**Make OIDC Test require the same issuer identity as sign-in**
Reject missing or unequal discovery issuers, including trailing-slash
and case differences, and qualify a successful discovery without
claiming credentials or sign-in were tested. Preserve restricted
outbound validation and saved provider/admin state. Couple the
diagnostic to real OIDC service discovery and the authenticated
consuming route.
Contract-Neutral: The OIDC Test response delta is documented and
verified in api-contracts.md. Shared internal/api references add no
agent-lifecycle or storage-recovery contract change.
**Keep issuer identity controls separate from success qualification**
Let exact-match parent controls pass on issuer identity alone, while the
authenticated consuming route pins the new qualified success message.
Contract-Neutral: Tests only. The OIDC Test contract and runtime source
are unchanged.
**Align OIDC help smoke checks with truthful issuer discovery**
Replace the stale success-copy literal with checks for missing and
unequal issuer rejection and qualified discovery-only success. Keep
every existing setup/session/access assertion, and use in-memory
mutations to prove the consistency check rejects false-green regressions
without changing runtime source.
Contract-Neutral: Documentation/source consistency tests only. The
completed OIDC runtime, API contract, guides and browser-verified
consumer remain unchanged.
---
Fleet candidate `20261027T120003Z-core-runtime` from the `core-runtime`
lane. Reviewed tip `dc5ce319d3d8c0540f39e0c0e3a04a0271958aa3` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Enforce the existing inbound ceiling on the decoded stream as well as wire frames. Reject oversized fragmented and unfinished messages before JSON handling while preserving compression and valid at-limit traffic.
**Expose latest backup failure evidence in workload Coverage**
Keep the provider task's error, start, duration and ID readable in the
existing workload details, including on phones. Preserve independent
protection and restore evidence, explicit unknowns and literal provider
text. Exercise scoped inventory consumption and ordinary polling without
adding reads or guest operations.
**Wrap the backup task qualification within narrow table cells**
The 320px production-browser capture exposed an inherited nowrap on the
task-status safety qualification. Explicitly wrap that paragraph and
protect both consuming and registered detail tests; keep shared table
behavior and provider evidence unchanged.
**Record desktop and phone proof for backup task evidence**
Bind the 83-check production Coverage consumer pass and six natively
inspected captures to this parent and the final runtime bytes, including
corrected 320px qualification wrapping.
---
Fleet candidate `20261027T114005Z-web-product` from the `web-product`
lane. Reviewed tip `b8e84d5eeaa93da6dd258f4ddfb989fd045bfe4b` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
**Admit reconstructible stable patches on version-bound release
branches**
Rebuild selected whole main merge results over the current stable tag,
retain only reviewed release controls and release metadata, and reject
unrelated source before a payload exists. Preserve reviewed snapshot
provenance, existing minor source rules and historical branch mappings.
Exercise real Git conflicts, successor patches and drift rejection in
canonical CI.
**Keep patch verification on the existing release policy**
The registry excludes release-control tooling from runtime path
matching, so a separate policy for those paths is empty. Retain the new
real-Git proof on the existing release workflow policy and use the
registry's case-folded order.
Contract-Neutral: Registry representation correction only; patch source
admission, release behaviour and required workflow proof are unchanged.
**Preserve installed Git hooks during patch assembly**
The new assembler must not copy the read-only Git helper's hook
suppression into its writing commands. Keep the ambient enforcement path
and add a regression check; real-Git source tests exercise the same
helper.
Contract-Neutral: Preserve existing Git hook enforcement; selected patch
source trees, public runtime and release checks are unchanged.
**Require reviewed snapshots for mechanical patch dispatch**
New version-bound patch targets are not protected main. Do not admit a
direct target-ref dispatch that omits the reviewed immutable
preparation; retain existing historical governed branch behaviour.
Contract-Neutral: Enforce the existing reviewed-snapshot requirement on
the new patch path; release contents and historical dispatch contracts
are unchanged.
**Run required governance on stable-patch preparation targets**
Keep independent read-only governance on release/v* PRs and pushes,
including metadata-only promotions. Regress actual control-plane
targets, trigger filters and the required job context without weakening
required-check admission.
**Fence delayed stable patches at reservation and publication**
Preserve the returned implementation and correct its six stale lookup
expectations. Re-read current stable/source and the minor-anchored
cutoff at the final publication boundary, including activation-only
recovery, without adding a minor-release gate.
**Keep the patch cut deadline out of soaked promotion**
The 48-hour rule governs a new rc.1 cut, not promotion of its
already-cut unchanged source. Preserve the current-stable and source
fences at both activation boundaries without inventing an additional
promotion hold.
---
Fleet candidate `20261027T111122Z-delivery-trust` from the
`delivery-trust` lane. Reviewed tip
`576f54b5b16f098797cd189ddedf0358c0e160e6` on `main`.
Lands together with: pulse-dev-infra
https://github.com/rcourtman/pulse-dev-infra/pull/837.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Reject missing or unequal discovery issuers, including trailing-slash and case differences, and qualify a successful discovery without claiming credentials or sign-in were tested. Preserve restricted outbound validation and saved provider/admin state. Couple the diagnostic to real OIDC service discovery and the authenticated consuming route.
Contract-Neutral: The OIDC Test response delta is documented and verified in api-contracts.md. Shared internal/api references add no agent-lifecycle or storage-recovery contract change.
Change-source: pulse-maintainer
The 320px production-browser capture exposed an inherited nowrap on the task-status safety qualification. Explicitly wrap that paragraph and protect both consuming and registered detail tests; keep shared table behavior and provider evidence unchanged.
Change-source: pulse-maintainer
Keep the provider task's error, start, duration and ID readable in the existing workload details, including on phones. Preserve independent protection and restore evidence, explicit unknowns and literal provider text. Exercise scoped inventory consumption and ordinary polling without adding reads or guest operations.
Change-source: pulse-maintainer
The 48-hour rule governs a new rc.1 cut, not promotion of its already-cut unchanged source. Preserve the current-stable and source fences at both activation boundaries without inventing an additional promotion hold.
Change-source: pulse-maintainer
**Explain PMG collection controls in the published stable release**
Distinguish v6.6.0's saved scope and failed downstream polls from
v6.5.0's hidden queue errors. Keep deliberate opt-out, independent
coverage and restored queue monitoring separate, with consuming guide
and source-bound regression coverage.
Contract-Neutral: Version-specific PMG guidance and regression coverage
only; collector behaviour, connection health, alerts and permissions are
unchanged.
**Record published PMG guidance browser verification**
Bind the shipped guide's desktop keyboard and narrow touch reading paths
to the exact source. Retain the failed initial evidence mount, 42 final
checks and three natively inspected captures without claiming gateway
recovery.
Contract-Neutral: Browser evidence only; no product behaviour or
subsystem contract delta.
---
Fleet candidate `20261027T104021Z-product-intelligence` from the
`product-intelligence` lane. Reviewed tip
`5db6279b543b06fc4c5b9b81a0111d2ae4ad9781` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
**Apply managed Proxmox TLS trust to exact polling endpoints**
Persist endpoint-scoped decisions alongside discovery pins, including
explicit CA mode, without clearing unrelated member trust or accepting
renewed certificates automatically. Use the same policy for
saved-credential probes, qualify their scope, and keep failed saves out
of live PVE configuration.
**Keep explicit TLS choices stable through consolidation and
projection**
Use the effective primary trust when reopening the editor, retain an
explicit CA choice during instance consolidation, and reject
contradictory equivalent trust scopes. Correct the synthetic leaf signer
and initialise persistence before injecting the failed-save control.
Contract-Neutral: Completes the exact-endpoint TLS contract in
aa8e809fc8 without another payload or policy change.
**Retain effective TLS response frames in polling regression
diagnostics**
Bind consuming editor proof to the actual saved-node projection and
single-endpoint probe responses; fixture endpoints and credentials are
synthetic. The same test continues to assert TLS isolation, encrypted
reload, ordinary polling and no mutation.
Contract-Neutral: Regression diagnostics only; no product or contract
change.
**Distinguish unknown member trust from explicit CA validation**
Expose first-use state alongside effective endpoint trust so the
existing editor can require a deliberate CA choice rather than infer one
from an empty field. Add renewed untrusted-leaf controls to prove that
clearing scoped pins does not bypass normal verification.
Contract-Neutral: The changed API projection is documented and verified
here; shared API-prefix references introduce no delta to the existing
agent-lifecycle or storage-recovery contracts updated in aa8e809fc8.
**Keep disabled collection scopes intact when editing TLS trust**
Return false values for the existing PVE collection fields instead of
omitting them. Otherwise the consuming editor substitutes enabled
defaults and a trust-only save can re-enable guest, storage or backup
collection. Cover the actual response and complete-scope update
round-trip.
**Manage Proxmox TLS trust per existing polling endpoint**
Keep primary and peer trust independent in the existing editor, expose
the actual dial scope and unknown first-use state, and require
deliberate CA choices. Test with stored credentials without saving trust
or claiming background health; invalidate results when the draft
changes, and read back effective policy after save. Retain disabled
collectors and malformed nonempty pins.
Browser proof: 93 checks and 16 natively inspected captures, desktop
Chromium and narrow WebKit, with actual source-produced synthetic
node/probe frames and the documented supplemental fixture limit.
**Align TLS editor fixtures with the scoped policy and normalised
readback**
Retain exact node-cache equality including its existing
credential-presence and temperature normalisation. Check the revised
primary-versus-member copy in every TLS combination without changing
policy, state or the existing no-probe assertions.
Contract-Neutral: Tests only; product source and the completed
browser-verified frontend content are unchanged.
**Keep malformed saved pins distinct from explicit empty trust**
Reject equivalent endpoint aliases that disagree between a malformed
nonempty pin and deliberate CA mode, including delimiter-only pins.
Certificate-verifier normalisation must not choose empty trust over a
nonempty saved decision during resolution or consolidation.
Contract-Neutral: Completes the existing fail-closed exact-endpoint
trust conflict contract; no new payload, route or frontend content.
**Use complete provider configurations in saved-connection test
fixtures**
Populate required collection fields for every tested node type rather
than asserting a partial object into the node union. Existing trust,
saved-credential and stale-result assertions remain unchanged.
Contract-Neutral: Typed fixture completion only; no product source or
browser-verified content changes.
**Keep endpoint TLS test feedback beside the member being tested**
Show scoped results locally and announce/reveal them without stealing
focus; primary results stay in the existing footer. Invalidate them with
trust edits. Contract and consumer checks cover the existing settings
flow.
**Use sentences in scoped Proxmox TLS guidance**
The exact PR3395 Frontend job rejected semicolons in the member
first-use explanation and the fallback endpoint Test message. Keep their
trust and background-collection qualifications, and pin both visible
strings in the existing consuming tests. No runtime or API policy
changes.
Contract-Neutral: Copy punctuation and existing test expectations only.
Endpoint trust, collector scope and response contracts are unchanged.
**Record desktop and phone proof for TLS copy correction**
Production connection-editor proof covers the two corrected strings,
keyboard test activation, endpoint-qualified feedback, and stale-result
invalidation. Original TLS source proof and own-parent browser receipts
remain unchanged.
Contract-Neutral: Browser evidence only. No product contract change.
**Pin scoped trust defaults in every provider form fixture**
Whole-tree frontend validation found three strict-form expectations
still missing the endpoint fingerprint and deliberate-edit maps
introduced by the reviewed trust editor. Add both empty maps to each
complete expected PVE, PBS and PMG shape, retaining strict equality and
all existing defaults.
Contract-Neutral: Existing strict default-form test fixtures only. No
runtime or public contract changes.
---
Fleet candidate `20261027T102020Z-core-runtime` from the `core-runtime`
lane. Reviewed tip `851eb8b4c8c10d3b8fbc0adac503e54f21efd4a9` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Preserve the returned implementation and correct its six stale lookup expectations. Re-read current stable/source and the minor-anchored cutoff at the final publication boundary, including activation-only recovery, without adding a minor-release gate.
Change-source: pulse-maintainer
Retain type and target ID on narrow Coverage rows and show the PVE workload connection independently of each backup reader. Qualify disclosure names and expose full scope in both existing Workload details without changing matching, owner links or protection policy. Exercise real inventory consumers and unknown, unmatched, host and live-update cases.
Change-source: pulse-maintainer
**Identify backup connections in restore-point evidence**
Keep each point's source connection distinct from guest placement and
same-named repositories in the existing list, detail and Coverage
consumers. Preserve unknown origins, filter identity, completion and
server-owned protection policy; exercise real inventory-to-table polling
in the normal suite.
**Scope backup-location assertion to its detail field**
The snapshot detail legitimately repeats its node as the location.
Assert the Location field rather than treating the complete panel as a
unique text scope. The first consuming suite retained 860 passes and
this one authored assertion failure.
**Find backup connections through the existing search**
Include the now-visible source connection and explicit unknown origin in
By date and Coverage search, independently of workload placement and
without changing exact location filtering. Preserve API-to-consumer
search and navigation coverage.
**Type the backup inventory test elements for consuming queries**
Use the actual HTMLElement row type with Testing Library within. The
corrected 861-test suite passed on 00ce2454; its subsequent type check
retained this authored TS2345, so no build pass was claimed. Runtime is
unchanged.
**Verify backup source identity in desktop and phone consumers**
Record the source-bound production consumer fixture, 60 native
keyboard/touch/search/polling assertions and seven natively inspected
captures. Preserve the initial selector/whitespace failures and the
boundary between source-selection clarity and original installed
recovery.
**Wait for Coverage navigation in the source-search regression**
Wait for the consuming Coverage table before selecting its disclosure,
rather than racing the departing By date control with the same
accessible name. Retain source-f4lp29vt's 136 passes and authored
navigation assertion failure; native keyboard/touch source-search proof
remains complete and unchanged.
**Observe source-search clearing before navigating its saved URL**
Await the URL-owned clear transition before selecting the By date link.
This keeps the consuming test on the same user-observable settled-state
sequence as the completed native browser proof, rather than clicking its
previous href within the synthetic input event. Runtime and browser
content are unchanged.
---
Fleet candidate `20261027T084028Z-web-product` from the `web-product`
lane. Reviewed tip `3832a811bbebdcdbdc06dde211b8ea378ae46b68` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Keep independent read-only governance on release/v* PRs and pushes, including metadata-only promotions. Regress actual control-plane targets, trigger filters and the required job context without weakening required-check admission.
Change-source: pulse-maintainer
Distinguish target, staging, activation and fresh reporting, including typed-helper version rejection and separate manual preflight failures. Keep trust, identity and original evidence intact instead of treating a manual command as a diagnostic retry.
Contract-Neutral: Existing agent-update help and rendered-guide regression coverage only; no updater, installer or authentication contract changes.
Change-source: pulse-maintainer
Show scoped results locally and announce/reveal them without stealing focus; primary results stay in the existing footer. Invalidate them with trust edits. Contract and consumer checks cover the existing settings flow.
Change-source: pulse-maintainer
Include the now-visible source connection and explicit unknown origin in By date and Coverage search, independently of workload placement and without changing exact location filtering. Preserve API-to-consumer search and navigation coverage.
Change-source: pulse-maintainer
Keep each point's source connection distinct from guest placement and same-named repositories in the existing list, detail and Coverage consumers. Preserve unknown origins, filter identity, completion and server-owned protection policy; exercise real inventory-to-table polling in the normal suite.
Change-source: pulse-maintainer
**Explain successful PVE tests alongside rejected cluster polling**
Separate primary connection-test TLS settings from saved per-member
trust, including a pin for the same primary endpoint. Keep agent
reporting distinct, preserve verified trust and route unchanged polling
failures to safe existing help rather than repeated clears or restarts.
Cover the shipped rendered guidance and navigation with the normal
frontend test suite.
Contract-Neutral: Documents existing test and polling trust scopes
without changing runtime behaviour, APIs, permissions or TLS policy.
**Check the existing TLS help fragment without assuming router
decoration**
Keep the regression test bound to the real Getting Help anchor and its
same-window target. Fragment-only links remain native anchors; only
cross-document links carry the router data attribute. The unchanged
product guide is still verified through its rendered consuming surface.
Contract-Neutral: Corrects a documentation test assumption; no runtime,
API or trust-policy change.
**Record TLS troubleshooting guide browser verification**
Bind the final shipped copy to its containing source, production Docs
consumer and desktop/narrow pixel review. Retain earlier fixture/test
mistakes and exact-source proof in the lane outcome.
Contract-Neutral: Adds the exact-content browser receipt for
documentation only; no product contract or runtime change.
---
Fleet candidate `20261027T064520Z-product-intelligence` from the
`product-intelligence` lane. Reviewed tip
`6f634192fcb65be744727402c71763836ade123a` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
The registry excludes release-control tooling from runtime path matching, so a separate policy for those paths is empty. Retain the new real-Git proof on the existing release workflow policy and use the registry's case-folded order.
Contract-Neutral: Registry representation correction only; patch source admission, release behaviour and required workflow proof are unchanged.
Change-source: pulse-maintainer
Keep primary and peer trust independent in the existing editor, expose the actual dial scope and unknown first-use state, and require deliberate CA choices. Test with stored credentials without saving trust or claiming background health; invalidate results when the draft changes, and read back effective policy after save. Retain disabled collectors and malformed nonempty pins.
Browser proof: 93 checks and 16 natively inspected captures, desktop Chromium and narrow WebKit, with actual source-produced synthetic node/probe frames and the documented supplemental fixture limit.
Change-source: pulse-maintainer
Rebuild selected whole main merge results over the current stable tag, retain only reviewed release controls and release metadata, and reject unrelated source before a payload exists. Preserve reviewed snapshot provenance, existing minor source rules and historical branch mappings. Exercise real Git conflicts, successor patches and drift rejection in canonical CI.
Change-source: pulse-maintainer
Return false values for the existing PVE collection fields instead of omitting them. Otherwise the consuming editor substitutes enabled defaults and a trust-only save can re-enable guest, storage or backup collection. Cover the actual response and complete-scope update round-trip.
Change-source: pulse-maintainer
Complete the separate Compose digest refresh on current main. Bind the
seed default to the shared runtime pin and prove that a well-formed
older seed or changed consumer default cannot pass same-run image
admission. Keep token setup, isolation, image overrides and terminal
provider failures unchanged; local source proof is not hosted image
delivery.
---
Fleet candidate `20261027T062029Z-delivery-trust` from the
`delivery-trust` lane. Reviewed tip
`6199517ea855888ff3489f21722ae64b191379c6` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
**Keep SAML metadata preview failures private and actionable**
Use recognised failure categories and bounded recovery guidance instead
of raw API, proxy or callback errors. Preserve drafts, explicit saves
and successful previews; each deliberate Preview makes one request.
Cover create/edit recovery through the real API client and retain the
dialog-owned presentation boundary in the registered settings proof and
frontend contract.
**Remove an unused metadata preview test callback argument**
The consuming preview tests pass, but TypeScript correctly rejects an
unused fetch-mock option parameter. No runtime or assertion changes.
**Return metadata preview focus to its invoking button**
Native browser proof exposed lost focus after the pending Preview button
was disabled. Use the existing Dialog returnFocus target, without
changing shared dialog machinery. Exercise a blurred pending opener in
create/edit, and keep the registered settings proof and contract
together.
**Verify SAML preview recovery and focus in both browsers**
Bind the exact final production build to desktop Chromium and 390 px
WebKit. The full 198-check journey and four settled capture
finalisations preserve drafts, explicit saves, Community SSO and Preview
focus. All retained routine captures were opened natively; the four
entrance-phase frames remain explicitly superseded rather than counted
as final pixels.
---
Fleet candidate `20261027T054903Z-web-product` from the `web-product`
lane. Reviewed tip `9777b487c708c8db05d00593efdbfeb9b58aa438` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Expose first-use state alongside effective endpoint trust so the existing editor can require a deliberate CA choice rather than infer one from an empty field. Add renewed untrusted-leaf controls to prove that clearing scoped pins does not bypass normal verification.
Contract-Neutral: The changed API projection is documented and verified here; shared API-prefix references introduce no delta to the existing agent-lifecycle or storage-recovery contracts updated in aa8e809fc8.
Change-source: pulse-maintainer
Persist endpoint-scoped decisions alongside discovery pins, including explicit CA mode, without clearing unrelated member trust or accepting renewed certificates automatically. Use the same policy for saved-credential probes, qualify their scope, and keep failed saves out of live PVE configuration.
Change-source: pulse-maintainer
**Keep retained PVE archives bound to their guest kind**
Select local guest backup dates within the explicit archive kind. Keep a
removed VM or LXC archive on its historical typed recovery subject
instead of borrowing a replacement occupant identity or placement.
Preserve archive facts, normal collection and legacy untyped matching;
exercise both replacement directions and the consuming lifecycle.
Contract-Neutral: Correct existing typed backup attribution without
changing public JSON, archive IDs or dates, posture policy, provider
access or agent lifecycle. Monitoring and storage contracts document the
behaviour; model, mapper and poll/ingest lifecycle tests cover it.
**Preserve archive kind during final state placement alignment**
The coupled archive lifecycle caught state publication reassigning
opposite-kind archives to the new occupant node after the collector had
kept their origin. Apply the same explicit-kind fence during final
alignment and share model normalisation with date selection. Cover
aliases, both directions, untyped compatibility, connection isolation
and caller-input preservation.
Contract-Neutral: Complete the existing typed backup attribution repair
without changing public JSON, archive IDs or dates, posture policy,
access or agent lifecycle. Monitoring/storage contracts and direct
state/lifecycle tests cover this final publication path.
---
Fleet candidate `20261027T060005Z-core-runtime` from the `core-runtime`
lane. Reviewed tip `c571c086ef551282160c154b9188bc724e43317f` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Separate primary connection-test TLS settings from saved per-member trust, including a pin for the same primary endpoint. Keep agent reporting distinct, preserve verified trust and route unchanged polling failures to safe existing help rather than repeated clears or restarts. Cover the shipped rendered guidance and navigation with the normal frontend test suite.
Contract-Neutral: Documents existing test and polling trust scopes without changing runtime behaviour, APIs, permissions or TLS policy.
Change-source: pulse-maintainer
Native browser proof exposed lost focus after the pending Preview button was disabled. Use the existing Dialog returnFocus target, without changing shared dialog machinery. Exercise a blurred pending opener in create/edit, and keep the registered settings proof and contract together.
Change-source: pulse-maintainer
Complete the separate Compose digest refresh on current main. Bind the seed default to the shared runtime pin and prove that a well-formed older seed or changed consumer default cannot pass same-run image admission. Keep token setup, isolation, image overrides and terminal provider failures unchanged; local source proof is not hosted image delivery.
Change-source: pulse-maintainer
Recompose the two Dependabot digest-only refreshes on current main,
update the stale Node proof pin, and bind all six Alpine consumers to
the same selected runtime image. Keep governed tag lines, release keys
and exact-candidate consumption unchanged; source contracts do not claim
a hosted image build or installed recovery.
---
Fleet candidate `20261027T044029Z-delivery-trust` from the
`delivery-trust` lane. Reviewed tip
`8f3f67db926abe0dd795d7f2edbf05f452c36ff4` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Use recognised failure categories and bounded recovery guidance instead of raw API, proxy or callback errors. Preserve drafts, explicit saves and successful previews; each deliberate Preview makes one request. Cover create/edit recovery through the real API client and retain the dialog-owned presentation boundary in the registered settings proof and frontend contract.
Change-source: pulse-maintainer
Resolve only the shared storage contract insertion: retain current main's prune-retention and verification guarantees, followed by the archive-kind attribution guarantees from PR3389. Preserve both imported source commits without amendment and retain every runtime/test blob unchanged.
Contract-Neutral: Compose independently verified backup repairs; the only conflict resolution is additive contract prose, with unchanged runtime, APIs, permissions and policies. Existing source and own-parent browser receipts remain attributed to their commits.
Change-source: pulse-maintainer
**Distinguish local-login hiding from SSO-only enforcement**
Explain the existing authentication boundary beside the visibility
setting, preserving the independent administrator recovery path. Add a
rendered-guide regression to keep that distinction next to the setting
and its local-form escape.
Contract-Neutral: Documentation and rendered-guide regression only;
authentication behaviour, endpoints and subsystem contracts are
unchanged.
**Record local-login guidance browser verification**
Bind the shipped OIDC visibility warning to its production Docs
consumer, desktop and narrow keyboard interactions and two native pixel
inspections.
Contract-Neutral: Source-bound browser receipt only; runtime, guide
content and subsystem contracts are unchanged.
---
Fleet candidate `20261027T041050Z-product-intelligence` from the
`product-intelligence` lane. Reviewed tip
`871c94edaaf80f9adfd33c41cd3fd05c48e6cf59` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Recompose the two Dependabot digest-only refreshes on current main, update the stale Node proof pin, and bind all six Alpine consumers to the same selected runtime image. Keep governed tag lines, release keys and exact-candidate consumption unchanged; source contracts do not claim a hosted image build or installed recovery.
Change-source: pulse-maintainer
The coupled archive lifecycle caught state publication reassigning opposite-kind archives to the new occupant node after the collector had kept their origin. Apply the same explicit-kind fence during final alignment and share model normalisation with date selection. Cover aliases, both directions, untyped compatibility, connection isolation and caller-input preservation.
Contract-Neutral: Complete the existing typed backup attribution repair without changing public JSON, archive IDs or dates, posture policy, access or agent lifecycle. Monitoring/storage contracts and direct state/lifecycle tests cover this final publication path.
Change-source: pulse-maintainer
Explain the existing authentication boundary beside the visibility setting, preserving the independent administrator recovery path. Add a rendered-guide regression to keep that distinction next to the setting and its local-form escape.
Contract-Neutral: Documentation and rendered-guide regression only; authentication behaviour, endpoints and subsystem contracts are unchanged.
Change-source: pulse-maintainer
Keep the existing safety boundaries and legacy Protected-label warning while describing Kept, explicit verification and separate Prune protection. Couple the normal guide test to all three actual state outcomes.
Contract-Neutral: Shipped guidance and its regression check align with the preceding backup presentation repair; no additional runtime or subsystem contract delta.
Change-source: pulse-maintainer
Select local guest backup dates within the explicit archive kind. Keep a removed VM or LXC archive on its historical typed recovery subject instead of borrowing a replacement occupant identity or placement. Preserve archive facts, normal collection and legacy untyped matching; exercise both replacement directions and the consuming lifecycle.
Contract-Neutral: Correct existing typed backup attribution without changing public JSON, archive IDs or dates, posture policy, provider access or agent lifecycle. Monitoring and storage contracts document the behaviour; model, mapper and poll/ingest lifecycle tests cover it.
Change-source: pulse-maintainer
Show explicit verification ahead of the prune flag in restore-point rows and drawers. Call retention without a verdict Kept, retain the legacy search alias, and keep workload protection server-owned. Four consuming parent witnesses exposed misleading Protected states; non-retained and running controls passed. Correct the search fixture so its name cannot satisfy the queried status.
Contract-Neutral: Backup presentation repair only. Canonical resource identity, ownership, schema, navigation and provider contracts are unchanged; frontend/storage presentation contracts and consuming verification are updated.
Change-source: pulse-maintainer
Use bounded local and PBS artifact discriminators with exact PBS format
fallback. Keep archive facts, identities, host handling and admission
unchanged. Exercise the poller, typed confirmations and recovery
lifecycle, including partial reads and accepted absence.
Contract-Neutral: Correct existing archive guest classification without
changing public JSON shape, IDs, timestamps, posture policy or provider
access. New poller and lifecycle tests exercise the repair; existing
protection-evidence semantics are unchanged.
---
Fleet candidate `20261027T024026Z-core-runtime` from the `core-runtime`
lane. Reviewed tip `74eead69df9a3d816c489c6e5d123001fb2d13d7` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
**Reproduce unknown backup sizes hiding completed activity**
Exercise the existing inventory consumer with unavailable and mixed
sizes, source scopes and day selection before changing presentation.
Contract-Neutral: Regression tests only; existing runtime and subsystem
contracts are unchanged.
**Keep unavailable backup sizes distinct from zero activity**
Retain completed activity and Count controls when sizes are missing.
Mark unknown-size days separately, label measured bytes as known volume
and avoid exact source shares for incomplete totals.
**Select the existing backup source accessible name in regression
tests**
Use the full production aria-label rather than its shorter visible
caption. The first two parent witnesses reproduced the defect; the third
initial failure was a test selector mistake.
Contract-Neutral: Test selector correction only; runtime and contracts
are unchanged.
**Record unknown-size backup activity browser verification**
Bind desktop Chromium and narrow WebKit checks and native pixel
inspection to the final runtime content. Retain the two proof-script
assertion mistakes and continue only unfinished checks.
Contract-Neutral: Browser evidence only for the preceding backup-size
repair; no runtime or contract delta.
**Use the existing copy style for unknown backup sizes**
The complete tests and types passed, but copy lint rejected semicolons.
Use sentences for the notice and a visual separator for known volume and
unknown-size counts.
Contract-Neutral: Copy-style correction only; the unknown-size contract
and behavior are unchanged, with matching test expectations.
**Verify final unknown-size backup copy in both browsers**
Inspect final sentence-based notice and mixed-volume separator at
desktop and phone widths. Preserve the earlier source-bound interaction
proof and its adverse records.
Contract-Neutral: Fresh browser evidence for the copy-style correction
only; no runtime or contract delta.
**Keep backup size guidance consistent with the live chart**
Repair the full-suite documentation assertion missed by the scoped
unknown-size proof. Explain the Known volume label, unknown-size
markers, and chart/filter scope in both shipped guide copies, and retain
executable count-versus-volume evidence in the guide test.
Contract-Neutral: Align shipped documentation and its regression checks
with the composed backup activity behaviour; no runtime or subsystem
contract change.
**Name the chart's verification filters precisely in recovery help**
The existing pills are Verified and Unverified, not running/failed
entry-state controls. Use verification in the facet explanation and its
consistency assertion.
Contract-Neutral: Correct documentation terminology and its assertion
only; backup runtime and contracts are unchanged.
**Record composed backup guidance browser verification**
The final shipped guide preserves protected-main scope and safety
guidance alongside the known-volume correction. Verify its production
Docs consumer at desktop Chromium and narrow WebKit; all seven captures
were inspected natively. Existing chart receipts remain unchanged.
Source-suite completion still awaits the original executor readback.
Contract-Neutral: source-bound browser receipt only; no additional
contract or runtime change.
---
Fleet candidate `20261027T030018Z-web-product` from the `web-product`
lane. Reviewed tip `90f4ea4404147833c52453a97d67900d33e41579` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Replace only exact top-level generated launches, retaining ambiguous
boot content and recovery on failure. Stage and validate replacement
before rename, preserve unrelated jobs and existing modes without
assuming FAT supports chmod, and stop installation before claiming
unconfirmed boot persistence. Cover compound commands, launch-like data,
write faults, FAT permission limits and caller failure in the normal
installer inventory.
---
Fleet candidate `20261027T020029Z-delivery-trust` from the
`delivery-trust` lane. Reviewed tip
`f56b7e2b38bce8f3dff3d0a3900470367250807b` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Use bounded local and PBS artifact discriminators with exact PBS format fallback. Keep archive facts, identities, host handling and admission unchanged. Exercise the poller, typed confirmations and recovery lifecycle, including partial reads and accepted absence.
Contract-Neutral: Correct existing archive guest classification without changing public JSON shape, IDs, timestamps, posture policy or provider access. New poller and lifecycle tests exercise the repair; existing protection-evidence semantics are unchanged.
Change-source: pulse-maintainer
rcourtman