Pulse v6.2.1

✅ Release Asset Validation: PASSED

All release assets have been validated successfully!

Status: Ready for publication ✅
Validated: 2026-08-10 07:56:51 UTC
Workflow: Pulse Release Pipeline #346

Validation Summary

• All required assets present ✓
• Checksums verified ✓
• Version strings correct ✓
• Binary architectures validated ✓

Pulse v6.2.1 Release Notes

v6.2.1 is a stable patch release following v6.2.0. It is promoted through
the emergency hotfix path because it repairs active customer failures in agent
installation and subscription-backed automation, and makes license activation
discoverable on fresh Pulse Pro installs.

Highlights

• Agent download preflight follows redirects and validates final checksum and
  signature headers.
• Agent Doctor recovers stale credentials; subscription-backed Patrol tools use
  strict provider schemas.
• Fresh Pro installs expose activation; compiled Pro builds show commercial
  context outside demo and white-label modes.

Fixed

• Redirecting agent artifact endpoints no longer lose the final response
  headers needed for checksum and signature preflight (#1696).
• Agent Doctor repairs stale local agent credentials through the governed
  recovery flow instead of leaving the agent unable to report.
• Subscription-provider tools no longer send schemas rejected for missing
  strict object-field requirements (#1697).
• New Pro deployments can reach Plans & Billing before activation and keep the
  expected commercial navigation after activation.
• Demo state converges after successful activation instead of retaining stale
  pre-activation presentation.
• The server updates panel labels cached "Up to date" verdicts with the age of
  the check behind them, so a cached result no longer reads as a live comparison
  (#1601).

Upgrade Notes

Use the normal v6 install or update flow for v6.2.1.

This is an emergency hotfix because the agent download issue crosses the
installer/updater risk boundary and causes active customer harm. The governed
release workflow still requires the integrated exact-SHA candidate checks,
immutable artifacts, published-digest verification, and definitive release
verdict.

Windows Unified Agent binaries in v6.2.1 are not Authenticode-signed under a
version-bound release-owner exception while the SignPath Release certificate 2026 CSR remains pending. Windows may therefore display an Unknown Publisher
warning. The immutable candidate manifest, checksums, detached .sig and
.sshsig signatures, and published-digest verification remain required.

The rollback target is v6.2.0. The exact rollback reinstall command is:

./scripts/install.sh --version v6.2.0

The server/mobile decision is no-mobile-impact. No mobile-facing API, Relay,
pairing, approval, push, authentication, or onboarding contract changed, so no
companion build upload or mobile-store rollout is required.

Paid Pulse Pro, Relay, and eligible legacy customers should continue to use the
private download page and private runtime image for paid runtime features.

Installation

Docker (recommended):

docker pull rcourtman/pulse:6.2.1

Docker Compose:
Update your docker-compose.yml to use rcourtman/pulse:6.2.1

See the Installation Guide for complete setup instructions.

Review the Code signing policy for release provenance, approval roles, and signing scope.

Paid Pulse Pro, Relay, and eligible legacy customers: public GitHub release assets and the public rcourtman/pulse Docker image are community builds. They do not include the private Pulse Pro runtime hooks. Use https://pulserelay.pro/download.html with your activation key to get the private Pulse Pro Docker image or Linux/LXC archive.

Promotion Metadata

• Promotion channel: stable
• Candidate stable tag: v6.2.1
• Promoted prerelease tag: n/a
• Rollback target: v6.2.0
• Rollback command: ./scripts/install.sh --version v6.2.0
• Hotfix exception: true
• Hotfix reason: Active v6.2.0 customer harm: agent binary installs can fail checksum preflight after redirects, subscription-backed Patrol rejects strict tool schemas, installed-agent credentials cannot recover, and fresh Pro installs cannot discover license activation.
• Windows Authenticode required: false
• Unsigned Windows exception: true
• Unsigned Windows reason: SignPath Release certificate 2026 CSR remains pending; the release owner accepts unsigned Windows Unified Agent binaries for v6.2.1 with exact-SHA manifest, checksum, detached-signature, published-digest, and Unknown Publisher disclosure controls.