Show explicit verification ahead of the prune flag in restore-point rows and drawers. Call retention without a verdict Kept, retain the legacy search alias, and keep workload protection server-owned. Four consuming parent witnesses exposed misleading Protected states; non-retained and running controls passed. Correct the search fixture so its name cannot satisfy the queried status.
Contract-Neutral: Backup presentation repair only. Canonical resource identity, ownership, schema, navigation and provider contracts are unchanged; frontend/storage presentation contracts and consuming verification are updated.
Change-source: pulse-maintainer
Use bounded local and PBS artifact discriminators with exact PBS format
fallback. Keep archive facts, identities, host handling and admission
unchanged. Exercise the poller, typed confirmations and recovery
lifecycle, including partial reads and accepted absence.
Contract-Neutral: Correct existing archive guest classification without
changing public JSON shape, IDs, timestamps, posture policy or provider
access. New poller and lifecycle tests exercise the repair; existing
protection-evidence semantics are unchanged.
---
Fleet candidate `20261027T024026Z-core-runtime` from the `core-runtime`
lane. Reviewed tip `74eead69df9a3d816c489c6e5d123001fb2d13d7` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
**Reproduce unknown backup sizes hiding completed activity**
Exercise the existing inventory consumer with unavailable and mixed
sizes, source scopes and day selection before changing presentation.
Contract-Neutral: Regression tests only; existing runtime and subsystem
contracts are unchanged.
**Keep unavailable backup sizes distinct from zero activity**
Retain completed activity and Count controls when sizes are missing.
Mark unknown-size days separately, label measured bytes as known volume
and avoid exact source shares for incomplete totals.
**Select the existing backup source accessible name in regression
tests**
Use the full production aria-label rather than its shorter visible
caption. The first two parent witnesses reproduced the defect; the third
initial failure was a test selector mistake.
Contract-Neutral: Test selector correction only; runtime and contracts
are unchanged.
**Record unknown-size backup activity browser verification**
Bind desktop Chromium and narrow WebKit checks and native pixel
inspection to the final runtime content. Retain the two proof-script
assertion mistakes and continue only unfinished checks.
Contract-Neutral: Browser evidence only for the preceding backup-size
repair; no runtime or contract delta.
**Use the existing copy style for unknown backup sizes**
The complete tests and types passed, but copy lint rejected semicolons.
Use sentences for the notice and a visual separator for known volume and
unknown-size counts.
Contract-Neutral: Copy-style correction only; the unknown-size contract
and behavior are unchanged, with matching test expectations.
**Verify final unknown-size backup copy in both browsers**
Inspect final sentence-based notice and mixed-volume separator at
desktop and phone widths. Preserve the earlier source-bound interaction
proof and its adverse records.
Contract-Neutral: Fresh browser evidence for the copy-style correction
only; no runtime or contract delta.
**Keep backup size guidance consistent with the live chart**
Repair the full-suite documentation assertion missed by the scoped
unknown-size proof. Explain the Known volume label, unknown-size
markers, and chart/filter scope in both shipped guide copies, and retain
executable count-versus-volume evidence in the guide test.
Contract-Neutral: Align shipped documentation and its regression checks
with the composed backup activity behaviour; no runtime or subsystem
contract change.
**Name the chart's verification filters precisely in recovery help**
The existing pills are Verified and Unverified, not running/failed
entry-state controls. Use verification in the facet explanation and its
consistency assertion.
Contract-Neutral: Correct documentation terminology and its assertion
only; backup runtime and contracts are unchanged.
**Record composed backup guidance browser verification**
The final shipped guide preserves protected-main scope and safety
guidance alongside the known-volume correction. Verify its production
Docs consumer at desktop Chromium and narrow WebKit; all seven captures
were inspected natively. Existing chart receipts remain unchanged.
Source-suite completion still awaits the original executor readback.
Contract-Neutral: source-bound browser receipt only; no additional
contract or runtime change.
---
Fleet candidate `20261027T030018Z-web-product` from the `web-product`
lane. Reviewed tip `90f4ea4404147833c52453a97d67900d33e41579` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Use bounded local and PBS artifact discriminators with exact PBS format fallback. Keep archive facts, identities, host handling and admission unchanged. Exercise the poller, typed confirmations and recovery lifecycle, including partial reads and accepted absence.
Contract-Neutral: Correct existing archive guest classification without changing public JSON shape, IDs, timestamps, posture policy or provider access. New poller and lifecycle tests exercise the repair; existing protection-evidence semantics are unchanged.
Change-source: pulse-maintainer
Replace only exact top-level generated launches, retaining ambiguous boot content and recovery on failure. Stage and validate replacement before rename, preserve unrelated jobs and existing modes without assuming FAT supports chmod, and stop installation before claiming unconfirmed boot persistence. Cover compound commands, launch-like data, write faults, FAT permission limits and caller failure in the normal installer inventory.
Change-source: pulse-maintainer
Replace substring and unterminated-range boot deletion with exact
owned-entry admission and staged same-filesystem replacement. Preserve
ambiguous content and failed staging for recovery, and check append plus
flash unmount before claiming persistence. Exercise production
writer/caller failures and keep the existing NAS removal fixtures
composed. Native QNAP acceptance remains separate.
---
Fleet candidate `20261027T010022Z-delivery-trust` from the
`delivery-trust` lane. Reviewed tip
`89969b6418827843a136e1ff70d3e3b59145ae75` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Replace substring and unterminated-range boot deletion with exact owned-entry admission and staged same-filesystem replacement. Preserve ambiguous content and failed staging for recovery, and check append plus flash unmount before claiming persistence. Exercise production writer/caller failures and keep the existing NAS removal fixtures composed. Native QNAP acceptance remains separate.
Change-source: pulse-maintainer
**Keep identical local backup paths independent across PVE nodes**
Scope local archive deduplication and opaque IDs to the exact
connection, storage read node, storage and volume tuple. Keep shared
repository identities unchanged and let only complete accepted scans
retire obsolete legacy IDs. Exercise VM/LXC polling, recovery history,
partial reads, migration, absence, exact tuples and direct-PBS controls.
**Correct the local archive fixture's read-node parameter**
Preserve the requested node when exercising same-path storage reads. The
first exact-candidate proof stopped at compilation before any tests ran;
this changes only the regression fixture, not the runtime repair.
---
Fleet candidate `20261026T234756Z-core-runtime` from the `core-runtime`
lane. Reviewed tip `afdabbe4caac1958af4514d57dfc58c79e27b0ee` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Retain completed activity and Count controls when sizes are missing. Mark unknown-size days separately, label measured bytes as known volume and avoid exact source shares for incomplete totals.
Change-source: pulse-maintainer
Retain the exact 2dbdd3b4 chart/list candidate and its own-parent browser proof after the human agent-authority correction landed first. Preserve protected main's complete storage/access contract, including disabled local reads and PBS continuity, alongside the original activity scope section. No frontend merge resolution or runtime reimplementation.
Change-source: pulse-maintainer
**Cover readable single-attempt SSO save recovery**
Exercise create/edit OIDC and SAML through the real Settings state and
API client, including structured/plain failures, malformed and upstream
responses, draft retention and explicit retry.
Contract-Neutral: Consuming regression tests only; runtime and existing
contracts are unchanged.
**Show readable SSO save guidance without replaying failed writes**
Use the existing API error parser, keep only bounded human guidance in
the active editor, and leave diagnostic envelopes out of browser logs.
Preserve drafts and explicit retry for both provider types; do not infer
no-save after a lost response. Give ordinary phone recovery guidance
more room above the existing controls.
Contract-Neutral: Correct existing SSO failure presentation and
single-submission behaviour; routes, API payloads, access rules,
saved-secret handling and shared Settings shell interfaces are
unchanged.
**Record consuming SSO save recovery browser verification**
Bind exact human-message, fallback, draft and deliberate retry proof to
the production panel at desktop and narrow widths. Native pixel
inspection covers every retained capture.
Contract-Neutral: Browser evidence only; runtime, public interfaces and
verification policies are unchanged.
---
Fleet candidate `20261026T214841Z-web-product` from the `web-product`
lane. Reviewed tip `a4acf08599d0d6451e456d987b4504b24dc9352a` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Do not let a successful same-named peer erase an unread local disk or
qualify its backup history as complete. Resolve ambiguous disabled-node
membership from the bounded datacenter catalogue without querying
disabled content; preserve unknown scopes, accepted shared reads and
cancellation.
---
Fleet candidate `20261026T213457Z-core-runtime` from the `core-runtime`
lane. Reviewed tip `24610bdf267b5dc9c6373a460e752e34010a2542` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Require organization administration for session and proxy callers on collector ingest, acknowledgements and agent configuration while preserving scoped agent token access.
Use the existing API error parser, keep only bounded human guidance in the active editor, and leave diagnostic envelopes out of browser logs. Preserve drafts and explicit retry for both provider types; do not infer no-save after a lost response. Give ordinary phone recovery guidance more room above the existing controls.
Contract-Neutral: Correct existing SSO failure presentation and single-submission behaviour; routes, API payloads, access rules, saved-secret handling and shared Settings shell interfaces are unchanged.
Change-source: pulse-maintainer
Separate staging-file admission from grep no-match in both shipped local
cleanup paths. Resolve shared targets, require intact metadata and
return incomplete results without replacing unrelated keys or caller
resources. Add actual filesystem failure and caller-path controls.
---
Fleet candidate `20261026T204021Z-delivery-trust` from the
`delivery-trust` lane. Reviewed tip
`44b0500abc90788a6fcb257a8ccf931793d2d6e3` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Do not let a successful same-named peer erase an unread local disk or qualify its backup history as complete. Resolve ambiguous disabled-node membership from the bounded datacenter catalogue without querying disabled content; preserve unknown scopes, accepted shared reads and cancellation.
Change-source: pulse-maintainer
**Keep unread PBS namespaces in the live backup inventory**
Carry only transiently unread namespace rows after accepted results,
without renewing their evidence or snapshot-cache clocks. Actual access
rejection and successful empty reads remain authoritative for their raw
scope, including mixed all-failed polls.
Contract-Neutral: Restore scoped live PBS continuity; public API shapes,
identities, limits, policy and access admission are unchanged.
**Cover PBS namespace carry-forward at the live-state bound**
An unread namespace cannot consume the bounded inventory before
independently accepted files. Preserve the newest last-known files
within the unchanged limit.
Contract-Neutral: Regression coverage only; runtime and contracts are
unchanged.
**Keep mixed unread PBS access evidence unknown**
When no namespace can be listed, a transient failure alongside a
rejection does not prove that every datastore was denied. Use fully
terminal datastore counts only for that wholly unread observation;
retain partial-access reporting when another listing succeeds.
Contract-Neutral: Correct existing PBS collection evidence without
changing public API shapes, identities, policy, limits or access
admission.
**Assert the mixed PBS access evidence boundary**
Bind the whole-failure regression and both owning contracts to unknown
access for mixed rejected/transient scopes, not invented universal
denial.
Contract-Neutral: Regression and contract clarification for the existing
collection-evidence correction; public interfaces and access admission
are unchanged.
---
Fleet candidate `20261026T200652Z-core-runtime` from the `core-runtime`
lane. Reviewed tip `4a4af72094090c1f508d640349d35cf177e1047b` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Use one filtered inventory for count, volume and the By date list. Keep day selection downstream so the other scoped dates remain selectable, and do not advertise unrelated activity for unresolved locations or empty matches.
Change-source: pulse-maintainer
**Keep backup evidence stable through native scrolling and polling**
Use the canonical keyed measured-row renderer for Coverage and By date,
with an opt-in outer extent reserve derived from all measured keyed
items. Tall evidence remains readable through live inventory replacement
and native window retirement without moving the operator viewport;
closing and filtering release the reserve. Retain the bounded row
budgets and full-result semantics, remove the obsolete helper and stale
ownership references, and exercise both consumers and the shared
primitive in the repository suites.
**Record consuming backup scroll and inventory browser proof**
Bind final source content to desktop Chromium and narrow WebKit journeys
through production backup consumers in the native app scroller,
including real polling, measured departure/return, fully visible estate
endpoints and reserve release. Runtime and tests are unchanged.
---
Fleet candidate `20261026T193406Z-web-product` from the `web-product`
lane. Reviewed tip `f7cfbc14c2f42ff374881f09e523416a553fbb3f` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Separate staging-file admission from grep no-match in both shipped local cleanup paths. Resolve shared targets, require intact metadata and return incomplete results without replacing unrelated keys or caller resources. Add actual filesystem failure and caller-path controls.
Change-source: pulse-maintainer
**Require complete inventory for legacy credential cleanup**
Keep Proxmox API JSON on the parser's stdin and validate every identity
before key cleanup. Failed inventory and key replacement must not become
empty successful cleanup; opted-in API removal propagates failures and
preserves the user when token removal is incomplete.
Exercise cluster discovery, local key preservation and API removal with
closed fixtures, alongside the existing SSH trust and stopped-container
controls.
**Preserve shared SSH key targets during legacy remote cleanup**
Resolve the fixed remote authorized_keys symlink before staging an
atomic target replacement. Fail closed on unresolved, non-file,
filtering, metadata and replacement errors, and leave already-clean
shared keys untouched.
Execute the actual transmitted POSIX payload against closed regular-file
and shared-link fixtures, with unrelated recovery-key and
failure-preservation checks. Exercise its failure through validated
cluster discovery into main without live SSH or customer operations.
**Match the final legacy-cleanup success message exactly**
The remote failure proof correctly reached main's nonzero incomplete
result. Its broad success substring also matched the truthful
local-file-cleanup warning, so narrow the assertion without changing the
runtime or cleanup contract.
Contract-Neutral: Test-only assertion precision; no runtime or contract
change.
---
Fleet candidate `20261026T194603Z-delivery-trust` from the
`delivery-trust` lane. Reviewed tip
`07e630d34ecf9b304e0f23775141bba7f6da7477` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Bind the whole-failure regression and both owning contracts to unknown access for mixed rejected/transient scopes, not invented universal denial.
Contract-Neutral: Regression and contract clarification for the existing collection-evidence correction; public interfaces and access admission are unchanged.
Change-source: pulse-maintainer
Use the canonical keyed measured-row renderer for Coverage and By date, with an opt-in outer extent reserve derived from all measured keyed items. Tall evidence remains readable through live inventory replacement and native window retirement without moving the operator viewport; closing and filtering release the reserve. Retain the bounded row budgets and full-result semantics, remove the obsolete helper and stale ownership references, and exercise both consumers and the shared primitive in the repository suites.
Change-source: pulse-maintainer
Carry only transiently unread namespace rows after accepted results, without renewing their evidence or snapshot-cache clocks. Actual access rejection and successful empty reads remain authoritative for their raw scope, including mixed all-failed polls.
Contract-Neutral: Restore scoped live PBS continuity; public API shapes, identities, limits, policy and access admission are unchanged.
Change-source: pulse-maintainer
**Keep unread local backup files scoped to their storage node**
A successful listing of local on one PVE node cannot establish absence
on another local disk. Keep runtime read origin distinct from guest
location and retain unread files without renewing evidence, while
accepted sibling catalogue or content removal still takes effect.
Preserve shared and node-restricted behavior, complete-read
reconciliation and public JSON.
Contract-Neutral: Restore existing unread-backup retention and
independent-source isolation with runtime-only provenance; no public
JSON, identity, policy, storage schema or access contract changes.
**Avoid overlapping backup documentation insertions**
Move the local-storage read-origin section below the existing
protection-assessment section so it merges with the published
calendar-date documentation. Preserve every documentation paragraph and
all reviewed runtime and test bytes.
Contract-Neutral: Documentation placement only; no runtime, test,
frontend or contract change.
---
Fleet candidate `20261026T185010Z-core-runtime` from the `core-runtime`
lane. Reviewed tip `c4205208ad6198f29eb2086e8f06b17598163f79` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Resolve the fixed remote authorized_keys symlink before staging an atomic target replacement. Fail closed on unresolved, non-file, filtering, metadata and replacement errors, and leave already-clean shared keys untouched.
Execute the actual transmitted POSIX payload against closed regular-file and shared-link fixtures, with unrelated recovery-key and failure-preservation checks. Exercise its failure through validated cluster discovery into main without live SSH or customer operations.
Change-source: pulse-maintainer
Move the local-storage read-origin section below the existing protection-assessment section so it merges with the published calendar-date documentation. Preserve every documentation paragraph and all reviewed runtime and test bytes.
Contract-Neutral: Documentation placement only; no runtime, test, frontend or contract change.
Change-source: pulse-maintainer
Keep Proxmox API JSON on the parser's stdin and validate every identity before key cleanup. Failed inventory and key replacement must not become empty successful cleanup; opted-in API removal propagates failures and preserves the user when token removal is incomplete.
Exercise cluster discovery, local key preservation and API removal with closed fixtures, alongside the existing SSH trust and stopped-container controls.
Change-source: pulse-maintainer
A successful listing of local on one PVE node cannot establish absence on another local disk. Keep runtime read origin distinct from guest location and retain unread files without renewing evidence, while accepted sibling catalogue or content removal still takes effect. Preserve shared and node-restricted behavior, complete-read reconciliation and public JSON.
Contract-Neutral: Restore existing unread-backup retention and independent-source isolation with runtime-only provenance; no public JSON, identity, policy, storage schema or access contract changes.
Change-source: pulse-maintainer
Build consecutive local-date buckets instead of stepping fixed 24-hour intervals. Keep the whole oldest and final local days visible without admitting future or undated evidence. Exercise spring, autumn and half-hour changes across all ranges in the ordinary activity suite.
Change-source: pulse-maintainer
Keep runtime-only provider authority through conversions and reconcile
legacy snapshots before persistence. Reject environment-managed writes
before bound handlers or service callbacks, while preserving independent
saved-provider editing and detached authorization snapshots.
Contract-Neutral: Restore existing environment-provider immutability,
non-persistence and snapshot isolation. The additive marker is
runtime-only and changes no HTTP payload, route, entitlement,
agent-lifecycle or storage-recovery contract.
---
Fleet candidate `20261026T171540Z-core-runtime` from the `core-runtime`
lane. Reviewed tip `b801b34381952c1fff78fc6fc135ff19e880f6b7` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
**Keep backup-location filters scoped to one repository**
Preserve the source, connection and repository tuple without folding
case or delimiter boundaries. Resolve legacy saved locations only while
their current interpretation is unique, and provide a removable choice
when it is not. Restore the useful withdrawn repair on current main with
a mounted-refresh regression; prior failed browser evidence remains
separate.
**Exercise refreshed location recovery through its active chip**
The first exact-source proof exposed an invalid regression selector:
active filters are changed through their chip, not the add-filter
select. Preserve that failure and test the supported existing recovery
interaction.
Contract-Neutral: Corrects a regression test selector to exercise the
already documented active-filter interaction; no runtime or contract
delta.
**Record scoped backup-location browser evidence**
Bind desktop keyboard and narrow WebKit touch proof to the final source.
Preserve the failed evidence runners and complete only their remaining
interactions; no native recovery or historical crash clearance is
claimed.
Contract-Neutral: Records source-bound browser acceptance for the
documented location-filter repair; no runtime or contract delta.
---
Fleet candidate `20261026T170022Z-web-product` from the `web-product`
lane. Reviewed tip `46d1b157195e79d52aa05f131ef8822b68dd250e` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
PVE and PBS report an ordinary failed read of one storage, datastore or
snapshot listing as partial history with unknown access. Posture treated
that unknown access as unreadable history. One failed target therefore
turned every guest in the cluster **Unknown**, with an explanation
blaming permissions, even for guests whose fresh, verified backup Pulse
had just read. A permission-denied partial read already showed
Attention, so the milder failure produced the harsher state.
When history is partial, unknown access describes only the unread part,
so this change counts it as partial:
- A guest with a readable backup shows Attention: "A backup exists, but
Pulse can see only part of the backup history or cannot read all of it."
- A guest without one shows Attention that does not claim a backup
exists.
- Unavailable history and denied access still fail to Unknown.
This matches the storage/recovery contract ("partial … evidence is
attention; unavailable … fails to unknown") and the legend on Backups >
Coverage. Companion to #3344, which removed the most common trigger:
node-restricted PVE storage counted as a failed read.
Tests: three new truth-table cases (partial + unknown access with and
without a backup, and unavailable + unknown access staying Unknown). The
partial cases fail on main.
`TestPBSOrdinaryPollSnapshotFailuresDoNotClaimCompleteHistory`
"transient" now expects Attention, the same as its "denied" sibling.
Keep runtime-only provider authority through conversions and reconcile legacy snapshots before persistence. Reject environment-managed writes before bound handlers or service callbacks, while preserving independent saved-provider editing and detached authorization snapshots.
Change-source: pulse-maintainer
Contract-Neutral: Restore existing environment-provider immutability, non-persistence and snapshot isolation. The additive marker is runtime-only and changes no HTTP payload, route, entitlement, agent-lifecycle or storage-recovery contract.
Proxmox lists storage restricted to other nodes as disabled on every
node it is excluded from. Since 0dfa8c193e each of those rows counted as
a failed content read, so any cluster with node-restricted backup
storage published partial PVE history with unknown access on every poll.
The posture engine turns that into **Unknown** for every guest in the
cluster, including guests with a fresh, verified backup.
Seen on a three-node homelab after upgrading 6.6.0 to 6.7.0-beta.1: all
38 guests on Backups > Coverage showed Unknown and the Protected filter
was empty, while the same rows showed backups from 3h ago with task OK.
The stored provider observations flip from `complete/sufficient` to
`partial/unknown` at the upgrade minute and stay there. Every PBS
storage reads fine on the node it is pinned to.
The fix decides "unread" per storage after all nodes are walked. A
target skipped on one node but listed on another was read. Only a target
no node listed still makes the history partial, so the
disabled-everywhere behaviour from 0dfa8c193e is unchanged.
`TestPVEProtectionNodeRestrictedStorageReadElsewhereIsComplete` fails on
main with the production shape (state unknown, history partial,
permissions unknown) and passes with the fix, in both node orders. The
existing disabled-storage and reconciliation tests still pass.
PVE and PBS report an ordinary failed read of one storage, datastore or
snapshot listing as partial history with unknown access. Posture treated
the unknown access as unreadable history, so a single failed target
turned every guest in that cluster Unknown with an explanation blaming
permissions, even guests whose fresh, verified backup Pulse had just
read. A permission-denied partial read already showed attention, so the
milder failure produced the harsher state.
When history is partial, unknown access describes only the unread part.
Count it as partial: guests with a readable backup show attention ("only
part of the backup history"), guests without one show attention that
does not claim a backup exists. Unavailable history and denied access
still fail to unknown, as the storage/recovery contract already states.
**Bound synchronous audit exports and summaries**
Limit the actual query to 10001 rows and refuse selections over 10000
before verification or encoding. Preserve complete accepted results,
selectors, signatures and access boundaries, and explain how to narrow a
refused selection.
**Align audit selection fixtures with the export row ceiling**
Keep the existing time, selector and verification assertions while
expecting the bounded read instead of an unlimited query.
**Use the canonical API error fields in audit bound checks**
Fix the new HTTP test's compile error and assert the bounded selection
error's status and maximum-event detail as well as its recovery
guidance.
---
Fleet candidate `20261026T155503Z-core-runtime` from the `core-runtime`
lane. Reviewed tip `0431bb8e14c39501f471b8cb667f3944708433e2` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Preserve the source, connection and repository tuple without folding case or delimiter boundaries. Resolve legacy saved locations only while their current interpretation is unique, and provide a removable choice when it is not. Restore the useful withdrawn repair on current main with a mounted-refresh regression; prior failed browser evidence remains separate.
Change-source: pulse-maintainer
Proxmox lists storage restricted to other nodes as disabled on every
node it is excluded from. Since 0dfa8c193e every such row counted as a
failed content read, so any cluster with node-restricted backup storage
published partial PVE history with unknown access on every poll. The
posture engine turns that into Unknown for every guest in the cluster,
even guests with a fresh, verified backup: on a three-node cluster with
PBS storages pinned to single nodes, the Backups coverage table showed
all 38 guests as Unknown after upgrading to 6.7.0-beta.1.
Decide unread per storage after all nodes are walked. A target skipped
on one node but listed on another was read; only a target no node
listed still makes the history partial, which keeps the disabled-
everywhere behaviour 0dfa8c193e introduced.
Pass the query abort signal through every posture batch and cancel sibling requests when one batch fails. Keep original errors and whole-read recovery semantics intact, with regression coverage for scope changes, organisation switches, disposal, replacement and polling.
Change-source: pulse-maintainer
Limit the actual query to 10001 rows and refuse selections over 10000 before verification or encoding. Preserve complete accepted results, selectors, signatures and access boundaries, and explain how to narrow a refused selection.
Change-source: pulse-maintainer
The daily install/recovery rehearsal stopped before installation in run 40343060586 when GitHub cancelled a metadata stream. Retry only that exact transport-only exit, with fixed GET identities, deadlines and a finite budget; discard partial output and stop on refusals, malformed data, signals or unknown errors.
Exercise the actual workflow resolver with synthetic process outcomes and retain the existing signed installation, update and rollback contracts. This changes no release gate or deployment operation.
Change-source: pulse-maintainer
**Reject malformed backup protection assessments**
Validate every posture batch, provider state and policy before
publishing health. Reject duplicate subjects and mixed policies through
the existing unavailable/retry path while preserving independent restore
evidence. Add registered parser, hook and consuming regressions and
update the recovery contract.
**Record posture response boundary browser proof**
Bind desktop Chromium and narrow touch WebKit proof to the containing
committed source, including malformed reads, source-local
pending/recovery, open-detail focus and whole-read handling for a
201-guest fleet.
---
Fleet candidate `20261026T133226Z-web-product` from the `web-product`
lane. Reviewed tip `cadf17e87bbc00c02598185f7bef9d5f7ad02682` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
## What
Every job that reads a release, signing or registry credential now
declares
`environment: release`, and `scripts/check_workflow_trust.py` enforces
it.
- 20 jobs across `create-release`, `build-release-candidate`,
`publish-docker`,
`promote-floating-tags`, `promote-private-pro-runtime`,
`recover-release-activation`, `backfill-release-assets`,
`retry-release-convergence`, `release-signing-preflight`,
`signpath-test-signing` and `canonical-private-governance` declare
`environment: release`. `qualify-browser-update-release` declares
`infra` for
its tailnet credentials. `PULSE_LICENSE_PUBLIC_KEY` is a public key and
stays
repository-wide.
- The checker reads job structure with a duplicate-key-rejecting YAML
loader
and scans both raw text and decoded values for secret expressions
(case-insensitive, across lines, quote-aware). It requires the literal
release environment for release credentials and a deployment environment
for demo/tailnet credentials (the demo workflow's runtime choice only in
its
own job). It refuses dynamic `secrets[...]` access and workflow-level
secret
env, and requires any push workflow that reads a secret to admit exactly
`branches: [main]`.
## Why
Release secrets are repository-level today, so any workflow run on any
branch,
including a pushed proposal branch before review, can read them. The
release
train is switching to post-merge `release-dispatch/*` branches that only
the
release dispatcher App can create (ruleset-enforced). A `release`
environment
admitting only `main` and `release-dispatch/*` then keeps these
credentials
away from unmerged code.
## Merge order (draft until then)
Stacked on #3297. Do not merge until:
1. a beta has published through a `release-dispatch/*` dispatch, and
2. the `release` (branches `main`, `release-dispatch/*`) and `infra`
(`main`)
environments exist with branch-typed policies, so the first post-merge
run
does not auto-create an unprotected environment.
Repository-level secret copies stay until no snapshot without these
declarations can still be dispatched or recovered.
## Validation
- Live tree passes the checker; `test_workflow_trust.py` 50 OK,
including new
cases for every rule and for bypasses found in review (lower-case names,
`}}` inside strings and YAML-escaped quotes, `release#x`, duplicate
keys,
quoted `tags`/`inherit`, a push key hidden in a description, the demo
expression outside its job).
- Eleven mutations, one per guard, each fail the tests.
- All 1301 `scripts/tests`, Go `scripts/installtests`, and
`release_promotion_policy_test.py` 74 OK (new proof test pins the
release
jobs' environment). Release-control discovery has 17 failures and 1
error
that are identical on `main` and on this branch's base.
Validate every posture batch, provider state and policy before publishing health. Reject duplicate subjects and mixed policies through the existing unavailable/retry path while preserving independent restore evidence. Add registered parser, hook and consuming regressions and update the recovery contract.
Change-source: pulse-maintainer
A Mac backing up to a network Time Machine destination mounts the backup
disk image plus one read-only APFS snapshot per retained backup. The
agent reported every one of them as a machine disk, so a Mac Mini showed
a dozen extra rows under /Volumes/.timemachine/ and "Backups of <host>",
each at a false 92%: the image advertises the sparse bundle's 15 TB
ceiling, not the destination's real free space.
macOS marks all of these mounts nobrowse (MNT_DONTBROWSE, "not a path to
user data"), as it does the APFS companion volumes and simulator
runtimes already filtered by path. The collector now skips nobrowse
mounts before the usage syscall unless the operator explicitly includes
them. /Volumes/.timemachine/ also joins the shared special mountpoints,
so the server hides snapshot rows that agents without this change still
send.
pulse-triage[bot]