diff --git a/VERSION b/VERSION index 19b860c18..4c77920fd 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -6.4.0 +6.4.1 diff --git a/deploy/helm/pulse/Chart.yaml b/deploy/helm/pulse/Chart.yaml index 97f482c85..55c64b725 100644 --- a/deploy/helm/pulse/Chart.yaml +++ b/deploy/helm/pulse/Chart.yaml @@ -2,9 +2,9 @@ apiVersion: v2 name: pulse description: Helm chart for deploying the Pulse hub and optional Docker, Kubernetes, or OpenShift monitoring agent. type: application -version: 6.4.0 -appVersion: "6.4.0" -icon: https://raw.githubusercontent.com/rcourtman/Pulse/v6.4.0/docs/images/pulse-logo.svg +version: 6.4.1 +appVersion: "6.4.1" +icon: https://raw.githubusercontent.com/rcourtman/Pulse/v6.4.1/docs/images/pulse-logo.svg keywords: - monitoring - proxmox @@ -32,7 +32,7 @@ annotations: description: Smoke tests with kind cluster deployment artifacthub.io/links: | - name: Documentation - url: https://github.com/rcourtman/Pulse/blob/v6.4.0/docs/KUBERNETES.md + url: https://github.com/rcourtman/Pulse/blob/v6.4.1/docs/KUBERNETES.md - name: Support url: https://github.com/rcourtman/Pulse/discussions artifacthub.io/maintainers: | diff --git a/deploy/helm/pulse/README.md b/deploy/helm/pulse/README.md index 7ddd2f47d..92cfed850 100644 --- a/deploy/helm/pulse/README.md +++ b/deploy/helm/pulse/README.md @@ -1,6 +1,6 @@ # pulse -![Version: 6.4.0](https://img.shields.io/badge/Version-6.4.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 6.4.0](https://img.shields.io/badge/AppVersion-6.4.0-informational?style=flat-square) +![Version: 6.4.1](https://img.shields.io/badge/Version-6.4.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 6.4.1](https://img.shields.io/badge/AppVersion-6.4.1-informational?style=flat-square) Helm chart for deploying the Pulse hub and optional Docker, Kubernetes, or OpenShift monitoring agent. diff --git a/docker-compose.yml b/docker-compose.yml index eb311e15f..0da9ffb16 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -2,7 +2,7 @@ version: '3.8' services: pulse: - image: ${PULSE_IMAGE:-rcourtman/pulse:6.4.0} + image: ${PULSE_IMAGE:-rcourtman/pulse:6.4.1} container_name: pulse restart: unless-stopped logging: diff --git a/docs/RELEASE_NOTES.md b/docs/RELEASE_NOTES.md index f46285855..392bade3f 100644 --- a/docs/RELEASE_NOTES.md +++ b/docs/RELEASE_NOTES.md @@ -7,10 +7,14 @@ For historical v4 notes that previously lived in this repo, see: `docs/releases/RELEASE_NOTES_v4.md` For the current stable v6 packet, see: +- `docs/releases/RELEASE_NOTES_v6.4.1.md` +- `docs/releases/V6_CHANGELOG_v6.4.1.md` + +For the preceding stable v6 packet, see: - `docs/releases/RELEASE_NOTES_v6.4.0.md` - `docs/releases/V6_CHANGELOG_v6.4.0.md` -For the preceding stable v6 packet, see: +For the earlier stable v6 packet, see: - `docs/releases/RELEASE_NOTES_v6.3.2.md` - `docs/releases/V6_CHANGELOG_v6.3.2.md` diff --git a/docs/UPGRADE_v6.md b/docs/UPGRADE_v6.md index 8f69732e5..9d9390a7a 100644 --- a/docs/UPGRADE_v6.md +++ b/docs/UPGRADE_v6.md @@ -4,10 +4,15 @@ This guide covers practical upgrade steps for existing Pulse installs moving to For the current stable v6 packet, see: +- `docs/releases/RELEASE_NOTES_v6.4.1.md` +- `docs/releases/V6_CHANGELOG_v6.4.1.md` + +For the preceding stable v6 packet, see: + - `docs/releases/RELEASE_NOTES_v6.4.0.md` - `docs/releases/V6_CHANGELOG_v6.4.0.md` -For the preceding stable v6 packet, see: +For the earlier stable v6 packet, see: - `docs/releases/RELEASE_NOTES_v6.3.2.md` - `docs/releases/V6_CHANGELOG_v6.3.2.md` diff --git a/docs/release-control/v6/internal/subsystems/deployment-installability.md b/docs/release-control/v6/internal/subsystems/deployment-installability.md index 01e932d67..30a4460e4 100644 --- a/docs/release-control/v6/internal/subsystems/deployment-installability.md +++ b/docs/release-control/v6/internal/subsystems/deployment-installability.md @@ -2145,6 +2145,20 @@ version. It opened the `v6.4.0` candidate line from `main` with `rollback_version=v6.3.1` and did not move stable/latest install pointers or stable semver aliases. +The active stable `v6.4.1` cut sets the repo-root `VERSION`, repo-root +`docker-compose.yml` image default, `scripts/install-docker.sh` fallback, and +Helm chart release metadata to the same `6.4.1` release version. This patch +release uses the stable hotfix path with `rollback_version=v6.4.0`, +`hotfix_exception=true`, a release-owner reason, and no fabricated same-version +RC tag. The active customer harm is the published `v6.4.0` server image's +non-executable embedded Unified Agent, which breaks Helm agent workloads and +direct agent entrypoints. The exact pushed `main` SHA must pass the integrated +candidate checks before publication, including the new pre-publication image +mode proof. No governed mobile-facing path changed from `v6.4.0`, so the +release decision is `no-mobile-impact`. The standing SignPath-unavailable +policy from `v6.3.2` onward still applies, with Public Unknown Publisher +disclosure and the existing signed integrity controls. + The preceding stable `v6.3.2` cut set the repo-root `VERSION`, repo-root `docker-compose.yml` image default, `scripts/install-docker.sh` fallback, and Helm chart release metadata to the same `6.3.2` release version. This patch @@ -2569,13 +2583,15 @@ For the active stable `v6.1.2` cut, the repo-root compose default and `scripts/install-docker.sh` fallback must both pin `6.1.2` whenever the governed `VERSION` is that stable cut. The stable promotion guard remains in force and rejects leftover `-rc.` defaults. -For the active stable `v6.4.0` cut, the repo-root compose default and -`scripts/install-docker.sh` fallback must both pin `6.4.0` until the next +For the active stable `v6.4.1` cut, the repo-root compose default and +`scripts/install-docker.sh` fallback must both pin `6.4.1` until the next governed release moves them forward. The stable promotion guard remains in force and rejects leftover `-rc.` defaults. Each new release moves these two pins together with the repo-root `VERSION` and the Helm chart metadata in the same commit; a cut that leaves any of the four on a superseded value is a release-packet blocker. +For the preceding stable `v6.4.0` cut, the repo-root compose default and +`scripts/install-docker.sh` fallback both pinned `6.4.0`. For the preceding stable `v6.3.2` cut, the repo-root compose default and `scripts/install-docker.sh` fallback both pinned `6.3.2`. For the preceding stable `v6.3.1` cut, the repo-root compose default and diff --git a/docs/releases/RELEASE_NOTES_v6.4.1.md b/docs/releases/RELEASE_NOTES_v6.4.1.md new file mode 100644 index 000000000..3d93f5e0f --- /dev/null +++ b/docs/releases/RELEASE_NOTES_v6.4.1.md @@ -0,0 +1,19 @@ +# Pulse v6.4.1 Release Notes + +`v6.4.1` is a stable patch release for the Pulse v6 line. It follows stable +`v6.4.0` and restores the embedded container agent while correcting first-load +Proxmox details and several persistence and AI budget edge cases. + +## What's improved + +- **Container agents start correctly** - The embedded Unified Agent is executable in the server image, restoring Helm deployments with `agent.enabled=true` and direct agent entrypoints. +- **Proxmox details are correct on first load** - VM and LXC backup status, uptime, and related guest details no longer appear missing until a later live update arrives. +- **Credential changes fail safely** - Token creation, migration, runtime preparation, and first-run reset restore prior live state when durable persistence fails. +- **AI budgets cover current models** - Anthropic Sonnet 5, Fable 5, and Mythos 5 usage remains accurately priced and enforceable in Assistant and Patrol summaries. + +## Before you upgrade + +- Existing configurations remain valid and no manual data migration is required. +- Pulse Mobile remains compatible. This patch does not require a companion mobile release. +- Windows Unified Agent binaries are not Authenticode-signed while SignPath remains unavailable and may show an Unknown Publisher warning. Verify downloads with the published checksums and detached signatures. +- The rollback target is stable `v6.4.0`. On systemd and Proxmox LXC installs, use `sudo /bin/update --version v6.4.0` to return to the previous stable release. For Docker Compose, pin `rcourtman/pulse:6.4.0` and recreate the container. diff --git a/docs/releases/V6_CHANGELOG_v6.4.1.md b/docs/releases/V6_CHANGELOG_v6.4.1.md new file mode 100644 index 000000000..37351224b --- /dev/null +++ b/docs/releases/V6_CHANGELOG_v6.4.1.md @@ -0,0 +1,47 @@ +# Pulse v6.4.1 + +_This changelog describes stable `v6.4.1` compared with stable `v6.4.0`._ + +## Changed + +- Anthropic cost accounting recognizes current Sonnet 5, Fable 5, and Mythos + 5 model identifiers before broad family fallbacks so budget summaries remain + enforceable in both overestimate and unknown-price cases. +- Release qualification verifies executable mode on the embedded Unified Agent + and non-executable mode on detached signature sidecars before publication. +- Published releases remain immutable when a later validation event reports a + problem. Remediation moves forward through an explicit patch release. + +## Fixed + +- The prebuilt server image restores executable mode on copied Unified Agent + payloads, so `/usr/local/bin/pulse-agent` works for Helm agent workloads and + direct container entrypoints ([#1795](https://github.com/rcourtman/Pulse/issues/1795)). +- Proxmox VM and LXC REST resources preserve source-authored backup, uptime, and + guest metadata on first paint instead of waiting for a WebSocket update + ([#1792](https://github.com/rcourtman/Pulse/issues/1792)). +- API token creation, whole-inventory regeneration, migration, and container + runtime preparation restore complete prior live state when persistence fails. +- First-run credential reset no longer commits a password change when the + paired API token update cannot be persisted. +- Stable rollback guidance uses the installed `/bin/update` helper instead of + referring to a repository-relative script that may not exist on the server. + +## Release Metadata + +- Version: `v6.4.1` +- Previous stable: `v6.4.0` +- Rollback target: `v6.4.0` +- Rollback command: `sudo /bin/update --version v6.4.0` +- Promotion path: emergency stable patch from `main`, using the single-build + release workflow after exact-SHA qualification +- Emergency reason: the `v6.4.0` server image cannot execute its embedded + Unified Agent, which breaks Helm agent workloads and direct container-agent + entrypoints on the current stable release +- Windows signing decision: the standing SignPath-unavailable policy publishes + unsigned Windows Unified Agent binaries. They may display an Unknown + Publisher warning while exact-SHA candidate binding, checksums, detached + signatures, immutable-manifest verification, and published-digest + verification remain mandatory +- Mobile decision: `no-mobile-impact`. No governed mobile-facing path changed + from `v6.4.0`, so no companion build or public store rollout is required diff --git a/frontend-modern/public/docs/UPGRADE_v6.md b/frontend-modern/public/docs/UPGRADE_v6.md index 8f69732e5..9d9390a7a 100644 --- a/frontend-modern/public/docs/UPGRADE_v6.md +++ b/frontend-modern/public/docs/UPGRADE_v6.md @@ -4,10 +4,15 @@ This guide covers practical upgrade steps for existing Pulse installs moving to For the current stable v6 packet, see: +- `docs/releases/RELEASE_NOTES_v6.4.1.md` +- `docs/releases/V6_CHANGELOG_v6.4.1.md` + +For the preceding stable v6 packet, see: + - `docs/releases/RELEASE_NOTES_v6.4.0.md` - `docs/releases/V6_CHANGELOG_v6.4.0.md` -For the preceding stable v6 packet, see: +For the earlier stable v6 packet, see: - `docs/releases/RELEASE_NOTES_v6.3.2.md` - `docs/releases/V6_CHANGELOG_v6.3.2.md` diff --git a/scripts/install-docker.sh b/scripts/install-docker.sh index 4343c8b4f..66bf9d39c 100755 --- a/scripts/install-docker.sh +++ b/scripts/install-docker.sh @@ -6,7 +6,7 @@ set -euo pipefail SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)" DOCKER_IMAGE_REPO="${DOCKER_IMAGE_REPO:-rcourtman/pulse}" -CANONICAL_DEFAULT_PULSE_VERSION="6.4.0" +CANONICAL_DEFAULT_PULSE_VERSION="6.4.1" resolve_default_pulse_version() { if [ -n "${PULSE_IMAGE_VERSION:-}" ]; then diff --git a/scripts/installtests/build_release_assets_test.go b/scripts/installtests/build_release_assets_test.go index 44489a766..87276fc41 100644 --- a/scripts/installtests/build_release_assets_test.go +++ b/scripts/installtests/build_release_assets_test.go @@ -773,21 +773,17 @@ func TestCurrentStablePatchReleasePacketTracksInstallMetadata(t *testing.T) { assertFileContainsAllNormalized(t, releaseNotesPath, "`v"+version+"` is a stable patch release", "`v"+previous+"`", - "Use the normal v6 install or update flow", - "integrated exact-SHA candidate checks", - "`v6.3.1`-only exception", + "## What's improved", "not Authenticode-signed", "Unknown Publisher warning", - "exact-SHA checksums, detached signatures, immutable-manifest verification", - "`no-mobile-impact`", - "rollback target is `v"+previous+"`", + "This patch does not require a companion mobile release", + "rollback target is stable `v"+previous+"`", ) assertFileContainsAllNormalized(t, changelogPath, "Version: `v"+version+"`", "Rollback target: `v"+previous+"`", "Promotion path: emergency stable patch from `"+releaseBranch+"`", - "Windows signing decision: version-bound `v6.3.1` owner exception", - "not Authenticode-signed", + "Windows signing decision: the standing SignPath-unavailable policy publishes unsigned Windows Unified Agent binaries", "Unknown Publisher warning", "Mobile decision: `no-mobile-impact`", ) diff --git a/scripts/installtests/install_docker_sh_test.go b/scripts/installtests/install_docker_sh_test.go index 9a1bfa1ee..18239ada2 100644 --- a/scripts/installtests/install_docker_sh_test.go +++ b/scripts/installtests/install_docker_sh_test.go @@ -325,7 +325,8 @@ func TestInstallDockerProofTracksStablePatchReleaseContract(t *testing.T) { ) } else { assertFileContainsAllNormalized(t, repoFile("docs", "release-control", "v6", "internal", "subsystems", "deployment-installability.md"), - "Windows Authenticode remains mandatory for `v"+version+"`", + "standing SignPath-unavailable policy from `v6.3.2` onward", + "Public Unknown Publisher disclosure", ) } }