Repair the deterministic PR2768 backend failure after the safe node guide added its ninth request. Exercise that private-file POST alongside the existing recipes without positional method/path assumptions, and reject missing, duplicate or unqualified examples while preserving privacy, trust, one-shot and real deadline controls.
Contract-Neutral: Copied-guidance regression test and synthetic fixture reconciliation only; no runtime, API, TLS, workflow, frontend or shipped documentation contract changes.
Change-source: pulse-maintainer
The completed PR2761 native run spent 243 runner-seconds acquiring and building frontend assets before its deterministic immutable-image source check failed in four Unix jobs. Execute the existing uncached bounded image checks immediately after Go setup, before Node and native runtime work. Keep real frontend assets, exhaustive installer groups, pins, all native gates and their deadlines unchanged; guard order, selection and terminal failures.
Contract-Neutral: Additional early execution of existing immutable-image source assertions only; no public contract, agent runtime/lifecycle, Windows behaviour, image pin, complete-suite coverage, existing gate or deadline changes.
Change-source: pulse-maintainer
Native Unix CI rejects the fixed compose override even though its local default remains digest-pinned. Recognise only that existing override or a literal complete governed pin, with malformed and mutable-default controls. Keep images, producer admission, required gates and deadlines unchanged.
Change-source: pulse-maintainer
The containing macOS Intel job exhausted its ten-minute package alarm with 500 general installer checks while an individual bounded guidance probe was still running. Interleave the complete discovered inventory across two general invocations and keep the reset matrix separate. Preserve exact-once selection, failure propagation, all fixture deadlines and the existing native platform matrix.
Contract-Neutral: Only partitions existing native Unix installer test inventory; runtime behaviour, per-invocation package alarms and fixture safety contracts are unchanged.
Change-source: pulse-maintainer
The shared private-response helper supports DELETE for reviewed RBAC recipes. Its older Go fixture still expected DELETE to stop before curl, failing the containing backend shard and all four native Unix jobs. Exercise unsupported PATCH instead; retain every credential, preparation, request and privacy fence without changing the documented helper.
Contract-Neutral: Test-only correction of a stale unsupported-method control; no runtime, API, installer, guide or frontend behaviour changes.
Change-source: pulse-maintainer
Load the real service-status enum in the mocked Windows SCM controls and check lifecycle statements independently of checkout line endings. Keep Linux-only server installer fixtures on supported Bash and GNU metadata tools within their macOS test step, after native agent runtime testing. Partition the discovered installer inventory so the expanded reset matrix retains its own existing package deadline; preserve every check, failure exit and per-fixture deadline.
Change-source: pulse-maintainer
Contract-Neutral: Native CI fixture environment and inventory repair only; product installers, native lifecycle, safety contracts and fixture deadlines are unchanged.
The complete installer package correctly stopped its old re-entry fixture at unavailable mask evidence. Admit exact unmasked fixture units and record the sole daemon-reload operation instead of depending on a real host manager. Exercise the actual CLI re-entry with both effective runtime masks as well; retain refusal and all assets unchanged.
Contract-Neutral: Confined test admission and CLI coverage only; no installer runtime or subsystem contract change.
Change-source: pulse-maintainer
Reconcile the returned timer-discovery repair: both exact units must have a successful bounded unmasked inventory before shared asset staging. Keep configured, runtime and off-destination persistent masks and all assets unchanged across every installer consumer, explicit setup and sandbox repair. Unknown or failed inventory stops replacement; enabled and disabled refresh remains consent-preserving.
Change-source: pulse-maintainer
The complete installer suite failed because its older guide check still required --ssh-known-hosts after reviewed 953e0c6dec deliberately made cleanup local-only. Check the actual copied command and reject remote scope, purge, account deletion, extra actions and prose-only impostors; preserve all existing bounded/private diagnostic checks.
Contract-Neutral: Test-only reconciliation with the existing local-only guide; no runtime, shipped document, access or cleanup contract change.
Change-source: pulse-maintainer
Match complete systemctl inventory rows by exact unit field with bounded reads, so updates and reinstalls reach the existing helper refresh. Preserve deliberate timer and updater masks instead of replacing their symlinks. Exercise all five installer consumers, unchanged settings and enablement, failure/timeout controls and actual fixture-root systemctl inventory.
Change-source: pulse-maintainer
Keep archive and sidecar downloads in owner-only staging, clean only owned leaves after handled failures and bootstrap exit, and preserve caller-provided inputs. Require the piped LXC installer signature before copying or execution instead of trusting PID-named files in shared tmp.
Exercise the actual download, prefetch and complete container bootstrap through confined offline doubles and real fixture SSH signatures. Preserve version, archive re-verification, staging-before-stop, service recovery, timer consent and removal boundaries; native acceptance remains separate.
Change-source: pulse-maintainer
Use the reviewed server-only selector in the existing-installation menu and bind automatic selection to available channel rows. A current selected release is a no-op; unavailable metadata or an automatic downgrade stops before mutations. Preview selection retains its channel, numeric beta/RC revisions compare correctly, and deliberate reinstall pins the actual current version.
Execute the actual menu through confined offline transport and stopped mutation boundaries. Preserve explicit version, interactive removal, signature and all-unit quiescence contracts; reconcile the inherited comment-only preview assertion with the real selector consumer.
Change-source: pulse-maintainer
Use one complete-metadata selector for installer URLs and server archives. Exclude chart and draft releases, reject unusable metadata and transport bodies, and preserve explicit pins, signed assets and downgrade refusal. Exercise the actual selectors with bounded offline controls and retain native installation as separate acceptance.
Change-source: pulse-maintainer
Contract-Neutral: Restore server-only discovery within existing stable/preview channels; installer authority, signatures, architecture admission, downgrade refusal and state contracts are unchanged.
Repair the candidate preflight failure without changing the PowerShell control tokens or runtime assertions. Validate whitespace across the complete candidate range.
Contract-Neutral: Removes one trailing ASCII space after a closed string literal in an existing test control; no runtime, assertion, coverage or subsystem contract delta.
Change-source: pulse-maintainer
Exercise removal of the actual preflight-to-environment wiring in the native acceptance contract, and accurately count the fourteen adverse structural controls.
Change-source: pulse-maintainer
Reject missing Windows engines and pre-existing or unknown runner state. Independently verify first and repeated uninstall, propagate failed SCM/listener reads, preserve captured machine settings and fail unconfirmed owned server cleanup. Add actual-function controls alongside the unchanged production removal and native-exit checks.
Change-source: pulse-maintainer
Replace suppressed stop/delete failures with bounded SCM stop and absence evidence before replacement or uninstall. Retain binary and agent state on uncertainty, and report incomplete local cleanup. Add production-function failure controls to the existing native Windows test route and pin both destructive callers.
Change-source: pulse-maintainer
Observe every timer, updater and server before mutation; refuse configuration deletion on uncertain quiescence and restore only prior-active servers and recorded timer states. Keep roles independent of accepted custom service names and never replay an interrupted updater. Exercise actual sourced paths and adverse controls. Move existing Windows native-exit assertions unchanged to their registry-named completion file without relaxing checks.
Change-source: pulse-maintainer
Contain destructive installer removal when systemd observation, stop or disable is uncertain. Stop the updater before the server, reconcile default aliases and local legacy units, and preserve files on refusal. Propagate failed legacy-key replacement even in conditional cleanup. Exercise both removal entrypoints and instance isolation in confined fixtures.
Change-source: pulse-maintainer
Preserve Delivery exact candidate 99d7b5e671 and both independently reviewed installability contract sections. The only conflict resolution combines documentation; runtime and verification bytes remain exactly as proved. Retained component suites pass while two enclosing assertions fail, and no native workload recovery is established.
Change-source: pulse-maintainer
Account for every byte in the root-boundary compatibility reader, preserving descriptor-first recovery and rejecting oversized valid prefixes, multiple identities and discarded NULs. Keep the original two-second fixture budget, contain descendant processes and report build/probe timing separately. Add real-agent, legacy and cancellation controls without claiming a cause for the retained timeout.
Change-source: pulse-maintainer
Require stopped-state readback before each LXC mutation, reject failed pct set fallback, preserve snapshot entries and only-prior-active restoration, and return incomplete cleanup without removing recovery files. Add isolated adverse lifecycle and completion controls.
Change-source: pulse-maintainer
Reject successful installers whose replacement cannot identify itself as the target community runtime. VERSION metadata and failed or unrecognised probes cannot establish acceptance; retain the existing verified rollback and prior-active restoration. Exercise the complete locally signed installer transaction and bounded executable read.
Change-source: pulse-maintainer
The installer rereads saved preferences without an explicit selector. Forward the parsed stable default as well as RC, and prove the containing installer's actual channel-selection functions against the same signed fixtures.
Change-source: pulse-maintainer
Stop the generated helper before downloads when saved channel evidence is malformed or unreadable. Preserve explicit selectors, source-marker precedence and signed-installer verification; exercise the actual helper with signed local fixtures.
Change-source: pulse-maintainer
The full installer race suite exposed report deletion despite the subshell-counter guard. Bind EXIT cleanup to the original process using the direct child shell parent PID, including before the inherited counter is initialised. Retain strict and unchanged-graph verdicts, exact arguments and parent cleanup. Align the stale channel-copy assertion with the existing non-stable message; executable consent controls remain unchanged.
Change-source: pulse-maintainer
Require a successful bounded executable identity probe before release discovery. Keep Pro and unknown runtime editions untouched even when VERSION offers a usable community version, and do not defer a broken primary binary to a legacy one. Exercise the real shell classifier and main boundary with adverse controls and a TERM-resistant deadline.
Change-source: pulse-maintainer
A TERM-only timeout relies on the child exiting. Keep a fixed five-second KILL backstop, preserve every timeout as a failure and bind the shell/Go command proofs to the actual bounded invocation.
Contract-Neutral: Internal build timeout containment; source graph, endpoints, checksum trust and artifact acceptance are unchanged.
Change-source: pulse-maintainer
Keep the same pinned Go graph and endpoint. Retry only the observed transport-only diagnostic, at most three attempts; stop on refusals, integrity errors, unknown output, timeouts and signals. Execute the actual Docker download command against controlled outcomes and retain its original-base rejection.
Contract-Neutral: Build-only transport recovery; source graph, endpoints, checksum trust and artifact acceptance are unchanged.
Change-source: pulse-maintainer
The broader installer race/vet VM attempt reached readiness but returned no command verdict at its observation deadline. Keep the same consent cases in the normal installer suite and make their committed file standalone, with only standard-library imports and the actual shell gate. This enables proportionate exact-source Bash regression proof without building unrelated application dependencies; the broader failed attempt remains retained.
Change-source: pulse-maintainer
Text matching admitted truncated configuration, nested opt-in and padded RC channels. Parse one configuration object with the installed jq dependency and fail closed before downloads when consent cannot be verified. Preserve the legacy no-config timer opt-in, manual updates and disabled-timer gate; add executed-shell regression cases and the deployment contract.
Change-source: pulse-maintainer
Admit a prepared executable and source revision before stopping Pulse. Keep the live binary in place until one same-filesystem rename, and restore only a previously active service after a failed rename. Preserve existing recovery files and exercise staging, stop, rename and recovery failures.
Change-source: pulse-maintainer
Reject signature, extraction, architecture, destination staging and version failures before the service outage. Keep the live executable until a same-filesystem rename succeeds, remove the destructive version retry, and recover only a previously active, confirmed-stopped service if rename fails. Exercise the real archive path with download/local inputs and retained byte/mode/state fault controls; preserve uncertain-stop restrictions and separate native acceptance.
Change-source: pulse-maintainer
Archive and source installs ignored stop failures, while the manual flows stopped Pulse before staging. Require bounded state reads and a confirmed inactive service before either replacement; keep prior-active attribution and installed metadata on refusal. Exercise both real paths, timeout and uncertain-state controls, and manual staging failures without native or production mutation.
Change-source: pulse-maintainer
Preserve f2b5080bcc and 580199f07c exactly. Resolve only the shared classifier working-directory comment in favour of main's wording, retaining its compilation assertions and the common checkout-root execution.
Change-source: pulse-maintainer
Completed PR2576 checks exposed a workflow-shell fixture running outside the checkout root, two unformatted test files, and the missing monitoring contract for accepted 26ae5b1aa2. Run the real classifier helper in its actual Actions context and assert Go compilation admission alongside strict dependency-audit decisions. Record collected metadata with empty series and retained-only exclusion without changing runtime or synthesizing samples. All reviewed commit identities remain unchanged; final source proof and exact-head hosted checks remain required.
Change-source: pulse-maintainer
The full committed-source installtests race run source-8gv7x0gy failed all code-bearing classification cases with exit 127: the extracted workflow invokes scripts/go-test-compile-required.sh relative to the checkout, while Go starts tests in scripts/installtests. Match the Actions working directory without stubbing the classifier, weakening strict audit or changing workflow behaviour.
Contract-Neutral: Verification-only working-directory repair; the existing real workflow cases, classifier and strict/inherited audit contract are unchanged.
Change-source: pulse-maintainer
Fail empty, malformed, truncated or substituted test streams even when the producer exits zero. Bind each existing CI shard to its source-derived selected names and package, retaining skips, diagnostics and bounded missing coverage alongside the unchanged timings. Preserve required checks, race/vet execution and timing weights; exercise real Go race JSON and parent failure controls.
Change-source: pulse-maintainer
The native matrix consumes the frontend manifests on every platform and uses their test runtime for Windows PowerShell command acceptance, but its event filters omit graph-only changes. Admit those two exact inputs on both PR and main while leaving UI-only changes and all existing native steps unchanged. Regression controls independently remove each input/event and exclude the graph.
Contract-Neutral: Native CI admission coverage only; installer inputs, runtime behaviour, service authority and recovery contracts are unchanged.
Change-source: pulse-maintainer
Publish failed and unfinished source-test names in the existing shard artifact without waiting for other workflow jobs. Keep logs, timings, test selection and failure exits unchanged; record unknown completion and omitted unsafe or excess identities explicitly. Pin privacy, bounds, pipefail and timing-refresh compatibility, and align the existing shard contract with current compile admission.
Change-source: pulse-maintainer
Compile all race-test binaries without execution only when source, graph, backend embeds or this admission path can affect Go. Preserve required check failures, docs/frontend-only skips and all full runtime/vet and frontend audit checks. Exercise inert and broken fixtures, diff classification and prerequisite propagation.
Change-source: pulse-maintainer
PR2576's deterministic mirror failure admitted expensive frontend, backend and browser work that could not land. Run the existing whole-tree checker before dependency work in the build admission job and all three E2E entrypoints, retaining every existing check, secret scan and test gate. Exercise the actual workflow commands with synced, stale and orphaned guides.
Change-source: pulse-maintainer
The declared 80-case trace reproduced a stopped watchdog running its inherited EXIT cleanup before classification, deleting a captured critical finding. Guard cleanup by Bash subshell ownership, including Bash 3.2, and exercise the actual hook with a deterministic child-exit control and a rejected legacy hook. Retain parent cleanup and every existing audit verdict and deadline.
Contract-Neutral: Repair captured-report lifetime only; advisory classification, strict and inherited verdicts, invocation scope, retry budgets and external permissions remain unchanged.
Change-source: pulse-maintainer
The native workflow did not admit helper/protocol/filesystem/signature-only edits and omitted their suites. Extend its existing Linux jobs with bounded uncached race coverage and an actual helper build, preserving ordinary-user execution and all installed/PVE acceptance boundaries. Regression controls reject missing triggers, platforms, packages and hidden failure.
Contract-Neutral: Native source-verification coverage only; installed helper authority, signed migration, isolation and guest-recovery contracts are unchanged.
Change-source: pulse-maintainer
Two completed PR runs put 24 minutes of overlapping package test time on rest-1 versus 14 on rest-0. Assign whole package binaries deterministically by recorded cost while deriving exhaustive coverage from the checked-out go list. Keep both required check names, every race test, failure propagation and the separate contiguous internal/api shards unchanged.
Contract-Neutral: Rebalance existing CI work only; no runtime, required-check, exhaustive coverage, race-test or dependency-admission contract changes.
Change-source: pulse-maintainer
Close the connected exit-propagation gap in the CI service harness: a version or sc.exe query that prints plausible text but exits nonzero must not become accepted evidence. Check each captured native exit before inspecting the text, retaining the existing checked installer invocation.
The workflow and harness regressions now cover twelve native boundaries. Controlled PowerShell execution remains required by native Windows CI and explicitly unavailable in the offline Linux guest; production installation, service operations and customer acceptance are not inferred.
Contract-Neutral: CI proof verdict propagation only; production agent, installer, service lifecycle and permission contracts are unchanged.
Change-source: pulse-maintainer
PowerShell steps containing multiple native commands only expose the last exit to Actions. Check all agent build/version/self-test and lifecycle build/invocation exits immediately, keeping the original status in the error. A later success can no longer conceal an earlier failure or start lifecycle mutation after a failed build.
The regression validates all seven workflow boundaries, rejects each missing guard and tolerant steps, and runs the actual guards against controlled native exits when PowerShell is available. Windows CI requires that runtime regression; offline Linux explicitly retains the unavailable runtime as a skip.
Contract-Neutral: Native CI verdict propagation only; production agent identity, installer behaviour, service lifecycle and authority are unchanged.
Change-source: pulse-maintainer
Consume the full change list so an early dependency-path match cannot make printf receive SIGPIPE under pipefail and select inherited-advisory warning mode. Exercise the actual workflow classifier and real audit runner with bounded offline controls, including a critical finding; exact paths and existing audit policy stay unchanged.
Contract-Neutral: Repair the existing complete-list classification obligation only; strict dependency paths, inherited-warning policy, audit verdicts, permissions and publication contracts are unchanged.
Change-source: pulse-maintainer
pulse-triage[bot]