Production SignPath signing requests require manual approval in the
SignPath UI, so the previous single-job flow (submit with
wait-for-completion inside a 40-minute window) let approval latency fail
the Windows build, and any re-run rebuilt the binaries and submitted a
second request needing a second approval.
The Windows lane is now two jobs: sign-windows-agent builds the unsigned
executables, submits the SignPath request without waiting, and uploads a
7-day signing-request record; collect-windows-signing absorbs approval
latency by polling the recorded request, downloads the signed artifact
by request id, and keeps the existing verification and evidence steps.
If approval outlasts the 115-minute polling window, the collection job
fails with re-run guidance and "Re-run failed jobs" collects the same
recorded request - no rebuild, no resubmission. The legacy PFX
break-glass backend rides the same two-job shape via an artifact
hand-off. Workflow output wiring, artifact names, and evidence content
are unchanged for downstream consumers.
The shape test now pins the async invariants (no wait-for-completion:
true in the candidate workflow), and the code signing policy plus the
deployment-installability contract describe the two-phase flow.
TestRepositoryDoesNotClaimTelemetryIsAnonymous flags any 'anonymous'
within 120 characters of 'telemetry' on one line. The MSP evaluation
clause landed in c17664b3d legitimately ends one sentence with
'telemetry' and starts the next with 'Anonymous evaluation', tripping
the scan without claiming telemetry is anonymous. State the same
requirement without the word collision.
Contract-Neutral: wording-only: same clause meaning, avoids telemetry-anonymous guardrail false positive
The reporter-test-image policy named the tag shape and version stamp but
not the build mechanics, so each agent rediscovered them. Name the
hosted_runtime Dockerfile target as the server-only diagnostic image,
warn that BUILD_AGENT=0 does not skip agent artifacts on the default
target, and point at LOCAL_CAPABILITIES.md for the workstation's default
builder.
Refs #1437
Every attention row on every install (and all 38 rows on the public demo)
carried a warning 'Evidence incomplete; timing unavailable' / 'Evidence
timing unavailable' metadata line. Unknown freshness just means the evidence
source publishes no validity window - only availability-poller evidence does
- so it is not an operator-facing warning, and the 'timing unavailable' claim
was false with per-envelope observation times rendered beside it.
- Presentation: the scan row now surfaces an evidence phrase only for states
worth a glance (unavailable, incomplete, stale, or window-backed current);
complete evidence with unknown freshness stays quiet on the row and shows
a muted 'Evidence recorded' badge in the detail, mirroring the existing
unavailable-protection row rule.
- Alerts bridge: provider incidents without a backing availability check now
carry a first-class complete/confirmed envelope derived from the observed
incident payload instead of falling to the legacy partial shim, and each
sync merges the cycle's freshly observed envelopes into the active alert so
raise-time evidence does not age out while the condition is still observed.
Verified live on a scratch mock instance at 1280px and 744px: all 44+ mock
attention rows now project complete evidence and render without the noise
line; detail shows 'Evidence recorded' with per-observation timestamps.
The Up to date verdict on the Pulse server updates panel can come from the
frontend's 24h localStorage cache, but it rendered with no timestamp, so a
day-old verdict read as a live comparison. A user on rc.9 read Up to date
minutes after v6.2.0 published and concluded the updater was broken.
The status cell now carries the age of the check the verdict came from
(Checked 3 hours ago, or Not checked yet when this browser has never
checked). Copy stays in the updatesPresentation owner, the store exposes
lastCheckedAt for the verdict actually displayed, and the line is hidden
for source builds, where checks are disabled.
Refs #1601
The Plans & Billing navigation entry is suppressed for sessions without
commercial context, which hid the only activation-form entry point from
exactly the customers who need it: a fresh Pro install has no license yet,
so hideUpgrade stayed true until the key the customer could not find a
place to paste was pasted. The compiled Pro binary is only distributed
through the paid broker flow, so a Pro-edition session is commercial
context by construction — edition.IsPro() now sets commercialContext in
securityStatusPresentationPolicy.
Ordinary free self-hosted sessions run the community binary and keep the
opt-in default (the edition marker keys off the compiled binary, never
license state). Demo mode and white-label keep full suppression via
hideCommercial, which wins over edition-derived context. Complements
1b9bc9482 (setup-completion activation pointer); together a fresh Pro
install gets both the first-run pointer and a permanently visible
Plans & Billing entry. api-contracts, storage-recovery, and
agent-lifecycle contracts record the policy delta.
A fresh Pro install has no way to discover where its activation key goes:
the Plans & Billing nav entry is navigation-suppressed until a license or
subscription exists (hideWhenUpgradeHidden), which hides the only panel
holding the activation form exactly while the install is unlicensed. A Pro
customer hit this after the broker download flow and emailed support.
The setup completion panel now probes /api/license/runtime-capabilities
and /api/license/status with the setup token and, only when the compiled
Pro build reports no valid license, renders an Activate Pulse Pro card
linking straight to /settings/pulse-intelligence/billing/plan (direct
routes stay reachable by design). Community builds, licensed installs,
and failed probes all keep the card hidden, so the self-hosted opt-in
commercial posture is untouched. The pro-unlicensed preview scenario
keeps browser proof deterministic; strings are localized in EN/DE/ES;
agent-lifecycle, frontend-primitives, and security-privacy contracts
record the new handoff and catalog boundaries.
Pulse Autonomous Maintainer