Maintenance policy reference#

Pulse uses a machine-readable maintenance policy so repository automation and Codex receive the same scope boundaries. The policy is advisory about product direction and mandatory about process: Codex may analyze, review, and prepare bounded patches, while a human retains architecture, merge, repository-setting, and release authority.

• Policy schema: pulse.maintenance-policy.v2
• Policy version: 6
• Release: 1.0.0-beta.1
• Reviewed: 2026-08-01
• Resident maintainer: Codex
• Merge authority: human-only
• Release authority: human-only
• Protected Codex environment: codex-maintainer
• Codex secret: OPENAI_API_KEY

Protected environments#

Production environments are release-control boundaries. Codex may inspect failures and prepare patches, but it cannot approve an environment, receive production credentials outside the declared job, publish packages, promote documentation, or activate infrastructure.

Change classes#

A normal human code review is still required for every merge. “Separate human decision” means the change also alters scope, architecture, or release authority and must be acknowledged before implementation is treated as approved direction.

Protected boundaries#

Path classification is intentionally conservative. Touching a protected path does not prove that a contract changed; it ensures the pull request names the boundary and receives deliberate review.

Validation catalog#

Portable checks use the normal lockfile-pinned workspace installation and do not require the release-only dependency bundle or external provider credentials. Dependency-bound checks remain required before publication when their affected paths are touched.

Reviewed GitHub Actions#

Every external action used by a checked-in workflow is pinned to a full reviewed commit SHA. The human-readable version is retained as a comment, but tags do not determine execution.

Pull-request declaration#

Every pull request includes a machine-readable Markdown comment with:

<!-- pulse-maintainer-declaration:start -->
Change class: defect
Scope: inside-developer-preview
Protected boundaries: none
Human decision: not-required
<!-- pulse-maintainer-declaration:end -->

The deterministic scope gate compares that declaration with changed paths. It fails only for a missing or contradictory declaration; a correctly declared architecture, scope, or release decision remains visible and relies on CODEOWNER/branch-rule approval rather than pretending an agent can approve it.

Issue intake#

Labels are synchronized by the manual Maintainer labels workflow. Issue labels classify incoming evidence; they do not authorize implementation or widen the Beta contract.

Codex operation#

The repository supports two complementary paths:

1. Native Codex GitHub review can be enabled in Codex settings and follows the nearest AGENTS.md file.
2. The manual Codex maintainer review workflow runs from the protected codex-maintainer environment, uses the policy-specific prompt in a read-only permission profile, validates its output against the generated maintainer-review schema, and posts a structured review to the selected pull request.

Neither path can merge, publish, change repository settings, or approve a protected-boundary decision. The environment secret is released only after the repository owner's configured protection rules pass.