rcourtman bc39aa5908 Move demo deploys to the tag:ci-deploy Tailscale client ...

The demo update and recovery workflows still joined the tailnet with
the July 2026 tag:infra OAuth client. That client was revoked on 30
September, when the private repositories moved to narrow clients, and
the public repository was missed. Since then every demo convergence
step has failed with an OAuth 401, so stable releases cannot converge
and the hourly reconcile keeps retrying v6.5.0.

Both workflows now use the TS_CI_DEPLOY_OAUTH_* binding that the
browser update qualification already expects, restricted to
tag:ci-deploy. The tailnet policy already grants that tag SSH to
pulse-relay, the demo host, so no policy change is needed. One narrow
client now serves all three workflows, and the broad tag:infra
identity is gone from this repository.

2026-10-24 13:25:23 +01:00

..

internal

Retire the obsolete governed worktree workflow

2026-10-12 12:18:05 +01:00

action_consumer_manifests.json

build(ci): refresh reviewed GitHub Actions pins

2026-09-20 08:16:44 +01:00

agent_preflight_test.py

Update release control to use main

2026-07-05 15:20:37 +01:00

agent_preflight.py

Add canonical agent preflight gate

2026-03-20 10:23:29 +00:00

ai_runtime_docs_policy_test.py

Describe the Assistant surface as Pulse Mobile chat

2026-10-23 16:10:15 +01:00

browser_verification_guard_test.py

Integrate current workload evidence and merge qualification

2026-10-12 23:07:52 +01:00

browser_verification_guard.py

Integrate current workload evidence and merge qualification

2026-10-12 23:07:52 +01:00

canonical_completion_guard_test.py

Retire the Assistant chat window; alert Investigate runs Patrol

2026-10-23 00:15:04 +01:00

canonical_completion_guard.py

Integrate current workload evidence and merge qualification

2026-10-12 23:07:52 +01:00

canonical_completion_history_test.py

Bind report-intake completion to the corrected source proof

2026-10-04 18:04:59 +01:00

canonical_completion_history.json

Merge main into fix/tenant-scoped-websocket-events

2026-10-17 13:44:52 +01:00

canonical_completion_history.py

fix(governance): restore safe.directory for completion-history clone

2026-09-19 21:38:48 +01:00

capture_release_note_visuals.mjs

Improve release highlights and reusable screenshot evidence

2026-10-15 11:42:25 +01:00

capture_release_note_visuals.test.mjs

Improve release highlights and reusable screenshot evidence

2026-10-15 11:42:25 +01:00

check_github_release_immutability_test.py

Gate release publication on immutable setting

2026-08-29 22:41:04 +01:00

commercial_cancellation_reactivation_proof.py

Restore public release proof entrypoints

2026-03-28 17:35:17 +00:00

commercial_cancellation_reactivation_rehearsal.py

Restore public release proof entrypoints

2026-03-28 17:35:17 +00:00

contract_audit_test.py

Make contract audit tests checkout-independent

2026-08-31 12:26:33 +01:00

contract_audit.py

Restore trustworthy governance signals

2026-08-31 00:55:44 +01:00

control_plane_audit_test.py

Use explicit governance qualification and evidence

2026-10-12 23:48:51 +01:00

control_plane_audit.py

…

control_plane.py

Use explicit governance qualification and evidence

2026-10-12 23:48:51 +01:00

customer_promotion_lease.sh

Keep convergence evidence off sealed releases

2026-09-01 11:38:55 +01:00

dev_runtime_governance_test.py

Build Core E2E test images once per exact workflow run

2026-10-09 22:25:34 +01:00

documentation_currentness_test.py

Restore Patrol's Safe auto-fix and Autopilot modes

2026-10-12 14:13:47 +01:00

format_staged_frontend_test.py

fix(tooling): stop worktree commits from skipping prettier

2026-08-06 21:53:44 +01:00

format_staged_frontend.py

fix(tooling): stop worktree commits from skipping prettier

2026-08-06 21:53:44 +01:00

format_staged_go_test.py

fix(release-control): scrub hook git env in remaining scratch-repo git users

2026-07-17 16:39:17 +01:00

format_staged_go.py

fix(release-control): scrub inherited git env in hook scratch-repo helpers

2026-07-17 15:52:11 +01:00

generate_mobile_compatibility_test.py

Enforce Pulse Mobile compatibility from the core contract

2026-07-22 13:41:09 +01:00

generate_mobile_compatibility.py

Enforce Pulse Mobile compatibility from the core contract

2026-07-22 13:41:09 +01:00

generate_platform_support_backend_module.py

Fix Unraid agent host profile detection

2026-05-08 11:05:14 +01:00

generate_platform_support_frontend_module.py

Correct VMware platform readiness classification

2026-05-22 09:13:29 +01:00

governance_stage_guard_test.py

fix(release-control): scrub hook git env in remaining scratch-repo git users

2026-07-17 16:39:17 +01:00

governance_stage_guard.py

fix(release-control): scrub inherited git env in hook scratch-repo helpers

2026-07-17 15:52:11 +01:00

helm_pages_retry_test.py

Authenticate Helm recovery from immutable release evidence

2026-10-14 15:39:52 +01:00

helm_publish_version_test.py

fix(release): bind Helm application version to chart release

2026-09-05 21:13:23 +01:00

live_runtime_proof_test.py

chore: require live proof for hardware fix claims

2026-08-04 23:57:44 +01:00

live_runtime_proof.py

chore: require live proof for hardware fix claims

2026-08-04 23:57:44 +01:00

mobile_compatibility_test.py

fix(governance): isolate release-control worktree roots

2026-08-08 05:12:07 +01:00

mobile_compatibility.py

Enforce Pulse Mobile compatibility from the core contract

2026-07-22 13:41:09 +01:00

mobile_relay_auth_approvals_proof.py

Restore public release proof entrypoints

2026-03-28 17:35:17 +00:00

mobile_release_gate_test.py

Add mobile impact gate to release dispatch

2026-07-07 18:21:20 +01:00

mobile_release_gate.py

Add mobile impact gate to release dispatch

2026-07-07 18:21:20 +01:00

paid_feature_claims_proof.py

Add paid feature claim proof bundle

2026-04-29 14:18:43 +01:00

proof_entrypoints_test.py

Add paid feature claim proof bundle

2026-04-29 14:18:43 +01:00

pulse_intelligence_gate_test.py

chore: seal Pulse Intelligence release gate

2026-07-13 01:14:19 +01:00

pulse_intelligence_gate.py

chore: seal Pulse Intelligence release gate

2026-07-13 01:14:19 +01:00

readiness_assertion_guard_test.py

fix(release-control): scrub hook git env in remaining scratch-repo git users

2026-07-17 16:39:17 +01:00

readiness_assertion_guard.py

Converge UI primitives and readiness guards

2026-06-13 16:31:52 +01:00

reconcile_release_convergence_test.py

Treat a deleted convergence owner as terminal

2026-10-24 11:40:23 +01:00

reconcile_release_convergence.py

Treat a deleted convergence owner as terminal

2026-10-24 11:40:23 +01:00

record_rc_to_ga_blocked.py

Prepare v6.0.0-rc.4 release packet

2026-05-05 15:32:32 +01:00

record_rc_to_ga_rehearsal.py

Govern RC-to-GA rehearsal record capture

2026-04-11 14:08:57 +01:00

registry_audit_test.py

Finish moving the last bespoke drawers onto the shared shape

2026-10-22 16:35:11 +01:00

registry_audit.py

Require empty subsystem default proof lists the guard never reads

2026-10-05 13:50:34 +01:00

rehearsal_source_test.py

Match watchdog Git fixtures to the checkout ignore policy

2026-10-01 03:05:17 +01:00

relay_registration_reconnect_drain_proof.py

Restore public release proof entrypoints

2026-03-28 17:35:17 +00:00

release_candidate_manifest_test.py

Enforce exact release visual assets

2026-08-29 02:59:47 +01:00

release_continuity_test.py

docs(release): clarify combined continuity incident recovery

2026-09-05 20:12:48 +01:00

release_continuity.py

Check release inventory independently of Git refs

2026-09-04 15:01:51 +01:00

release_note_visuals_test.py

Improve release highlights and reusable screenshot evidence

2026-10-15 11:42:25 +01:00

release_note_visuals.py

Improve release highlights and reusable screenshot evidence

2026-10-15 11:42:25 +01:00

release_promotion_policy_support_test.py

fix(ci): qualify grouped release action pin consumers

2026-09-10 00:35:47 +01:00

release_promotion_policy_support.py

Govern RC-to-GA rehearsal record capture

2026-04-11 14:08:57 +01:00

release_promotion_policy_test.py

Move demo deploys to the tag:ci-deploy Tailscale client

2026-10-24 13:25:23 +01:00

release_snapshot_test.py

Publish reviewed release snapshots independently of branch tips

2026-09-07 19:30:27 +01:00

release_snapshot.py

Publish reviewed release snapshots independently of branch tips

2026-09-07 19:30:27 +01:00

render_release_body_test.py

Keep Mobile compatibility explicit beside its retirement notice

2026-10-13 01:27:42 +01:00

render_release_body.py

Point release pages at GitHub's comparison with a Source comparison section

2026-10-13 00:20:18 +01:00

repo_file_io_test.py

Read the guard's registry and contracts from the evaluated commit

2026-10-05 10:04:06 +01:00

repo_file_io.py

Integrate current workload evidence and merge qualification

2026-10-12 23:07:52 +01:00

resolve_release_promotion_test.py

Describe releases as the fixed release train everywhere

2026-10-06 12:06:18 +01:00

resolve_release_promotion.py

Describe releases as the fixed release train everywhere

2026-10-06 12:06:18 +01:00

secure_runtime_attestation_test.py

Qualify helper-backed agent update recovery

2026-08-30 21:54:46 +01:00

secure_runtime_attestation_v6_test.py

fix(release-control): qualify release-line RCs against their own branch

2026-09-22 04:28:39 +01:00

secure_runtime_attestation_v6.py

fix(release-control): qualify release-line RCs against their own branch

2026-09-22 04:28:39 +01:00

secure_runtime_attestation_v7_test.py

Add rootful Docker secure-runtime qualification

2026-08-31 18:13:22 +01:00

secure_runtime_attestation_v7.py

Add rootful Docker secure-runtime qualification

2026-08-31 18:13:22 +01:00

secure_runtime_attestation.py

Qualify helper-backed agent update recovery

2026-08-30 21:54:46 +01:00

secure_runtime_rootful_attestation_v1_test.py

Bind native-agent frontend tests into installer attestation

2026-10-06 03:40:10 +01:00

secure_runtime_rootful_attestation_v1.py

Fix isolated rootful attester loading

2026-09-02 01:53:48 +01:00

secure_runtime_rootful_source_manifest_v1.json

Bind native-agent frontend tests into installer attestation

2026-10-06 03:40:10 +01:00

secure_runtime_rootless_attestation_v1_test.py

Validate each rootless socket identity

2026-09-01 21:26:49 +01:00

secure_runtime_rootless_attestation_v1.py

Validate each rootless socket identity

2026-09-01 21:26:49 +01:00

secure_runtime_rootless_source_manifest_v1.json

Add rootless runtime qualification harness

2026-09-01 12:29:44 +01:00

secure_runtime_source_manifest_v4.json

Integrate typed helper container summaries

2026-08-30 21:29:11 +01:00

secure_runtime_source_manifest_v5.json

Qualify helper-backed agent update recovery

2026-08-30 21:54:46 +01:00

secure_runtime_source_manifest_v6.json

Wire secure runtime RC qualification

2026-08-31 01:50:48 +01:00

secure_runtime_source_manifest_v7.json

Add rootful Docker secure-runtime qualification

2026-08-31 18:13:22 +01:00

ssh_host_key_policy_test.py

fix(security): verify SSH hosts during proxy cleanup

2026-08-08 05:18:55 +01:00

staged_commit_shape_guard_test.py

Use explicit governance qualification and evidence

2026-10-12 23:48:51 +01:00

staged_commit_shape_guard.py

Use explicit governance qualification and evidence

2026-10-12 23:48:51 +01:00

status_audit_test.py

Use explicit governance qualification and evidence

2026-10-12 23:48:51 +01:00

status_audit.py

Use explicit governance qualification and evidence

2026-10-12 23:48:51 +01:00

status_lookup_test.py

Use explicit governance qualification and evidence

2026-10-12 23:48:51 +01:00

status_lookup.py

Use explicit governance qualification and evidence

2026-10-12 23:48:51 +01:00

subsystem_contracts_test.py

Read the guard's registry and contracts from the evaluated commit

2026-10-05 10:04:06 +01:00

subsystem_contracts.py

Read the guard's registry and contracts from the evaluated commit

2026-10-05 10:04:06 +01:00

subsystem_lookup_test.py

Retire the Assistant chat window; alert Investigate runs Patrol

2026-10-23 00:15:04 +01:00

subsystem_lookup.py

fix(governance): isolate release-control worktree roots

2026-08-08 05:12:07 +01:00

validate_artifact_release_line_test.py

Preserve the published 6.4.6 packet's release-line mapping

2026-10-02 21:15:35 +01:00

validate_artifact_release_line.py

Parallelize inert release artifact staging

2026-08-21 18:08:22 +01:00

verify_github_release_integrity_test.py

fix(release): reject ambiguous activation asset inventories

2026-09-05 15:43:23 +01:00

verify_release_container_images_test.py

Retry registry reads when verifying release container images

2026-10-12 12:44:29 +01:00

verify_release_helm_chart_test.py

Recover Helm Pages from attested OCI charts

2026-09-04 01:04:30 +01:00

verify_stable_container_aliases_test.py

Continuously verify stable container aliases

2026-08-30 13:55:41 +01:00

work_claim_test.py

Add governed work-claim tooling

2026-03-19 10:06:39 +00:00

work_claim.py

Add governed work-claim tooling

2026-03-19 10:06:39 +00:00