Expose only the installed GNU gtimeout as timeout through a new runner-owned directory. Keep native BSD utilities on their original PATH so installing the missing dependency cannot silently change the other platform checks. The connected workflow test verifies the symlink identity and that the directory contains no other utilities.
Contract-Neutral: Narrow the native CI dependency PATH and its proof; no shipped installer or runtime contract changes.
Change-source: pulse-maintainer
Both macOS native jobs fail the copied temperature recipes before reading any sensor. Install coreutils into the workflow PATH and verify GNU timeout for every Unix runner. Exercise the actual workflow snippets with real GNU timeout and fail-closed install, missing-tool and unsupported-tool controls; leave the recipes and their TERM/KILL/privacy controls unchanged.
Contract-Neutral: Native CI prerequisite and its fixture coverage only; no installer, runtime, API, permission or diagnostic contract changes.
Change-source: pulse-maintainer
Match QNAP guidance to existing data-volume relocation, create private per-attempt staging and preserve diagnostic logs and identity. Exercise copied commands for preparation and installer failures without an appliance operation.
Contract-Neutral: Clarifies existing installer storage and private staging guidance; no runtime, permission or data-contract change.
Change-source: pulse-maintainer
Preserve the exact reviewed documentation candidate and its retained privacy/query proof; no runtime or storage changes.
Change-source: pulse-maintainer
Reuse the tested API helper, explain point/source and access distinctions, and preserve data before storage tuning. Copied examples now exercise private success/error responses, redirects, incomplete transport and encoded IDs.
Contract-Neutral: Documentation and recipe checks align with existing history API behaviour; no runtime, storage, entitlement or authentication contract changes.
Change-source: pulse-maintainer
Preserve the reviewed candidate commits as the second parent and retain canonical one-shot, redirect, partial-response and disclosure controls in the overlapping API/PBS smoke fixtures. Keep the candidate's canonical PBS guard, scoped private temperature-file assertions and unchanged-verdict audit diagnostics.
Contract-Neutral: Integration of test-only private-help adapters; no runtime, guides, dependencies or frontend source changed.
Change-source: pulse-maintainer
The reviewed phase-aware runner and PBS helper exclude Windows. Apply the same build constraint to their existing Bash temperature consumers so Windows test compilation does not retain unresolved runPBSRecipe references. Linux test content, guides and runtime are unchanged.
Contract-Neutral: Align an existing Bash-only test file with its non-Windows test helper; no runtime, guide, dependency or platform contract change.
Change-source: pulse-maintainer
A bounded synthetic comparison shows the whole-shell watchdog can kill a POST before its own curl deadline or expire before a PBS request starts. Observe each phase privately, preserve curl arguments and exact request limits, cancel owned descendants and retain incomplete pipe results. Exercise delayed preparation, one-shot transport, private responses and every cancellation phase without changing any guide or runtime.
Contract-Neutral: Repair Bash documentation test timing and owned-child observation only; no guide, mirror, runtime, API, authentication, request deadline, dependency or permission contract changes.
Change-source: pulse-maintainer
Bind the new 0600 assertion only to the reviewed temperature cleanup helper rather than impose it on the unchanged public Unified Agent installer recipe. Include the captured canned audit output when its existing one-call assertion fails, preserving verdicts, call counts and timing controls. The complete second proof retains its fail-closed two-call observation without a cause or successful-retry claim.
Contract-Neutral: Test adapter scope and failure diagnostics only; existing guide, audit verdict and timing contracts are unchanged.
Change-source: pulse-maintainer
Keep the shared direct-curl recorder compatible with the other existing guides while binding API requests to its reviewed private helper. Update the temperature selector to the reviewed fail-closed temporary download and retain disable-first TLS and mode checks. The first broad proof caught both adapter faults before publication.
Contract-Neutral: Test-only adapters for existing reviewed guide contracts; no runtime, guide, dependency or frontend change.
Change-source: pulse-maintainer
Repair deterministic governance and script-smoke failures against the reviewed guides without restoring public response output, literal credential commands or clobbering downloads. Exercise the actual shared API helper and independently verify private, unique response files, methods, bodies and hostile curl defaults.
Contract-Neutral: Update test adapters for the existing reviewed credential-private guide contract; no runtime or guide change.
Change-source: pulse-maintainer
Execute the actual API helper and PBS private-file/download handoffs, keeping their response-privacy assertions separate from shared credential-transport fixtures. Verify one-shot requests, exact methods and JSON, retained private responses and failure exits, TLS and preparation. Match the temperature cleanup test to its current non-clobbering download, without changing any guide.
Contract-Neutral: Repair connected documentation fixtures only; no guide, mirror, runtime, API, authentication, dependency or permission contract changes.
Change-source: pulse-maintainer
Replace automatic hardware detection with existing-driver reads, keep SSH forced-key trust intact, and prevent incomplete legacy cleanup downloads from replacing a saved helper. Validate the copied commands against synthetic tools and HTTPS peers.
Contract-Neutral: Existing help and copied-command safety only; sensor collection, authentication, installer interfaces and runtime schemas are unchanged.
Change-source: pulse-maintainer
Bound the existing passive preflight before Bash can discard NULs or accept unlimited configuration output. Preserve producer errors independently, isolate the byte reader from Python startup hooks, and keep the copied helper and mirrored help private and off the guest-agent channel.
Contract-Neutral: Operator diagnostics and existing help only; Proxmox polling, guest-agent coordination, APIs, storage and service behaviour are unchanged.
Change-source: pulse-maintainer
Save every existing reference response privately, including errors and partial POST results. Preserve private header files, reject unsafe preparation and URLs, and stop on redirects or transport errors without retries. Exercise all eight copied GET/POST examples against real synthetic HTTP/TLS peers, including the old response exposure.
Contract-Neutral: Harden existing API documentation recipes and their shipped mirror with connected tests; no runtime, endpoint, authentication, scope, action, dependency or permission contract changes.
Change-source: pulse-maintainer
Retain the guide recipe array before selecting its request slice; the initial exact-source proof rejected a temporary array slice before running any tests.
Contract-Neutral: Correct test compilation only; existing PBS documentation and runtime contracts are unchanged.
Change-source: pulse-maintainer
Fail closed before editing unsafe credential paths, ignore curl configuration and retain diagnostic responses privately. Bound requests, reject redirects and publish the local installer path only after a complete HTTPS 200 download without overwriting existing files. Exercise the copied recipes against synthetic TLS peers and file failures.
Contract-Neutral: Harden existing PBS documentation recipes and their shipped mirror; no runtime, API, permission, installation contract or dependency change.
Change-source: pulse-maintainer
PR2472 build run 37239183545 extracts no wrapped TrueNAS recipes; exercise all three current blocks and retain synthetic HTTP response bodies only in private files, including 201 save and error controls. Native run 37239183481 expects a Linux QGA capability on macOS and Windows; assert non-Linux agents do not advertise it and scope the connected PVE fixture to its actual Linux runtime. Production safety and documentation remain unchanged.
Contract-Neutral: Test-only reconciliation of already-reviewed private-response recipes and existing Linux-only guest-execution capability; no product contract change.
Change-source: pulse-maintainer
Source proofs can supply unrelated input files. Retain recipe mutation controls while reading the exact parent only when its named guide was supplied; unrelated input directories must not become a new full-suite prerequisite.
Contract-Neutral: Test-only optional-input handling; no shipped guidance or product contract change.
Change-source: pulse-maintainer
Make the existing connection guide fail closed before editing credentials, ignore curl configuration, bound each single POST and retain sensitive responses in new private files. Explain actual test/save status and uncertain-save readback without retrying setup as diagnostics.
Contract-Neutral: Documentation-only credential handling and copied-recipe regression tests; no runtime API, TrueNAS polling, authentication or connection-management contract changes.
Change-source: pulse-maintainer
Reviewed exact PI candidate 5e6d5af3b5. Existing guidance and shipped mirror now use private header files, verified HTTPS and bounded read-only checks. Retain source-e1x7r92a installer/vet, source-oypceg0j docs tests and Chromium/WebKit rendering evidence; no native tenant isolation or publication claim.
Change-source: pulse-maintainer
Replace inline token arguments and certificate bypasses with private header files and verified HTTPS. Bound the read-only probes, discard bodies, preserve failed curl exits and distinguish an invalid token from a checked tenant boundary. Keep the shipped guide byte-synchronised. Exercise copied commands with a synthetic TLS peer, private-header canaries, hostile curl configuration and refusal/redirect controls; no customer endpoint is used.
Contract-Neutral: Existing diagnostic guidance and regression coverage only; no runtime, public API, token scope or tenant-isolation contract change.
Change-source: pulse-maintainer
Release candidate cut from main at 2e9404504b. It carries every change merged since stable v6.4.5.
Contract-Neutral: Release-only v6.5.0-rc.1 version, notes and packet metadata generated by pulse-maintainer-release-metadata; no public install or runtime contract changes.
Change-source: pulse-maintainer
## What changes and why
- Keep backup-age checks fast and make failed or partial evaluations
visible through one existing system warning, without clearing retained
age alerts. Indexed latest-observation reads preserve retention, schema
and the read budget. This responds to the recurring missed checks
reported in #2465; synthetic timing is not proof of relief on the
reporter's Pi.
- Defer guest-agent commands after uncertain HTTP results and require
same-target, unambiguous backup-lock evidence before guest reads. Keep
guest coverage truthful when only remembered versions or a parent-node
assignment exist. Preserve the original observation time/source of
retained memory through existing backend projections. These changes
advance #2439 safety, but do not establish native thaw or recovery.
- Attribute Proxmox backups using native connection/node and unique PBS
namespace evidence, retaining ambiguous artifacts rather than assigning
them by substring or display name. Show unreliable PBS capacity as
Unknown/Unavailable, while retaining valid measured zero and readable
phone warnings.
- Restore existing TrueNAS and VMware connection alerts using the
constructed runtime pollers. This does not resolve the distinct
monitoring cause reported in #2382.
- Keep safe report collection and attachment guidance self-contained,
and make manual backup pause/resumption precautions usable. Repair the
Diagnostics integration journey's outdated controls, download assertions
and session capability, without changing production authorization.
## Included source
Published base `61146105c74a5968d877691e02963c41f8e66076` → exact final
head `af73b0e6c618da83c4fc5e702ba464257481851c`.
The previous proposal head `dcde1d0157d5e3c4cd626d6b920a45016a3f0437`
and all reviewed ancestry remain unchanged. This advances the proposal
once after its workflows completed with demonstrated failures; it does
not interrupt a checking head.
Reviewed candidates include:
- Previous batch: guest HTTP `cd1e3ba12f`, runtime alerts `7f5c8a0cf1`,
safe intake `496ba1e73e`, PBS capacity/render sequence `8f09a59996`
through `d2f7e456b3a`.
- Manual pause `3fd44b8325`; native backup ownership `c5e83ceb3a` /
`6198a3ce22`; authoritative locks `b77e6908e6`; truthful guest coverage
`ba3e2d2c1c` / `8f9a9a6a1e` / `f9f53befbb`.
- Backup evaluation/query `5774b6bc4b` / `7a19a06631`; Diagnostics
sequence `ed168c8d7e` through `a3bbcae0c9`; memory provenance
`abee023634` through `80d8ad0f59`; self-contained intake `7c9922f55d`.
- Starting reviewed canonical tip
`8003a4037bf2e6628d47ca6c7da239a11096168e` is retained. Four additive
publication corrections (`745ddc982a` through `79091f7b03`) supply the
report-form contract, connected docsLinks regression and exact
historical completion pair. The first completion's section placement
failed the checker; its substantive-section correction passes. No
accepted commit was amended or recreated.
## Validation and remaining gates
The previous proposal's completed runs remain adverse: Build/Test
`37204956836` failed the documentation drift assertion; E2E
`37204956824` failed Diagnostics shards 3/6/8 (download/obsolete
Run-control timeouts). These warrant the admitted changed-source
repairs, not an unchanged retry.
Retained reviewed evidence includes guest transport/connected/race/build
(`source-5_ta7via`), runtime alert connected proof (`source-s0xmdftf`),
PBS source/render evidence (`source-_9ekxhcy`), manual-pause
source/render (`source-ifgmfzhw`), all-reader authoritative-lock proof
(`source-41amnzmb`), guest coverage's 1,901 connected tests/full
types/lint/build and inspected Chromium/WebKit desktop/phone renders
(`source-3y6kfagt`), backup recovery/alerts/monitoring/races/vet/real
builds (`source-vc1jlsz9`), and memory
models/unified-resource/alerts/monitoring/races/vet/types/real
embed/build (`source-5swnugj9`). Diagnostics retains nine passing
full-app journeys with matching source hashes; catalogue
`source-cyehgbio` discovers 916 test/project identities, including all
nine Diagnostics cases, but is not runtime acceptance. Intake
`source-stznewur` retains two intended parent failures and passing
policy/documentation/mirror checks.
Publication checks: provenance, clean retained ancestry, per-commit
canonical completion/history, registry/contract audits and final
browser-content coverage (nine changed production frontend files) pass.
Earlier proposal-head (`79091f7b`) offline VM proof `source-1fn6chab`
passes 36 docsLinks tests, formatting, 27 intake cases, 211 public
Markdown checks and 62 mirrors, with complete hash-matched output and
guest stop. Its line-index bound is explicit. Earlier `source-yj300mm2`
passed docsLinks but exited 1 when a browser script was mistakenly
invoked in a source VM without Playwright; no browser result is claimed
from that attempt. Earlier local preparation failures and prior
API/embed limitation remain evidence at their own bindings, not green
aggregate results.
Required exact-head CI must run the complete backend/build/frontend,
audit and protected E2E checks, with independent source review, before
landing. Existing sufficient connected/render proof was not repeated
solely for batching. This is source publication, not release
qualification, deployment, native appliance/guest acceptance or
completion of the linked reports. The containing all-main release, Pi
evaluation/failure/recovery, native backup/thaw/covered writes/liveness,
remaining memory drawer consumption and installed whole-panel/alert
results remain separate.
Related to #2465
Related to #2439
Related to #2382
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
## Completed workflow reconciliation and additive smoke repair
The starting proposal head `79091f7b0317807fcc76e36cde52c4ee1cc4c928`
and every reviewed commit remain ancestors of this head. Build/Test
`37219920651` has now completed. All backend partitions, frontend,
governance, security and all eight E2E shards/verdict passed, but script
smoke failed two obsolete whole-guide assertions in
`test_vm_disk_diagnostics.py`; backend build was consequently skipped.
The reviewed manual backup precaution deliberately adds six server/timer
examples. The old passive-helper test counted all seven guide examples
and banned `systemctl` throughout the whole guide. This source mismatch
warrants changed-source repair, not an unchanged retry. Additive
test-only `c4a72995c6bf2465a6540a1b546a9dcd732944af` scopes
passive-helper execution to its named section and admits only the exact
six reviewed manual-pause blocks. Its first local run retained one
failure because a shell comment was mistaken for a heading. Additive
`af73b0e6c618da83c4fc5e702ba464257481851c` parses headings only outside
fenced blocks. All 17 diagnostics/safety controls now pass, including
missing/duplicate headings, shell comments and five prohibited-command
mutations. The passive helper still rejects active guest requests and
service mutations. Production and guidance bytes remain unchanged;
mirrored docs and connected intake checks pass. Both failed
correction/control observations remain recorded, not relabelled.
Final publication provenance, clean retained ancestry, additive
contract/registry audits and the unchanged nine-production-file
browser-content coverage pass. Lightweight confined fixture proof
supplies the full 17-case suite; existing heavy/render proof was not
repeated for this test-only delta. This proposal advances only after the
previous head's workflows completed. Exact new-head CI must rerun its
required checks before landing.
The completed advisory benchmark job is also adverse:
`RefreshPlatformScopes` 294.1 → 325.0 ns (+10.51%) and
`ClassifyResourceSensitivity` 67.68 → 77.20 ns (+14.07%), each p=0.000
with ten samples. Their implementation and benchmark source are
unchanged across the batch; that does not prove noise, intentional cost
or lack of regression. Delivery owns a bounded evidence-based
disposition through the existing lane handoff. No favourable repeat,
threshold change or performance/release approval is claimed.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Retain both exact completion histories and combine their self-contained safety obligations with the parsed-YAML and connected docsLinks controls. Use the reviewed corrected f8c5e988 completion pair; guards and frontend source remain unchanged.
Change-source: pulse-maintainer
The first publication correction retained the two original defects as history but its heading matcher treated the reviewed shell comment as a boundary. Parse headings only outside fenced blocks, and pin comment, duplicate-heading and missing-heading controls. All 17 passive diagnostics and safety-boundary fixtures now pass; no production or guidance bytes changed.
Change-source: pulse-maintainer
The completed PR smoke job demonstrates two obsolete whole-guide assertions after the reviewed manual backup precaution added six server-control examples. Select the unique passive preflight section for helper execution, constrain planned pause examples exactly, and reject active probes or service operations outside that section. Production code and safe guidance remain unchanged.
Change-source: pulse-maintainer
Releases are cut from the head of main since 2 October, but three things
still made every release need hand edits before it could pass:
- the control plane routed 6.5.x to the abandoned release/v6.5 line;
- main lacked the published 6.4.4 to 6.4.6 packets, so rollback
derivation on main still found 6.4.1;
- the packet tests pinned prose from old 6.4.x notes (named
highlights, issue numbers, one release's mobile decision) and the
per-release sentences in the deployment-installability contract,
which changes several times a day on main.
Map 6.5 to main, carry the published packets over from release/v6.4,
and keep the packet tests to what the release tooling generates: version
pins, packet pointers, required sections and the rollback, signing and
mobile sentences.
Contract-Neutral: Release routing and release-packet test scope only; no runtime, install or public contract changes.
Use the exact additive completion that satisfies the unchanged canonical checker. Retain the earlier failed completion and every reviewed commit as history.
Change-source: pulse-maintainer
Register the exact historical completion pair for governance CI; preserve the intermediate repair and all later accepted source unchanged. Completion checks still require ancestry, substantive contract text and registry-accepted proof.
Change-source: pulse-maintainer
Keep the inherited report-form commit untouched and bind its additive completion to the tree with the actual optional attachment field IDs. The existing real guard still requires the contract and executable verification together; no release or runtime acceptance is asserted.
Change-source: pulse-maintainer
The first exact-source suite reached an erroneous common evidence-field assumption: the bug form uses logs while the prerelease form uses evidence. Verify both real identities and their shared label without changing either form, requiring new diagnostics or weakening the optional-evidence assertion. Retain the original failed proof.
Change-source: pulse-maintainer
Use the existing exact-commit completion registry and exercise its real guard, ancestry and substantive verification requirements. Preserve the original documentation-link commit and the final self-contained forms; no history is rewritten and no completion or release check is weakened.
Change-source: pulse-maintainer
Record self-contained collection and privacy safeguards for installed releases and parse both forms to protect their actual inline advice. This additively supplies the missing deployment-installability contract and accepted verification for the retained documentation-link correction without rewriting reviewed history or changing any runtime safeguard.
Change-source: pulse-maintainer
Keep canonical guidance aligned with the actual unchanged header and copied member-aware templates. Pin the correction in the same safety guard so a later maintainer does not restore permanent header-only deduplication.
Contract-Neutral: Documentation clarification and its verification only; webhook wire format, retry stability and runtime behaviour are unchanged.
Change-source: pulse-maintainer
Normalise Markdown emphasis in the safety guard and observe optional runtime imports instead of requiring an auth call on every browser reload. Assert no other backend activity and preserve all console errors.
Contract-Neutral: Validation fixtures only; product and notification behaviour are unchanged.
Change-source: pulse-maintainer
The legacy correlation header omits occurrence start, severity and group members. Show receivers the existing full-precision member data, preserve later incidents and severity updates, and test the copyable templates through the actual signed sender. Keep the freshness verifier and runtime wire format unchanged.
Contract-Neutral: Help, executable examples, tests and sender comments only; notification behaviour, schemas and webhook headers are unchanged.
Change-source: pulse-maintainer
PR #2456 run 37179468966 failed TestNodeToolchainParity because the new workflow selected a patch version instead of the existing governed Node 24 line. Match the other workflows and add a focused trust regression without weakening the parity contract.
Contract-Neutral: Correct a workflow toolchain selector to the existing repository contract; no application, permission or release gate changes.
Change-source: pulse-maintainer
Accept a stable exact Node pin only within the governed major instead of
comparing its entire string with the major selector. Keep all other lines,
ranges and unresolved selectors rejected. This repairs the deterministic
required-check failure on the published-RC browser workflow without removing
its exact Node pin.
Give fake npm audit tests their own default timing controls and exercise
poisoned caller environments while preserving explicit watchdog tests.
No production audit verdict, dependency graph, benchmark threshold or release
gate changes.
Change-source: pulse-maintainer
PR #2456 run 37175962472 rejected retained safety warnings only because of a line break and sentence capitalization. Normalize prose for these assertions without removing any required warning or diagnostic field.
Contract-Neutral: Documentation test presentation normalization only; no runtime, API or safety-guidance change.
Change-source: pulse-maintainer
Retain exact Delivery candidate and its reviewed history. Offline packet, lifecycle and Tailnet controls pass; unchanged Chromium refusal receipts remain bound to their executed source. Native collection still requires protected publication, host activation and credential-administrator confirmation of dedicated tag:ci-deploy scope and self-only access.
Change-source: pulse-maintainer
Use a dedicated Auth Keys write client restricted to tag:ci-deploy, never the broader demo registration. Reject missing configuration and validate the actual running Self tag and DNS before Serve. Keep exact-source, denial-stop, no-replay and cleanup contracts, with connected offline registration and Serve controls.
Change-source: pulse-maintainer
Do not report an absent lock or agent setting after malformed current-configuration output. Preserve passive bounded host reads, private output, unknown well-formed fields and the distinction from guest responsiveness or thaw.
Contract-Neutral: The operator-only helper now enforces its existing incomplete-read failure semantics; polling, guest-agent admission, API and storage contracts are unchanged.
Change-source: pulse-maintainer
A denial arriving as the browser closes must leave a failed bounded receipt and suppress recovery authentication. Exercise real late HTTP401/403 responses alongside the earlier navigation and API controls.
Contract-Neutral: Enforces the existing all-response refusal contract through final context disposal; no new acceptance route or permission.
Change-source: pulse-maintainer
The browser sandbox has no jq. Retain all browser control receipts and execute the actual harness guard in the offline source-proof VM with their explicit input binding, checking denied and permitted process/auth preparation. Browser context cleanup failure also remains a failed receipt.
Contract-Neutral: Existing refusal, bounded evidence and cleanup contract is unchanged; this connects its proof across the browser and source-proof runtimes.
Change-source: pulse-maintainer
pulse-triage[bot]