Since 15:00 UTC on 5 October every paired benchmark run that was not
superseded has hit its 25-minute step timeout. Each step runs ten base
and ten candidate samples, so per-sample growth is multiplied by twenty.
BenchmarkRegistryProjectionSnapshot (#2518) rebuilt a registry behind
StopTimer on every cold iteration. Go sizes b.N from timed work only, so
the empty-registry cases ran hundreds of thousands of untimed ingests
and took 16 s of a 100 ms benchtime. With #2486's new owner-index and
metadata benchmarks, internal/unifiedresources went from 8 s to 38 s per
sample. Cold now invalidates the registry's derived state instead. The
refresh never reads its own output, so this repeats a fresh ingest's
first read with the same allocations, and the family drops from 22 s to
about 5 s per sample.
Paired runs also measured every package even when both trees compiled
identical code, as on frontend-only changes. They now sample only
packages whose in-module dependency closure the change reaches. Module
files, dirty or non-Git trees and an unreadable graph still select
everything.
A module or shared-model change still samples nearly every package,
about 24 minutes with warm-up. The step therefore gets a measured 30
minutes, and the script stops at a 28-minute projected budget with
per-package costs instead of meeting a bare timeout.
Explain the missing v6.4.5 undo control and the existing scoped API. Verify exact selection, confirmation, browser session and CSRF, failure handling and readback without copying credentials or deleting unrelated rules.
Contract-Neutral: Documentation and regression-proof coverage of existing Patrol suppression APIs only; no runtime, route, authority or subsystem contract changes.
Change-source: pulse-maintainer
Match QNAP guidance to existing data-volume relocation, create private per-attempt staging and preserve diagnostic logs and identity. Exercise copied commands for preparation and installer failures without an appliance operation.
Contract-Neutral: Clarifies existing installer storage and private staging guidance; no runtime, permission or data-contract change.
Change-source: pulse-maintainer
Preserve the exact reviewed documentation candidate and its retained privacy/query proof; no runtime or storage changes.
Change-source: pulse-maintainer
Reuse the tested API helper, explain point/source and access distinctions, and preserve data before storage tuning. Copied examples now exercise private success/error responses, redirects, incomplete transport and encoded IDs.
Contract-Neutral: Documentation and recipe checks align with existing history API behaviour; no runtime, storage, entitlement or authentication contract changes.
Change-source: pulse-maintainer
Preserve the reviewed candidate commits as the second parent and retain canonical one-shot, redirect, partial-response and disclosure controls in the overlapping API/PBS smoke fixtures. Keep the candidate's canonical PBS guard, scoped private temperature-file assertions and unchanged-verdict audit diagnostics.
Contract-Neutral: Integration of test-only private-help adapters; no runtime, guides, dependencies or frontend source changed.
Change-source: pulse-maintainer
Bind the new 0600 assertion only to the reviewed temperature cleanup helper rather than impose it on the unchanged public Unified Agent installer recipe. Include the captured canned audit output when its existing one-call assertion fails, preserving verdicts, call counts and timing controls. The complete second proof retains its fail-closed two-call observation without a cause or successful-retry claim.
Contract-Neutral: Test adapter scope and failure diagnostics only; existing guide, audit verdict and timing contracts are unchanged.
Change-source: pulse-maintainer
Keep the shared direct-curl recorder compatible with the other existing guides while binding API requests to its reviewed private helper. Update the temperature selector to the reviewed fail-closed temporary download and retain disable-first TLS and mode checks. The first broad proof caught both adapter faults before publication.
Contract-Neutral: Test-only adapters for existing reviewed guide contracts; no runtime, guide, dependency or frontend change.
Change-source: pulse-maintainer
Repair deterministic governance and script-smoke failures against the reviewed guides without restoring public response output, literal credential commands or clobbering downloads. Exercise the actual shared API helper and independently verify private, unique response files, methods, bodies and hostile curl defaults.
Contract-Neutral: Update test adapters for the existing reviewed credential-private guide contract; no runtime or guide change.
Change-source: pulse-maintainer
Execute the actual API helper and PBS private-file/download handoffs, keeping their response-privacy assertions separate from shared credential-transport fixtures. Verify one-shot requests, exact methods and JSON, retained private responses and failure exits, TLS and preparation. Match the temperature cleanup test to its current non-clobbering download, without changing any guide.
Contract-Neutral: Repair connected documentation fixtures only; no guide, mirror, runtime, API, authentication, dependency or permission contract changes.
Change-source: pulse-maintainer
Bound the existing passive preflight before Bash can discard NULs or accept unlimited configuration output. Preserve producer errors independently, isolate the byte reader from Python startup hooks, and keep the copied helper and mirrored help private and off the guest-agent channel.
Contract-Neutral: Operator diagnostics and existing help only; Proxmox polling, guest-agent coordination, APIs, storage and service behaviour are unchanged.
Change-source: pulse-maintainer
PR2472 build run 37239183545 extracts no wrapped TrueNAS recipes; exercise all three current blocks and retain synthetic HTTP response bodies only in private files, including 201 save and error controls. Native run 37239183481 expects a Linux QGA capability on macOS and Windows; assert non-Linux agents do not advertise it and scope the connected PVE fixture to its actual Linux runtime. Production safety and documentation remain unchanged.
Contract-Neutral: Test-only reconciliation of already-reviewed private-response recipes and existing Linux-only guest-execution capability; no product contract change.
Change-source: pulse-maintainer
The first publication correction retained the two original defects as history but its heading matcher treated the reviewed shell comment as a boundary. Parse headings only outside fenced blocks, and pin comment, duplicate-heading and missing-heading controls. All 17 passive diagnostics and safety-boundary fixtures now pass; no production or guidance bytes changed.
Change-source: pulse-maintainer
The completed PR smoke job demonstrates two obsolete whole-guide assertions after the reviewed manual backup precaution added six server-control examples. Select the unique passive preflight section for helper execution, constrain planned pause examples exactly, and reject active probes or service operations outside that section. Production code and safe guidance remain unchanged.
Change-source: pulse-maintainer
Keep canonical guidance aligned with the actual unchanged header and copied member-aware templates. Pin the correction in the same safety guard so a later maintainer does not restore permanent header-only deduplication.
Contract-Neutral: Documentation clarification and its verification only; webhook wire format, retry stability and runtime behaviour are unchanged.
Change-source: pulse-maintainer
Normalise Markdown emphasis in the safety guard and observe optional runtime imports instead of requiring an auth call on every browser reload. Assert no other backend activity and preserve all console errors.
Contract-Neutral: Validation fixtures only; product and notification behaviour are unchanged.
Change-source: pulse-maintainer
The legacy correlation header omits occurrence start, severity and group members. Show receivers the existing full-precision member data, preserve later incidents and severity updates, and test the copyable templates through the actual signed sender. Keep the freshness verifier and runtime wire format unchanged.
Contract-Neutral: Help, executable examples, tests and sender comments only; notification behaviour, schemas and webhook headers are unchanged.
Change-source: pulse-maintainer
PR #2456 run 37179468966 failed TestNodeToolchainParity because the new workflow selected a patch version instead of the existing governed Node 24 line. Match the other workflows and add a focused trust regression without weakening the parity contract.
Contract-Neutral: Correct a workflow toolchain selector to the existing repository contract; no application, permission or release gate changes.
Change-source: pulse-maintainer
Accept a stable exact Node pin only within the governed major instead of
comparing its entire string with the major selector. Keep all other lines,
ranges and unresolved selectors rejected. This repairs the deterministic
required-check failure on the published-RC browser workflow without removing
its exact Node pin.
Give fake npm audit tests their own default timing controls and exercise
poisoned caller environments while preserving explicit watchdog tests.
No production audit verdict, dependency graph, benchmark threshold or release
gate changes.
Change-source: pulse-maintainer
PR #2456 run 37175962472 rejected retained safety warnings only because of a line break and sentence capitalization. Normalize prose for these assertions without removing any required warning or diagnostic field.
Contract-Neutral: Documentation test presentation normalization only; no runtime, API or safety-guidance change.
Change-source: pulse-maintainer
Retain exact Delivery candidate and its reviewed history. Offline packet, lifecycle and Tailnet controls pass; unchanged Chromium refusal receipts remain bound to their executed source. Native collection still requires protected publication, host activation and credential-administrator confirmation of dedicated tag:ci-deploy scope and self-only access.
Change-source: pulse-maintainer
Use a dedicated Auth Keys write client restricted to tag:ci-deploy, never the broader demo registration. Reject missing configuration and validate the actual running Self tag and DNS before Serve. Keep exact-source, denial-stop, no-replay and cleanup contracts, with connected offline registration and Serve controls.
Change-source: pulse-maintainer
Do not report an absent lock or agent setting after malformed current-configuration output. Preserve passive bounded host reads, private output, unknown well-formed fields and the distinction from guest responsiveness or thaw.
Contract-Neutral: The operator-only helper now enforces its existing incomplete-read failure semantics; polling, guest-agent admission, API and storage contracts are unchanged.
Change-source: pulse-maintainer
A denial arriving as the browser closes must leave a failed bounded receipt and suppress recovery authentication. Exercise real late HTTP401/403 responses alongside the earlier navigation and API controls.
Contract-Neutral: Enforces the existing all-response refusal contract through final context disposal; no new acceptance route or permission.
Change-source: pulse-maintainer
The browser sandbox has no jq. Retain all browser control receipts and execute the actual harness guard in the offline source-proof VM with their explicit input binding, checking denied and permitted process/auth preparation. Browser context cleanup failure also remains a failed receipt.
Contract-Neutral: Existing refusal, bounded evidence and cleanup contract is unchanged; this connects its proof across the browser and source-proof runtimes.
Change-source: pulse-maintainer
Bind anonymous probes at request start, record bounded navigation/API/SSE denial, close the page immediately and suppress recovery authentication when the upgrade receipt is refused or unavailable. Exercise real Chromium response controls through the actual shell recovery guard.
Change-source: pulse-maintainer
Use the established setup-node disable contract: no explicit cache backend and package-manager-cache false. The empty cache value was rejected by the workflow trust guard; retain the guard and add an omission check.
Contract-Neutral: The exact published-RC browser, credential isolation and cache prohibition contract is unchanged; this fixes its setup-node representation.
Change-source: pulse-maintainer
Live stable and RC archive metadata exceed 256 MiB; retain a streaming bounded 512 MiB archive/16 KiB signature/1 GiB binary contract instead. Disable automatic setup caches in the CI credential job and encode derived command outputs with the reviewed writer. Add regressions; do not relax workflow or release guards.
Change-source: pulse-maintainer
Reuse the signed-install lifecycle assertions on a fresh public hosted VM without Docker identity overrides. Bind immutable release assets/control, observe one real UI apply/SSE/modal journey, retain sanitised terminal evidence and stop access refusals without reauthentication. Update the deployment contract and execute its recovery-access guard; release judgment and gates are unchanged.
Change-source: pulse-maintainer
Merge exact upstream 99927467f5. Resolve only the agent-lifecycle contract append conflict by retaining both monitor recovery ownership and AI usage export clauses. Frontend auto-merges preserve reviewed final bytes; no runtime conflict correction or browser receipt rebinding.
Change-source: pulse-maintainer
Replace active guest probes with bounded passive host reads. Preserve errors and private configuration, distinguish setup from responsiveness, and put backup/thaw precautions ahead of troubleshooting. Exercise the actual helper and copied command with adverse and healthy controls.
Contract-Neutral: Operator diagnostics and existing help only; Proxmox polling, guest-agent coordination, APIs, storage and runtime behaviour are unchanged.
Change-source: pulse-maintainer
Reject stale or malformed signed requests and empty keys in the existing receiver example. Explain authenticated payload deduplication and unsigned correlation headers, and exercise the exact copied code with adverse and healthy controls.
Contract-Neutral: Documentation and its executable safety checks only; the outbound signing format, transport, endpoints and runtime are unchanged.
Change-source: pulse-maintainer
Use one bounded, authenticated snapshot and local queries instead of secret-bearing argv and repeated requests. Preserve configuration precedence and rollback state, and judge successful polls rather than a universal queue-depth threshold. Exercise copied commands with HTTP, transport, schema and credential controls.
Contract-Neutral: Documentation and copied-command tests only; scheduler runtime and API contracts are unchanged.
Change-source: pulse-maintainer
GHSA-vfj7-8cjw-p6xm (braces <= 3.0.3, no patched release) reached the
frontend graph only through dev-only tailwindcss 3 and jscpd 4, and from
3 October it failed the required Frontend check on every open pull
request, Go-only ones included. The production audit is clean, and a
change that leaves package.json and package-lock.json untouched has the
base commit's graph, so it can neither add a finding nor remove one.
Failing it blocked every fix and made nothing safer.
The runner now applies the split it already used for an unreachable
endpoint to findings too. A change that moves the graph, or edits the
runner, still fails on any finding at any severity. A change whose graph
is the base commit's warns, naming every finding. Only an explicit
NPM_AUDIT_REQUIRE_RESULT=false selects that mode; an empty or
unrecognised value, as a missing workflow output would give, stays
strict, which also tightens the outage path.
The scheduled npm-audit scan and the daily dependency advisory watch
keep the strict default, so an inherited advisory still fails somewhere
every day until the dependency graph is fixed. No severity threshold,
allowlist or suppression is added.
The first complete authentication-help proof exposed a fixture expectation error: curl removes a colon-only header rather than sending an empty value. Preserve that case and add the semicolon form, checking the exact transmitted value across success, denial and redirect controls. Documentation and runtime behaviour are unchanged.
Contract-Neutral: Executable documentation control correction only; no authentication, authorisation, frontend or runtime contract delta.
Change-source: pulse-maintainer
Use private header files rather than shared passwords or proxy secrets in process arguments. Separate intentional AI settings writes from diagnostics, distinguish proxy denials from authentication/transport failures, and preserve the real proxy trust boundary and 5.x limitation. Exercise copied commands, private-file preparation and rendered help.
Contract-Neutral: Documentation and executable help controls only; no authentication, authorization, AI autonomy or runtime contract change.
Change-source: pulse-maintainer
Route Docker and FAQ readers through one credential-source-aware recovery guide. Replace only the active password, retain unrelated settings and agent tokens, and account for systemd drop-ins and container environment application. Check private prompt output, failure stops, bcrypt loading, precedence and rendered help links.
Contract-Neutral: Documentation and test coverage only; existing authentication, setup and deployment contracts are unchanged.
Change-source: pulse-maintainer
Remove the shared Compose password from the main installation entry point, preserve image and data settings, and explain existing-deployment credential overrides. Extend the auth guide controls and rendered browser navigation checks to this page.
Contract-Neutral: Documentation and its controls now reflect the existing bootstrap and environment-override behaviour; no runtime or API contract changes.
Change-source: pulse-maintainer
Remove the shared-password override from German and Spanish Compose setup and the password-on-argv example from configuration help. Default to bootstrap setup; exercise private-file permissions, argument boundaries and failed preparation with synthetic credentials.
Contract-Neutral: Help and regression fixtures only; authentication, container and API contracts are unchanged.
Change-source: pulse-maintainer
Separate installation rollback from stopped full-state recovery, correct the install guide's automatic-backup promise and name the verified limited published snapshots. Keep shipped help matched, reject the original unsafe claims and exercise desktop and phone Docs links without claiming the unready backend has shipped.
Contract-Neutral: Documentation and help verification only; no updater runtime or API contract changes.
Change-source: pulse-maintainer
Remove unconfigured Docker and Helm shorthand from the deployment overview. Preserve target edition, existing service and storage scope, and the limits of snapshots and rollback; exercise the maintained help links and regression guards.
Change-source: pulse-maintainer
Replace the destructive hardcoded restore recipe with path and backup-scope checks, the existing history control and reversible recovery guidance. Keep Compose image selection persistent and recreate only Pulse after a successful pull. Verify shipped mirrors, source/UI scope, synthetic command failures and desktop/phone Docs rendering.
Change-source: pulse-maintainer
Give existing help readers scoped process/container samples, honest units and unchanged-workload baselines. Exercise the exact copied recipes, including stopped services, missing counters and failed or empty container reads, without touching a database or service.
Contract-Neutral: Existing-guide documentation and recipe tests only; no runtime, API, persistence, access or retention change.
Change-source: pulse-maintainer
Preserve existing polling evidence before a connection test updates its ledger. Explain freshness, optional telemetry and session turnover using the read-only projection, correct the 60-second default, and keep diagnostic steps free of credentials and destructive reproductions.
Contract-Neutral: Documentation and existing-guide checks only; no runtime, API, transport, identity, access or retention change.
Change-source: pulse-maintainer
The existing drawer fetches all metrics without a metric query field. Explain metrics-object and single-metric points responses so readers do not wait for an absent CPU request or mistake missing CPU and measured zero for the same result.
Contract-Neutral: Clarify existing History diagnostics and protect mirrored documentation; no runtime, API, identity, access, retention or response-shape change.
Change-source: pulse-maintainer
Preserve every accepted commit while incorporating the published setup-node advisory-cache repair. Upstream changes a separate workflow; retain the proved runtime and documentation candidate bytes.
Change-source: pulse-maintainer
The scheduled watch reads each release line's lockfile in the default
branch's cache scope, so it deliberately writes no dependency cache.
It sets no cache input, but the pinned setup-node enables npm caching
on its own once package.json names npm as its packageManager. Nothing
declares that today; adding it later would silently reopen a
default-branch cache write here. Set package-manager-cache: false, as
five release workflows already do, assert it in the workflow test, and
say how the contract's no-dependency-cache promise is kept.
A skipped profile could reuse an earlier installer receipt and falsely pass the guide's regression check. Clear each recipe's receipt, require its own invocation, and exercise successful no-op and nonzero controls without changing the existing ten-second bound. Apply the same isolation to retarget and cleanup recipes.
Change-source: pulse-maintainer
rcourtman