Keep the inherited report-form commit untouched and bind its additive completion to the tree with the actual optional attachment field IDs. The existing real guard still requires the contract and executable verification together; no release or runtime acceptance is asserted.
Change-source: pulse-maintainer
The first exact-source suite reached an erroneous common evidence-field assumption: the bug form uses logs while the prerelease form uses evidence. Verify both real identities and their shared label without changing either form, requiring new diagnostics or weakening the optional-evidence assertion. Retain the original failed proof.
Change-source: pulse-maintainer
Use the existing exact-commit completion registry and exercise its real guard, ancestry and substantive verification requirements. Preserve the original documentation-link commit and the final self-contained forms; no history is rewritten and no completion or release check is weakened.
Change-source: pulse-maintainer
Record self-contained collection and privacy safeguards for installed releases and parse both forms to protect their actual inline advice. This additively supplies the missing deployment-installability contract and accepted verification for the retained documentation-link correction without rewriting reviewed history or changing any runtime safeguard.
Change-source: pulse-maintainer
Merge exact Delivery candidate c5bd6f1d99. Resolve the overlapping test-only repair by retaining the union of existing and candidate read-only admission and billing-write prohibitions. No runtime or frontend changes.
Contract-Neutral: Test-only integration preserves production behaviour and release authority.
Change-source: pulse-maintainer
PR2429 governance run 37161775883 still required the superseded entitlement rewrite after reviewed repair 7d739698 made profile admission read-only. Require the existing demo capability and reject the former integrity removal and billing rewrite instead. Retain runtime-setting, release and recovery guards unchanged.
Contract-Neutral: Test-only integration reconciliation; production billing and release admission are unchanged.
Change-source: pulse-maintainer
PR2429 governance run 37161775883 still requires the removed demo entitlement rewrite and integrity clearing. Require the existing read-only capability gate instead, and reject billing writes or integrity removal. Keep all runtime profile, protected publication and exact-RC controls.
Contract-Neutral: Test-only alignment with the reviewed billing-preserving demo transaction; no runtime, API, deployment authority or release policy delta.
Change-source: pulse-maintainer
Retain reviewed local source and upstream governance exactly. Resolve the retired shared receipt in favour of deletion; historical non-merge receipts remain available in Git.
Contract-Neutral: Integration only; no changed frontend runtime content or product contract.
Change-source: pulse-maintainer
Correct the empty-heading control and retain current signed-archive selection and loss-aware rollback terminal checks. Reviewed runtime commits a2fc29b70b and 227657b1b0 replaced the old installer and unconditional receipt writes; this changes no runtime or release gates.
Contract-Neutral: Test-only alignment with already-reviewed release signing and recovery contracts; no runtime, policy, qualification requirement or public content changes.
Change-source: pulse-maintainer
Align Python preparation with the existing Go reader-facing contract. Accept authored titles with or without the legacy suffix, require exact first-heading identity, and reject malformed headings even when prose repeats the version.
Contract-Neutral: Test-only alignment with the existing release-note identity contract; no runtime, policy, packet, qualification requirement or public content changes.
Change-source: pulse-maintainer
The per-commit receipt change left
frontend-modern/browser-verification.json in the tree, frozen, so that
it would not conflict with the pull requests still rewriting it. Nothing
reads the file at the tip: range mode reads a receipt from the commit
that recorded it. Left in place it invites the old habit and keeps those
pull requests conflicting with each other on it.
The guard now refuses a staged tree or a range tip that carries the
file, rather than only a commit that writes it. Without that, resolving
the modify/delete conflict by keeping the file changes nothing against
HEAD, passes the hook, and restores the file on main when the branch
merges.
A pull request that still rewrites the file is repaired by merging main
and removing the file with git rm. Its commits remain valid evidence in
range mode.
Every commit touching user-visible frontend source rewrote the single
frontend-modern/browser-verification.json, so any two open frontend pull
requests conflicted as soon as either merged. A merge could not repair
the loser: concluding it staged main's frontend files as if the author
had changed them, and the guard then demanded a receipt for files the
author never ran. The only honest recovery was a rebuild on the new main
and a fresh browser pass, as #2415 -> #2418 -> #2433 showed on 2-3
October.
Each commit now adds its own receipt under
frontend-modern/browser-verification/, named by the fingerprint of the
content it verified. Receipts are only ever added, so git merges them
unaided. The guard keeps every binding it had: the commit's own parent,
the exact changed paths and their content digests, a desktop and a
narrow viewport, non-empty routes, states and interactions, and the
range check that each changed file's final content matches a receipt
from a non-merge commit in the range.
Concluding a merge no longer counts content a merged parent already
carries as the commit's own change. Merged content that neither parent
holds is flagged and still needs a follow-up receipt in range mode, and
a merge commit may not record one.
The shared file is retired: no commit may write it again. A commit that
modified it while its own parent still carried it stays valid evidence
in range mode, so a pull request that still rewrites it is repaired by
merging main and taking main's copy rather than by a rebuild. The file
is deleted in a change of its own, because deleting it here would
conflict with every pull request that still rewrites it.
--write-template writes the skeleton at the path the staged content
requires. --prune deletes receipts already on main. A change that
records a receipt may not delete one: git pairs the two as a rename,
which conflicts with any other change deleting the same receipt.
Candidate preflight rejected three path lists that used ASCII or insertion order instead of the registry's case-insensitive order. Sort only those lists and exercise the committed registry in the audit suite so fixture-only passes cannot miss the same mistake.
Contract-Neutral: Canonical registry path-list ordering and regression coverage only; ownership, verification requirements and runtime behaviour are unchanged.
Change-source: pulse-maintainer
The broader release-policy check still expected the removed shell configuration step. Assert its real transaction entry and runtime profile/entitlement preservation while keeping activation, exact stable tag, network and public browser checks unchanged.
Contract-Neutral: Align verification with the already implemented demo transaction; no runtime or authority change.
Change-source: pulse-maintainer
Exercise actual systemd and Caddy with a changed executable, distinct persistent data, delayed synthetic failure, observer loss and TERM during full rollback. Keep 300-second clocks, exact-source and cleanup receipts; no production credential or worker system privilege is added. Update the connected recovery contract and policy assertions, and retain bounded service identity observations.
Change-source: pulse-maintainer
Assert the existing file-level verification receipt so the new routing control exercises real ownership instead of assuming an unavailable summary field.
Contract-Neutral: Test-only assertion of existing subsystem lookup output; no runtime or authority change.
Change-source: pulse-maintainer
Keep new source paths on their own connected proof policy after the full lookup suite exposed six broadened metadata expectations. Preserve terminal no-op cancellation evidence and the runtime file owner.
Contract-Neutral: Correct connected observation and verification routing within the existing demo operations and authority.
Change-source: pulse-maintainer
Convergence used main's unmapped fallback and rejected the immutable 6.4.6-rc.1 source. Retain its exact-version release/v6.4 policy for artifact convergence and promotion without mapping future patches or accepting unrelated source.
Change-source: pulse-maintainer
Governance run 37016171545 rejected the original malformed timestamp even though a later reviewed receipt corrected it for identical runtime bytes. Use the existing fail-closed integration-range guard in CI while retaining per-commit canonical checks. Exercise the workflow shell with valid additive correction and invalid missing-base or unverified-content fixtures.
Change-source: pulse-maintainer
Exact closure validation also identified eleven uncovered package roots pulled into the install-test binary. Bind their Go/template inputs without changing runtime or relaxing the attestation assertions.
Contract-Neutral: Additive source-manifest coverage only; no runtime or subsystem contract change.
Change-source: pulse-maintainer
Include the four current install-test inputs omitted from the rootful source manifest and report exact missing paths on future drift. Product and qualification assertions are unchanged.
Contract-Neutral: Additive qualification source closure and diagnostic-only assertion message; no runtime or subsystem contract change.
Change-source: pulse-maintainer
First step of the release simplification plan. create-release.yml loses
candidate_qualification and release_readiness, which only restated other
jobs' results. Their exact predicates move into publish_release_tag,
publish_docker, publish_helm_chart, activate_release and
release_commit_verdict, with cancellation unchanged.
recover-release-activation accepts both run shapes, so v6.4.6 and older
runs recover exactly as before. Failure-only diagnostics and the chart
artifact nobody downloads keep 3 days instead of 14 or 90. Only lines
cut from main after this land use it (release/v6.6 from 7 Oct). Reviewed
with gpt-6.1-sol, SAFE TO MERGE; predicate equivalence sampled over
2,784 cases.
Completed PR #2379 governance run 36949586647 reached a later subsystem lookup assertion that also omitted the reviewed startup test. Preserve registry coverage and update the remaining stale expectation additively; no runtime or permission change.
Change-source: pulse-maintainer
The first correction exposed the later monitoring-specific assertion in the same test. Align that exact list too, without changing policy or coverage. All 132 governance fixture tests now pass under the confined native-Git fixture executor.
Change-source: pulse-maintainer
PR #2379 governance run 36940673378 failed two exact verification-file assertions after the reviewed startup test was added to the registry. Retain the declared coverage and update both fixture expectations; runtime and accepted commit identities remain unchanged.
Change-source: pulse-maintainer
candidate_qualification and release_readiness only restated other jobs'
results. publish_release_tag, publish_docker, publish_helm_chart and
activate_release now each carry the exact candidate predicate in their own
needs and if, guarded by !cancelled() with the same allowed integration
skip, and activation joins the tag and both registry publications directly.
The commit verdict restates every candidate result in place of the
readiness join.
recover-release-activation.yml accepts both shapes. A source run that has
release_readiness still has to prove only that join, as before. A run
without it has to prove publish_release_tag and at least one, and only
successful, jobs under the publish_docker and publish_helm_chart caller IDs.
Failure diagnostics and the inspection-only Helm chart artifact, which
nothing downloads, are kept for three days instead of 14 and 90.
Exact-source validation found two unbound compiled packages after composing the retained notes repair with current main. Include both in the source manifest and report the whole dependency closure without weakening the check.
Change-source: pulse-maintainer
Bind the new compiled notes helper and authored fixture in the rootful source manifest. Repair the visual rollback fixture's missing version and align the internal control-plane page with the active release-reliability target, without changing source routing or published packets.
Change-source: pulse-maintainer
Bind stable notes to version and operator disclosures rather than obsolete prose. Support bounded grouped customer sections for v6.4.6 and later, align generation and rendering, and preserve published history and all qualification gates.
Change-source: pulse-maintainer
The first exact offline suite passed the metadata cases but the clean-tree assertion saw Python import bytecode because the fixture omitted the real .gitignore. Copy that existing policy into the fixture, retaining the source/no-mutation assertion.
Contract-Neutral: Fixture setup now copies the existing repository ignore policy; runtime and deployment contracts are unchanged.
Change-source: pulse-maintainer
The exact no-mutation watchdog failed at published 6.4.5 because the release line has pending repairs but still declares its stable VERSION. Observe that governed source and its preceding stable reference without inventing a new promotion, while keeping candidate resolver gates unchanged and watchdog artifacts out of promotion-readiness records.
Change-source: pulse-maintainer
Replace two stale schema assertions with explicit watchdog omission and ordinary candidate rollback requirements. The actual workflow admission/source-selection shell tests preserve the fail-closed distinction.
Contract-Neutral: Tests and explanatory comments reflect the already recorded watchdog admission contract; no further runtime contract change.
Change-source: pulse-maintainer
Retain the scheduled governed-source selection and no-mutation demo verdict in a separate fixed dispatch mode. Check its control SHA and candidate-free envelope before checkout, preserve ordinary rehearsal rollback and exact event-source guards, and skip candidate builds.
Change-source: pulse-maintainer
Keep the existing signed installer fallback and require nearby Pulse helper ownership for every install and rollback example, including authored bullets. A distant community-scripts warning must not make an unsafe command publishable.
Change-source: pulse-maintainer
The feedback form forced screenshots into shell code fences and conflated a running container image with a non-container release asset. Preserve rendered attachments, ask for the Pulse image only on running containers, and keep failed-install evidence truthful.
Contract-Neutral: Community issue intake only; release and installation contracts unchanged.
Change-source: pulse-maintainer
The bug and v6 pre-release forms previously required reproduction steps even when a retry could cause a host outage, duplicate update, alert storm or data loss. Ask for the original sequence and safe evidence instead, and mirror the guidance in the public triage document.
Contract-Neutral: Community intake wording only; release and installation contracts unchanged.
Change-source: pulse-maintainer
The maintainer coordinator integrates reviewed candidates by merge onto a
main that keeps moving, then ran this guard once over before..after with
--commit after. That demands one tip receipt whose base_sha is the tip's
parent and whose paths and digests cover the whole cumulative delta. The
tip is a merge and the range carries the candidate plus upstream work that
was verified on its own, so no lane could ever produce that receipt. 13 of
13 coordinator browser-guard rollbacks since 28 September failed on
base_sha for this reason.
Add --base <range-base> for range mode. Every changed user-visible
frontend file's content at the tip must equal a digest recorded by a valid
receipt in a non-merge commit inside the range, and each receipt is
validated as the per-commit guard validates it at its own commit, bound to
that commit's parent and tree. Merge-authored receipts are never evidence,
so a conflict resolution or a later correction that changes frontend
source still needs fresh proof for the final content. Replaying the three
rolled-back 29 September batches from the host passes, and the existing
per-commit and staged modes are unchanged.
The resolver refused a stable promotion until its candidate had soaked for
72 hours, or 168 for a minor. Few installs run previews: 35 of about 7,900
active installs ran v6.4.5-rc.3 in the week to 2026-09-28, so a longer
soak saw little the first day did not, while 75 percent of installs sat on
a stable build a month old. Richard set a 24 hour soak for every release
on 2026-09-28.
The minimums drop to 24 hours for minor and patch alike, the error text
reads the constants instead of repeating numbers, and the workflow and
trigger prompts, the promotion policy and the deployment contract say the
same. The content-drift check and the hotfix exception are unchanged.
The release-promotion guard still expected the old installer-link wording,
so it rejected the corrected helper-ownership and version-pinning guidance.
Separate the installer safety assertions from support-pack coverage and
check the signed fallback, rollback applicability and version verification.
Rejected active-alert writes still reached history, firing events and
notification dispatch. Make admission explicit across detector and restore
paths so repeated suppressed observations cannot create those side effects.
Reconcile restored alerts when persisted resource policy attaches at startup,
reconcile again after native aliases become canonical, and refresh shared
state before those alerts reach clients.
Preserve occurrence identity when retained alerts re-fire, including durable
history reconstruction and delayed lifecycle replay.
Keep retained table and card components mounted when scrolling shifts the
visible window, so policy editors do not lose unsaved state. Show actual
future maintenance times and the paused-attention effect.
Keep synthetic host machine identities stable across restarts so saved
operator policy remains attached during verification.
Qualify server update and rollback instructions by helper ownership, and
stop signed installer recipes before execution if a download or signature
check fails.
Refs #2237
Every stable cut re-pins CANONICAL_DEFAULT_PULSE_VERSION in
scripts/install-docker.sh from the RC to the stable version, and the
stable install-metadata test requires it. The drift allowlist omitted
that file, so no release candidate could be promoted without
hotfix_exception. The rule arrived on 2026-09-01, after v6.4.1, so no
stable promotion has run under it yet. v6.4.5 would be the first to fail.
The installer is shipped content, so the resolver accepts it only when
its diff against the candidate changes nothing but that pin line. Any
other installer change still counts as drift.
Go _test.go files are never compiled into a shipped artifact. A stable
cut can need test-only corrections, as v6.4.5 needs for the RC-derived
install-metadata contract, so they no longer count as unsoaked content.
Tests cover the allowed shapes, the refused near misses, and the pin
check against a real git diff.
Register 8b56fc72e4 with its contract-completion commit so canonical governance evaluates the reviewed Proxmox LXC linked-agent memory runtime change and its monitoring and unified-resources contract sections as one historical unit.
Change-source: pulse-maintainer
The secure-runtime RC qualification workflow (commit 79d87a4a2c) resolves the branch the control plane maps the version to and passes it as --main-ref, but secure_runtime_attestation_v6.verify_canonical_main_identity still required origin/main and required the candidate to be an ancestor of origin/main. Every release-train candidate therefore failed the pre-authentication step before any check ran; v6.4.5-rc.1 failed at 'Pre-authenticate exact qualification packet' with 'committed-main classification requires canonical origin/main' (run 35680955017), and all three historical runs failed.
Accept exactly origin/main or the release train's origin/release/vX.Y, verify the ref against the canonical origin's live branch tip, and check candidate ancestry against that same ref. The release-candidate classification is unchanged. Update the deployment-installability contract and the v6 unit tests, including a mapped-release-branch acceptance case.
Change-source: pulse-maintainer
Register the two #2140 runtime commits with their contract and proof completion commit so the canonical completion guard evaluates each runtime change together with the follow-up that records its contracts and verification artifacts, as one reviewed unit. Registry-only change; no runtime behaviour.
Change-source: pulse-maintainer
Pair the windowed item-height estimate repair (6f0dc177c8) with its contract completion commit (8738eb1bff) so the per-commit canonical guard evaluates them as one reviewed unit.
Change-source: pulse-maintainer
Register the server startup-stall watchdog runtime commit and its shared
follow-up contract/proof commit in the canonical completion history so the
per-commit guard evaluates the pair as one reviewed unit.
Change-source: pulse-maintainer
Integrate the reviewed failed-staging config-backup discard repair (07d54cd345)
with its deployment-installability contract, installtest proof and registered
completion pair (ccfd22da7f, b36e9609dd). The candidate auto-update RETURN-trap
repair (9b004cc787) duplicates the already-integrated 564c235e32, so the merge
keeps the canonical trap implementation and both regression suites and retains
both registry entries. Change-source: pulse-maintainer
Change-source: pulse-maintainer
Register the two update-path runtime commits and their shared follow-up
contract/proof commit in the canonical completion history so the per-commit
guard evaluates each pair as one reviewed unit.
Change-source: pulse-maintainer
pulse-triage[bot]