CorePulse v0.2.4

CorePulse v0.2.4 — packaging maintenance preview

Update the container's bundled kubectl from v1.35.1 to v1.35.10, the current patch in the same minor line verified from the official Kubernetes release endpoint on 9 November. The lab's Kubernetes server is unchanged. Ordinary Linux CI now builds and executes the image with networking disabled and a read-only root filesystem, including CorePulse's version and kubectl's client-only version.

Native archives now contain the project MIT LICENSE and THIRD_PARTY_NOTICES.md with the Go runtime/standard-library license. The image includes both files under /usr/share/licenses/corepulse/. Separately bundled Kubernetes/base components remain under their upstream licenses; this native notice is not a complete container license inventory. Container publication requests an SBOM attestation. Local untracked Claude workspace metadata is excluded from Docker build contexts; its files are untouched.

CorePulse's Go code and evaluation semantics are unchanged from v0.2.3. That preview introduced prospective session declarations, whole-session holdouts and the read-only doctor command. Original cohort limitations and poor AMF results remain visible; no live model-serving or cross-session accuracy claim is added.

The maintained Go 1.27.3 release toolchain, macOS 13 runtime floor and actual packaged-archive execution gates remain in place. Linux amd64, Windows amd64 and macOS arm64 are natively checked before publication; Linux arm64 and Darwin amd64 remain cross-built without native execution claims.

Changes: https://github.com/lazypanic999/CorePulse/blob/v0.2.4/CHANGELOG.md
Native notices: https://github.com/lazypanic999/CorePulse/blob/v0.2.4/THIRD_PARTY_NOTICES.md
Doctor: https://github.com/lazypanic999/CorePulse/blob/v0.2.4/docs/doctor.md
Session guide: https://github.com/lazypanic999/CorePulse/blob/v0.2.4/docs/session-holdouts.md

This is an isolated-lab preview. Verify archives with SHA256SUMS. Container: ghcr.io/lazypanic999/corepulse:v0.2.4.

Post-publication verification (9 November): four downloaded platform archives matched SHA256SUMS. Windows/Linux archives and the network-isolated, read-only-rootfs container passed both synthetic holdout modes. The exact macOS arm64 archive passed hosted execution; both Darwin archives contain LC_UUID and the macOS 13 minimum. Native project/runtime notices match the repository, kubectl reports v1.35.10, and the registry's SPDX 2.3 attestation contains 92 packages with descriptor digests and image subject verified. Image index digest: sha256:687a78132197a399064b22d62478268fb856caecbc3bd1105332bb3c1566f1b8. The published Linux evaluator preserves the original CSV and every fitted parameter, prediction and metric. Govulncheck v1.9.0 reports no known vulnerabilities in the published CorePulse Windows executable. The live dashboard uses v0.2.4 and its post-reset doctor passed all eight checks.

Detailed verification summary. This is maintainer evidence with explicit scope; raw cohort inputs remain local and the SBOM is not a complete license/security certification.