From 85db074eff7aa487de39d8ebdddd22bbcca62c0d Mon Sep 17 00:00:00 2001 From: rcourtman Date: Sun, 16 Aug 2026 10:35:14 +0100 Subject: [PATCH] copy: simplify security guidance punctuation Contract-Neutral: Punctuation-only copy revision with no lifecycle behavior or contract change --- docs/SECURITY_REVIEW.md | 8 +++--- frontend-modern/browser-verification.json | 27 ++++++++++--------- .../public/docs/SECURITY_REVIEW.md | 8 +++--- .../InfrastructureInstallerSection.tsx | 2 +- .../InfrastructureOperationsModel.test.tsx | 2 +- 5 files changed, 24 insertions(+), 23 deletions(-) diff --git a/docs/SECURITY_REVIEW.md b/docs/SECURITY_REVIEW.md index 20f10e878..4c4c04201 100644 --- a/docs/SECURITY_REVIEW.md +++ b/docs/SECURITY_REVIEW.md @@ -7,10 +7,10 @@ reproducible starting point and makes the intended trust boundaries explicit. Before reviewing the code, read: - [Production Deployment and Security](PRODUCTION_SECURITY.md) for the - least-privilege deployment model and operational checklist; -- the canonical [Security Policy](../SECURITY.md) for reporting and hardening; + least-privilege deployment model and operational checklist. +- The canonical [Security Policy](../SECURITY.md) for reporting and hardening. - [Agent Security](AGENT_SECURITY.md) for root privilege, command execution, - guest access, and update verification; + guest access, and update verification. - [Installation](INSTALL.md) for the signed, version-pinned server installer. ## Suggested review boundaries @@ -115,7 +115,7 @@ Starting points: Review behavior under concurrent reads and writes, stale data, partial platform responses, retention, and large resource sets. Pulse includes simulated -500-node API and metrics-store regression coverage; treat that as reproducible +500-node API and metrics-store regression coverage. Treat that as reproducible engineering evidence, not as a production certification. Starting points: diff --git a/frontend-modern/browser-verification.json b/frontend-modern/browser-verification.json index 864c84363..4d8341df6 100644 --- a/frontend-modern/browser-verification.json +++ b/frontend-modern/browser-verification.json @@ -1,17 +1,17 @@ { "version": 1, - "base_sha": "205df735c7b3864a89cc54d5254f520500f27cfc", - "verified_at": "2026-08-16T10:32:00Z", + "base_sha": "20cd89dcc6db28184ec3083880484dcd35e15970", + "verified_at": "2026-08-16T09:34:36Z", "result": "passed", "changed_paths": [ - "frontend-modern/src/stores/websocket.ts" + "frontend-modern/src/components/Settings/InfrastructureInstallerSection.tsx" ], "content_sha256": { - "frontend-modern/src/stores/websocket.ts": "9d50b11d050466742e592ae74d678b4c6d694495b7e78f805f3a54183dce033b" + "frontend-modern/src/components/Settings/InfrastructureInstallerSection.tsx": "2b2d9fe3abd53a3855d9a60f77f358e10bfd45828a146f98198e5baf06e3dac2" }, "routes": [ - "/", - "/proxmox" + "/settings/infrastructure", + "/settings/infrastructure?add=agent" ], "viewports": [ { @@ -24,14 +24,15 @@ } ], "states": [ - "authenticated shell loaded via admin bypass on the 7655 dev backend through the pulse-sidecar-preview proxy", - "Proxmox overview rendering live node and workload data at desktop viewport", - "Proxmox overview rendering nodes and workloads at mobile viewport after reload", - "REST fallback active because the preview proxy cannot carry WebSocket upgrades (known sidecar-preview limitation)" + "authenticated local development shell with Infrastructure settings loaded", + "Add infrastructure source picker and host installer dialog at desktop width", + "generic agent onboarding guidance at desktop and narrow widths", + "Proxmox API-first recommendation with the revised punctuation and no em dash" ], "interactions": [ - "verified the Vite-served websocket.ts module carries MAX_INBOUND_WEBSOCKET_MESSAGE_BYTES = 32 * 1024 * 1024", - "confirmed the backend accepts a ws upgrade advertising max_message_bytes=33554432 with HTTP 101 via direct handshake against port 7655", - "reloaded after viewport resize so responsive table staging re-ran" + "opened Settings and waited for the Infrastructure workspace to finish loading", + "opened Add infrastructure and selected Install Pulse Agent", + "opened the generic agent onboarding route and read the complete API-first Proxmox guidance", + "confirmed the revised sentence reads No root agent is required for normal platform inventory and metrics" ] } diff --git a/frontend-modern/public/docs/SECURITY_REVIEW.md b/frontend-modern/public/docs/SECURITY_REVIEW.md index 20f10e878..4c4c04201 100644 --- a/frontend-modern/public/docs/SECURITY_REVIEW.md +++ b/frontend-modern/public/docs/SECURITY_REVIEW.md @@ -7,10 +7,10 @@ reproducible starting point and makes the intended trust boundaries explicit. Before reviewing the code, read: - [Production Deployment and Security](PRODUCTION_SECURITY.md) for the - least-privilege deployment model and operational checklist; -- the canonical [Security Policy](../SECURITY.md) for reporting and hardening; + least-privilege deployment model and operational checklist. +- The canonical [Security Policy](../SECURITY.md) for reporting and hardening. - [Agent Security](AGENT_SECURITY.md) for root privilege, command execution, - guest access, and update verification; + guest access, and update verification. - [Installation](INSTALL.md) for the signed, version-pinned server installer. ## Suggested review boundaries @@ -115,7 +115,7 @@ Starting points: Review behavior under concurrent reads and writes, stale data, partial platform responses, retention, and large resource sets. Pulse includes simulated -500-node API and metrics-store regression coverage; treat that as reproducible +500-node API and metrics-store regression coverage. Treat that as reproducible engineering evidence, not as a production certification. Starting points: diff --git a/frontend-modern/src/components/Settings/InfrastructureInstallerSection.tsx b/frontend-modern/src/components/Settings/InfrastructureInstallerSection.tsx index eefb36afc..d53de0402 100644 --- a/frontend-modern/src/components/Settings/InfrastructureInstallerSection.tsx +++ b/frontend-modern/src/components/Settings/InfrastructureInstallerSection.tsx @@ -52,7 +52,7 @@ const INSTALLER_FOCUS_PRESENTATION: Record< 'Install the agent for host-local, Docker, or Kubernetes telemetry. API-backed platforms such as Proxmox start under Platform connections.', recommendationTitle: 'Recommended install model', recommendationDetail: - 'Pulse Agent is a low-overhead background service. It collects node-local telemetry such as CPU, memory, disks, network I/O, temperatures, SMART disk health, services, Docker, and Kubernetes. For Proxmox, start with a dedicated read-only or narrowly scoped API token; no root agent is required for normal platform inventory and metrics. Add the agent only to nodes that need host-local augmentation. Use Availability checks for ping-only or agentless device monitoring.', + 'Pulse Agent is a low-overhead background service. It collects node-local telemetry such as CPU, memory, disks, network I/O, temperatures, SMART disk health, services, Docker, and Kubernetes. For Proxmox, start with a dedicated read-only or narrowly scoped API token. No root agent is required for normal platform inventory and metrics. Add the agent only to nodes that need host-local augmentation. Use Availability checks for ping-only or agentless device monitoring.', preferredProfile: 'auto', platforms: ALL_AGENT_PLATFORMS, }, diff --git a/frontend-modern/src/components/Settings/__tests__/InfrastructureOperationsModel.test.tsx b/frontend-modern/src/components/Settings/__tests__/InfrastructureOperationsModel.test.tsx index a8ac2be63..436504f86 100644 --- a/frontend-modern/src/components/Settings/__tests__/InfrastructureOperationsModel.test.tsx +++ b/frontend-modern/src/components/Settings/__tests__/InfrastructureOperationsModel.test.tsx @@ -211,7 +211,7 @@ describe('infrastructure operations model', () => { 'Adding Proxmox? Start with the API connection.', ); expect(infrastructureInstallerSectionSource).toContain( - 'no root agent is required for normal platform inventory and metrics', + 'No root agent is required for normal platform inventory and metrics', ); expect(infrastructureInstallerSectionSource).toContain( "buildInfrastructureOnboardingPath('pve')",