rcourtman bad8c4fc6b Publish reviewed release snapshots independently of branch tips ...

Continuous development must not change the source of an admitted release.
Allow the workflow to run at the qualified preparation PR head after its
normal merge, verifying exact source and workflow identity, canonical PR
provenance, and ancestry in the governed release line. Later branch commits
remain outside that release. Document the immutable-candidate contract and
verify source workflow compatibility before qualification.

Validation: snapshot identity and workflow contract tests passed, including
wrong-head, wrong-base, fork, unmerged and unbound dispatch rejection. The
existing release workflow promotion policy test also passed.

(cherry picked from commit b64709e7b7)
Change-source: pulse-maintainer

2026-09-07 21:26:02 +01:00

..

dev

…

eval

chore: add evaluation scripts, CI workflow and dev tooling

2026-01-30 19:00:48 +00:00

installtests

Bind release dispatches to the admitted commit

2026-09-07 12:49:23 +01:00

intelligence_lab

Document RG-06 autonomy proof runner

2026-07-13 18:32:56 +01:00

lib

backend and governance: MCP contract, agent capabilities, API, and release-control

2026-06-23 17:26:15 +01:00

lint-fixer

feat: Pulse v6 release

2026-03-18 16:06:30 +00:00

release_control

Publish reviewed release snapshots independently of branch tips

2026-09-07 21:26:02 +01:00

tests

fix(ci): bind benchmark samples to executed binary hashes

2026-09-06 14:31:11 +01:00

.go-version

security(build): advance release toolchain to Go 1.26.7

2026-08-27 05:04:03 +01:00

audit-private-boundary.sh

Ratchet private boundary audit debt

2026-07-29 20:09:23 +01:00

backfill-release-assets.sh

Add historical release asset backfill workflow

2026-04-22 17:25:58 +01:00

BENCHMARK_EVIDENCE.md

fix(ci): bind benchmark samples to executed binary hashes

2026-09-06 14:31:11 +01:00

build-release-binaries.sh

Separate agent remediation runtime

2026-08-29 23:48:28 +01:00

build-release.sh

Keep Windows agent update signatures addressable

2026-09-01 16:11:04 +01:00

build-secure-runtime-qualification.sh

Wire secure runtime RC qualification

2026-08-31 01:50:48 +01:00

bundle.manifest

feat: Pulse v6 release

2026-03-18 16:06:30 +00:00

bundle.sh

feat: add shared script library system and refactor docker-agent installer

2025-10-20 15:13:38 +00:00

capture-release-note-visuals.sh

feat(release): add visual changelog comparisons

2026-08-28 11:29:44 +01:00

check_docs_mirror.py

Keep the docs guard out of the branch-tip link scan

2026-09-01 12:17:00 +01:00

check_public_docs.py

Align TrueNAS guidance with JSON-RPC runtime

2026-09-01 18:32:39 +01:00

check_telemetry_schema_parity.py

Harden Patrol activation telemetry

2026-08-28 11:35:41 +01:00

check_workflow_trust.py

Close mirrored workflow scalar syntax gaps

2026-09-01 22:13:37 +01:00

check-alert-diagnosis-ordering.mjs

fix(alerts): backport delivery diagnosis response ordering

2026-09-06 17:42:51 +01:00

check-alert-dispatch-copy.mjs

fix(alerts): backport truthful dispatch status with qualification

2026-09-06 16:56:17 +01:00

check-assistant-identity.mjs

fix(assistant): backport invocation and evidence identity repair

2026-09-06 12:47:02 +01:00

check-bench-regression.sh

Pair benchmark evidence on one runner

2026-09-06 01:41:01 +01:00

check-delivery-health-ordering.mjs

fix(alerts): backport latest delivery-health request ownership

2026-09-06 01:31:42 +01:00

check-github-release-immutability.sh

Gate release publication on immutable setting

2026-08-29 22:41:04 +01:00

check-overview-health-refresh.mjs

fix(alerts): backport overview unavailable-health refresh

2026-09-06 13:27:33 +01:00

check-workflow-dispatch-inputs.py

fix(release): restore release helper executable bits

2026-03-26 12:26:55 +00:00

clean-mock-alerts.sh

Route mock alert cleanup through managed runtime

2026-03-24 15:49:29 +00:00

cleanup.sh

feat: Pulse v6 release

2026-03-18 16:06:30 +00:00

cloud-backup.sh

feat: Pulse v6 release

2026-03-18 16:06:30 +00:00

com.pulse.hot-dev.plist.template

feat: Pulse v6 release

2026-03-18 16:06:30 +00:00

conformance-smoke.sh

feat: Pulse v6 release

2026-03-18 16:06:30 +00:00

demo_public_browser_smoke.cjs

Use semantic demo connection status

2026-08-29 04:02:06 +01:00

dev-check.sh

Switch script-reference integrity test from rg to git grep for portable CI

2026-05-12 00:30:43 +01:00

dev-deploy-agent.sh

Harden dev agent deploy SSH host verification

2026-04-22 11:41:50 +01:00

dev-launchd-setup.sh

fix(dev): preserve executable launchd wrapper mode

2026-08-27 17:54:10 +01:00

dev-launchd-wrapper.sh

Supervise launchd dev runtime through hot-dev-bg

2026-03-24 15:39:55 +00:00

dev-prepush.sh

fix(governance): align pre-push guard with CI

2026-08-27 17:07:58 +01:00

docker-build.sh

…

ensure_test_assets.sh

feat: Pulse v6 release

2026-03-18 16:06:30 +00:00

exclusive-lock.mjs

feat: Pulse v6 release

2026-03-18 16:06:30 +00:00

generate-pulse-intelligence-docs.go

backend and governance: MCP contract, agent capabilities, API, and release-control

2026-06-23 17:26:15 +01:00

generate-release-notes.sh

Define beta and RC release maturity

2026-08-31 11:42:03 +01:00

generate-self-hosted-feature-catalog.go

Format generated self-hosted feature catalog with prettier in the generator

2026-07-27 11:58:05 +01:00

generate-types.go

feat(assistant): mid-turn steering of the running response

2026-07-12 23:01:40 +01:00

hot-dev-bg.sh

backend and governance: MCP contract, agent capabilities, API, and release-control

2026-06-23 17:26:15 +01:00

hot-dev.sh

Keep hot-dev build temp on the configured Go temp volume

2026-08-31 22:11:38 +01:00

install-container-agent.sh

Restore Docker agents to Hosts inventory

2026-07-23 22:06:56 +01:00

install-docker.sh

chore(release): prepare v6.4.4-beta.1 checkpoint

2026-09-07 10:45:36 +01:00

install-go-toolchain.sh

security(build): advance release toolchain to Go 1.26.7

2026-08-27 05:04:03 +01:00

install-mcp.ps1

Fail closed when installing MCP binaries

2026-08-30 05:11:55 +01:00

install-mcp.sh

Fail closed when installing MCP binaries

2026-08-30 05:11:55 +01:00

install.ps1

Contain agent command authority

2026-08-29 22:12:41 +01:00

install.sh

Fix portable root ownership for installer lifecycle state

2026-09-04 22:46:06 +01:00

package-helm-chart.sh

release: prepare v4.25.0

2025-10-22 10:46:18 +00:00

patrol_e2e_matrix.sh

feat(patrol): implement patrol findings, evaluation, and investigation logic

2026-01-31 16:23:08 +00:00

prepare-release-container-context.sh

Keep Windows agent update signatures addressable

2026-09-01 16:11:04 +01:00

pulse-auto-update.sh

Fix auto-update leaving service down after installer failure

2026-07-27 09:38:37 +01:00

release_asset_common.sh

Keep Windows agent update signatures addressable

2026-09-01 16:11:04 +01:00

release_build_targets.sh

Separate agent remediation runtime

2026-08-29 23:48:28 +01:00

release_candidate_manifest.py

Enforce exact release visual assets

2026-08-29 02:59:47 +01:00

release_ldflags.sh

Require signed unified agent release assets

2026-04-22 02:00:29 +01:00

release_update_key.go

Wire secure runtime RC qualification

2026-08-31 01:50:48 +01:00

release-preflight-worker.sh

fix(release): backport canonical browser workspace identity repair

2026-09-07 08:37:02 +01:00

remerge-parallel.sh

Align v6 release branch governance

2026-03-19 10:18:45 +00:00

render_installers.go

Fix RC3 backend release blockers

2026-05-01 21:36:28 +01:00

repo-boundary-paid-surface.allowlist

Fix companion compatibility CI

2026-07-29 20:09:23 +01:00

repo-boundary-private-implementation.baseline

Ratchet private boundary audit debt

2026-07-29 20:09:23 +01:00

require-safe-gh-attestation.sh

Bind release activation to trusted provenance

2026-08-30 01:51:58 +01:00

run_cloud_public_signup_smoke.sh

Add Pulse Cloud public signup smoke

2026-04-23 23:09:10 +01:00

run_demo_public_browser_smoke.sh

Add public browser smoke proof to demo workflows

2026-04-11 13:50:00 +01:00

run_hosted_staging_smoke.sh

Auto-select hosted staging tenant

2026-04-15 12:23:57 +01:00

run-ci-benchmarks.sh

fix(ci): bind benchmark samples to executed binary hashes

2026-09-06 14:31:11 +01:00

run-native-pve-action-qualification.sh

Add native PVE action qualification harness

2026-09-01 10:43:35 +01:00

run-release-backend-tests.sh

Fix stable release backend partition

2026-08-29 01:15:59 +01:00

run-release-preflight.sh

Accelerate release qualification with exact-SHA worker

2026-08-12 17:07:12 +01:00

run-secure-runtime-rootful-qualification.sh

Harden rootful qualification evidence boundary

2026-09-01 23:53:36 +01:00

run-secure-runtime-rootless-qualification.sh

Give rootless qualification hosts unique identities

2026-09-01 21:18:24 +01:00

security_review_auth_credentials.sh

Make security review baseline fail closed

2026-09-01 01:02:17 +01:00

session-handoff.sh

feat: Pulse v6 release

2026-03-18 16:06:30 +00:00

shard_go_tests.py

Harden release backend cold-run qualification

2026-08-28 03:36:33 +01:00

standalone.manifest

Require immutable attested releases

2026-08-29 19:59:04 +01:00

sync_chart_release_metadata.py

fix(deploy): pin docs links to release refs

2026-03-28 21:32:11 +00:00

sync-production-config.sh

chore: update dev scripts and mock configuration

2026-01-22 22:32:45 +00:00

telemetry_adoption_report.py

Separate notification server errors from rejections

2026-08-29 16:57:44 +01:00

test-vm-disk.sh

…

toggle-mock.sh

Scale large-estate workload and Proxmox demo performance

2026-08-23 15:09:32 +01:00

trigger-release-dry-run.sh

Define beta and RC release maturity

2026-08-31 11:42:03 +01:00

trigger-release.sh

Bind release dispatches to the admitted commit

2026-09-07 12:49:23 +01:00

trigger-stable-patch.sh

Bind release dispatches to the admitted commit

2026-09-07 12:49:23 +01:00

uninstall-sensor-proxy.sh

fix(security): verify SSH hosts during proxy cleanup

2026-08-08 05:18:55 +01:00

validate-published-release.sh

Authenticate every published installer

2026-08-31 04:55:15 +01:00

validate-release.sh

Keep Windows agent update signatures addressable

2026-09-01 16:11:04 +01:00

verify-github-release-integrity.sh

Verify exact release activation bytes

2026-09-01 13:29:06 +01:00

verify-release-container-images.sh

Pin container provenance workflow revision

2026-09-01 09:56:14 +01:00

verify-release-helm-chart.sh

Bind Helm delivery to release provenance

2026-08-30 07:34:56 +01:00

verify-stable-container-aliases.sh

Continuously verify stable container aliases

2026-08-30 13:55:41 +01:00

write_github_output.py

Close runner output alias bypasses

2026-09-01 16:54:07 +01:00