Retain the upstream contract and lookup repair already present when review began, without expanding candidate source scope.
Change-source: pulse-maintainer
Contract prose still described surfaces that no longer exist:
- `frontend-primitives.md` told new route-level copy to extend
`problemResourcePresentation` (deleted in ae65c5e9a2), tied that helper
to `ProblemResourcesTable.tsx` (deleted with the dashboard overview in
c743a231b8), and kept a readability rule for that table and the
dashboard Pulse Brief. No live surface implements the rule; Patrol's
grouping and affected-resource counts are governed in
`patrol-intelligence.md`. The ownership paragraph and the rule are
dropped, and problem-resource joins the list of deleted dashboard
helpers that must not return.
- `unified-resources.md` said the change and correlation summary cards
default Infrastructure resource-filter links for the Patrol page and the
problem-resource dashboard panels. Since the 2026-05-16 drilldown
retirement the cards have no link default and render only in the
resource drawer, which passes no link builder.
- `api-contracts.md` named the dashboard Pulse Brief as a sender of
`autonomous_mode:false` and described the field as a client override.
Since 4edf5f8265, `ChatRequest` has no such field: the server runs every
`/api/ai/chat` exchange in approval-required mode (pinned by
`TestHandleChat_CannotElevateAutonomousModePerRequest`), and the field
is dropped at decode.
The new `subsystem_lookup_test.py` case pins the deleted helper as
unowned, next to the other retired dashboard paths.
Verification: `contract_audit.py`, `registry_audit.py` and
`status_audit.py` pass with `--check`; the retired-path lookup tests
pass (9/9); the full pre-commit battery passed. No frontend or backend
runtime files change.
Replace incomplete provider snippets with the existing authenticator and header-replacement requirements. Surface the all-users-admin default before enablement and stop copied diagnostics on bounded transport failure, preserving credentials and actual access checks.
Contract-Neutral: Documentation and synthetic recipe tests only; proxy authentication semantics and runtime contracts are unchanged.
Change-source: pulse-maintainer
Retain exact commit 18df4c1b46. Executable identity and bounded successful version probes replace metadata-only acceptance, retaining rollback and prior-active restoration. Source-uy8hwdan contains passing 24 focused methods and 191 subcases with vet; enclosing exit 1 from the incorrect control count and the independent broad installer failure remain adverse evidence, not cleared.
Change-source: pulse-maintainer
Retain exact commits 953e0c6dec and 2ffb4eb8ab. Existing cleanup guidance discloses LXC disruption, preserves recovery evidence and API access, and requires planned maintenance and real postconditions. Hash-bound source-4e_1ht9i proves the documentation controls, not native cleanup or shipped relief.
Change-source: pulse-maintainer
Reject successful installers whose replacement cannot identify itself as the target community runtime. VERSION metadata and failed or unrecognised probes cannot establish acceptance; retain the existing verified rollback and prior-active restoration. Exercise the complete locally signed installer transaction and bounded executable read.
Change-source: pulse-maintainer
The existing argv test now exercises the one documented non-purging cleanup instead of the two removed destructive examples. Retarget and ordinary agent uninstall checks are retained.
Contract-Neutral: Documentation test expectations only; no runtime or installer change.
Change-source: pulse-maintainer
Treat the existing helper as disruptive Proxmox host maintenance: disclose its LXC stop/start and key-removal scope, omit purge and API-account deletion, and require pre-state, private backups and actual postconditions. Exercise copied success/failure arguments with a synthetic helper and bind safety prose to current source.
Contract-Neutral: Documentation and documentation tests only; the cleanup helper, privileges and runtime contracts are unchanged.
Change-source: pulse-maintainer
Accept the exact Delivery candidate and its complete source-s468dla1 installer proof. The final repair removes only contract EOF whitespace; installer and regression-test bytes are unchanged. Native installed recovery and protected publication remain separate.
Change-source: pulse-maintainer
Accept product-intelligence candidate 20261007T180421Z-product-intelligence at exact tip 2209c65e8c. Preserve the existing ZFS row and health contract while replacing blanket permission grants and masked log reads with configured-token, deployment-scoped guidance. Retained source-3rssfcmh passes fifteen affected methods and rejects parent plus adverse controls; this is source help, not native recovery or publication.
Change-source: pulse-maintainer
The installer rereads saved preferences without an explicit selector. Forward the parsed stable default as well as RC, and prove the containing installer's actual channel-selection functions against the same signed fixtures.
Change-source: pulse-maintainer
The exact-source adverse control restored a guessed-account ACL command in inline Markdown without rejection. Parse fenced shell and single-line inline commands separately so triple backticks cannot hide a later permission mutation.
Contract-Neutral: Documentation safety test repair only; no runtime or permission contract delta.
Change-source: pulse-maintainer
Additively incorporate upstream 843daf7ae3 without removing accepted source. Resolve the overlapping AI documentation assertion by preserving its whitespace-normalized compatibility check together with upstream dead-Patrol guidance. The focused documentation policy tests pass; browser and final-source validation dependencies remain explicit.
Change-source: pulse-maintainer
Keep the same safety assertion with the lower-case clause used by the guide; the first local assertion failed on capitalisation, not reader behaviour.
Contract-Neutral: Documentation test wording only; no runtime or contract delta.
Change-source: pulse-maintainer
Separate missing storage rows, capacity and pool health; remove blanket guessed-account ACL advice and user-only permission checks. Reuse bounded server log guidance on the actual Pulse host, preserving native health checks and private evidence.
Contract-Neutral: Existing documentation and safety controls only; no runtime, API, feature or permission contract change.
Change-source: pulse-maintainer
Stop the generated helper before downloads when saved channel evidence is malformed or unreadable. Preserve explicit selectors, source-marker precedence and signed-installer verification; exercise the actual helper with signed local fixtures.
Change-source: pulse-maintainer
Preserve the three reviewed Web commits and their exact source proof. Existing help separates classification from stale inventory without disruptive diagnostics.
Change-source: pulse-maintainer
frontend-primitives.md still told new route-level copy to extend
problemResourcePresentation, deleted in ae65c5e9a2, and kept a paragraph
tying that helper to ProblemResourcesTable.tsx, deleted with the dashboard
overview in c743a231b8. It also kept a readability rule for that table and
the dashboard Pulse Brief. Neither surface exists and no live surface
implements the rule; Patrol's grouping and affected-resource counts are
governed in patrol-intelligence.md. Drop the ownership paragraph and the
rule, and list problem-resource among the deleted dashboard helpers that
must not return.
unified-resources.md still said the change and correlation summary cards
default Infrastructure resource-filter links for the Patrol page and the
problem-resource dashboard panels. Since the 2026-05-16 drilldown
retirement the cards have no link default and render only in the resource
drawer, which passes no link builder, so labels show as plain text.
api-contracts.md named the dashboard Pulse Brief as a sender of
autonomous_mode:false and described that field as a client override. Since
4edf5f8265 ChatRequest has no autonomous_mode field: the server runs every
/api/ai/chat exchange in approval-required mode, as
TestHandleChat_CannotElevateAutonomousModePerRequest pins, and the field
that scoped handoffs still send is dropped at decode. Say so, and stop
calling Patrol finding handoffs stricter than ordinary chat.
The new lookup test pins the deleted helper as unowned, next to the other
retired dashboard paths, so the dropped ownership claim cannot come back
through the registry unnoticed.
Replace indefinite journal followers, a failure-masking search and diagnostic debug/restart advice with one shared deadline-bounded reader. Preserve failed reads and both streams, identify the affected agent host and keep raw errors private. Exercise copied commands with missing-tool, partial-failure, timeout and termination controls; no native recovery claim.
Contract-Neutral: Existing agent-help recipes and executable documentation controls only; agent, installation, collection, command-channel, permission and notification runtime contracts are unchanged.
Change-source: pulse-maintainer
Clarify Test versus ordinary delivery and message identity in the existing optional evidence fields. Preserve original queue context without sending, replaying or exposing destination secrets; pin both form schemas and the mirrored triage guide.
Contract-Neutral: Report guidance and its static checks only; no runtime, notification delivery or intake automation change.
Change-source: pulse-maintainer
Separate job outcome classification from stale or absent inventory, point to existing native and expanded-row evidence, and keep disruptive diagnostics and broad permissions out of the help path.
Contract-Neutral: Existing mirrored help and rendered guidance checks only; replication runtime, API and authority contracts are unchanged.
Change-source: pulse-maintainer
Preserve the exact Web candidate, mirrored guidance and rendered-document proof without treating documentation as native recovery.
Change-source: pulse-maintainer
Preserve the exact reviewed product-intelligence commit and its proof. Existing intake fields and mirrored triage guidance keep repeated identities distinguishable without private names or setup changes; no runtime or new product surface changes.
Change-source: pulse-maintainer
The full installer race suite exposed report deletion despite the subshell-counter guard. Bind EXIT cleanup to the original process using the direct child shell parent PID, including before the inherited counter is initialised. Retain strict and unchanged-graph verdicts, exact arguments and parent cleanup. Align the stale channel-copy assertion with the existing non-stable message; executable consent controls remain unchanged.
Change-source: pulse-maintainer
Keep wrong-node errors, backup attribution and lost agent-backed Docker monitoring separate. Provide passive existing-view comparisons and native fallbacks without renaming hosts, re-enrolling agents or recreating the incident. Bind the help entry points and privacy limits to rendered documentation checks.
Contract-Neutral: Existing help maintenance only; no runtime, identity or provider contract changes.
Change-source: pulse-maintainer
Require a successful bounded executable identity probe before release discovery. Keep Pro and unknown runtime editions untouched even when VERSION offers a usable community version, and do not defer a broken primary binary to a legacy one. Exercise the real shell classifier and main boundary with adverse controls and a TERM-resistant deadline.
Change-source: pulse-maintainer
Repeated identity reports affect node errors, backup status and agent-backed Docker monitoring. Let reporters describe shared and independent targets using consistent aliases, without disclosing private identities or changing their setup. Preserve every affected surface during triage.
Contract-Neutral: Clarifies existing issue intake and triage guidance; no runtime, automation or feature contract changes.
Change-source: pulse-maintainer
source-2h58772x exposed an outdated copy assertion left behind by 53e1bff13c. Check the current severity/tag guidance and its real help link, retaining both filter conjunction requirements. No reader, guide or routing behaviour changes.
Contract-Neutral: Documentation test repair for existing routing guidance; no runtime or subsystem contract changes.
Change-source: pulse-maintainer
Preserve exact Delivery commits 697608448a and 745c1f9ce5. Same graph and endpoints; only the observed transport-only error can retry. Refusals, integrity failures, unknown output, timeouts and signals remain terminal.
Change-source: pulse-maintainer
Remove the record-limited but indefinitely blocking duplicate commands. Use the existing unfiltered Pulse readers, preserve NAS-specific safety guidance, and exercise the linked source and rendered help against failures, real deadlines, TERM resistance and missing timeout.
Contract-Neutral: Documentation and diagnostic-recipe verification only; no runtime, API, permission or subsystem behaviour changes.
Change-source: pulse-maintainer
A TERM-only timeout relies on the child exiting. Keep a fixed five-second KILL backstop, preserve every timeout as a failure and bind the shell/Go command proofs to the actual bounded invocation.
Contract-Neutral: Internal build timeout containment; source graph, endpoints, checksum trust and artifact acceptance are unchanged.
Change-source: pulse-maintainer
buildPatrolAssessmentAssistantHandoff lost its last caller when the Patrol
summary card's Discuss handler was removed in eac7dfe9ef (2026-05-15), and
buildPatrolConfigurationFailureHandoff lost its last caller in 27ba85ddc6
(2026-06-23). Since then only their own tests called them. A TypeScript
compiler import graph rooted at src/index.tsx confirms no reachable file
imports either one. Removing them also drops PatrolInvestigationContextSummary,
their input and output types, and the private assessment, recent-change,
correlation and save-failure helpers that only they used (found with
noUnusedLocals until it reported nothing).
Rollup had already tree-shaken all of it: production builds of the parent
tree and of this tree are byte-identical across all 187 dist files, and the
bundle-size check passes. The presentation helpers the dead code imported
keep their live callers.
Their test cases go with them. Two cases covered branches the live finding
handoff still uses, so they now run through
buildPatrolAssistantFindingHandoffActions and buildPatrolAssistantFindingHandoff:
a typed pending action without a legacy approval id stays approval-bound,
and the finding context qualifies its resource with the record's node and
truncates long lines. v8 coverage of the surviving model code matches the
pre-removal baseline except one defensive guard the live caller cannot
reach. The raw-source guards pinned none of the removed code.
The Assistant drawer still restores saved patrol_assessment and
patrol_configuration_failure sessions, so that compatibility path stays.
The contracts described both handoffs as live producers, and described a
Patrol summary card, assessment strip, assessment readout, score chip and
header trust line that the page no longer renders. patrol-intelligence,
ai-runtime, api-contracts, frontend-primitives, security-privacy,
storage-recovery, agent-lifecycle and unified-resources now say what the
code does: those handoffs survive only as saved sessions,
the drawer, session list and API keep restoring them, rules for a returning
summary card, strip or readout are conditional, and handoff_actions and
adjacent-boundary clauses name the finding and attention handoffs that send
them today. The run-history handoff clauses also claimed the browser sends a
[Patrol Run Context] block and scoped resources; it sends the briefing and
run identity, and internal/ai/patrol_assistant_handoff.go rebuilds the rest
from the run ID.
docs/AI.md (and its public mirror) told users the legacy operational score
sits in a collapsed supporting-context section. That section and the score
are gone; the section now points at Activity > Finding options and history,
where check history lives. ai_runtime_docs_policy_test.py, its registered
proof, now pins that location and rejects the retired claim. The same file
had failed on main since 2789a15fe5 reworded the Patrol mode API sentence to
"The API retains `autonomy_level` for compatibility" without updating its
pin; the pin now matches that wording.
Keep the same pinned Go graph and endpoint. Retry only the observed transport-only diagnostic, at most three attempts; stop on refusals, integrity errors, unknown output, timeouts and signals. Execute the actual Docker download command against controlled outcomes and retain its original-base rejection.
Contract-Neutral: Build-only transport recovery; source graph, endpoints, checksum trust and artifact acceptance are unchanged.
Change-source: pulse-maintainer
Bring the general Unix private-file bootstrap up to the existing PBS guide's safety floor. Preserve token and installer files, ignore curl configuration, require verified HTTPS and HTTP 200 before publishing the script, and exercise refusal and partial-download paths.
Contract-Neutral: Documentation and executable documentation tests only; no installer, API, runtime or capability contract changes.
Change-source: pulse-maintainer
Register the real shell verifier for the updater without admitting it as proof for unrelated installers. Preserve exact installer requirements and test missing/unrelated proof rejection.
Change-source: pulse-maintainer
The broader installer race/vet VM attempt reached readiness but returned no command verdict at its observation deadline. Keep the same consent cases in the normal installer suite and make their committed file standalone, with only standard-library imports and the actual shell gate. This enables proportionate exact-source Bash regression proof without building unrelated application dependencies; the broader failed attempt remains retained.
Change-source: pulse-maintainer
Text matching admitted truncated configuration, nested opt-in and padded RC channels. Parse one configuration object with the installed jq dependency and fail closed before downloads when consent cannot be verified. Preserve the legacy no-config timer opt-in, manual updates and disabled-timer gate; add executed-shell regression cases and the deployment contract.
Change-source: pulse-maintainer
Preserve the exact candidate and its installer race and adverse-control proof. Native installed recovery remains separate.
Change-source: pulse-maintainer
Admit a prepared executable and source revision before stopping Pulse. Keep the live binary in place until one same-filesystem rename, and restore only a previously active service after a failed rename. Preserve existing recovery files and exercise staging, stop, rename and recovery failures.
Change-source: pulse-maintainer
Restore machine and other subject alert enrichment without path-based ownership. Reuse the existing PVE alert journal decision and cross-source hardware matching for serials, WWNs, placeholders, moved paths and ambiguous identities. Preserve machine isolation, handover counts, resolution windows and exact paid-boundary controls.
Adapt rcourtman's PR #2641 (de524e823d) and the boundary controls of rejected maintainer candidate b548e6dd3ae6d689a479254baf785d2bead7cf77. Correct its disk ownership defect against current main rather than retaining a parallel identity matcher. Imported and shared history is unchanged.
Change-source: pulse-maintainer
Reject signature, extraction, architecture, destination staging and version failures before the service outage. Keep the live executable until a same-filesystem rename succeeds, remove the destructive version retry, and recover only a previously active, confirmed-stopped service if rename fails. Exercise the real archive path with download/local inputs and retained byte/mode/state fault controls; preserve uncertain-stop restrictions and separate native acceptance.
Change-source: pulse-maintainer
Integrate Delivery candidate 7ee03281c0 without re-parenting either reviewed commit. Bounded service-state admission protects archive and source replacement, and manual flows stage before stopping. Retain exact-source installer/race proof source-93q9_bp2 and its stated skips, line-bound warning and native limits; no frontend or infrastructure delta.
Change-source: pulse-maintainer
Remove unscoped Compose and Helm update shortcuts and blind container removal from the installation entry point. Keep exact edition, effective storage, successful staging and current-state checks connected to the maintained procedures; add regression controls for the shipped guidance.
Contract-Neutral: Documentation-only update guidance and regression checks; installer, runtime and deployment behaviour are unchanged.
Change-source: pulse-maintainer
pulse-triage[bot]