the existing half-removed update contract; no runtime, workflow, authority or installability behaviour changes.
Accept known-timer containment and preservation of evidence, masks and prior schedule states with retained copied-command and connected documentation controls.
Change-source: pulse-maintainer
Accept exact updater state and rollback guards with retained final-byte component, discovery and smoke evidence; full installtests and installed recovery remain separate follow-through.
Change-source: pulse-maintainer
Keep unattended update containment separate from cancellation, host-stop diagnosis and rollback. Preserve known timer ownership, masks, consent, prior enabled and active states, and the original failure evidence; exercise copied commands with an isolated unit-manager double and a real timeout.
Contract-Neutral: Documentation and confined recipe controls only; no installer, updater, service or recovery runtime behaviour changed.
Change-source: pulse-maintainer
Accept exact candidate 6809ca2b23. Keep attempted upgrades, failing runtimes and later recovery distinct while preserving passive, private evidence collection. No runtime or release outcome is asserted.
Change-source: pulse-maintainer
Read bounded, complete unit state before mutation and confirm inactive state before rollback replacement. Keep the verified backup and stop automatic recovery when service state cannot be reconciled; preserve prior-active restoration, masks, signatures and configuration.
Exercise failed/partial reads, deadlines, no-op stops and restoration through confined production-shell fixtures and the existing signed transaction controls. Fix fixture path and manager observations so registered Go controls execute the actual source.
Refs: #2785
Change-source: pulse-maintainer
Keep the failing runtime, intended release, original updater result, host stop and later recovery separate. Accept unknowns and existing redacted evidence without a repeat update, reboot, restore or loss of rollback backups. Guard both forms and preserve version classification when attempted and recovered versions differ.
Change-source: pulse-maintainer
Contract-Neutral: Community intake guidance and regression tests only; installer, updater, runtime and triage automation contracts are unchanged.
The helper selects and passes an explicit service name, bypassing installer discovery. Apply the same bounded exact-unit admission there and preserve its error before any prior-active query, backup, installer call or restart trap. Execute both producers and the real helper handoff in the registered unattended updater proof artifact.
Refs: #2785
Change-source: pulse-maintainer
Consume one bounded inventory of exact historical unit names without early pipe closure. Preserve legacy and explicit-instance selection, and stop replacement, unit creation, reset and removal after unknown inventory even when Bash errexit is disabled. Distinguish this source defect from the unconfirmed cause of the reported LXC stop.
Refs: #2785
Change-source: pulse-maintainer
Existing forms warn against uploading secrets but stop at prevention. Explain issuer revocation, separate attachment removal, surviving copies, private follow-up and independent monitoring coverage without asking for another diagnostic or credential test.
Change-source: pulse-maintainer
Contract-Neutral: Documentation and guidance coverage only; runtime, API, storage and deployment contracts are unchanged.
The full documentation proof counted all 18 current recipes, including the newly documented standalone action runner removal. Keep the exact inventory assertion and shell parsing rather than retaining the old 17-command expectation.
Contract-Neutral: Test inventory correction for the documented runner-only recipe; no runtime, lifecycle, API or authority behaviour changes.
Change-source: pulse-maintainer
Settings > Assistant offered a Protected guests list (protected_guests)
that was saved and pushed into the Assistant tool executor, but its only
reader was executeControlGuest, which nothing calls. pulse_control plans
through the shared action lifecycle and never consulted the list, so a
guest named in it (by VMID and by name) was planned like any other. The
"legacy" label added in #2765 states that limit; this removes the
setting instead of keeping a field that cannot do its job.
The canonical way to keep Pulse off a resource is its operator lock
(Never auto-remediate, or a Retired lifecycle). It is keyed by canonical
resource id, applies to every platform, and the action lifecycle refuses
dispatch for it even for approved plans. The one gap was planning: the
lifecycle plans without reading operator state, so the Assistant could
leave a plan in Actions that can never run. assistantTypedActionPlanner
now reads the state through the tenant-scoped lifecycle store (the same
read Patrol's broker uses) and declines before Plan, and pulse_control
reports the block with how to clear it. A state that cannot be read does
not refuse planning, because dispatch re-checks.
Removed: AIConfig.ProtectedGuests and its getter, the settings API
field, the executor field/setter/config, the chat service plumbing, the
Settings field and form state, and the legacy copy, pins and prose from
#2765. A stored value still loads (tolerant decode) and is dropped the
next time the settings are written; older PUT bodies that send the key
are ignored. The Settings panel points at the guest's Manage tab.
Preserve exact Delivery candidate 13206d2fa7 and use its fully qualified nine-request catalogue in place of the earlier narrower section-boundary integration fix. Resolve the sole test-file conflict to the candidate bytes already covered by full-package and race source receipts; no frontend resolution or runtime change.
Change-source: pulse-maintainer
Explain evidence loss, saved-state trust, platform differences and partial removal before administrators act. Keep whole-agent removal separate from the Linux action runner, preserve deliberate path protections, and exercise copied commands with bounded synthetic recorders.
Contract-Neutral: Documentation and synthetic source-bound recipe checks only; no runtime, lifecycle, authority, platform or API behaviour changes.
Change-source: pulse-maintainer
pulse-triage[bot]