Require whole bounded, unambiguous enumerations on the efficient and node fallback routes. Preserve scoped empty inventories, LXC integer compatibility and ordinary counter/receipt semantics. Validate retained readings, History, breaches and template policy through actual fallback and recovery.
Change-source: pulse-maintainer
Consume the bounded response through EOF before admitting nodes or a cluster probe. Reject missing, ambiguous and incomplete inventories without leaking response details, retain scoped empty arrays and provider metadata, and cover trusted startup, recovery, cached reads and consuming endpoint projection.
Change-source: pulse-maintainer
Contract-Neutral: Tightens existing node-inventory and recovery-health admission without changing the public response schema, API surface, permissions, TLS or guest-command policy.
Replace the old optimistic-health expectation with cached selection, failed-request and later-success controls. Advance no production clock or safety fence and avoid an irrelevant constructor attempt in the in-memory fixture.
Contract-Neutral: Test-only correction to the recovery contract established in 4147f48db3; runtime and browser inputs are unchanged.
Change-source: pulse-maintainer
Require the actual nodes/login probe to succeed at startup, recovery and lazy selection instead of accepting guest-like response text. Retain failed single-endpoint health until an ordinary request succeeds, preserving cached last-resort reads, real guest error handling, temporary rate-limit handling and trust policy. Add producing-path and connected projection regressions and revise the old nodes-as-guest fixture contract.
Change-source: pulse-maintainer
The projection fixture now uses the actual saved ClusterEndpoint schema. Give each malformed-filesystem fixture an independent base path so reused listener ports cannot borrow a previous live uncertainty fence; all real guard state and response assertions remain.
Contract-Neutral: Test-only schema correction and independent synthetic endpoint identity; no production policy, deadline, wire or configuration changes.
Change-source: pulse-maintainer
A completed first-use retry does not return its nodes payload. Omit that unknown diagnostic count rather than reporting zero. Concurrent ordinary reads may legitimately open additional TLS sockets, so the construction control bounds logins and probe reads rather than pooled read connections.
Contract-Neutral: Diagnostic-count fidelity and fixture-only connection counting; no wire, trust, polling, authority or consumer contract delta.
Change-source: pulse-maintainer
The shared probe must release the health mutex for first-use trust. Retain the prior single construction boundary so joined readers do not duplicate capture and password login. The actual TLS concurrency control checks eight ordinary reads and nonblocking health inspection.
Contract-Neutral: Preserve existing serialized lazy client construction while releasing only the health and trust mutex for first-use capture; no wire, authority, configuration or consumer contract changes.
Change-source: pulse-maintainer
Use one bounded first-use probe for constructor and nodes-read pin failures at startup, recovery and lazy selection. Keep capture credential-free, primary and saved pins immutable, and full polling-session acceptance separate. Qualify all existing auth encodings and refusal, cancellation and consuming projection controls.
Change-source: pulse-maintainer
The containing race suite observed a prior cooldown before the invalid-success matrix sent its first HTTP request. Use per-case synthetic base paths instead of recycled listener authority; prove two first admissions and preserved cross-client fences on one shared listener. Production admission keys, aliases and safety state are unchanged.
Contract-Neutral: Isolate synthetic test identities; no production guest admission, TLS, session, polling or History contract delta.
Change-source: pulse-maintainer
Reject incomplete or ambiguous 200 login bodies before replacing ticket, CSRF, expiry and PVE generation. Preserve retained sessions, joined renewal failures, normal encoding fallback and later ordinary recovery; cover real pinned startup/poll/broadcast consumption.
Contract-Neutral: Restore existing complete-session and failed-renewal preservation guarantees; no API/wire schema, TLS trust, credential authority, guest lifecycle, polling cadence or History contract delta.
Change-source: pulse-maintainer
Carry cancellation through PVE/PBS construction, cluster probes and retained sessions, startup retries and port fallback. Preserve prior health/errors on caller termination; accepted clients retain independent ordinary reads and full timeouts. Cover real pinned HTTPS cancellation, deadlines, form fallback and first-poll publication.
Contract-Neutral: Restore existing caller cancellation and usable-session guarantees; no wire/API schema, agent lifecycle, TLS trust, guest safety, polling cadence or History contract delta.
Change-source: pulse-maintainer
Retain the actual authentication refusal and existing client when the full-timeout session cannot be constructed after a successful short probe. Cover pinned HTTPS rejection, malformed and form-refused sessions, later ordinary recovery and the monitor endpoint projection.
Change-source: pulse-maintainer
Validate result/content/truncated types before shared guest-command admission is released. Scalar results must not become empty inventories, and wrongly typed file fields must not release admission before decoder failure. Preserve compatible empty/null rows and completed but unusable measurements. Add six-reader, alias/expiry and actual-state polling/broadcast/History controls with untouched healthy-read origins. Native thaw and restart recovery remain separately unverified.
Change-source: pulse-maintainer
Retain the shared resolver and request authority while retrying only failed socket establishment. Usable addresses share one bounded dial budget; cancellation prevents further attempts and TLS still authenticates the original hostname and pin. Connected controls reproduce the first-address defect and cover cache reuse, families, deadlines and cancellation.
Change-source: pulse-maintainer
Bind the credential-free capture handshake to the polling context under the existing five-second ceiling. Recheck cancellation before publishing a runtime pin; retain established trust, endpoint selection and ordinary declared-member first use. Add local stalled-handshake, peer-closure, no-dial and later-recovery controls.
Change-source: pulse-maintainer
Reject impossible physical counters and overflowing cache estimates. Keep the original trusted source through repeated failed/negative-cache polls within the unchanged observation-age and capacity fences, instead of clearing the incident on an independent provider fallback after one retained poll.
Exercise all eight refusals through both collectors and both HTTP clients, original percentage/byte History, backup admission, real alert decisions, valid recovery and measured zero. Preserve TLS, operation locks, shared uncertainty, deadlines and native recovery exclusions. This completes the original guest-memory outcome coherently, not a replay of source-xubz2c16.
Change-source: pulse-maintainer
Validate PVE and PBS hosts before logging them, omit url.Parse input from syntax errors, and keep cluster logging, health snapshots, recovery summaries and returned error labels separate from configured routing and TLS identity. Exercise actual rejected-host constructors, cluster routing/recovery and accepted-host controls with synthetic credentials. Connection policy, authentication and guest safety fences are unchanged.
Change-source: pulse-maintainer
Publish ticket, CSRF and expiry together and share only an expired session renewal. Preserve independent requests, context cancellation without false credential errors, JSON/form authentication, token authority and terminal API refusals without replay. Add registered pinned HTTPS race, failure and recovery controls plus a canonical consuming projection. Keep exact verification paths sorted as required by candidate admission; runtime and tests are unchanged from the source-proven candidate.
Change-source: pulse-maintainer
Omit mobile connection and push offers, and advertise only current Pro history. Same-path HTTP controls preserve signed grants, public/private runtime fences and 7/14/90-day compatibility without changing subscriber terms.
Change-source: pulse-maintainer
Publish ticket, CSRF and expiry as one locked snapshot, and bind expiry/401 renewal to the rejected session generation. Concurrent readers share one authentication attempt while retaining their own cancellation and ordinary single-retry behaviour. Keep guest commands single-attempt and token/TLS policy unchanged.
Contract-Neutral: Synchronise existing Proxmox password-session renewal without changing API fields, TLS policy or guest-command admission and replay rules.
Change-source: pulse-maintainer
Reverts #2863 before any release ships it. The live Pro pricing and
Patrol pages, in English, German and Spanish, sell both modes ("applies
safe fixes in the mode you choose: Ask first, Safe auto-fix, or
Autopilot"), and paying installs chose them. Shipping the retirement
would have silently downgraded those installs while the sales page still
promised the modes.
If the modes are retired, that needs a dated notice: stop selling them
first, warn installs on those modes in-app, and then re-ship the change.
It should not arrive through an engineering cleanup.
The receipt #2863 landed stays in place; this commit adds the receipt
for the restored content.
The pulse-intelligence telemetry snapshot test fed the retired assisted level through the snapshot and expected it back. Patrol now reports only monitor or approval, so the fixture uses approval; the pass-through it checks is unchanged.
Patrol could run some fixes on its own in two paid modes: assisted (Safe
auto-fix) and full (Autopilot, behind a server-owned acknowledgement).
Schema-v17 telemetry for the week to 2026-10-11 counts 1 assisted and 2
full installs out of 612 reporting Patrol, 4 executed Patrol actions in
30 days, all on one install, and no GitHub request for more autonomy,
while the automatic path carried its own policy leases, acknowledgement
store, per-resource allowlist, release gate and Colima lab. Investigation
is what paid installs use, so it stays.
Patrol now has two modes. Watch only reports findings. Ask first
investigates and proposes fixes, and every fix waits in Actions for an
operator to approve and run it.
- A saved assisted, full or autonomous level reads as approval, and the
update routes refuse those levels with 400 invalid_autonomy_level.
- The core Patrol action broker only plans: Plan and Submit persist the
plan and return. ExecuteUnderPolicy, the policy authorization lease,
the policy admission store methods, the Autopilot acknowledgement
persistence, routes and dialog, and the per-resource automatic-action
allowlist (store column now written as NULL) are gone.
GetPatrolFullModeUnlocked stays on the extension contract and reports
false.
- Historical action records keep their policy lease and tenant/resource
reason codes decodable, labelled as retired modes.
- The Patrol inbox no longer splits issues into "continuing without a
decision"; every current issue is an operator decision.
- Release gate RG-06 now proves Patrol never executes without an operator
decision (integration tier) instead of limited unattended autonomy,
and RG-02/RG-04 point at the surviving human-admission proofs.
- Pro plan copy, AI docs, privacy telemetry wording and the subsystem
contracts describe the two modes.
Compose current main e2f4bdff03 additively. Retain both subsystem records and the held change-age control while withdrawing only the obsolete Discovery identification test. Reviewed identities and ancestry, canonical guest History ownership and upstream feature removal remain intact.
Change-source: pulse-maintainer
Normalise the selected data directory with the storage path routine before inspection. Raw symlink/.. traversal and trailing separators must not probe an empty peer or hide a linked root while the encrypted importer writes elsewhere. Retain and validate the existing canonical agent credential.
Change-source: pulse-maintainer
Check the actual saved-token destination when a configured path contains symlink/.. traversal, plus live and dangling directory links with trailing separators. The original guard can inspect an empty peer while persistence writes existing canonical state.
Change-source: pulse-maintainer
The first exact-source check found the old nodes.enc-only gate was the last user of path/filepath. Remove that unused import; runtime admission and served guide bytes remain unchanged.
Contract-Neutral: Remove an unused standard-library import only; the preceding startup admission contract and regression obligations are unchanged.
Change-source: pulse-maintainer
Require a blank destination instead of using nodes.enc as a first-run sentinel. Recheck before writes, retain unknown or unreadable state, and leave deliberate authenticated transfer unchanged. Keep deployment .env provisioning and encrypted file precedence; explain the separate archive path in canonical and served help.
Change-source: pulse-maintainer
Exercise ordinary configuration loading, saved access and unknown destination state through the production startup helpers. Retain blank provisioning, file precedence, input failure and deliberate configuration-transfer controls.
Change-source: pulse-maintainer
AI Discovery ran a separate model-backed service scanner beside Patrol
and the Assistant: its own store, scheduler, model route, API, tool and
drawer UI. No telemetry counter ever measured its use (the telemetry
discovery_enabled flag OR'd it with network subnet discovery), the
maintainer judged it a flop, and the context it produced is already
available to the models through pulse_query, pulse_read and the
unified-resource context sections.
This deletes internal/servicediscovery, internal/ai/infradiscovery, the
pulse_discovery tool, the /api/discovery routes, the mock Discovery
fixtures, the Discovery tabs in the resource, guest, node and Docker host
drawers, the identified-service cards, readiness badges, provenance
markers, suggested web-interface URLs, the Workloads AI Context column,
the chat "Discovery is off" hint and the AI Service Context settings page.
The old settings route redirects to Assistant settings. The model-bound
sanitizer allow-list existed only to pass Discovery context through, so it
goes too, along with the CopyableCodeRow primitive that only the
Discovery tab used.
Network subnet discovery (/api/discover, the Infrastructure discovery
settings) and the discoveryTarget agent coordinates are separate features
and stay. Stored discovery_enabled, discovery_interval_hours and
discovery_model AI settings are ignored on load; the settings API decoder
is lenient, so older frontends saving those fields still succeed.
The first single-endpoint ordinary read performs a connectivity check before the requested API read. Keep the fixture assertion on successful declared-target monitoring and zero injected-target authentication; guest single-attempt and admission assertions remain exact. Retain the failed final-source proof rather than treating it as a runtime failure.
Change-source: pulse-maintainer
Discriminate live routing, first-use TLS trust and shared guest-command coordination after the constructor input is reused. Use only synthetic loopback services; no native guest workload or reporter recovery is claimed.
Change-source: pulse-maintainer
IPv4-mapped IPv6 and literal IPv4 reach the same numeric guest channel. Share only per-VM admission so another spelling cannot bypass an in-flight or uncertain command. Preserve the previous certificate origin identity, URL, proxy and first-use trust behaviour.
Change-source: pulse-maintainer
The broad suite retained the old cross-endpoint positive oracle. Keep same-origin proxy reads, require cross-origin refusal before a second request, and retain every stricter guest-lock refusal and same-target recovery assertion.
Contract-Neutral: Update a verification oracle for the already implemented infrastructure origin contract; no runtime change or relaxation of guest-command safety.
Change-source: pulse-maintainer
Refuse redirect scheme, host, port and userinfo changes before any redirected request. Preserve same-origin proxy paths, canonical default ports and IPv6 literals, zone identity, the ten-redirect budget and existing CA/pin/explicit-opt-out policy. PVE and PBS password/token/ticket controls reproduce the previous exposure on actual synthetic sockets.
Change-source: pulse-maintainer
Exercise actual TLS sockets and the PVE/PBS token, ticket/CSRF and password JSON/form flows using synthetic credentials. Retain same-origin proxy paths and the existing ten-redirect budget.
Contract-Neutral: Add discriminating source controls for the existing infrastructure connection trust boundary; no runtime or authority change.
Change-source: pulse-maintainer
Keep explicit URL defaults aligned with the API client and join IPv6 socket addresses correctly. Preserve the legacy bare-host port and credential-free capture without weakening any established pin or verification choice. Cover endpoint parsing, actual IPv4/IPv6 leaves and invalid-authority rejection.
Change-source: pulse-maintainer
Check the public helper selects the HTTPS default port and formats a bare IPv6 authority before dialing. Loopback failures are deliberate discriminators, not native connection acceptance.
Contract-Neutral: This adds endpoint-selection regression controls only; TLS trust, credentials and provider behaviour are unchanged.
Change-source: pulse-maintainer
Apply the existing canonical-key admission rule to filesystem identity and filter metadata as well as counters. A case-variant mount or type can otherwise overwrite a real volume, filter it out and falsely publish a complete healthy inventory. Preserve valid peers with the existing completeness error and hold only the original qualified disk evidence. Cover metadata ordering, array and object replies, both collectors, History, alert continuity and genuine ordinary recovery without changing guest command admission.
Contract-Neutral: Repairs existing filesystem identity and incomplete-reading invariants; no public wire schema, guest command, retry, lock, permission, threshold or backup contract delta.
Change-source: pulse-maintainer
Retain valid peer rows with a completeness error instead of treating rejected or unrecognized volumes as removed. Both collectors hold only the last complete tuple within its original age bound, preserving History and real filesystem breaches until a complete ordinary replacement can recover. Keep guest command admission and backup policy unchanged.
Contract-Neutral: Repairs existing truthful guest filesystem completeness and recovery invariants; no public wire schema, guest command, retry, lock, permission, identity or backup contract delta.
Change-source: pulse-maintainer
Keep explicit status/current zero availability through decoding and JSON copies so genuine exhaustion cannot become a healthy cache fallback. Connected direct/cluster collector controls cover canonical memory, History and breach/recovery. Complete race validation also exposed a shared-logger guidance fixture race: keep guidance on its caller logger with ordinary fallback, and stop the named scheduler-health fixture monitor. Message, backup precautions, command fences, thresholds and dependencies are unchanged; prior failed proof receipts remain retained.
Change-source: pulse-maintainer
Reject automatic replacement of primary and known member fingerprints. Admit first-use capture only for a declared new member and a typed local verifier failure; preserve concurrent trust, caller-owned configuration and operator-visible mismatch evidence. Validate real changed/restored TLS leaves through startup, recovery and new-member acceptance while retaining guest-command safeguards.
Change-source: pulse-maintainer
An unfamiliar 4xx from an intermediary does not establish QGA command completion. Keep supported terminal refusals and command-bound HTTP 500 rejections as errors; retain the shared uncertainty fence for other statuses. Cover all six readers, configured aliases, independent guests, resumption and connected last-known History without changing ordinary API reads or backup locks.
Change-source: pulse-maintainer
Inspect the byte after each matching system-directory prefix instead of constructing slash-suffixed strings on every disk poll. Keep exact roots and children excluded and local sibling volumes eligible, with unchanged reasons and explicit operator patterns. Add a deterministic zero-allocation guard for eligible local mount paths.
Contract-Neutral: Preserve existing filesystem eligibility, skip reasons, user patterns, identities, wire schemas and guest-command safety policy; change only the allocation cost of the directory-boundary predicate.
Change-source: pulse-maintainer
Prefer named guest interfaces over local container networks instead of globally sorting flattened IP text. Preserve all secondary and unknown addresses, management interfaces, warm metadata caches, explicit agent report IPs and machine identity. Cover LXC status/config/runtime fallback, QEMU metadata and canonical list/broadcast projection for issue #2757.
Change-source: pulse-maintainer
Gate mail, queue and quarantine reads at the owning poller. Preserve legacy mail defaults while persisting explicit all-off scope, keep missing readings out of alert recovery and reject absent PMG object data. Partial queue observations may prove the highest configured severity but cannot resolve or downgrade alerts. Retain version connectivity separately from downstream poll failure and cover scope, persistence, pause, in-flight and adverse-read boundaries.
Change-source: pulse-maintainer
Additively integrate exact upstream 1a094646d7 while retaining starting reviewed 19a8358a49. Keep reviewed UUID incident/event IDs and upstream non-wrapping atomic sequences for other memory IDs. Compose upstream shared SMART/Unraid temperatures with reviewed pending context and observation-gap interruption; pin Unraid-only continuity and both grace paths. Retain all browser, completion and security validation limits until evidenced.
Change-source: pulse-maintainer
pulse-triage[bot]