A permanently-offline derived identity flapped a docker-host alert and wrote 4,748 resolved/refired pairs in three days; each lifecycle event stores a full alert-state snapshot averaging ~170 KB, so events.db reached 1.2 GB and filled the host root filesystem (#2113 downstream evidence). The 90-day age retention is not a volume bound: one alert can still write unbounded payload inside the window.
The hourly prune now also enforces a total stored snapshot-payload cap and removes the oldest events first when it is exceeded, raising the same retention revision age pruning uses so the history projection rebuilds from the remaining log. Normal installs stay far below the cap and are unaffected; the bound only triggers on pathological amplification. Focused proof in eventlog_snapshot_test.go; the alerts subsystem contract records the bound.
Change-source: pulse-maintainer
Register the server startup-stall watchdog runtime commit and its shared
follow-up contract/proof commit in the canonical completion history so the
per-commit guard evaluates the pair as one reviewed unit.
Change-source: pulse-maintainer
pkg/server/server.go is a security-privacy runtime path, so the startup
watchdog commit needs its contract obligation and an accepted proof in the
same reviewed unit. Record the local-only diagnostic boundary in the
security-privacy contract and place the watchdog proof in the
registry-accepted pkg/server/service_health_test.go.
Change-source: pulse-maintainer
Bind the UI/API listener early so port conflicts fail fast, but srv.Serve
only starts near the end of Run. Every synchronous initialization step in
between therefore runs with a live listening socket whose accept queue fills
while nothing accepts: the reported #2129 shape (bound port, non-zero Recv-Q,
no HTTP response). A stall there is invisible because no log line is emitted
while it runs.
Track the last completed startup phase and arm an independent watchdog that
fires if serving has not begun within two minutes, logging the last phase and
every goroutine stack. This makes a recurrence diagnosable from the field log
without an operator sending SIGQUIT. The watchdog is stopped when serving
begins or Run exits and is safe to stop more than once.
Change-source: pulse-maintainer
Integrate the reviewed failed-staging config-backup discard repair (07d54cd345)
with its deployment-installability contract, installtest proof and registered
completion pair (ccfd22da7f, b36e9609dd). The candidate auto-update RETURN-trap
repair (9b004cc787) duplicates the already-integrated 564c235e32, so the merge
keeps the canonical trap implementation and both regression suites and retains
both registry entries. Change-source: pulse-maintainer
Change-source: pulse-maintainer
Register the two update-path runtime commits and their shared follow-up
contract/proof commit in the canonical completion history so the per-commit
guard evaluates each pair as one reviewed unit.
Change-source: pulse-maintainer
Record the deployment-installability contract section for the auto-update
RETURN-trap and failed-staging config-backup repairs, and add the Go proof
that exercises the extracted perform_update and asserts the trap does not leak
into a later function return. This completes the two runtime commits for
canonical governance as one reviewed unit each.
Change-source: pulse-maintainer
Register 564c235e32 (runtime) with bb25e3ec03 (contract + Go proof) as a
reviewed completion unit so the per-commit canonical guard evaluates them
together rather than rejecting the runtime commit for a missing same-commit
contract and verification artifact.
Change-source: pulse-maintainer
Follow-up to 564c235e32 (fix(update): disarm perform_update RETURN trap after
it runs). That runtime change touches the deployment-installability subsystem,
so this commit adds the matching substantive contract section in
docs/release-control/v6/internal/subsystems/deployment-installability.md and
the registry-accepted deployment-script-runtime proof in
scripts/installtests/pulse_auto_update_test.go
(TestPerformUpdateDoesNotLeakReturnTrap). The pair is registered in
scripts/release_control/canonical_completion_history.json by the next commit.
Change-source: pulse-maintainer
backup_existing snapshots the configuration before the update stages, but a
staging disk-headroom failure then exited and left that snapshot behind. On a
small root filesystem each automatic retry added another full backup and made
the low-space condition progressively worse until updates could no longer run
(#2127). Record the snapshot and remove it when download_pulse aborts at the
headroom check, before anything was replaced. Add regression coverage.
Change-source: pulse-maintainer
The RETURN trap installed inside perform_update is shell-global and was left
installed after the function returned. It fired again when a later function
returned, expanding the now out-of-scope local installer_tmp/signature_tmp
under set -u, so pulse-update.service reported a successful install as failed
with 'installer_tmp: unbound variable' (#2128). Clear the trap as it runs and
cover it with a regression test.
Change-source: pulse-maintainer
A RETURN trap is not scoped to the function that installs it. perform_update
left its trap referencing function-local installer_tmp/signature_tmp (and
service_name/service_was_active) installed, so it re-ran when a later function
returned. With those locals gone and 'set -u' active, the updater aborted with
'installer_tmp: unbound variable' immediately after logging 'Auto-update check
completed' — pulse-update.service entered failed state even though the update
had succeeded (reported #2128, affects v6.3.2/v6.4.1).
Disarm the trap with 'trap - RETURN' on its first invocation, and use
${installer_tmp:-}/${signature_tmp:-} so a stray invocation cannot abort the
script. Add a regression test asserting no RETURN trap remains after both the
successful and the prerelease-refusal paths.
Change-source: pulse-maintainer
The five unified syncs ran serially and each waited for its own SQLite commit, so a registry rebuild that carried new data for several resource types opened one transaction per type and re-committed the same WAL. Collect the agent, VM, storage and app-container writes through a batch sink and commit them once; the per-series replay guard still runs first, so the series, values and source observation times are unchanged. Standalone callers keep the immediate write. Focused proof in monitor_host_agents_test.go; contract sections recorded in monitoring.md and agent-lifecycle.md.
Change-source: pulse-maintainer
Record the unified physical-disk SMART runtime commit abaca8f9c0 and its
contract/proof follow-up 33260be25b as one reviewed completion unit so the
per-commit canonical guard evaluates the pair together.
Change-source: pulse-maintainer
The unified physical-disk sync now anchors SMART history to the source
observation time and drops exact replays, so the monitoring and
agent-lifecycle contract sections record the disk-history behaviour and its
focused proof. The proof lives in monitor_host_agents_test.go alongside the
other unified-sync rebuild tests.
Change-source: pulse-maintainer
syncUnifiedPhysicalDiskMetrics stamped every SMART sample with the registry rebuild wall clock and wrote through the unguarded buffered path, so each read-side rebuild re-issued the same physical-disk observation as fresh rows (#1966). writeSMARTMetrics now anchors both the in-memory history and the persisted batch to the source observation time and drops exact replays through the existing unified guard; the unified sync passes unifiedResourceObservedAt. Adds a two-rebuild focused proof and updates the TrueNAS disk fixture to a current observation time.
Change-source: pulse-maintainer
The unified syncs now timestamp history with the source observation time, so the TrueNAS and VMware fixtures must carry a current collectedAt for the in-memory and chart windows to retain the samples. The previous fixed 2026-03 fixtures represented data older than the 24h history retention and would be trimmed. No production behaviour changes.
Change-source: pulse-maintainer
The replay guard added in df44238797 only suppressed repeats for storage, whose samples already carry the provider LastSeen. The agent, VM and app-container syncs still stamped every write with the rebuild wall clock, so dedupeUnifiedMetricWrites could never match and each read-side registry rebuild re-issued the whole batch as fresh rows. That is the same WAL churn described in #1966, still live for VMware/TrueNAS VMs, TrueNAS apps and supplemental agents.
Resolve each resource's observation time from its metric source (unifiedResourceObservedAt) and use it for both the in-memory history point and the store write, matching the storage path. Proxmox and libvirt VMs already have native history writers, so exclude libvirt VMs from the unified VM sync to avoid writing a second timeline for the same series.
Contract sections recorded in monitoring.md and agent-lifecycle.md; focused proof added in monitor_polling_test.go and monitor_host_agents_test.go. Local Go compilation is unavailable this turn (module cache read-only, toolchain snapshot missing); the canonical completion guard passes and gofmt is clean.
Change-source: pulse-maintainer
Bind the create-release pair preflight commit to the follow-up contract and proof commit as one reviewed completion unit, matching the existing canonical completion history entries.
Change-source: pulse-maintainer
The create-release prepare job now verifies that pulse-enterprise declares docs/release-source-pairs/<expected_source_sha>.json and that it names the frozen public commit before any draft release object exists. Record that obligation in the deployment-installability contract and add the release-promotion policy proof that guards the step and its ordering ahead of create_release.
Change-source: pulse-maintainer
A 6.x release creates its draft release object before stage_private_pro_runtime dispatches the private Pro build, which resolves the payload by the exact frozen public commit (docs/release-source-pairs/<sha>.json). When that declaration is absent or names a different pulse_sha, the private build refuses and the run leaves an orphaned draft (v6.4.5-beta.2, v6.4.5-beta.3). Verify the declaration in prepare, before any draft exists, and fail with the exact path to create. This is an unconditional fact check independent of the opt-in harness gate in pulse-dev-infra #443/#444; the release steward still owns choosing the pair. Source issue: pulse-dev-infra #441.
Change-source: pulse-maintainer
Recover Windows host info when MachineGuid is braced: read MachineGuid directly when gopsutil's combined InfoWithContext fails on the host-ID field, and canonicalise Windows machine IDs so a braced GUID and its bare form resolve to one stable agent identity. Fixes#2125.
Change-source: pulse-maintainer
The Windows unified agent exits at startup when HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid is a braced GUID. gopsutil v4.26.6 reads the value through a fixed 74-byte buffer and rejects any length other than 36, so a braced 38-character GUID fails the whole InfoWithContext call and newAgent aborts with 'fetch host info'. Recover the host info on Windows when the host-ID read is the failing field: read MachineGuid directly, strip braces and fill the other fields from gopsutil accessors, while keeping any non-host-ID failure fatal. Canonicalise Windows machine IDs by removing braces so both forms map to one stable agent identity. Includes agent-lifecycle contract section and focused proof in the registry-accepted agent_new_test.go. Windows recovery is cross-compiled with GOOS=windows; runtime execution on Windows is not qualified in this environment.
Change-source: pulse-maintainer
Dependabot #2094, #2095 and #2096 bump actions/setup-go 6.4.0 -> 7.0.0, signpath/github-action-submit-signing-request 2 -> 3.0 and actions/github-script 8.0.0 -> 9.0.0. Each proposal is blocked only by the reviewed pin constants, the workflow-trust allowlist, the release-consumer action manifest and the installer governance assertions that hard-code the previous revisions. Carry all three bumps with those artifacts in one commit so the proposals can be closed as superseded.
All three actions keep the node24 runtime and their existing inputs and outputs; no consumer interface, installer behaviour or public contract changes. The deployment-installability and agent-lifecycle workflow references are pin-only.
Contract-Neutral: Reviewed action pin refresh with identical node24 consumer interfaces and unchanged inputs/outputs; no public-contract or installer-behaviour delta.
Change-source: pulse-maintainer
Register the reviewed completion pair for the TrueNAS legacy-REST memory telemetry runtime commit and its contract/proof follow-up so canonical governance evaluates them as one unit without rewriting history.
Change-source: pulse-maintainer
Record the monitoring contract section for the TrueNAS legacy-REST memory telemetry repair and move its regression coverage into the registry-accepted internal/truenas/client_test.go proof file. The runtime commit and this contract/proof follow-up are one reviewed completion unit.
Change-source: pulse-maintainer
On the legacy REST transport used by TrueNAS CORE 13, GetSystemTelemetry had no reporting.realtime subscription, so MemoryAvailableBytes and ARCSizeBytes stayed zero and trueNASEffectiveMemoryUsed collapsed to total, reporting every CORE install as 100% used (#2077). Reconstruct live telemetry and host-chart history from reporting.get_data over REST, and when no available reading exists mark agent memory UsageUnavailable instead of fabricating usage from total-0.
Change-source: pulse-maintainer
The npm-minor-patch group (Dependabot #2115) has been held since 17 Sep
because it bundles @playwright/test, playwright and playwright-core
1.56.1 -> 1.63.0 with 12 safe frontend updates. The offline
browser-verification runtime is pinned to Playwright 1.56.1, so a lockfile
bump breaks browser-proof parity; holding the whole group blocked the safe
updates instead.
Ignore Playwright version updates on the governed 1.56.1 line, matching the
docker governed-tag policy, so the remaining grouped updates can be reviewed
on their own. Security updates stay covered by the weekly npm-audit scan and
the frontend dependencySecurity proof. Extend the dependabot config guard to
lock the policy in.
Change-source: pulse-maintainer
Integrate the reviewed FreeBSD/pfSense installer checksum-tool fallback. FreeBSD base ships sha256(1) but neither GNU sha256sum nor Perl shasum, so installer_file_sha256 in scripts/install.sh now falls back through sha256sum, sha256 -q, shasum -a 256 and openssl dgst -sha256, routing the main binary, typed privileged helper and action runner checksums through it; scripts/install-mcp.sh gains the same sha256 -q branch. Contract sections agent-lifecycle.md and deployment-installability.md record the platform digest-tool contract, with install_sh_test.go and build_release_assets_test.go proof.
The reviewed tip's parent is 838ca6f26d; this merge preserves its identity.
Change-source: pulse-maintainer
Register the reviewed completion pair for the FreeBSD checksum-tool fallback runtime commit and its contract/proof follow-up so canonical governance evaluates them as one unit without rewriting history.
Change-source: pulse-maintainer
FreeBSD base ships sha256(1) but not GNU sha256sum or Perl shasum. Record the fallback contract for the unified and MCP installers and add the MCP installer proof the deployment-installability verification policy requires.
Change-source: pulse-maintainer
FreeBSD base ships sha256(1) but not GNU sha256sum or Perl shasum, so a
fresh pfSense/FreeBSD host without coreutils failed the download checksum
and refused to install. Route every installer checksum through
installer_file_sha256 and fall back through sha256sum, sha256 -q, shasum and
openssl dgst. install-mcp.sh gets the same sha256 branch. Add a focused test
that hides sha256sum/shasum and asserts the FreeBSD fallback returns the
digest.
Change-source: pulse-maintainer
Integrate the reviewed #2070 vSphere VI JSON fix. vCenter 8.0.3 rejects a composite request data object that omits the documented _typeName discriminator with HTTP 500; a bare ManagedObjectReference is special-cased and accepted. Send _typeName on PerfQuerySpec, PerfMetricId, EventFilterSpec, EventFilterSpecByEntity and the ManagedObjectReference arguments, with focused request-shape tests pinning the serialized QueryPerf and QueryEvents bodies (c978cc452c). The reviewed tip's parent is 9444da374f; this merge preserves its identity.
Change-source: pulse-maintainer
The vmware test package defines writeJSON as a function-local closure, so the new request-shape test needs its own package-level helper.
Change-source: pulse-maintainer
The vSphere VI JSON API documents _typeName on request data objects. Calls whose only argument is a bare ManagedObjectReference (QueryPerfProviderSummary, QueryAvailablePerfMetric) succeed against vCenter 8.0.3, but every call that passes a composite data object (PerfQuerySpec/PerfMetricId for QueryPerf, EventFilterSpec/EventFilterSpecByEntity for QueryEvents) is rejected with HTTP 500. Issue #2070 shows exactly that split, so add the discriminators the documented schema carries to those request bodies. Morefs now carry _typeName too, matching the same schema. Focused tests pin the serialized request bodies.
Change-source: pulse-maintainer
The vSphere JSON API represents an absent or null property (for example the parent of a top-level folder) as a successful response with an empty body, which was decoded as a spurious 'not valid JSON' enrichment error. Non-2xx responses also carry a JSON fault body that was discarded. See #2070.
Change-source: pulse-maintainer
Integrate the reviewed #2122 TrueNAS system-temperature fix (9a1cfa4c40) that rejects the synthesised cpu_package aggregate in favour of the hottest per-core reading, with its focused provider coverage and monitoring subsystem contract note. The reviewed commit's parent is 9459ec7f26; this merge preserves its identity.
Change-source: pulse-maintainer
TrueNAS SCALE on AMD reports the bare `cpu` cputemp legend series at roughly 1.5x the hottest per-core reading, and the provider trusted that mapped `cpu_package` value unconditionally, firing an 80C threshold alert at a real ~60C. Compare `cpu_package` against the hottest `cpu*` per-core entry and fall back to the per-core max only when the package value exceeds it by more than 20%. Package-only and per-core-only payloads keep their existing behaviour. Adds focused provider coverage and records the selection contract for #2122.
Change-source: pulse-maintainer
Integrate the reviewed #2121 guest-drawer filesystem panel ordering fix (958eae0744) with its contract assertion and the Playwright browser receipt recomposed into the same commit. The reviewed commit's parent is 22fd851e72; this merge preserves its identity.
Change-source: pulse-maintainer
The shared DetailSectionTable span algorithm gives the earlier of the last two compact sections the wider column. GuestDrawerOverview declared Tags before Filesystems, so a guest with tags and disks but no network section rendered Tags two tiles wide and the mount-point list one tile wide, which the reporter found hard to read (#2121). Declaring Filesystems first gives the longer list the readable panel and keeps the short tag list narrow.
Recomposes the reviewed #2121 fix and its Playwright browser receipt into a single commit on the current maintenance base (22fd851e72), because the per-commit browser guard requires the receipt in the same commit as the user-visible frontend source. The GuestDrawerOverview.tsx blob is byte-identical to the previously browser-verified content (sha256 bcfebc20), so the receipt is content-addressed to the same source; the added contract assertion and performance-and-scalability ordering note are unchanged.
Refs: https://github.com/rcourtman/Pulse/issues/2121
Change-source: pulse-maintainer
Integrate the reviewed ai-runtime prompt-cache repair (248ada3cc6) with its transport contract (f08b96b968) and registered completion pair (bc3da3ad49). Merge resolved the canonical completion registry against the rehearsal-timeout completion pair already on main by keeping both entries.
Change-source: pulse-maintainer
Register 248ada3cc6 as completed by f08b96b968, which records the
Anthropic stable-system-prefix prompt-cache transport contract, so the reviewed
runtime repair is evaluated with its contract as one completion unit.
Change-source: pulse-maintainer
Add the ai-runtime contract section for the Anthropic stable-system-prefix
prompt-cache reuse and its focused proof. This completes the contract obligation
for the runtime repair in 248ada3cc6 without rewriting that reviewed commit.
Change-source: pulse-maintainer
Dependabot #2099 bumps @types/node 20.19.43 to 26.5.1 in frontend-modern, but the PR is blocked twice: Frontend tsc fails with TS2550 on .at() (26 removed the compatibility polyfill), and Canonical Governance blocks the package.json/lock change for a missing deployment-installability contract update and frontend dependency security proof.
Carry the bump with its required governance artifacts in one commit. tsconfig already declares the ES2022 lib (95db35b6c3), which the source's .at() usage needs; this adds the manifest and lock bump (matching tests/integration, which already pins @types/node ^26.5.1), a Completion Obligations entry, and a dependencySecurity proof that keeps the manifest range, the locked @types/node/undici-types versions and the declared lib in step. Verified offline: the guard passes and the proof test passes.
Change-source: pulse-maintainer
The completion-history validator materialises its completion tree with a shared clone. The proof sandbox strips the maintainer read config and a linked worktree's gitdir sits outside the checkout, so the clone failed with dubious ownership and the preflight reported a history failure instead of validating the registered pair. Give every git subprocess a private config carrying the fixed safe.directory policy, and register the rehearsal backend package-timeout runtime commit together with its deployment-installability contract follow-up as one completion unit. Change-source: pulse-maintainer
Change-source: pulse-maintainer
Record the deployment-installability contract section for the rehearsal backend package timeout and its proof surface. This is the contract follow-up for the runtime change in d0f138cf26. Change-source: pulse-maintainer
Change-source: pulse-maintainer
The accelerated rehearsal profile runs the backend as one serial 'go test -json -p 1 ./...', whose Go default per-package timeout is 10m. internal/api exceeded that under ordinary shared-worker load (606.9s at loadavg 5.55 on 2026-09-19) and the run failed with 'panic: test timed out after 10m0s' despite zero test assertions failing. The release profile already budgets 30m per package via run-release-backend-tests.sh. Add PULSE_RELEASE_PREFLIGHT_REHEARSAL_TIMEOUT (default 30m) and pass it as -timeout, and update the worker contract test that pins the exact rehearsal command. Change-source: pulse-maintainer
Change-source: pulse-maintainer
pulse-triage[bot]