Preserve the exact Web candidate and its connected source and production-component browser proof. Unusable completion times stay cautionary in existing rows and drawers; running activity and genuine absence remain distinct.
Change-source: pulse-maintainer
Preserve the exact Core candidate and its retained focused, lifecycle, race, full-alert, monitoring and embedded-build evidence. Non-finite readings remain unknown rather than changing trusted incident state.
Change-source: pulse-maintainer
Repair the deterministic Prettier failure reported by PR2457 run 37185009631 without changing assertions or reviewed source identities.
Contract-Neutral: Test formatting only; runtime and documentation behaviour are unchanged.
Change-source: pulse-maintainer
Preserve malformed timestamp evidence through resource projection and label future, invalid or unusable dates as unknown in existing row indicators, tooltips and drawer protection. Keep explicit absence, configured age thresholds and running activity distinct. Validate real API and canonical snapshot replacements with parent controls and production-component browser fixtures; no native backup or thaw claim.
Change-source: pulse-maintainer
Treat non-finite current observations, authoritative rolling-history samples and overflowing averages as unknown. Preserve trusted incident and notification state instead of opening, recovering or poisoning JSON snapshots. Retain timestamp/duplicate authority, normal finite evaluation and explicit rule disable.
Change-source: pulse-maintainer
Fixes a flaky test in the Frontend job: `credential-free Unix lifecycle
execution > keeps private input out of root/sudo argv, environment,
output and history (uid=1000)` failed on run 37158578995 (PR 2451, a
Go-only change).
**Cause (test harness, not the product).** The history-mode runner types
the install command into an interactive bash, and the tty echoes that
line. The line quotes the prompt text `(paste at this prompt, not in the
command): `. When an output chunk ended inside that quoted text, the
runner's `endswith(prompt)` check matched it and typed the synthetic
token while echo was still on. The failing transcript shows the token
and `exit` echoed straight after the command echo, before bash had
printed `PULSE_TEST$`. The real read then picked up the typed-ahead
token, so the capture still matched and only the no-leak assertion
failed.
The generated command has no echo window: it runs `stty -echo </dev/tty`
before `read -r -s -p` prints the prompt, so the real prompt never
appears while echo is on.
**Fix.** The runner now types input only once the prompt is showing
**and** the stty fixture has recorded the bootstrap's own `stty -echo`.
Nothing else calls `stty -echo`, and readline does not use the stty
binary. At that point the runner also reads the terminal flags. If ECHO
is still on, the run fails with `Bootstrap prompted for the token with
terminal echo enabled`, so a product regression is reported directly
rather than as a timeout.
**Verification (Linux, pulse-dev, Node 24):**
- Forced repro: splitting the command write right after the quoted
prompt text makes the old runner fail all three history-mode tests every
time. With the fix, the same forced split passes.
- Negative control: changing the product to prompt with echo on (`stty
echo` after `stty -echo`, no `read -s`) makes both uid variants and the
slow-input test fail with the new message and the echoed token.
- Whole file passes 3/3. The PTY describe block passes 25/25.
Accept exact Core candidate fcd9b65b82 with retained semantic, allocation, race, monitoring-suite and actual embedded build evidence. Preserve observations and caller isolation; no native performance or release acceptance is asserted.
Change-source: pulse-maintainer
The interactive-history variant types the install command into bash, and
the tty echoes that command line, which quotes the token prompt text. When
an output chunk ended inside that quoted text, the runner treated it as the
prompt and typed the synthetic token while echo was still on, so the no-leak
assertion failed (Frontend job of run 37158578995, PR 2451).
The generated command is not at fault: it runs stty -echo before read -s
prints the prompt, and the failing transcript shows the token echoed before
bash had even shown its own prompt. The runner now types input only after
the stty fixture has recorded the bootstrap's stty -echo, and fails the run
if the terminal still echoes at that moment, so a product regression that
prompts with echo on is reported explicitly instead of being masked.
Contract-Neutral: test harness timing only; no runtime or contract change
Keep canonical guidance aligned with the actual unchanged header and copied member-aware templates. Pin the correction in the same safety guard so a later maintainer does not restore permanent header-only deduplication.
Contract-Neutral: Documentation clarification and its verification only; webhook wire format, retry stability and runtime behaviour are unchanged.
Change-source: pulse-maintainer
Reject mismatched resource, range and metric envelopes and malformed samples at the shared client boundary. Preserve explicit Kubernetes compatibility, real access failures, valid empty history and measured zero. Exercise drawer, single-metric and row-cache consumers, and inspect desktop and phone-emulated browser renders.
Change-source: pulse-maintainer
Normalise Markdown emphasis in the safety guard and observe optional runtime imports instead of requiring an auth call on every browser reload. Assert no other backend activity and preserve all console errors.
Contract-Neutral: Validation fixtures only; product and notification behaviour are unchanged.
Change-source: pulse-maintainer
Model the incidental initial security-status read as first-run state instead of depending on an absent backend. Keep console errors asserted; the receipt is offline Docs rendering, not authentication or notification acceptance.
Contract-Neutral: Browser fixture only; no product, notification or security behaviour changes.
Change-source: pulse-maintainer
Count retained samples before allocating detached snapshots for guest, node, disk and storage readers. Preserve exclusive cutoffs, unordered inputs, original observations and empty arrays. Cover public series, snapshot isolation, connected chart/window consumers and same-executable allocation comparisons; no SQL, retention or source-selection change.
Change-source: pulse-maintainer
Contract-Neutral: In-memory History copy allocation only; public API/JSON shape, sample order/cutoffs, retention and observation authority are unchanged.
The legacy correlation header omits occurrence start, severity and group members. Show receivers the existing full-precision member data, preserve later incidents and severity updates, and test the copyable templates through the actual signed sender. Keep the freshness verifier and runtime wire format unchanged.
Contract-Neutral: Help, executable examples, tests and sender comments only; notification behaviour, schemas and webhook headers are unchanged.
Change-source: pulse-maintainer
Preserve the exact Web candidate and its parent-bound browser receipt; retain the unrelated backup-date timeout and source-proof exit discrepancy as adverse evidence.
Change-source: pulse-maintainer
Accept exact PI candidate b27387d8fc and ancestor ad4fbff6be. Existing help now matches observation-location selection, server-dependent notification delivery, bounded buffering and Mobile retirement. Retain source-_7_dmsnc and inspected desktop/phone-emulated Docs render evidence; no runtime behaviour or native delivery acceptance is claimed.
Contract-Neutral: Integrate existing help, shipped mirrors and their verification without changing runtime, API semantics, entitlement or alert policy.
Change-source: pulse-maintainer
Preserve exact upstream 24723dd642 alongside the clean reviewed canonical tip. This is a bounded batch-start reconciliation; source content is unchanged.
Change-source: pulse-maintainer
Withdraw another target’s service and URL while its replacement is loading or unavailable. Preserve final access status without denied bodies, label same-target transient evidence and offer an in-place retry. Dispose per-guest forms and the replaced discovery consumer without cancelling or repeating server operations. Preserve existing same-target query reuse and independent saved operator URLs. Add connected identity/access regressions, contracts and exact-content desktop/phone browser evidence.
Change-source: pulse-maintainer
Fresh editor and API inspection shows that local and remote paths can coexist, including in published v6.4.5. Explain the actual location picker, per-path uncertainty and safe canonical-versus-legacy update fields, and validate the linked target-field instructions in the Docs renderer.
Contract-Neutral: Documentation, shipped mirrors and guidance verification only; existing observation and API semantics are unchanged.
Change-source: pulse-maintainer
## What changed and why
- Guest filesystem History distinguishes paused/retained readings from
current observations. Incomplete readings stay unavailable rather than
appearing as healthy empty disks; measured zero and known capacity
remain useful. Related to #2439 and #1723.
- Installation help removes the minimal root-server service recipe,
explains the existing hardened installer and distinguishes a missing
unit from a loaded root service. Removal guidance preserves persistent
data by default, explains temporary container storage and Helm claim
ownership, requires a consistent private full-state backup and separates
disabling the service from destructive erasure.
- TrueNAS setup help distinguishes a successful system-information
connection test from collected inventory/metrics and preserves polling
evidence. Passive VM preflight rejects malformed configuration before
concluding that an agent setting or backup lock is absent. Related to
#2382 and #2439.
- The native backup evidence checker requires observed post-task
filesystem and memory reads, not merely fresh-looking timestamps.
- Add an exact-published-RC browser update/recovery workflow with
authenticated archives, reviewed control identity, a dedicated narrow CI
registration, self-only Serve and terminal refusal handling. It is a
qualification route, not a qualification result.
The documentation and filesystem changes address unsafe implications in
existing surfaces; no new product route or feature is added. The browser
route supports the required release update/recovery journey.
## Included source
Range:
`13df84e9038be8017110105186b44f626154a3f6..c0ceff669774cec9f3b71f0bade244133f9949bb`.
All previously reviewed identities and their ancestry are retained:
- TrueNAS candidates `1c999113` / `59a27e2c`, integration `22f16541`,
additive published-main merge `a6b83db5`, passive preflight `adcd0ddf`
(the original PR head).
- Installation candidates `a6959e57` / `01adf338`, integration
`6cf691ec`; data-preserving removal candidate `fa6282b7`, integration
`0f3575bd`.
- Filesystem/History candidates `28bb0fb5` / `81b07e8a`, compositions
`ba8b9fcd` / `5d1b03c1`, integration `53cfdf60`.
- Browser-route candidate sequence `fdf46457`, `619133aa`, `729b2cf7`,
`f0ff1934`, `73b790b8`, `d855d322`, `30ca9681`, `a847b05e`, `2fb4bf9e`,
integration `b42563d9`.
- Backup-resumption checker `1920db3c`, integration `acace4d4`.
- New additive publication correction `c0ceff66` normalizes only
Markdown whitespace and capitalization in the TrueNAS safety assertions.
Every required warning and diagnostic field remains checked;
documentation/runtime content is unchanged by this correction.
## Validation and remaining limits
Recorded reviewed source evidence includes full TypeScript checking, 407
filesystem/UI regressions across fifteen relevant families, production
embedded build and unchanged bundle budgets (`source-bnh7z6xi`); 58
removal-help controls/types/build/budgets (`source-f_l3trzu`); inspected
desktop Chromium and phone-emulated WebKit help and filesystem states;
57 connected browser-route controls/workflow trust (`source-agx1sbr6`);
and nineteen focused backup-checker methods. These remain evidence at
their original source bindings. Publication comparisons confirm
unchanged validated runtime, removal guidance and qualification-route
bytes; the final browser guard covers all four changed frontend runtime
files with their in-range receipts.
Exact final-source offline smoke receipt `source-ljvxb1yx` at
`c0ceff669774cec9f3b71f0bade244133f9949bb` ran 59 families: 57 passed,
two failed; exit 1 with complete output and confirmed guest stop. All
changed smoke families, including the corrected seven TrueNAS tests and
new browser-route controls, passed. The failures concern unchanged
historical Git fingerprints (unavailable objects in the disposable
source input) and an extra synthetic npm-audit invocation. The same
unchanged tests passed in the original hosted PR run and all 21 pass in
a confined lightweight native-Git comparison. The npm observation
remains unresolved with Delivery; the complete VM suite is **not**
reported as a pass or replaced by the comparison.
Publication also verifies provenance, clean committed source, upstream
and starting-reviewed-tip ancestry, matching documentation mirrors and
whitespace. Removing either affected safety warning still fails the
corrected assertion. Sufficient completed frontend/browser proofs were
not repeated just because their changes share this batch.
The original PR's completed run `37175962472` failed required script
smoke on capitalization/line wrapping, now corrected additively. Its
advisory benchmark reported
`HandleMetricsHistory_MemoryFallback/all-metrics` +12.58% (p=0.019, ten
samples). No Go or benchmark source differs between that original head
and its base; this is not a causal diagnosis or a passing measurement.
The adverse result remains with Delivery for independent disposition.
The old head has finished checks and cannot land independently because
of the required smoke failure, so this proposal advances once to include
the coherent reviewed batch and correction, rather than restarting
still-running CI.
Exact-head review and protected checks remain required. Earlier
unexecuted readiness attempts are not reconstructed passes. This source
does not establish native thaw, TrueNAS collection, installed recovery,
a containing release or deployment. The browser route still needs its
dedicated registration/ACL prerequisite and activated dispatcher before
native use; the earlier HTTP401 remains adverse and unreplayed. Release
qualification, soak and promotion remain separate.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
## Additive follow-on batch and final publication check
The completed exact-head Build and Test run `37179468966` cannot land:
its required rest-1 job rejects the browser workflow's Node `24.20.0`
selector under the existing governed `24` parity contract. Correction
`903dc08d23d4278103950e0df6ed5f7b8fb97760` selects the same `24` line as
other workflows and adds a focused trust regression; no parity
assertion, pinned action, browser tooling, privilege or release gate is
weakened. The old head is terminal, not still validating, so the
proposal advances once with this repair and the coherent reviewed
follow-on source.
Final range:
`13df84e9038be8017110105186b44f626154a3f6..903dc08d23d4278103950e0df6ed5f7b8fb97760`.
Additional accepted identities, preserved unchanged:
- Complete VM-configuration response boundary `227f4f7e` / composition
`f7eeabc4`, integrated by `de081296`: do not admit guest reads from an
incomplete unlocked JSON prefix. Related to #2439.
- Token help `74c35227` / `383be305`, integration `630f45a2`: match
seven least-privilege presets, distinguish prompt exposed-token
revocation from planned rotation, and explain kiosk bearer-link and
per-tab limits.
- Guest workload evidence `23235502`, integration `0e41d8d2`: preserve
existing disk-deferral, guest-agent and lock facts through API and
canonical snapshots, clear obsolete omitted facts only after an explicit
new native outcome, and withdraw unavailable numeric bars while
preserving labelled prior and measured-zero readings. Related to #2439
and #1723.
- Used-memory History retention `0ea87307`, integration `768952fd`:
expire byte samples alongside existing series without deleting
still-live byte-only resource entries. This is not an attribution of
reported process memory growth.
Aggregate reviewed evidence adds `source-hctbddnb` for complete-response
parent/final race controls; `source-n8_u1xm9` for 37 token-help
controls, types/build/budgets, with fixture-only syntax
`source-5ws674f3` and six inspected desktop/phone-emulated captures;
`source-c8k64dn9` for types, 761 tests in eighteen relevant files,
lint/audits/build/budgets, forty browser transitions and six inspected
captures; and `source-0qcd2wj7` for adverse parent omissions, final
retention and connected History readers under race/vet/affected-package
build. These retain their original source bindings. Publication
comparisons confirm final changed Web runtime and Core Go bytes match
those tested candidates, and the final browser guard covers all seven
changed frontend runtime files through their own-parent in-range
receipts. Sufficient compiler, build and visual proofs were not repeated
solely for batching.
Exact final-source offline receipt **`source-1_rh272s`** at
`903dc08d23d4278103950e0df6ed5f7b8fb97760` passes the previously failing
Node parity test under race, selected
guest-agent/backup/History/memory/metric-window families in Proxmox and
monitoring under race, 18 browser-packet/Tailnet controls and 43
workflow-trust controls. Exit 0, complete 11,065-byte output and
completed guest stop; this is focused source proof, not a full-suite or
release qualification claim.
The same old-head run also reports advisory `ReportMarshal_Parallel-4`
+23.25% (p=0.009, ten samples, candidate spread 19%). At that old
proposal head, Go/dependency/build-and-test/benchmark source is
unchanged from its base. This establishes no changed benchmark source,
not a passing measurement or a cause. It remains adverse alongside the
earlier +12.58% History result under the existing Delivery disposition
request. No unchanged retry, threshold relaxation or release clearance
is claimed. The newer retention repair changes Go source, so it is not
covered by that unchanged-source comparison. New exact-head required
checks and independent review must finish before landing.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Separate remote check execution from server-side alert delivery, explain indeterminate and bounded-buffer behaviour, and link independent watchdog coverage without a permanent Mobile or Relay promise. Preserve the existing probe and notification contracts and verify both shipped guides and their keyboard help paths.
Contract-Neutral: Existing help, its shipped mirrors and verification only; no runtime, entitlement, alert policy or API changes.
Change-source: pulse-maintainer
PR #2456 run 37179468966 failed TestNodeToolchainParity because the new workflow selected a patch version instead of the existing governed Node 24 line. Match the other workflows and add a focused trust regression without weakening the parity contract.
Contract-Neutral: Correct a workflow toolchain selector to the existing repository contract; no application, permission or release gate changes.
Change-source: pulse-maintainer
Accept exact Core candidate 0ea87307e2. Retained source-0qcd2wj7 proves parent omissions, final retention and connected readers under race, vet and affected-package build; intervening canonical changes do not touch the affected Go source.
Change-source: pulse-maintainer
Accept a stable exact Node pin only within the governed major instead of
comparing its entire string with the major selector. Keep all other lines,
ranges and unresolved selectors rejected. This repairs the deterministic
required-check failure on the published-RC browser workflow without removing
its exact Node pin.
Give fake npm audit tests their own default timing controls and exercise
poisoned caller environments while preserving explicit watchdog tests.
No production audit verdict, dependency graph, benchmark threshold or release
gate changes.
Change-source: pulse-maintainer
Periodic guest and node cleanup omitted raw memory-used samples from both expiry and live-entry checks. Trim them with the existing retention and backing-array policy without deleting a still-live byte series. Cover every supported History series, byte-array reclamation, concurrent cleanup and poll-to-chart/metric-window resumption. No SQL retention, source-selection or wire changes.
Change-source: pulse-maintainer
Forward existing disk deferrals, guest-agent state and VM locks through API and canonical snapshots. Supersede omitted optional fields only on an explicit native VM outcome, consistently across full and fast merges. Withdraw unavailable row numerics while preserving valid prior and measured-zero readings. Add connected hook, merge, mounted and inspected browser controls without issuing guest or backup commands.
Change-source: pulse-maintainer
The real scope table contains the 15 selectable UI scopes plus the wildcard row. Count all 16 entries rather than rejecting the correctly rendered reference. The corrected Chromium and phone-emulated WebKit run passes with all six screenshots inspected; shipped documentation and suite-covered source are unchanged.
Contract-Neutral: Browser-test assertion only; no runtime or user-facing contract delta.
Change-source: pulse-maintainer
Correct the existing configuration help against the live preset model and token client: reporting does not include lifecycle authority, exposed credentials need prompt revocation, and kiosk display preferences do not restrict credentials or guarantee persistence. Keep the shipped mirror and add runtime-model-bound documentation controls and browser help validation.
Contract-Neutral: Documentation and test fixtures only; no runtime token, authorization, navigation or delivery contract changes.
Change-source: pulse-maintainer
PR #2456 run 37175962472 rejected retained safety warnings only because of a line break and sentence capitalization. Normalize prose for these assertions without removing any required warning or diagnostic field.
Contract-Neutral: Documentation test presentation normalization only; no runtime, API or safety-guidance change.
Change-source: pulse-maintainer
Preserve exact reviewed History and incomplete-reading commits with their own-parent browser receipts. Retained final compiler, 407 regressions and production-build proof cover runtime content; preserve current data-retaining removal guidance.
Change-source: pulse-maintainer
Preserve current safety evidence, installer guidance and reviewed release-browser source while validating the previously unexecuted runtime response-boundary correction. No native thaw or old executor cleanup is inferred.
Change-source: pulse-maintainer
Preserve the exact History and incomplete-reading candidates and their own-parent browser receipts while including the current assigned main. No frontend resolution or receipt rebinding.
Change-source: pulse-maintainer
Retain exact Core candidate. Nineteen focused committed-source checker and CLI methods establish rejection of unsupported post-task resumption while preserving calibrated healthy records. No production polling or native thaw acceptance is changed.
Change-source: pulse-maintainer
Retain exact Delivery candidate and its reviewed history. Offline packet, lifecycle and Tailnet controls pass; unchanged Chromium refusal receipts remain bound to their executed source. Native collection still requires protected publication, host activation and credential-administrator confirmation of dedicated tag:ci-deploy scope and self-only access.
Change-source: pulse-maintainer
Require finite capacity and measured used bytes in the existing filesystem list and guest Overview. Missing, invalid and sentinel readings remain unavailable rather than a healthy empty disk; measured zero and valid byte-derived readings stay visible. Preserve the exact retained History correction and add mounted, multi-filesystem and browser controls.
Change-source: pulse-maintainer
Accept exact Product intelligence commits a6959e571b and 01adf338a4. Existing installation help now uses the signed non-root server path and protects custom installation state. Retained 55 documentation controls and inspected desktop Chromium and phone WebKit proof are adequate for this documentation-only change.
Change-source: pulse-maintainer
Reject a resumed disk or memory History claim when the complete native trace lacks the corresponding successful new guest read after backup completion. Preserve calibrated clock bounds, normal later polls, independent filesystem writes and native provenance review; no QGA command or runtime behaviour changes.
Contract-Neutral: Tighten consistency checks for the existing backup-safety measurement only; production polling, interfaces, access boundaries and release gates are unchanged.
Change-source: pulse-maintainer
Use a dedicated Auth Keys write client restricted to tag:ci-deploy, never the broader demo registration. Reject missing configuration and validate the actual running Self tag and DNS before Serve. Keep exact-source, denial-stop, no-replay and cleanup contracts, with connected offline registration and Serve controls.
Change-source: pulse-maintainer
Preserve the exact reviewed History candidate and its own-parent browser receipt. The updated main frontier changes setup help only; executor readiness and complete source qualification remain unfinished.
Change-source: pulse-maintainer
Preserve the reviewed denial and recovery corrections for an additive least-privilege registration repair. No native acceptance is inferred.
Change-source: pulse-maintainer
Do not report an absent lock or agent setting after malformed current-configuration output. Preserve passive bounded host reads, private output, unknown well-formed fields and the distinction from guest responsiveness or thaw.
Contract-Neutral: The operator-only helper now enforces its existing incomplete-read failure semantics; polling, guest-agent admission, API and storage contracts are unchanged.
Change-source: pulse-maintainer
pulse-triage[bot]