Compose current main e2f4bdff03 additively. Retain both subsystem records and the held change-age control while withdrawing only the obsolete Discovery identification test. Reviewed identities and ancestry, canonical guest History ownership and upstream feature removal remain intact.
Change-source: pulse-maintainer
Read optional intake precautions at their expandable report fields, bind OpenShift Secret tests to the validated private file, and target helper workflow negative controls by step. Preserve the prepared GNU timeout in the private teardown probe on macOS and keep the actual security migration boundaries mandatory. Production guidance, installer behaviour and platform coverage are unchanged.
Contract-Neutral: Fixture-only integration repair; no product, installer, workflow, deployment or safety contract delta.
Change-source: pulse-maintainer
Combined-source validation found the removal-help assertion still looking for a direct systemctl stop after accepted teardown moved that operation into its fail-closed shared helper. Verify the actual helper call before revocation and retain stop, disable and complete-set readback assertions, with missing, late and ignored-call adverse controls.
Contract-Neutral: Test-fixture reconciliation only; no installer, help, lifecycle, schema or authority change.
Change-source: pulse-maintainer
Require bounded diagnostic-free service and all-runlevel readback before server removal or local mutation, and reconcile again after remote confirmation while recovery state still exists. Refused stops, disable failures, unknown reads and unexpected init paths retain local material; absent and repeated removal need independent manager/process absence. Add executable confined refusal, ordering, custom-runlevel and timeout-child controls to the registered installer hook and owning contracts. Native OpenRC, Windows, other-manager and installed acceptance remain separate.
Change-source: pulse-maintainer
SSO operators can hold permitted non-administrative write capabilities. The guide now checks the actual instance-administration boundary, without instructing a settings mutation or changing roles.
Change-source: pulse-maintainer
Preserve the exact reviewed candidate and its portable proof. Hosted native systemd receipts, matching Go compilation, signed installed-agent transport and Windows recovery remain separate acceptance obligations.
Change-source: pulse-maintainer
Copy generated callbacks only after provider save, align group-claim advice with provider-specific scopes, and retain administrator access until separate-session permission checks pass. Keep shipped documentation and regression checks in step without changing authentication or provider behaviour.
Change-source: pulse-maintainer
Preserve the exact reviewed guide and regression-test commits. Retained command controls and browser evidence establish safer credential paths and permission diagnostics without cluster or privilege changes.
Change-source: pulse-maintainer
Preserve the five reviewed Core commits exactly. Blank-only bootstrap admission and the matching persistence path retain existing access; authenticated transfer remains unchanged.
Change-source: pulse-maintainer
Run the accepted Unix teardown functions on fresh public Linux x64 and ARM64 CI, with real stop refusal, socket activation, batch reactivation and independent process/file readback. Retain bounded source-bound phase and owned-cleanup receipts; keep synthetic revocation separate from installed TLS, signed-agent and Windows acceptance.
Change-source: pulse-maintainer
The copied token recipe followed linked paths and continued without its own failure boundary. Reject unsafe paths before editing or contacting the cluster, preserve scoped file-only provisioning, and distinguish Kubernetes RBAC from local pod privilege and missing usage. Exercise the exact copied recipes with synthetic inputs and render the served guidance.
Contract-Neutral: Existing Kubernetes help and its regression tests only; no runtime, API, chart, role, deployment profile or feature change.
Change-source: pulse-maintainer
Load the production quiescence helpers in the existing failed-revocation fixture and provide complete closed systemd observations. Continue testing the actual revocation refusal after verified stop/disable rather than replacing or bypassing the new safety boundary.
Change-source: pulse-maintainer
Replace ignored stop and disable failures with bounded complete state observations and independent inactive/non-enabled readback. Reconcile helper socket and service together, and quiesce the full uninstall activation set before remote or local mutation. Preserve failed runner revocation material and existing saved-state, token, trust and platform boundaries. Add executable production-shell refusal, reactivation, timeout and owned-cleanup controls.
Change-source: pulse-maintainer
Require a blank destination instead of using nodes.enc as a first-run sentinel. Recheck before writes, retain unknown or unreadable state, and leave deliberate authenticated transfer unchanged. Keep deployment .env provisioning and encrypted file precedence; explain the separate archive path in canonical and served help.
Change-source: pulse-maintainer
The v4-to-v5 entry point still offered privileged download-and-purge cleanup and duplicate update shortcuts despite safer current procedures. Preserve configuration, credential and workload recovery evidence, separate server and agent paths, and link the inspected local cleanup without broadening it.
Contract-Neutral: Existing customer guidance, shipped Markdown and focused regression checks only; no runtime, API, permission, installer or cleanup contract changes.
Change-source: pulse-maintainer
Retain exact PI candidate identity and its proof; existing configuration-transfer help now states the real admission gate and replacement limits.
Change-source: pulse-maintainer
Non-interactive token-file reading currently erases the supplied credential before permission checks and authenticated removal, including when removal is refused or its result is unknown. Treat token-file ingress as read-only: callers own their bootstrap cleanup, and confirmed removal still deletes only authorised runtime state. Keep token validation, TLS policy, exact record confirmation and credential-free local removal unchanged.
Extend the existing portable removal fixture through the actual parser and token ingress, root refusal and post-confirmation owned cleanup. Parent proof records thirty premature-erasure failures; a separate no-TTY harness control remains distinct. Update both owning contracts and the registered Go inventory hook together. Native Windows, compiled TLS and installed whole-job acceptance remain separate.
Change-source: pulse-maintainer
Document the existing nodes.enc gate, replacement scope, file precedence and non-fatal import errors. Preserve agent identity and excluded state, isolate provisioning from live traffic, and keep one-shot inputs private rather than forcing a reset.
Contract-Neutral: Existing bootstrap and encrypted-import behaviour is unchanged; this corrects canonical and served help, with documentation regression controls.
Change-source: pulse-maintainer
Retain the exact Delivery candidate b3b368c21b and its attributed PR2855 adaptation. Independent review verifies one-read failure retention and unchanged runtime-proof bytes; no native installation or published availability is claimed.
Change-source: pulse-maintainer
Adapt rcourtman’s Pulse PR2855 (aef53d0d3e), which diagnosed systemd’s silent exit-one absence. The original contributor commit is unchanged and explicitly credited, not imported, amended or re-parented in this maintainer candidate.
One bounded stdout/stderr observation accepts genuine absence but retains failed first reads, other statuses and blank-line output. Include the existing registered installer/updater verification hooks, real-empty-root controls and missing-unit recovery double in this same source commit. This replaces the rejected foreign-history composition with a normal maintainer-reviewed implementation; no provenance policy, credential or host installation changes.
Source-attribution: rcourtman, https://github.com/rcourtman/Pulse/pull/2855, aef53d0d3e
Change-source: pulse-maintainer
Align existing removal and orphan-service help with credential-first Unix admission. Explain same-instance recovery, keep older served scripts and Windows behaviour distinct, and prevent stopping retries from being mistaken for revocation or completed removal.
Contract-Neutral: Existing operator guidance and regression assertions only; no runtime, schema, lifecycle or trust-boundary change.
Change-source: pulse-maintainer
Credential-bearing removal currently short-circuits its confirmation gate when connection recovery leaves no URL, allowing local teardown without durably removing the server record. Check credential presence first and stop with same-instance recovery guidance before any process, service or state teardown. Keep credential-free local-only removal and existing exact-record/path authority intact.
Execute the real admission and initial teardown with private transport/service doubles, including every saved credential form, refusal, unknown response, identity mismatch and authorised cleanup. Register the portable Python controls in the installer inventory and describe the boundary in both owning contracts. Native Windows/TLS and whole installed lifecycle acceptance remain separate.
Change-source: pulse-maintainer
Accept original failure evidence without another reproduction or a diagnostic export, and place public-sharing precautions before readers leave for GitHub. Keep the shipped documentation index in sync and guard both entrypoints within the README page budget.
Contract-Neutral: Documentation-only intake guidance and regression checks; no runtime, API, collection, authentication or release contract changes.
Change-source: pulse-maintainer
Accept exact product-intelligence candidate 5db15c9366. Retained source-stb_euh2 verifies all 46 selected documentation checks, public links and shipped mirrors; token generation and hint semantics agree with source. Runtime and credential policy are unchanged.
Change-source: pulse-maintainer
The Pi authentication report identified duplicated token characters despite a matching partial hint. Check correct, duplicated-middle and legacy input through the real generated terminal prompt and installer writer, including restoration of the original synthetic value and private hand-off cleanup. Clarify the existing guide without imposing a token-shape rule or claiming installed reporting recovery.
Contract-Neutral: Documentation and regression coverage only; command generation, credential selection, authentication, scopes, trust and runtime behaviour are unchanged.
Change-source: pulse-maintainer
The current host installer issues a 64-character lowercase hexadecimal token, but a bare file and matching inventory hint can still hide duplicated or changed middle characters. Explain the private whole-value check before first installation and its limits during authentication triage. Preserve other credential families, installation state, scopes and trust.
Contract-Neutral: Existing setup and authentication guidance only, with source-bound documentation checks. Runtime behaviour, credential formats, scopes and trust are unchanged.
Change-source: pulse-maintainer
Apply the existing ten-second deadline to both qm and its response reader. Stop only the local collection group even when a producer exits with an inherited pipe or a reader ignores TERM. Preserve byte limits, independent failures, private output and the refusal to probe or change a guest; test actual owned-reader termination and the mirrored help.
Contract-Neutral: Passive operator diagnostics and existing help only; Proxmox polling, guest-agent admission, APIs, storage, permissions and service behaviour are unchanged.
Change-source: pulse-maintainer
The staged commit guard read tracked status and registry JSON from the
working tree, so unstaged changes could alter its verdict. Read both
inputs strictly from the Git index and fail when an input is missing.
Regression tests use real Git indexes. They cover valid and malformed
unstaged edits, deleted working-tree files, and missing index entries.
The new tests fail against the previous implementation.
Validation: all 12 staged-guard tests and all 10 shared file-reader
tests pass. Control-plane, status, registry and staged contract audits
pass.
Compose the exact observed upstream additively without rewriting reviewed tip 805ea6d712 or any accepted ancestry. The new Go 1.26.9 and x/net graph need matching final-source evidence before this batch can be proposed.
Change-source: pulse-maintainer
The commit guard read tracked status and registry files from the working
tree, allowing unstaged edits to change its decision about staged content.
Use the shared strict index reader and fail when required inputs are absent.
Regression tests use real Git indexes and cover divergent, malformed and
missing working-tree files plus missing index entries.
The canonical security guide still encouraged Debug logging, broad service/log inspection and a fresh unmounted Docker container. Route verification through existing bounded private evidence, distinguish file rotation from journal, container and audit retention, and preserve the active deployment when changing logging. Keep the shipped guide synchronized and check these boundaries against the current server source.
Contract-Neutral: Correct existing security guidance and its regression checks without changing runtime, permissions, credential handling, API behaviour or subsystem contracts.
Change-source: pulse-maintainer
govulncheck on the pinned 1.26.8 toolchain reports twelve reachable
standard library vulnerabilities in Pulse (net/http, crypto/tls,
html/template, os, net/textproto), published on 2026-10-08 and fixed in
Go 1.26.9. golang.org/x/net v0.58.0 carries further advisories fixed in
v0.60.0. With 1.26.9 and x/net v0.60.0 the scan reports no affecting
vulnerabilities under both govulncheck v1.1.4 and v1.7.0.
Pulse's own govulncheck job last ran on 2026-10-05, so nothing flagged
this. The private Enterprise build and test job notices it: once the scan
finds reachable advisories it needs more than the 4 GiB CI VM holds, the
guest kernel kills govulncheck, and the job is cancelled. That has failed
every Enterprise pair check since 2026-10-08, including the first
beta's.
Move every release builder and local toolchain guard together, as 1.26.8
did, so no candidate artifact keeps an older compiler: go.mod, the
builder image digests (index digest for 1.26.9-alpine), the release and
dev scripts, the devcontainer, and the root pair diagnostic. Only x/net
is raised in the module graph; go mod tidy is deliberately not run, so
unrelated indirect requirements stay as they were.
Contract-Neutral: Toolchain and indirect dependency patch update that clears reported advisories; no product or runtime contract changed.
AI Discovery ran a separate model-backed service scanner beside Patrol
and the Assistant: its own store, scheduler, model route, API, tool and
drawer UI. No telemetry counter ever measured its use (the telemetry
discovery_enabled flag OR'd it with network subnet discovery), the
maintainer judged it a flop, and the context it produced is already
available to the models through pulse_query, pulse_read and the
unified-resource context sections.
This deletes internal/servicediscovery, internal/ai/infradiscovery, the
pulse_discovery tool, the /api/discovery routes, the mock Discovery
fixtures, the Discovery tabs in the resource, guest, node and Docker host
drawers, the identified-service cards, readiness badges, provenance
markers, suggested web-interface URLs, the Workloads AI Context column,
the chat "Discovery is off" hint and the AI Service Context settings page.
The old settings route redirects to Assistant settings. The model-bound
sanitizer allow-list existed only to pass Discovery context through, so it
goes too, along with the CopyableCodeRow primitive that only the
Discovery tab used.
Network subnet discovery (/api/discover, the Infrastructure discovery
settings) and the discoveryTarget agent coordinates are separate features
and stay. Stored discovery_enabled, discovery_interval_hours and
discovery_model AI settings are ignored on load; the settings API decoder
is lenient, so older frontends saving those fields still succeed.
Preserve Delivery tip 00680c9c5a exactly in merge ancestry. Resolve the overlapping startup helper to the candidate implementation and retain the canonical diagnostic controls and existing documentation. Frontend test formatting is already present; no runtime UI or workflow changes.
Change-source: pulse-maintainer
Beta cut from main at 7520daae8e. It carries every change merged since stable v6.5.0.
Contract-Neutral: Release-only v6.6.0-beta.1 version, release notes and distribution metadata; no public install or runtime contract changes.
Change-source: pulse-maintainer
Use the existing exact-completion validator for de5f541553 and bf2742cce6. The validator still requires ancestry, substantive contracts and the registry-selected proof; preserve all original commits and enforced checks.
Change-source: pulse-maintainer
Completed PR2825 CI reports Windows Unix-type compilation failures and three Prettier fixture failures. Compile the existing Linux-only MSP daemon fixture only on Linux and format the unchanged frontend assertions. Separate successful CLI stdout from retained stderr diagnostics so Compose warnings cannot corrupt container identities, ports or bootstrap facts; add three executable controls without changing deadlines or acceptance gates.
Change-source: pulse-maintainer
The release train now cuts a beta every two days before the release
candidate. Its first beta, v6.6.0-beta.1, failed its preparation checks
twice: the governance test that maps VERSION to its release packet only
matched -rc.N, and two tests required the release index to say "current
v6 release candidate packet" while the metadata tool writes "current v6
beta packet" for a beta.
Accept -beta.N where the packet paths are derived and derive the expected
index wording from the version. Release candidates and stable releases
are checked exactly as before.
Contract-Neutral: Release metadata tests only; no runtime, API, install or customer contract change.
Preserve every accepted maintenance commit while incorporating human-authored diagnostics token visibility. Resolve API guide overlap by retaining the shared ai:execute narration gate, explicit deterministic fallback and CSV refusal in both mirrors.
Change-source: pulse-maintainer
pulse-triage[bot]