Stream ungrouped retained reads in the existing time-major index order,
avoiding temporary metric sorts without changing tier reconciliation or
chart samples. Extend query-plan and filtered-result coverage.
Add an explicit strict mode for the existing 90 ms API budget and an
optional fresh-worker CI proof with fixed executable identities and raw
capacity evidence. Keep ordinary hosted budgets and required gates intact.
Contract-Neutral: Chart payloads, retained-tier reconciliation, sampling, index layout and source/release gates are unchanged; the implementation removes an unnecessary sort and adds controlled verification of existing latency budgets.
A cancelled login can consume an empty response before the transport reports
cancellation. Preserve that context outcome for the owner and joined readers,
reject late session publication and prevent a cancelled refusal from retrying
another encoding. Keep live response validation and later recovery intact.
Initial password authentication has one owner and must end with its
constructor. Keep its complete JSON/form exchange within the caller and
client timeout. Retained-session renewal still serves concurrent readers
independently of any one caller's cancellation.
Retain generation-based coalescing and the shared parser, exercise both
initial encodings under the client timeout, and document the ownership
boundary alongside existing startup and cluster cancellation controls.
Retain the failed CI and reproduced baseline in the existing reliability
record while final-source qualification remains open.
Preserve selected memory freshness and the VM/LXC interpretation.
Retain both native tool contracts and current API concurrency controls.
Qualify this source separately from release and installed recovery.
Contract-Neutral: Integrate already-governed parents without a new contract change. Incoming verification files already match main. Fresh integration tests and source-bound browser proof cover the combined memory and installer surfaces.
Serial pinned-address dialing could spend the request deadline on a stalled
first address while a validated fallback was healthy. Share one bounded
two-worker dialer with restricted HTTP clients and retain cancellation in
webhook DNS admission and dialing.
Add real stalled-TCP and DNS cancellation controls, persistent queue verdict
readback, shared transport ownership and explicit proof routing.
Record successful response writes, scheduled generation, file saves and SMTP
outcomes in a durable content-free tally. Distinct active days include manual
exports, while saved-schedule periods deduplicate retries and monthly reuse.
Publish bounded scalars through the existing opt-out-controlled heartbeat and
report missing coverage explicitly. Preserve pricing and customer entitlements.
Retain backup execution outcomes and collection coverage in each
organization's recovery store so provider inventory changes and restarts
cannot erase report evidence. Keep missing and incomplete history distinct
from an observed period with no attempts.
Reuse existing report scopes, calendar schedules, branding and delivery
recovery for client PDF and CSV reports. Register the paid renderer through
the existing private runtime boundary. Pricing and grants are unchanged.
The report engine read every report's metrics from the default
organization's store, whatever organization the request came from. A
tenant request for a resource ID outside its own inventory fell through
to that store with the caller's ID, so one organization could read the
default organization's history, and even a tenant's own resources were
reported from the wrong store. Reporting was closed to org owners until
this was fixed.
The engine now resolves the metrics store of each request's OrgID
through the multi-tenant monitor and refuses a request that names none,
so no report path can fall back to the default store. Report handlers
reject resources outside the requesting organization's inventory,
scheduled runs resolve their scope against their owning organization's
inventory and skip resources it no longer holds, and Pulse Assistant's
pulse_summarize reads its executor's organization.
With every report read scoped, the reporting routes move to
ensureOrgAdminSession and reportingRead is offered to org managers
again, so providers can build reports inside client workspaces.
The report engine wiring lives in pkg/server/server.go, which the
completion guard only let telemetry tests prove. server.go now has its
own security-privacy path policy that keeps those proofs and also
accepts pkg/server/reporting_engine_test.go; the other telemetry files
keep their existing policy unchanged.
Session renewal became single-flight in 97e4c8eac7, but the caller that
started the login ran it on its own context. When that caller was a
short-lived read (a 10s guest-agent call, a guest-metadata fetch cancelled
on invalidation, an API request whose browser disconnected), cancelling it
aborted the shared login and every concurrent waiter failed with
"re-authentication failed: context canceled" despite live contexts. The
cluster client treats that text as an authentication error and skips
failover, and a failed GetNodes marks the instance's nodes unreachable for
the cycle.
Run the shared login detached from any single caller's cancellation,
bounded by the client's per-request timeout, and have every caller,
starter included, stop waiting only when its own context ends. A genuine
login failure is still shared with all waiters, and a login whose starter
has left still completes and is reused instead of being repeated.
Contract-Neutral: Proxmox password-session renewal keeps its API fields, TLS policy and guest-command rules; only which context bounds the shared login changes.
Measure delivered extended history before changing free and paid features.
Count only successful responses containing an older metric point and retain
only bounded daily totals. Expose the rolling sum through schema v19 and
Preview with matching privacy disclosure and explicit report coverage.
Proxmox Mail Gateway 9 returns the cluster status cid as a string, so
decoding it into an int failed the whole cluster read and the poller
lost the node list (issue 2960). Pulse never reads cid, so the field is
no longer decoded and any format works.
With no nodes, the poller then requested backups from a node named
after the connection's display name ("PMG-01"), which PMG rejected with
a hostname-lookup error that pointed users at DNS. That fallback now
runs only when PMG answered with no cluster entries; after a failed
cluster read the request could never return backups, and the poll
already records the cluster failure.
Stream every nested result field without imposing a new uniqueness policy on completed filesystem measurements. Existing counter validation retains unusable/partial results without a cooldown; a later null or case alias cannot erase an earlier foreign interface field. Correct the legacy HTTP-200 error-payload assertion to the documented unverified-completion behavior.
Contract-Neutral: Restore the documented completed-measurement semantics and strengthen tests of existing foreign-reply refusal; no additional contract delta.
Change-source: pulse-maintainer
A structurally valid reply for another guest command must not become an empty current inventory, acquire filesystem identity or release the serial-command fence. Check known command-exclusive fields and information-result shape before postflight lock checks; preserve null/empty/shared/unknown fields, partial row decoding, unusable file measurements, trust and independent live polling. Add six-reader cross-command controls, alias/expiry/recovery controls and actual builder/state/broadcast/History proof. This detects contradictory payload shapes, not native command correlation, thaw or report attribution.
Change-source: pulse-maintainer
Distinguish observed 403 permission denials from 401 authentication and other HTTP failures, rather than prescribing token rotation or user-only grants. Carry fixed, identity-free recovery guidance into the existing Diagnostics error summary while preserving live-monitor/PBS probe attribution, TLS trust and ordinary request behavior. Add wire-status, ACL-scope, same-credential recovery and serializer controls with their subsystem contracts.
Change-source: pulse-maintainer
Current qualification exposes Go's #NN repeated-name suffix as an invalid URL fragment in the new fixture path. Hash the complete evidence label so clients retain the same per-case key without using test labels as URL syntax. The actual hostname validation and guest fences remain unchanged.
Contract-Neutral: Fixture-only identity encoding repair; no runtime or trust-contract change.
Change-source: pulse-maintainer
Retained full-suite proof reports an inherited agent-cooldown before the invalid-UTF8 lock case dispatches any command. Give each synthetic case a distinct base path, keeping all clients in that case on its shared key. A same-listener control retains the prior uncertainty fence unchanged. No runtime guest guard, native target or assertion is weakened.
Change-source: pulse-maintainer
The retained 277ec211 source proof times out on a correctly retained target, with injected requests zero and its pin unchanged. This test owns routing and trust, not a latency SLO. Use explicit five-second client and ten-second caller fixture bounds, record elapsed work, and retain every routing/pin/guest assertion. Runtime timeouts and timeout controls are unchanged; the original failed receipt remains adverse evidence, not a diagnosed host fault.
Change-source: pulse-maintainer
Carry exact duplicate-row conflicts into owned client trust before map deduplication. Keep unresolved saved trust through initialization, missing-client retry and topology refresh without replacing pins or stopping trusted siblings. Cover actual monitor lifecycle routes and member projections alongside client TLS controls.
Change-source: pulse-maintainer
Resolve all saved pins for an endpoint before credential-bearing construction. Contradictory trust is an explicit failure, not a missing-pin fallback or first-use opportunity. Preserve independent authorities, agreeing formats and saved configuration; prove zero provider work, sibling monitoring and normal reload through the member projection.
Change-source: pulse-maintainer
Require whole bounded, unambiguous enumerations on the efficient and node fallback routes. Preserve scoped empty inventories, LXC integer compatibility and ordinary counter/receipt semantics. Validate retained readings, History, breaches and template policy through actual fallback and recovery.
Change-source: pulse-maintainer
Consume the bounded response through EOF before admitting nodes or a cluster probe. Reject missing, ambiguous and incomplete inventories without leaking response details, retain scoped empty arrays and provider metadata, and cover trusted startup, recovery, cached reads and consuming endpoint projection.
Change-source: pulse-maintainer
Contract-Neutral: Tightens existing node-inventory and recovery-health admission without changing the public response schema, API surface, permissions, TLS or guest-command policy.
Replace the old optimistic-health expectation with cached selection, failed-request and later-success controls. Advance no production clock or safety fence and avoid an irrelevant constructor attempt in the in-memory fixture.
Contract-Neutral: Test-only correction to the recovery contract established in 4147f48db3; runtime and browser inputs are unchanged.
Change-source: pulse-maintainer
Require the actual nodes/login probe to succeed at startup, recovery and lazy selection instead of accepting guest-like response text. Retain failed single-endpoint health until an ordinary request succeeds, preserving cached last-resort reads, real guest error handling, temporary rate-limit handling and trust policy. Add producing-path and connected projection regressions and revise the old nodes-as-guest fixture contract.
Change-source: pulse-maintainer
The projection fixture now uses the actual saved ClusterEndpoint schema. Give each malformed-filesystem fixture an independent base path so reused listener ports cannot borrow a previous live uncertainty fence; all real guard state and response assertions remain.
Contract-Neutral: Test-only schema correction and independent synthetic endpoint identity; no production policy, deadline, wire or configuration changes.
Change-source: pulse-maintainer
A completed first-use retry does not return its nodes payload. Omit that unknown diagnostic count rather than reporting zero. Concurrent ordinary reads may legitimately open additional TLS sockets, so the construction control bounds logins and probe reads rather than pooled read connections.
Contract-Neutral: Diagnostic-count fidelity and fixture-only connection counting; no wire, trust, polling, authority or consumer contract delta.
Change-source: pulse-maintainer
The shared probe must release the health mutex for first-use trust. Retain the prior single construction boundary so joined readers do not duplicate capture and password login. The actual TLS concurrency control checks eight ordinary reads and nonblocking health inspection.
Contract-Neutral: Preserve existing serialized lazy client construction while releasing only the health and trust mutex for first-use capture; no wire, authority, configuration or consumer contract changes.
Change-source: pulse-maintainer
Use one bounded first-use probe for constructor and nodes-read pin failures at startup, recovery and lazy selection. Keep capture credential-free, primary and saved pins immutable, and full polling-session acceptance separate. Qualify all existing auth encodings and refusal, cancellation and consuming projection controls.
Change-source: pulse-maintainer
The containing race suite observed a prior cooldown before the invalid-success matrix sent its first HTTP request. Use per-case synthetic base paths instead of recycled listener authority; prove two first admissions and preserved cross-client fences on one shared listener. Production admission keys, aliases and safety state are unchanged.
Contract-Neutral: Isolate synthetic test identities; no production guest admission, TLS, session, polling or History contract delta.
Change-source: pulse-maintainer
Reject incomplete or ambiguous 200 login bodies before replacing ticket, CSRF, expiry and PVE generation. Preserve retained sessions, joined renewal failures, normal encoding fallback and later ordinary recovery; cover real pinned startup/poll/broadcast consumption.
Contract-Neutral: Restore existing complete-session and failed-renewal preservation guarantees; no API/wire schema, TLS trust, credential authority, guest lifecycle, polling cadence or History contract delta.
Change-source: pulse-maintainer
Carry cancellation through PVE/PBS construction, cluster probes and retained sessions, startup retries and port fallback. Preserve prior health/errors on caller termination; accepted clients retain independent ordinary reads and full timeouts. Cover real pinned HTTPS cancellation, deadlines, form fallback and first-poll publication.
Contract-Neutral: Restore existing caller cancellation and usable-session guarantees; no wire/API schema, agent lifecycle, TLS trust, guest safety, polling cadence or History contract delta.
Change-source: pulse-maintainer
Retain the actual authentication refusal and existing client when the full-timeout session cannot be constructed after a successful short probe. Cover pinned HTTPS rejection, malformed and form-refused sessions, later ordinary recovery and the monitor endpoint projection.
Change-source: pulse-maintainer
Validate result/content/truncated types before shared guest-command admission is released. Scalar results must not become empty inventories, and wrongly typed file fields must not release admission before decoder failure. Preserve compatible empty/null rows and completed but unusable measurements. Add six-reader, alias/expiry and actual-state polling/broadcast/History controls with untouched healthy-read origins. Native thaw and restart recovery remain separately unverified.
Change-source: pulse-maintainer
Retain the shared resolver and request authority while retrying only failed socket establishment. Usable addresses share one bounded dial budget; cancellation prevents further attempts and TLS still authenticates the original hostname and pin. Connected controls reproduce the first-address defect and cover cache reuse, families, deadlines and cancellation.
Change-source: pulse-maintainer
Bind the credential-free capture handshake to the polling context under the existing five-second ceiling. Recheck cancellation before publishing a runtime pin; retain established trust, endpoint selection and ordinary declared-member first use. Add local stalled-handshake, peer-closure, no-dial and later-recovery controls.
Change-source: pulse-maintainer
Reject impossible physical counters and overflowing cache estimates. Keep the original trusted source through repeated failed/negative-cache polls within the unchanged observation-age and capacity fences, instead of clearing the incident on an independent provider fallback after one retained poll.
Exercise all eight refusals through both collectors and both HTTP clients, original percentage/byte History, backup admission, real alert decisions, valid recovery and measured zero. Preserve TLS, operation locks, shared uncertainty, deadlines and native recovery exclusions. This completes the original guest-memory outcome coherently, not a replay of source-xubz2c16.
Change-source: pulse-maintainer
Validate PVE and PBS hosts before logging them, omit url.Parse input from syntax errors, and keep cluster logging, health snapshots, recovery summaries and returned error labels separate from configured routing and TLS identity. Exercise actual rejected-host constructors, cluster routing/recovery and accepted-host controls with synthetic credentials. Connection policy, authentication and guest safety fences are unchanged.
Change-source: pulse-maintainer
Publish ticket, CSRF and expiry together and share only an expired session renewal. Preserve independent requests, context cancellation without false credential errors, JSON/form authentication, token authority and terminal API refusals without replay. Add registered pinned HTTPS race, failure and recovery controls plus a canonical consuming projection. Keep exact verification paths sorted as required by candidate admission; runtime and tests are unchanged from the source-proven candidate.
Change-source: pulse-maintainer
Omit mobile connection and push offers, and advertise only current Pro history. Same-path HTTP controls preserve signed grants, public/private runtime fences and 7/14/90-day compatibility without changing subscriber terms.
Change-source: pulse-maintainer
Publish ticket, CSRF and expiry as one locked snapshot, and bind expiry/401 renewal to the rejected session generation. Concurrent readers share one authentication attempt while retaining their own cancellation and ordinary single-retry behaviour. Keep guest commands single-attempt and token/TLS policy unchanged.
Contract-Neutral: Synchronise existing Proxmox password-session renewal without changing API fields, TLS policy or guest-command admission and replay rules.
Change-source: pulse-maintainer
Reverts #2863 before any release ships it. The live Pro pricing and
Patrol pages, in English, German and Spanish, sell both modes ("applies
safe fixes in the mode you choose: Ask first, Safe auto-fix, or
Autopilot"), and paying installs chose them. Shipping the retirement
would have silently downgraded those installs while the sales page still
promised the modes.
If the modes are retired, that needs a dated notice: stop selling them
first, warn installs on those modes in-app, and then re-ship the change.
It should not arrive through an engineering cleanup.
The receipt #2863 landed stays in place; this commit adds the receipt
for the restored content.
The pulse-intelligence telemetry snapshot test fed the retired assisted level through the snapshot and expected it back. Patrol now reports only monitor or approval, so the fixture uses approval; the pass-through it checks is unchanged.
Patrol could run some fixes on its own in two paid modes: assisted (Safe
auto-fix) and full (Autopilot, behind a server-owned acknowledgement).
Schema-v17 telemetry for the week to 2026-10-11 counts 1 assisted and 2
full installs out of 612 reporting Patrol, 4 executed Patrol actions in
30 days, all on one install, and no GitHub request for more autonomy,
while the automatic path carried its own policy leases, acknowledgement
store, per-resource allowlist, release gate and Colima lab. Investigation
is what paid installs use, so it stays.
Patrol now has two modes. Watch only reports findings. Ask first
investigates and proposes fixes, and every fix waits in Actions for an
operator to approve and run it.
- A saved assisted, full or autonomous level reads as approval, and the
update routes refuse those levels with 400 invalid_autonomy_level.
- The core Patrol action broker only plans: Plan and Submit persist the
plan and return. ExecuteUnderPolicy, the policy authorization lease,
the policy admission store methods, the Autopilot acknowledgement
persistence, routes and dialog, and the per-resource automatic-action
allowlist (store column now written as NULL) are gone.
GetPatrolFullModeUnlocked stays on the extension contract and reports
false.
- Historical action records keep their policy lease and tenant/resource
reason codes decodable, labelled as retired modes.
- The Patrol inbox no longer splits issues into "continuing without a
decision"; every current issue is an operator decision.
- Release gate RG-06 now proves Patrol never executes without an operator
decision (integration tier) instead of limited unattended autonomy,
and RG-02/RG-04 point at the surviving human-admission proofs.
- Pro plan copy, AI docs, privacy telemetry wording and the subsystem
contracts describe the two modes.
Compose current main e2f4bdff03 additively. Retain both subsystem records and the held change-age control while withdrawing only the obsolete Discovery identification test. Reviewed identities and ancestry, canonical guest History ownership and upstream feature removal remain intact.
Change-source: pulse-maintainer
Normalise the selected data directory with the storage path routine before inspection. Raw symlink/.. traversal and trailing separators must not probe an empty peer or hide a linked root while the encrypted importer writes elsewhere. Retain and validate the existing canonical agent credential.
Change-source: pulse-maintainer
Check the actual saved-token destination when a configured path contains symlink/.. traversal, plus live and dangling directory links with trailing separators. The original guard can inspect an empty peer while persistence writes existing canonical state.
Change-source: pulse-maintainer
The first exact-source check found the old nodes.enc-only gate was the last user of path/filepath. Remove that unused import; runtime admission and served guide bytes remain unchanged.
Contract-Neutral: Remove an unused standard-library import only; the preceding startup admission contract and regression obligations are unchanged.
Change-source: pulse-maintainer
Require a blank destination instead of using nodes.enc as a first-run sentinel. Recheck before writes, retain unknown or unreadable state, and leave deliberate authenticated transfer unchanged. Keep deployment .env provisioning and encrypted file precedence; explain the separate archive path in canonical and served help.
Change-source: pulse-maintainer
Exercise ordinary configuration loading, saved access and unknown destination state through the production startup helpers. Retain blank provisioning, file precedence, input failure and deliberate configuration-transfer controls.
Change-source: pulse-maintainer
AI Discovery ran a separate model-backed service scanner beside Patrol
and the Assistant: its own store, scheduler, model route, API, tool and
drawer UI. No telemetry counter ever measured its use (the telemetry
discovery_enabled flag OR'd it with network subnet discovery), the
maintainer judged it a flop, and the context it produced is already
available to the models through pulse_query, pulse_read and the
unified-resource context sections.
This deletes internal/servicediscovery, internal/ai/infradiscovery, the
pulse_discovery tool, the /api/discovery routes, the mock Discovery
fixtures, the Discovery tabs in the resource, guest, node and Docker host
drawers, the identified-service cards, readiness badges, provenance
markers, suggested web-interface URLs, the Workloads AI Context column,
the chat "Discovery is off" hint and the AI Service Context settings page.
The old settings route redirects to Assistant settings. The model-bound
sanitizer allow-list existed only to pass Discovery context through, so it
goes too, along with the CopyableCodeRow primitive that only the
Discovery tab used.
Network subnet discovery (/api/discover, the Infrastructure discovery
settings) and the discoveryTarget agent coordinates are separate features
and stay. Stored discovery_enabled, discovery_interval_hours and
discovery_model AI settings are ignored on load; the settings API decoder
is lenient, so older frontends saving those fields still succeed.
The first single-endpoint ordinary read performs a connectivity check before the requested API read. Keep the fixture assertion on successful declared-target monitoring and zero injected-target authentication; guest single-attempt and admission assertions remain exact. Retain the failed final-source proof rather than treating it as a runtime failure.
Change-source: pulse-maintainer
rcourtman