mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-09-10 02:25:56 +00:00
Prepare v6.1.0 RC1 release
This commit is contained in:
rcourtman
@@ -2,9 +2,9 @@ apiVersion: v2
|
||||
name: pulse
|
||||
description: Helm chart for deploying the Pulse hub and optional Docker monitoring agent.
|
||||
type: application
|
||||
version: 6.0.6-rc.1
|
||||
appVersion: "6.0.6-rc.1"
|
||||
icon: https://raw.githubusercontent.com/rcourtman/Pulse/v6.0.6-rc.1/docs/images/pulse-logo.svg
|
||||
version: 6.1.0-rc.1
|
||||
appVersion: "6.1.0-rc.1"
|
||||
icon: https://raw.githubusercontent.com/rcourtman/Pulse/v6.1.0-rc.1/docs/images/pulse-logo.svg
|
||||
keywords:
|
||||
- monitoring
|
||||
- proxmox
|
||||
@@ -32,7 +32,7 @@ annotations:
|
||||
description: Smoke tests with kind cluster deployment
|
||||
artifacthub.io/links: |
|
||||
- name: Documentation
|
||||
url: https://github.com/rcourtman/Pulse/blob/v6.0.6-rc.1/docs/KUBERNETES.md
|
||||
url: https://github.com/rcourtman/Pulse/blob/v6.1.0-rc.1/docs/KUBERNETES.md
|
||||
- name: Support
|
||||
url: https://github.com/rcourtman/Pulse/discussions
|
||||
artifacthub.io/maintainers: |
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# pulse
|
||||
|
||||
  
|
||||
  
|
||||
|
||||
Helm chart for deploying the Pulse hub and optional Docker monitoring agent.
|
||||
|
||||
|
||||
+1
-1
@@ -2,7 +2,7 @@ version: '3.8'
|
||||
|
||||
services:
|
||||
pulse:
|
||||
image: ${PULSE_IMAGE:-rcourtman/pulse:6.0.6-rc.1}
|
||||
image: ${PULSE_IMAGE:-rcourtman/pulse:6.1.0-rc.1}
|
||||
container_name: pulse
|
||||
restart: unless-stopped
|
||||
logging:
|
||||
|
||||
@@ -7,8 +7,8 @@ For historical v4 notes that previously lived in this repo, see:
|
||||
`docs/releases/RELEASE_NOTES_v4.md`
|
||||
|
||||
For the current v6 support release candidate packet, see:
|
||||
- `docs/releases/RELEASE_NOTES_v6.0.6-rc.1.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.0.6-rc.1.md`
|
||||
- `docs/releases/RELEASE_NOTES_v6.1.0-rc.1.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.1.0-rc.1.md`
|
||||
|
||||
For historical v6 support release candidate packets, see:
|
||||
- `docs/releases/RELEASE_NOTES_v6.0.5-rc.4.md`
|
||||
|
||||
+2
-2
@@ -4,8 +4,8 @@ This guide covers practical upgrade steps for existing Pulse installs moving to
|
||||
|
||||
For the current v6 support release candidate packet, see:
|
||||
|
||||
- `docs/releases/RELEASE_NOTES_v6.0.6-rc.1.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.0.6-rc.1.md`
|
||||
- `docs/releases/RELEASE_NOTES_v6.1.0-rc.1.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.1.0-rc.1.md`
|
||||
|
||||
For the current stable v6 packet and rollout references, see:
|
||||
|
||||
|
||||
@@ -977,7 +977,10 @@ TLS floor in the dynamic config.
|
||||
`mobile-candidate-required` is a blocking state until the mobile candidate
|
||||
is built/submitted and the release is rerun with `mobile-candidate-uploaded`
|
||||
evidence. Compatibility or uploaded-candidate decisions must carry evidence
|
||||
text rather than relying on memory.
|
||||
text rather than relying on memory. A `mobile-candidate-uploaded` release
|
||||
packet must also name the exact iOS build number and Android version code in
|
||||
its release notes and changelog, and must distinguish TestFlight or Play
|
||||
internal-testing availability from a public store rollout.
|
||||
12. Keep forward release signing pinned to an explicit trust root. Governed
|
||||
release scripts, Docker release builds, and historical backfill paths must
|
||||
accept the active private signing key only alongside a non-secret expected
|
||||
@@ -1007,6 +1010,9 @@ operator-facing Actions inbox, monitor-first product workflows, governed host
|
||||
and storage operations, native-agent update safety, Windows logged-readiness
|
||||
and recovery proof, OIDC callback recovery, and fail-closed security hardening
|
||||
behind RC validation before the next stable minor release.
|
||||
The companion evidence for this cut is Pulse Mobile iOS build 8 and Android
|
||||
versionCode 7 on TestFlight and Google Play internal testing only. The release
|
||||
packet must not describe either candidate as a public store rollout.
|
||||
The same release boundary now provides one canonical in-app release-note
|
||||
experience. Update checks can preview a curated `Highlights` section, and an
|
||||
authenticated running-version endpoint lets the update surface show those
|
||||
|
||||
+52
-9
@@ -1,9 +1,21 @@
|
||||
# Pulse v6.0.6-rc.1 Release Notes
|
||||
# Pulse v6.1.0-rc.1 Release Notes
|
||||
|
||||
`v6.0.6-rc.1` is a release candidate for the next Pulse v6 patch line. It
|
||||
follows stable `v6.0.5` with a larger monitor-first product update, a typed
|
||||
Pulse Intelligence action lifecycle, safer native-agent update and recovery
|
||||
behavior, and broad security and reliability hardening.
|
||||
`v6.1.0-rc.1` is a release candidate for the next Pulse v6 minor line. It
|
||||
follows stable `v6.0.5` with a substantial monitor-first product update, a
|
||||
typed Pulse Intelligence action lifecycle, a dedicated Actions workspace,
|
||||
safer native-agent update and recovery behavior, and broad security and
|
||||
reliability hardening.
|
||||
|
||||
## Highlights
|
||||
|
||||
- Patrol findings can now move through one reviewed Actions inbox with clear
|
||||
approval, execution, and verification state.
|
||||
- Pulse can safely carry out a wider set of explicitly governed Docker,
|
||||
Proxmox, host-update, package-maintenance, and storage-cleanup actions.
|
||||
- Platform pages, connected systems, responsive layouts, and Assistant
|
||||
conversations are more task-focused and easier to operate day to day.
|
||||
- Native updates, agent recovery, authentication boundaries, and service
|
||||
hardening fail closed across more installation and recovery paths.
|
||||
|
||||
## Added
|
||||
|
||||
@@ -13,10 +25,16 @@ behavior, and broad security and reliability hardening.
|
||||
- Patrol action state now reconciles from the authoritative action audit and
|
||||
stays current across investigation history, desktop approval controls, and
|
||||
Pulse Mobile approve or reject flows.
|
||||
- Actions provides a dedicated inbox for reviewing proposed work, checking
|
||||
policy and verification details, and seeing pending approvals without
|
||||
searching through Assistant history.
|
||||
- Patrol can authorize low-risk Docker and Podman restarts through explicit
|
||||
per-resource capability allowlists and optional recurring maintenance
|
||||
windows, while unsupported, out-of-window, or downgraded-mode actions remain
|
||||
approval-gated and fail closed.
|
||||
- Governed host updates, Debian and Ubuntu package maintenance, storage-pressure
|
||||
cleanup, and supported Proxmox guest lifecycle operations now use reviewed
|
||||
plans, durable execution receipts, and independent outcome verification.
|
||||
- Local AI setup includes a guided Ollama quickstart for `qwen3:8b`, with
|
||||
clearer Provider & Models readiness guidance.
|
||||
- Cluster members can override their connection addresses when the discovered
|
||||
@@ -40,6 +58,13 @@ behavior, and broad security and reliability hardening.
|
||||
- Investigation prompts receive the real typed capability catalog, including
|
||||
approval requirements and parameter constraints, instead of asking the
|
||||
model to guess which actions are available.
|
||||
- Assistant conversations can be retried, regenerated, edited and resent, and
|
||||
steered while a response is running. Long pasted input is collapsed into a
|
||||
manageable composer attachment, and the last-turn summary reports estimated
|
||||
model cost when available.
|
||||
- Patrol handoffs now open the related Actions review directly, background
|
||||
Patrol work stays out of the Assistant quick-resume list, and the Actions tab
|
||||
shows its pending-approval count.
|
||||
- Docker, Kubernetes, TrueNAS, vSphere, and Proxmox node tables preserve
|
||||
user-controlled column sorting through one shared platform-table model.
|
||||
|
||||
@@ -48,6 +73,10 @@ behavior, and broad security and reliability hardening.
|
||||
- Native updates self-test the replacement binary before swapping it in,
|
||||
reject silent edition downgrades, preserve a sanctioned rollback path, and
|
||||
fail fast when signing configuration is incomplete.
|
||||
- Native updates fail closed instead of silently falling back to a community
|
||||
build, preserve writable configuration backups under hardened services, and
|
||||
publish verification keys in the exact OpenSSH `allowed_signers` form used
|
||||
by the documented verification command.
|
||||
- Docker updates now recreate the container instead of attempting a restart
|
||||
that cannot apply a new image.
|
||||
- Docker containers retain their grouped-by-host view and open configured web
|
||||
@@ -64,20 +93,34 @@ behavior, and broad security and reliability hardening.
|
||||
this candidate.
|
||||
- FreeBSD agent update recovery and Windows service recovery now preserve a
|
||||
usable runtime across replacement and restart paths.
|
||||
- Cluster re-registration preserves an operator-selected member address, moved
|
||||
guests keep their alert ownership aligned with the new node, and unavailable
|
||||
guest-agent disk data is no longer presented as a real measurement.
|
||||
- Physical disks no longer disappear on wide node layouts, standby SSDs no
|
||||
longer report misleading state, shared Docker network namespaces survive
|
||||
container updates, and SSO administrators retain the expected settings
|
||||
authority.
|
||||
|
||||
## Upgrade Notes
|
||||
|
||||
Use the normal v6 install or update flow for `v6.0.6-rc.1` only when you are
|
||||
Use the normal v6 install or update flow for `v6.1.0-rc.1` only when you are
|
||||
comfortable testing an RC. The rollback target for this release candidate is
|
||||
`v6.0.5`.
|
||||
|
||||
The exact rollback reinstall command is:
|
||||
|
||||
```bash
|
||||
./scripts/install.sh --version v6.0.5
|
||||
```
|
||||
|
||||
This candidate changes authentication and native installer/updater boundaries,
|
||||
so it is intentionally using the governed RC path rather than the direct
|
||||
stable-patch path.
|
||||
|
||||
Pulse Mobile candidate builds with runtime version 1 receive the matching
|
||||
typed-action approval client through the candidate OTA channel; no public store
|
||||
rollout is part of this RC.
|
||||
Pulse Mobile iOS candidate build 8 and Android candidate versionCode 7 carry
|
||||
the matching plan-bound action review and approval client. They remain on the
|
||||
TestFlight and Google Play internal-testing tracks; no public store rollout is
|
||||
part of this RC.
|
||||
|
||||
Windows Unified Agent binaries in this release candidate retain the same
|
||||
checksum and detached-signature verification used by `v6.0.5`, but they are
|
||||
+33
-3
@@ -1,6 +1,6 @@
|
||||
# Pulse v6.0.6-rc.1
|
||||
# Pulse v6.1.0-rc.1
|
||||
|
||||
_This changelog describes the `v6.0.6-rc.1` release candidate compared with
|
||||
_This changelog describes the `v6.1.0-rc.1` release candidate compared with
|
||||
stable `v6.0.5`._
|
||||
|
||||
## Added
|
||||
@@ -12,11 +12,17 @@ stable `v6.0.5`._
|
||||
- Desktop and Pulse Mobile clients now use the canonical pending-action queue,
|
||||
decision endpoint, and action identity instead of retired command-shaped
|
||||
approval endpoints.
|
||||
- The desktop Actions inbox now provides one review surface for proposed work,
|
||||
policy provenance, approval state, execution progress, verification detail,
|
||||
and direct Patrol handoffs.
|
||||
- Docker and Kubernetes actions verify supported scale and update outcomes
|
||||
after execution.
|
||||
- Policy-scoped Patrol autonomy can authorize low-risk Docker and Podman
|
||||
restarts only for explicitly allowed resources and optional recurring
|
||||
maintenance windows.
|
||||
- Host update, Debian and Ubuntu package, storage-pressure cleanup, Docker
|
||||
restart, and supported Proxmox guest lifecycle plans now share the governed
|
||||
action, durable receipt, and independent-verification path.
|
||||
- Local provider setup includes a guided Ollama `qwen3:8b` quickstart.
|
||||
- Cluster members can override discovered connection addresses.
|
||||
- The Unified Agent accepts a rotating JSON log path for native service use.
|
||||
@@ -37,12 +43,20 @@ stable `v6.0.5`._
|
||||
read later.
|
||||
- Investigation prompts include the validated capability catalog with approval
|
||||
floors, parameter schemas, and sensitive/operator-only constraints.
|
||||
- Assistant supports in-place retry, response regeneration, edit-and-resend,
|
||||
mid-turn steering, collapsed long-paste attachments, and estimated
|
||||
last-turn cost summaries.
|
||||
- Patrol action handoffs open the matching Actions review, background Patrol
|
||||
sessions stay out of Assistant quick resume, and pending approvals are
|
||||
visible on the Actions navigation tab.
|
||||
- Docker, Kubernetes, TrueNAS, vSphere, and Proxmox node tables share one
|
||||
sortable platform-table model and retain user-controlled column ordering.
|
||||
- Windows native CI exercises installer parsing, install, version replacement,
|
||||
logged readiness, forced-process recovery, restart persistence, and cleanup.
|
||||
- Release automation builds one signed exact-SHA candidate and promotes that
|
||||
candidate without rebuilding.
|
||||
- Action dispatch now binds server-authored policy provenance and reviewed plan
|
||||
identity through durable admission, transport, result, and audit records.
|
||||
|
||||
## Fixed
|
||||
|
||||
@@ -53,6 +67,8 @@ stable `v6.0.5`._
|
||||
- Docker update guidance recreates the container so the selected image is
|
||||
actually applied.
|
||||
- Docker and Kubernetes agent liveness handles clock skew correctly.
|
||||
- Docker updates preserve containers that share another container's network
|
||||
namespace.
|
||||
- Guest suppression is honored for posture alerts.
|
||||
- Legacy OIDC callback handling recovers the initiating provider.
|
||||
- Simultaneous provider/runtime and proposal-channel failures preserve both
|
||||
@@ -65,6 +81,14 @@ stable `v6.0.5`._
|
||||
- Windows install success now requires both local readiness and a non-empty
|
||||
durable service log.
|
||||
- Discovery backfills quiesce during shutdown.
|
||||
- Cluster members retain an operator-selected connection address when they
|
||||
re-register through another member.
|
||||
- Guest alerts move with the guest when its owning node changes, and missing
|
||||
guest-agent disk data uses an unavailable sentinel instead of a fabricated
|
||||
measurement.
|
||||
- Physical disk tables keep wide-node disks visible and avoid reporting
|
||||
standby SSDs as active failures.
|
||||
- SSO-backed administrators retain their effective settings privileges.
|
||||
|
||||
## Security
|
||||
|
||||
@@ -77,9 +101,15 @@ stable `v6.0.5`._
|
||||
explicitly while the public signing application is pending.
|
||||
- Demo SSH setup no longer weakens host-key handling for private deploy hosts
|
||||
or IP targets.
|
||||
- Update verification documentation and release output use a guarded OpenSSH
|
||||
`allowed_signers` line, and hardened update services keep configuration
|
||||
backups on a writable path.
|
||||
|
||||
## Release Metadata
|
||||
|
||||
- Version: `v6.0.6-rc.1`
|
||||
- Version: `v6.1.0-rc.1`
|
||||
- Rollback target: `v6.0.5`
|
||||
- Rollback command: `./scripts/install.sh --version v6.0.5`
|
||||
- Promotion path: release candidate from `main`
|
||||
- Mobile companion candidates: iOS build 8 and Android versionCode 7 on the
|
||||
TestFlight and Google Play internal-testing tracks
|
||||
@@ -6,7 +6,7 @@ set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
|
||||
DOCKER_IMAGE_REPO="${DOCKER_IMAGE_REPO:-rcourtman/pulse}"
|
||||
CANONICAL_DEFAULT_PULSE_VERSION="6.0.6-rc.1"
|
||||
CANONICAL_DEFAULT_PULSE_VERSION="6.1.0-rc.1"
|
||||
|
||||
resolve_default_pulse_version() {
|
||||
if [ -n "${PULSE_IMAGE_VERSION:-}" ]; then
|
||||
|
||||
@@ -329,6 +329,7 @@ func TestCurrentSupportPrereleasePacketTracksInstallMetadata(t *testing.T) {
|
||||
|
||||
assertFileContainsAllNormalized(t, releaseNotesPath,
|
||||
"`v"+version+"` is a release candidate",
|
||||
"## Highlights",
|
||||
"stable `v"+previous+"`",
|
||||
"Pulse Intelligence",
|
||||
"detection and investigation profiles",
|
||||
@@ -345,6 +346,8 @@ func TestCurrentSupportPrereleasePacketTracksInstallMetadata(t *testing.T) {
|
||||
"Legacy OIDC callbacks",
|
||||
"Windows service recovery",
|
||||
"fail closed",
|
||||
"Pulse Mobile iOS candidate build 8 and Android candidate versionCode 7",
|
||||
"TestFlight and Google Play internal-testing tracks",
|
||||
"rollback target for this release candidate is `v"+previous+"`",
|
||||
)
|
||||
assertFileContainsAllNormalized(t, changelogPath,
|
||||
@@ -367,6 +370,8 @@ func TestCurrentSupportPrereleasePacketTracksInstallMetadata(t *testing.T) {
|
||||
"Windows service installation fails closed",
|
||||
"First-run security boundaries now fail closed",
|
||||
"one signed exact-SHA candidate",
|
||||
"Mobile companion candidates: iOS build 8 and Android versionCode 7",
|
||||
"TestFlight and Google Play internal-testing tracks",
|
||||
)
|
||||
assertFileContainsAll(t, repoFile("docs", "RELEASE_NOTES.md"),
|
||||
"docs/releases/RELEASE_NOTES_v"+version+".md",
|
||||
@@ -399,6 +404,7 @@ func TestCurrentSupportPrereleasePacketTracksInstallMetadata(t *testing.T) {
|
||||
"The active support prerelease `v"+version+"` cut sets the repo-root `VERSION`, repo-root `docker-compose.yml` image default, `scripts/install-docker.sh` fallback, and Helm chart release metadata to the same `"+version+"` release version.",
|
||||
"This support prerelease keeps `rollback_version=v"+previous+"`, publishes a versioned public GitHub prerelease plus versioned Docker and Helm artifacts, and does not move stable/latest install pointers or stable semver aliases.",
|
||||
"For the active support prerelease `v"+version+"` cut, the repo-root compose default and `scripts/install-docker.sh` fallback must both pin `"+version+"` until the next governed stable cut moves them forward.",
|
||||
"The companion evidence for this cut is Pulse Mobile iOS build 8 and Android versionCode 7 on TestFlight and Google Play internal testing only. The release packet must not describe either candidate as a public store rollout.",
|
||||
)
|
||||
}
|
||||
|
||||
|
||||
@@ -231,7 +231,8 @@ func TestInstallDockerProofTracksSupportPrereleaseContract(t *testing.T) {
|
||||
assertFileContainsAllNormalized(t, repoFile("docs", "release-control", "v6", "internal", "subsystems", "deployment-installability.md"),
|
||||
"The active support prerelease `v"+version+"` cut sets the repo-root `VERSION`, repo-root `docker-compose.yml` image default, `scripts/install-docker.sh` fallback, and Helm chart release metadata to the same `"+version+"` release version.",
|
||||
"This support prerelease keeps `rollback_version=v"+previous+"`, publishes a versioned public GitHub prerelease plus versioned Docker and Helm artifacts, and does not move stable/latest install pointers or stable semver aliases.",
|
||||
"the typed Pulse Intelligence lifecycle, monitor-first product workflows, native-agent update safety, Windows logged-readiness and recovery proof, OIDC callback recovery, and fail-closed security hardening behind RC validation",
|
||||
"the expanded Pulse Intelligence action and verification lifecycle, the operator-facing Actions inbox, monitor-first product workflows, governed host and storage operations, native-agent update safety, Windows logged-readiness and recovery proof, OIDC callback recovery, and fail-closed security hardening behind RC validation",
|
||||
"The companion evidence for this cut is Pulse Mobile iOS build 8 and Android versionCode 7 on TestFlight and Google Play internal testing only. The release packet must not describe either candidate as a public store rollout.",
|
||||
"For the active support prerelease `v"+version+"` cut, the repo-root compose default and `scripts/install-docker.sh` fallback must both pin `"+version+"` until the next governed stable cut moves them forward.",
|
||||
)
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user