Return actual allocation, syntax, mode and rename failures before
publishing a configured updater. Prepare the rewrite beside its input
and leave the installed helper and units unchanged when configuration
cannot complete. Exercise the real rewriter and its containing asset
installer under the conditional callers that suppress errexit.
Contract-Neutral: Repairs the existing configured-helper and
failure-preservation guarantees without changing update consent, source
selection, service policy or deployment contracts.
---
Fleet candidate `20261025T214019Z-delivery-trust` from the
`delivery-trust` lane. Reviewed tip
`aa4f3bbf8db4e9ff1b055f391ef4ecf0d6fb9a0a` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
## What
`recover-release-activation.yml` now also admits failed
`create-release.yml`
runs dispatched from release-train snapshot refs
(`release-candidate/<packet>`
or `release-dispatch/<packet>`), not only from `main`.
A snapshot run is admitted only when main's `release_snapshot.py` proves
its
commit is the merged head of exactly one `release-candidate/<packet>`
release
PR. The source run's own `prepare` job ran that branch's code, so it is
not
trusted. Recovery now refuses to run unless dispatched on `main`,
fetches full
history for the ancestry check, and gains `pull-requests: read` for the
PR
lookups.
## Why
The release train has dispatched on `release-candidate/*` branches since
October, and will move to post-merge `release-dispatch/*` branches so
release
secrets can be confined to refs that exist only after merge. A train
release
that failed at activation could not use this recovery path at all.
## Stacking
This branch is built on #3295 (snapshot check accepts
`release-dispatch/*`
refs), whose commit is included here. The two PRs touch different files.
## Validation
- New executable test runs the recovery admission against stubbed GitHub
and
git: `main`, `release-candidate/*` and `release-dispatch/*` runs are
admitted;
lane branches, missing, unmerged or mismatched PRs, a different head
commit,
two matching PRs, malformed refs and a merge missing from main are
rejected.
- Mutations that each fail it: skipping the provenance check, and not
mapping
`release-dispatch/*` to its candidate head. Two more (admitting any
branch in
the run predicate, dropping the head-SHA filter in PR selection) are
caught
by `release_snapshot.py`'s own checks instead.
- `release_promotion_policy_test.py` 73/73, `check_workflow_trust.py`
and its
44 tests, `release_snapshot_test.py` 7/7, all on a full checkout.
**Align triage disclosure with current release and retest policy**
Correct the disclosure linked from every community reply and its shipped
Docs copy: weekly stable targets, daily betas instead of early candidate
cuts, and the stable publication clock when a same-fix preview retest
already exhausted unanswered contact. Correct the linked release guide
as well, preserving every-symptom resolution, safe retesting and
unchanged candidate soak. Add registered document and
production-renderer coverage.
Contract-Neutral: Public guidance now matches existing standing release
and contact policy; no runtime, release machinery, authority or
subsystem contract change.
**Explain CORE reporting rejection without repeated capture**
Distinguish the reported HTTP 400 query-schema failure from an invalid
API key, refreshed inventory and measured idle zeros. Link
missing-telemetry readers to the safe native Reporting fallback before
more capture, retaining the original report and upgrade relevance. Add
registered production-renderer regression coverage.
Contract-Neutral: Existing TrueNAS troubleshooting guidance only; no
API, collector, storage, permission or release contract change.
**Assert the native fragment contract for CORE help**
The first source proof caught a test-only assumption: fragment-only
links deliberately use native browser anchors, not the cross-document
router marker. Check that existing contract; the guide bytes are
unchanged. Retain the original failed proof.
Contract-Neutral: Correct a documentation test assertion; no runtime or
subsystem contract change.
**Format issue follow-through renderer tests for CI**
The reviewed help candidate failed the required full frontend formatting
check because its disclosure test file was not included in the focused
formatting command. Apply the configured style without changing
assertions, documentation or runtime behaviour.
Contract-Neutral: Test-only formatting; no rendered content, runtime or
subsystem contract changes.
**Finish formatting long disclosure assertions**
The full-tree check found additional over-width assertions beyond the
first scoped repair. Reflow the remaining expressions without changing
their tokens or documentation.
Contract-Neutral: Test expression layout only; assertions and runtime
behaviour are unchanged.
---
Fleet candidate `20261025T210853Z-product-intelligence` from the
`product-intelligence` lane. Reviewed tip
`b06f1584aa8da42d3effbae4c57e7b8c325c5d57` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
## What
The release snapshot check
(`scripts/release_control/release_snapshot.py`)
now also accepts dispatches from `release-dispatch/<packet>` refs. Such
a
dispatch must name a merged PR whose head is
`release-candidate/<packet>` at
the dispatched commit. The other checks are unchanged: closed and
merged,
head SHA equals `GITHUB_SHA` and `GITHUB_WORKFLOW_SHA`, base is the
requested
source line, canonical repository, and both merge ancestry checks.
`release-candidate/*` dispatches keep working exactly as before.
## Why
Release, signing and registry secrets are repository-level today, so a
workflow run on any branch can read them. The planned fix moves them
into a
`release` environment that admits only `main` and post-merge dispatch
refs.
`release-candidate/*` cannot be that ref, because unmerged release PR
heads
live under the same name. This check has to accept the new namespace
first,
and every snapshot cut after this merges will carry it, before the host
dispatcher switches over.
This validates identity only. Restricting who can create or move
`release-dispatch/*` refs is a separate repository ruleset; the contract
in
`deployment-installability.md` says the namespace carries no extra trust
until that ruleset is active.
## Validation
- `release_snapshot_test.py`: 7/7, including new cases for the dispatch
mapping, rejected head names (`release-candidate/other`,
`release-dispatch/*`, `maintainer/*`), malformed dispatch names and
unbound inputs, plus the end-to-end `main()` path for both namespaces.
- Mutation checks, each failing the tests: dispatch ref not mapped to
its
candidate head; slashes admitted in dispatch names; dispatch ref not
admitted by `source_branch`.
- `release_promotion_policy_test.py` behaves identically with and
without
the change on the same partial tree; CI runs it in full.
Activation recovery only admitted failed create-release runs dispatched on
main, but the release train dispatches on release-candidate/* snapshot
branches, and will move to post-merge release-dispatch/* branches. A train
release that failed at activation could not use the recovery path.
Recovery now also admits runs from those refs, but only after main's
release_snapshot.py proves the run's commit is the merged head of exactly one
release-candidate/<packet> release PR. The source run's own prepare job ran
that branch's code, so it is not trusted. Recovery refuses to run unless
dispatched on main, fetches full history for the ancestry check, and gains
pull-requests: read for the PR lookups.
Release secrets are repository-wide today, so any workflow on any branch can
read them. The plan is to move them into a `release` environment that admits
only `main` and post-merge dispatch refs. Today's dispatch refs cannot serve:
`release-candidate/*` also names unmerged release PR heads.
The snapshot check now also accepts `release-dispatch/<packet>`. It must name
a merged PR whose head is `release-candidate/<packet>` at the dispatched
commit, with the same source-line and ancestry checks as before. The
existing `release-candidate/*` dispatch keeps working, so the host dispatcher
can switch over later. Every snapshot cut after this lands carries the check.
This change validates identity only. Restricting who can create or move
`release-dispatch/*` refs is a separate repository ruleset, and the contract
says the namespace carries no extra trust until that ruleset is active.
Return actual allocation, syntax, mode and rename failures before publishing a configured updater. Prepare the rewrite beside its input and leave the installed helper and units unchanged when configuration cannot complete. Exercise the real rewriter and its containing asset installer under the conditional callers that suppress errexit.
Contract-Neutral: Repairs the existing configured-helper and failure-preservation guarantees without changing update consent, source selection, service policy or deployment contracts.
Change-source: pulse-maintainer
The label sync was the only workflow that read PULSE_TRIAGE_APP_PRIVATE_KEY.
That key belongs to an App installation that can administer the repository,
and as a repository-level Actions secret any workflow run on any branch could
read it. Everything the helper does (read the issue, create, add and remove
labels) is covered by the run's own GITHUB_TOKEN with issues: write, so the
App key can now be deleted from Actions.
The policy test now requires issue-mutating workflows to use the scoped
GITHUB_TOKEN and to reference no secrets, and still requires the parser tests
to run before the label write. Silent labels are applied as
github-actions[bot]; AI_TRANSPARENCY.md says so.
Require complete Git scope, parent, trailer and file observations before checking committed source. Keep ordinary dirty-tree exits distinct from read errors, retain every failing canonical commit, and stop before expensive source checks when admission is already blocked. Fault-injection controls exercise empty and partial reads alongside the successful Go, type-check and browser-guard path.
Contract-Neutral: Local pre-push orchestration only; product contracts and the required source, audit and browser checks are unchanged.
Change-source: pulse-maintainer
Returned CI rejected the new curl protocol flags in the existing channel fixture. Admit only the exact HTTPS options and require both. Make the invalid-signature control prove it reached the real verifier instead of passing on a fixture error; retain all channel and no-download checks.
Change-source: pulse-maintainer
Correct the disclosure linked from every community reply and its shipped Docs copy: weekly stable targets, daily betas instead of early candidate cuts, and the stable publication clock when a same-fix preview retest already exhausted unanswered contact. Correct the linked release guide as well, preserving every-symptom resolution, safe retesting and unchanged candidate soak. Add registered document and production-renderer coverage.
Contract-Neutral: Public guidance now matches existing standing release and contact policy; no runtime, release machinery, authority or subsystem contract change.
Change-source: pulse-maintainer
The generated manual helper currently permits an HTTPS asset redirect to plaintext HTTP, unlike the unattended downloader. Restrict initial and redirect protocols for both signed inputs, without weakening deadlines, signature verification or cleanup. Exercise the actual helper with real curl and authenticated local TLS, including downgrade refusals and permitted HTTPS redirects; keep the native systemd fixture on the exact envelope.
Change-source: pulse-maintainer
The published v6.5.0 to v6.6.0 lifecycle run 40197749411 reported an unmatched quote after the installer rewrote /bin/update in place. Stage, validate and atomically replace the helper so an executing Bash reader keeps its original inode. Preserve the optional non-fatal setup guarantee on every preparation or replacement failure.
Change-source: pulse-maintainer
Every /msp evaluation link opens docs/MSP.md, which still installed the
v6.4.1 bundle and said paid licences come through an assisted upgrade
path. Plan in the provider portal has sold every MSP plan since v6.5.0,
so a provider following the site could never reach it.
The guide now installs the signed v6.6.0 bundle, explains buying,
renewing and lapsing from Plan as shipped (paid period plus 14 days,
then 7 days of grace), and adds an upgrade section. Walking it on a lab
VM found three more gaps, now covered: day-2 commands need sudo because
setup writes a root-only .env; client runtimes move only with
--rollout-tenants; and a v6.4.x control plane keeps stopping clients,
which blocks the upgrade gate until it is stopped and the current
runtimes are started. No plan exists above 40 clients, so the guide no
longer offers a custom licence for that.
SetBytes benchmarks report B/s beside time and allocation costs. Treat lower byte throughput as adverse, retain lower-is-better cost metrics, and include each finding's unit so scaled values are not ambiguous. Keep the significance, sample and magnitude gates unchanged.
Contract-Neutral: CI benchmark verdict parsing and registered regression controls only; no product runtime or subsystem contract change.
Change-source: pulse-maintainer
Restore the existing dialog/flow verification policy unchanged and give the Recovery overview its own direct-test requirement. Pin rejection of cross-surface substitutes, cumulative proof for mixed edits and truthful forward/reverse lookup routes without changing frontend bytes or imported history.
Change-source: pulse-maintainer
The proposed-source triage suite already exercises the locked parser and
silent-mutation consumers. Pure helper edits still queued unrelated
application suites for more than twenty minutes. Recognise only the six
exact triage inputs from a complete tree diff; mixed, missing and
control-path changes retain full application checks. Keep workflow
output outside the fixture source tree so real-diff controls do not
stage it.
Contract-Neutral: CI admission for isolated issue-event inputs only;
locked triage tests, secret scanning, governance and mixed-source
runtime checks remain enforced, with no product contract or permission
change.
---
Fleet candidate `20261025T085429Z-delivery-trust` from the
`delivery-trust` lane. Reviewed tip
`e404c2fe07096fcf9b733f307a5a834719a966c5` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Complete the same Recovery policy move in lookup coverage, including all three transfer surfaces and their exact proof list. The broader governance run exposed this stale framing expectation after the first repair; no runtime, registry or enforcement changes are required.
Change-source: pulse-maintainer
Keep the seven remaining settings shells under framing proof, and assert transfer-specific membership for Recovery, its dialogs and its flow. Confirm dedicated proofs match and generic settings architecture cannot satisfy transfer safety. This repairs PR 3249's reproducible governance-test failure without changing the guard or weakening the registry.
Change-source: pulse-maintainer
Safe-profile migration pinned the output of hostname -f as the agent's
reported name, so every migrated host switched to its FQDN while
root-profile hosts kept the short system hostname the agent reads. Pin
the system hostname instead. An explicit --hostname still wins, and the
server's authority check already accepts short and FQDN forms of the
bound name. Hosts migrated earlier keep their stored name.
Contract-Neutral: Safe-profile migration now pins the system hostname the agent already reports; no agent-lifecycle or deployment-installability clause names the hostname -f choice, and the new install_sh_test.go case proves the behaviour.
The proposed-source triage suite already exercises the locked parser and silent-mutation consumers. Pure helper edits still queued unrelated application suites for more than twenty minutes. Recognise only the six exact triage inputs from a complete tree diff; mixed, missing and control-path changes retain full application checks. Keep workflow output outside the fixture source tree so real-diff controls do not stage it.
Contract-Neutral: CI admission for isolated issue-event inputs only; locked triage tests, secret scanning, governance and mixed-source runtime checks remain enforced, with no product contract or permission change.
Change-source: pulse-maintainer
Promote v6.6.0-rc.6 to stable after its 24-hour soak. Only release metadata changes.
Contract-Neutral: Release-only v6.6.0 version, release notes and distribution metadata; no public install or runtime contract changes.
Change-source: pulse-maintainer
The containing installer suite exhausted a single 30-second Python-class budget after eleven controls and killed the last. Use the existing serial discovery runner with all twelve required methods, retaining each control's 30-second bound and the existing inner shell bounds rather than treating cumulative class time as a safety deadline.
Change-source: pulse-maintainer
Admit only the manual helper's exact new curl envelope in the existing closed transport fixture. Require a signed emitted-helper round trip and reject altered deadlines, retries and TLS flags through the registered installer suite; do not widen the adapter or execute a native journey.
Change-source: pulse-maintainer
Keep both bootstrap requests within curl's connection and whole-request deadlines, without ambient retry settings. Arm cleanup before allocation so a second mktemp failure cannot strand the first input. Exercise the emitted helper's signed success, partial download failures, allocation failures and signature rejection without native or production execution.
Change-source: pulse-maintainer
Cold seven-day mock workload charts synthesized 914 values per series
before discarding most of them. Selecting the existing timestamp grid
before synthesis preserves the retained readings, newest point and
complete history window while bounding expensive work. The controlled
native request fell from 8.9 seconds to 1.3 seconds.
The strict chart query gate also exceeded its 90 ms p95 limit. Profiling
showed repeated SQLite row decoding, so raw fleet value reads now carry
the series and timestamp in one integer per observation. This
statement-local transport preserves exact values, negative-epoch
timestamps, tier reconciliation, resource scope and ordering, with
separate columns when a window could overflow. Full metrics-store tests
and targeted monitoring/API regressions pass, including boundary and
prepared-query cache controls. The 90 ms limit remains unchanged.
Organization browser fixtures arrange activated API fixtures before
their first workspace load. Explicit activation and deletion bounds
cover the existing server deadlines. Cleanup owns partial preparation,
attempts every tracked organization and retains failures. Native backend
teardown retains its final log. CI executes all 63 authentication,
organization and backend lifecycle controls before browser fanout.
Browser OS acquisition uses the hosted runner's existing signed Ubuntu
source definition. An unrelated Microsoft feed returning 403 can no
longer stop browser setup. Missing, unreadable or empty Ubuntu
definitions and incomplete Ubuntu index updates still fail. Existing
mirror, TLS, signature and cached archive hash checks remain in force.
Real apt acquisition controls, 17 package cache tests, 11 ownership
tests and normal commit/push checks pass.
The mock target lookup benchmark keeps fixture lifecycle logs out of
Go's result stream. A combined stdout/stderr control reproduces the lost
original observations and parses all ten corrected observations with
identical 4,731 lookups per operation. The benchmark work and comparison
thresholds remain unchanged.
Current-build browser verification covers
`/proxmox/workloads?type=vm&platform=proxmox-pve` at 1440×1000 and
390×844: seven-day trends, row drawer expansion, history range
selection, oldest/latest keyboard inspection and drawer dismissal.
Twelve organization-route cases cover organization settings, access,
sharing and billing across Chromium, mobile Chrome and mobile Safari
with retries disabled.
The [full stable/probation browser
run](https://github.com/rcourtman/Pulse/actions/runs/40160832317)
passed: 530 passed, 392 skipped, zero failures and no retry/flaky
markers in all eight shard logs. Agent registration and organization
provisioning also passed. This evidence covers product code at 64c0a3f9.
The later correction changes only a Go benchmark fixture and its
performance contract.
The [final-head stable E2E
run](https://github.com/rcourtman/Pulse/actions/runs/40163545118) also
passed all eight shards, agent registration and organization
provisioning: 186 passed, 183 skipped, zero failures.
All nine required source checks passed. The [final-head build and test
run](https://github.com/rcourtman/Pulse/actions/runs/40163545117)
passed, including benchmark comparison and strict chart qualification.
The chart result on valid hosted capacity was p50 38.31 ms, p95 51.01 ms
and p99 52.28 ms against the unchanged 90 ms p95 limit. The retained
artifact binds the measured binary to the tested synthetic merge commit.
The preceding runtime qualification also passed at p95 86.55 ms on its
runner. The benchmark comparison found no regression above the existing
10% and p<0.05 threshold. The corrected lookup fixture supplied all ten
observations without parser warnings.
After main advanced with scoped authentication and tenant runtime
changes, a native compatibility proof composed this exact head with
c809d3c93b. API, configuration API and
monitoring regressions passed. All twelve organization browser cases
passed again with retries disabled. A fresh embedded runtime passed the
desktop and phone seven-day chart matrix with both endpoints accessible.
The reviewed combined tree is 2e9a154b1c.
An unrelated Microsoft repository returned 403 during fresh-index admission and stopped a browser shard before any test could run. Load the hosted runner's existing Ubuntu Deb822 definition for browser packages, preserving its mirrors and signature policy. Fail when that definition is missing, unreadable or empty and keep strict index and archive hash checks.
Exercise the real apt parser, exclusion of unrelated feeds, missing definitions and incomplete index failures in private acquisition directories. Register the package helper and policy with their exact verification routes, and update the fixture helper's governance assertion to its scoped proof contract.
Admit the complete index and patch reads, and drain pattern matches before interpreting their result under pipefail. Preserve sensitive-file and fallback-secret blocks and required docs, governance and lint admission; distinguish an empty filtered patch from a failed read. Exercise the actual hook with bounded synthetic large inputs and retained failure exits.
Contract-Neutral: Local hook input handling only; existing secret patterns, required checks and production contracts are unchanged.
Change-source: pulse-maintainer
Scrolling through a long platform drawer could unmount its owning row
and close the detail being read. REST resource projection also dropped
source provenance, hiding vCenter context and host placement from
owning-snapshot consumers. Diagnostic commands lacked keyboard
scrolling, and dark-theme text and several Patrol control names failed
accessibility checks.
Measure summary rows and inline details together in the shared bounded
window, preserve canonical resource sources, make diagnostic command
blocks focusable, and repair shared contrast and visible control naming.
Browser fixtures await mounted authentication and keep synthetic
provider inventory authoritative. Journey assertions follow current
read-only capabilities, technical disclosures and composed resource
queries. Long settings audits traverse the actual scroll extent; curated
estate checks use native inventory disclosures and search; disk proofs
follow canonical serial-bound shared history; the published
completed-restore-point calendar checks remain intact, including day
selection and filter reset. Update API proofs no longer mount an
unrelated dashboard before each request.
Fresh password login now waits for mounted bootstrap too. The
delayed-bootstrap regression owns and revokes its own token, so it runs
with cookie-only and primary-token fixtures without replacing the
fixture credential. Update API cases share an admitted cookie fixture.
Growth assertions use the current fixed-window header, LXC refresh
assertions use the fixture's canonical identity, and the gated-panel
observer follows actual gate readiness while still detecting visible
unlocked controls. The Docker browser stack explicitly opts into a
bounded development update budget for its shared bridge IP. Production
and login limits remain unchanged.
The remaining recovered failures exposed three test synchronization
defects. Alerts now leaves the whole editor before judging a staged
change and exercises its sibling-focus contract. Protected panel
assertions wait for mounted bootstrap before their existing readiness
timeout. The delayed-token regression uses its own page, avoiding
interception of reads from a departing setup document. CI retains
failed-attempt HTML diagnostics after a successful retry and small JUnit
results for each completed tier, including stable receipts before
probation starts.
Validation includes negative controls for the original drawer,
provenance and password-bootstrap defects, 335 focused frontend tests,
23 authentication-fixture tests, type-checking and a production build.
The cookie-only follow-up matrix passed 39 cases across Chromium, mobile
Chrome and mobile Safari with 18 existing skips. Twelve additional
onboarding cases passed with no retries, and the token-bootstrap matrix
passed 12 cases with cookies alone and 12 with a primary token. Native
Chromium and WebKit checks exercise the gated-panel detector's positive
and negative controls. The earlier remaining-failures matrix passed 31
cases with 10 existing skips, and both disk-history cases passed on
desktop.
Current-build browser verification covers onboarding, accessibility,
VMware context and exclusion boundaries, demo commercial isolation,
persisted Alerts settings, Patrol, availability and background refresh.
Pixel and interaction review covers infrastructure, Agent Doctor,
Patrol, Docker, Kubernetes and vSphere at desktop, tablet and phone
widths in both themes where applicable. Existing timeouts, skips,
mounted-row limits and the 90 ms chart budget remain in place.
The final recovered-failure matrix passed 27 cases with 14 existing
mobile skips using cookies alone, followed by 12 passes with a primary
token, all without retries. The forced desktop table control reproduces
the old focus failure and passes after leaving the editor. The preceding
qualified tree completed all required source checks and the full
stable/probation matrix. Its executed strict chart proof measured p95
61.1 ms against 90 ms with valid capacity. The updated head is being
qualified again before landing.
Governed work: L12 journey verification and the shared L10 windowing
proof. This source change does not publish a release.
The first exact-source parallel attempt failed the generated Unraid and QNAP watchdog control. Its real machine-wide process observation is not isolated by private fixture files. Preserve the entire NAS class's serial execution and make concurrency explicit only for the seven modelled-inventory classes. The regression now proves that the serial helper still preserves ordering, as well as bounded parallelism and complete failure/skip/cleanup evidence.
Contract-Neutral: Test-only fixture scheduling; real NAS observations, production manager deadlines, process ownership checks and required test coverage are unchanged.
Change-source: pulse-maintainer
Exercise Chromium and WebKit geometry once after browser installation,
before the first shard admits its runtime fixture. Content growth must
complete the new scroll extent and unchanged-extent resets must still fail.
Current successful public CI puts the installer package on the backend critical path for 683-764 seconds. Each registered Python method already owns a separate process and private fixtures; run those methods through the existing Go parallel scheduler, starting their unchanged deadlines only after admission. Keep exhaustive discovery and exact non-skipped method verdicts, with connected parallel, serial, failure, skip and cleanup controls.
Contract-Neutral: Test-only scheduling of already isolated fixture processes; no installer, runtime, service deadline, source selection, required check or native acceptance contract changes.
Change-source: pulse-maintainer
Judge consuming panels after their protected document has mounted, and
give the delayed-token regression its own bootstrap page. Leave the whole
Alerts editor before checking for a staged change, including its desktop
focus and card Save contracts. Keep the existing panel timeouts.
Preserve failed-attempt HTML diagnostics when a first retry succeeds and
retain small JUnit results for every completed tier. Upload stable evidence
before probation starts. Integrate the published node disk observation
repair before qualification.
Fresh password login must await the mounted workspace before a caller
opens an onboarding route. Own and revoke the bootstrap regression token
without replacing the primary credential, and bootstrap update API tests
once per worker when CI provides cookies alone.
Opt the synthetic shared-IP stack into a finite development update budget
without changing production, authentication or configuration limits.
Observe gated panels through actual gate readiness. Keep the fixed 24h
growth assertion on its native header and select the retained LXC drawer
with the fixture's canonical resource identity. Integrate the published
filesystem-observation and issue-topic repairs before qualification.
Preserve published absent-disk, completed-backup and accessible-name fixes
alongside the verified drawer and resource-provenance changes.
Follow native inventory disclosures, full settings scroll geometry and
shared disk-history responses so browser proofs exercise the current UI
without weakening row, layout, signature or chart-latency budgets.
Preserve source provenance in REST-loaded resources so owning-snapshot
consumers retain provider context and host placement. Keep visible control wording in accessible names and retain readable command
and navigation text in both themes. Token fixtures now await mounted browser
bootstrap before handing control to the next journey.
Measure bounded platform table items together with their inline details so
scrolling down a tall drawer cannot unmount the resource being inspected.
Retain regression coverage for bootstrap timing, drawer state and scroll
extent, responsive controls, Patrol and availability, and align navigation
assertions with current read-only capabilities and composed resource queries.
Provider fixtures retain one authoritative inventory across transport updates.
The Highlights guidance used "Resource Overview shows alerts, recent
trends and longer history together" as its example. That is a real
v6.6.0 change, and a test draft of the v6.6.0 notes copied it almost
word for word, so a later release could repeat it as if it were new.
The generator and the release-notes template now describe the shape
instead, the page or feature and then what it now does, and say to
describe only changes in this release. The slogan counterexamples stay,
and the release-assets test pins the new sentence.
Since v6.5.0 demo mode signs a fresh visitor in with the published
demo credentials, so the login form never stays on screen for a first
visit. The browser smoke still waited two minutes for that form and
failed, which blocked every stable demo convergence once the Tailscale
step worked again. It went unnoticed because the demo update had not
got past Tailscale since v6.5.0 shipped.
The smoke now proves the visitor's real path, a fresh tab reaching the
connected workspace, when the server reports demo mode. A second
context sets the frontend's own pulse-demo-auto-login marker to keep
proving the login form and a manual demo sign-in. Against the live
demo the old script times out and the new one passes both phases. The
policy test pins the marker to localStorage.ts so a rename fails in
source checks rather than on the live demo.
Make release Highlights name concrete changes
The generator only asked for "one to three plain-text outcomes", so it
produced slogans such as "See problems, recent trends and longer
history together" that tell a user nothing about what changed. These
lines are what the update banner shows before someone installs.
The generator prompt and the release-notes template now ask for the
release's biggest specific changes and where users find them, with an
example and named anti-examples, and the release-assets test pins that
wording. Their description of the post-update modal also follows the
new plain changelog, which no longer collapses upgrade notes or puts
Highlights above the changes.
Since v6.5.0 demo mode signs a fresh visitor in with the published
demo credentials, so the login form never stays on screen for a first
visit. The browser smoke still waited two minutes for that form and
failed, which blocked every stable demo convergence once the Tailscale
step worked again. It went unnoticed because the demo update had not
got past Tailscale since v6.5.0 shipped.
The smoke now proves the visitor's real path, a fresh tab reaching the
connected workspace, when the server reports demo mode. A second
context sets the frontend's own pulse-demo-auto-login marker to keep
proving the login form and a manual demo sign-in. Against the live
demo the old script times out and the new one passes both phases. The
policy test pins the marker to localStorage.ts so a rename fails in
source checks rather than on the live demo.
The generator only asked for "one to three plain-text outcomes", so it
produced slogans such as "See problems, recent trends and longer
history together" that tell a user nothing about what changed. These
lines are what the update banner shows before someone installs.
The generator prompt and the release-notes template now ask for the
release's biggest specific changes and where users find them, with an
example and named anti-examples, and the release-assets test pins that
wording. Their description of the post-update modal also follows the
new plain changelog, which no longer collapses upgrade notes or puts
Highlights above the changes.
Retained hosted samples include both an over-budget failure and an
under-budget pass with one provisioning agent occupying about one
logical CPU. Attribute only that bounded Actions overhead; retain raw
CPU and absolute 90 ms latency, and keep other or unattributed CPU,
guest, steal and swap invalidating. Exercise the real CLI and workflow
shells with adverse controls; no timed workload or release acceptance is
claimed.
---
Fleet candidate `20261024T104012Z-delivery-trust` from the
`delivery-trust` lane. Reviewed tip
`fbe410e244f3d44b44de258c6f3db68dabd257da` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
The demo update and recovery workflows still joined the tailnet with
the July 2026 tag:infra OAuth client. That client was revoked on 30
September, when the private repositories moved to narrow clients, and
the public repository was missed. Since then every demo convergence
step has failed with an OAuth 401, so stable releases cannot converge
and the hourly reconcile keeps retrying v6.5.0.
Both workflows now use the TS_CI_DEPLOY_OAUTH_* binding that the
browser update qualification already expects, restricted to
tag:ci-deploy. The tailnet policy already grants that tag SSH to
pulse-relay, the demo host, so no policy change is needed. One narrow
client now serves all three workflows, and the broad tag:infra
identity is gone from this repository.
Treat a deleted convergence owner as terminal
The hourly "Reconcile release convergence debt" job has failed every run
since 13 Oct. The v6.5.0 activation marker names convergence run
37395942598 as its owner, and that run was deleted from Actions with the
rest of the 30 Sep - 8 Oct release history. The immutable marker
outlives
Actions history, so the reconciler and release-convergence.yml both
waited
forever on an owner that can no longer be read, and the permanently red
job hid real failures such as the rc.6 paid-broker miss.
GitHub only deletes a run that has completed or is older than two weeks,
which is beyond every convergence job timeout, so a definite 404 is a
terminal owner. Both the reconciler and the successor's adoption wait
now
proceed from the validated marker in that case. Any other read failure
still waits or fails.
Also remove the workflow_run retry job. Convergence runs are dispatched
with GITHUB_TOKEN, and GitHub does not deliver workflow_run for them:
the
job fired seven times ever, each for a run an operator started by hand,
and never after 29 Aug while dozens of bot-dispatched failures were
recovered by the hourly schedule. The schedule is documented as the
retry
mechanism.
v6.5.0 is served on every surface (Docker aliases at the marker digest,
Helm index entry, paid broker, demo /api/version), but no convergence
run
has proved it. The next scheduled pass dispatches a fresh v6.5.0
convergence; its demo surface will fail until the Tailscale OAuth client
behind TS_OAUTH_CLIENT_ID/TS_OAUTH_SECRET is rotated, as it returns 401.
pulse-pro gives a promotion run credentials only while that run is
still its current main. Any pulse-pro merge that lands while the run is
queued or validating, roughly 20 minutes, makes the refusal certain.
The convergence caller treated it like any other failure, so the
release stayed off the Pro broker until the hourly reconcile happened
to retry. That race caused five of the last six Pro promotion failures
(12, 17 and 24 October); on 24 October it held v6.6.0-rc.6 back from
Pro installs on the RC channel.
The refusal happens before credentials, so nothing was mutated. The
caller now re-dispatches on the new main when every failed job failed
only the source check and pulse-pro main has moved off the run's head,
up to five attempts in the existing one-hour budget. Every other
failure stays terminal, and only the terminal failure is annotated so
reconciliation still finds exactly one private run URL.
pulse-triage[bot]