Preserve the exact reviewed Product intelligence candidate and its deployment-specific, credential-safe help. No runtime or new product surface changes.
Change-source: pulse-maintainer
Remove the full service-environment dump, which can expose authentication and integration credentials. Explain listener precedence, the separate agent port, systemd reloads, and Docker port recreation without changing the image or deleting persistent data. Keep the shipped guide identical and protect these boundaries with documentation tests.
Contract-Neutral: Guidance and verification for existing port configuration only; no runtime, authentication, schema or frontend behaviour changes.
Change-source: pulse-maintainer
Render escaped, allowlisted details from the captured audit response instead of making a second registry call outside the wall-clock watchdog. Preserve every advisory failure and outage policy; executable fixtures pin single-request diagnostics, missing detail, transport-error precedence and annotation-safe output.
Change-source: pulse-maintainer
A fixed ten-entry history made accepted higher thresholds unreachable and silently disabled storm suppression. Bound retained observations to the configured threshold while preserving the existing diagnostic allowance, expiry and one-shot cooldown. Verify normal config updates, callback admission, delivery diagnosis, window expiry, rearming and threshold changes, and register the focused proof owner.
Change-source: pulse-maintainer
Preserve the exact reviewed documentation candidate and its focused proof while retaining the current canonical frontier.
Change-source: pulse-maintainer
The agent prefers its saved identity before deriving one from the OS. The old live machine-ID deletion recipe could disrupt unrelated services while leaving a Pulse collision unchanged. Explain managed overrides, precedence, private evidence and distinct-host verification in both shipped guides; cover the safe path with documentation and real-browser checks.
Contract-Neutral: Guidance and verification for existing agent identity options only; no runtime, authentication, schema or frontend behaviour changes.
Change-source: pulse-maintainer
Compose the retained PBS identity repair with current reviewed source without rewriting its history. The continuation requires terminal exact-source race validation before this candidate is complete.
Change-source: pulse-maintainer
Direct PBS host correlation could lend Agent History and SMART ownership through loopback, Docker-local or stale address evidence, and a stale Agent could block its fresh replacement. Reuse the provider address filter and the five-minute observation boundary, preserve IPv6 URL hosts, and cover unsafe evidence, private management controls, link replacement and the three-PBS/nine-Agent topology.
Change-source: pulse-maintainer
Remove the obsolete inline recovery-token curl recipe: recovery sessions are client-bound, so it neither unlocks a separate browser nor needs a credential copied into command history. Point to deployment-specific bootstrap recovery and give symptom-specific, reviewed and sanitized incident reporting steps without requiring dangerous repeats.
Contract-Neutral: Documentation and verification only; clarifies existing browser-bound recovery and sanitized diagnostics without changing authentication, API, schema or runtime behaviour.
Change-source: pulse-maintainer
A user-chosen PBS label could attach an unrelated Agent before the exact guest-IP/Agent link was evaluated, putting host History and SMART ownership on the wrong server. Use reported node and endpoint evidence instead, and cover both the collision and label-only cases.
Change-source: pulse-maintainer
When a PBS API token cannot report nodeName and the in-guest Agent omits interface addresses, use a unique running PVE VM at the exact PBS endpoint IP plus its state-owned Agent link. Reject stale or ambiguous observations instead of guessing from display names. This restores the source-native host target for corroborated PBS VMs while preserving the separate PBS service target.
Change-source: pulse-maintainer
Do not infer success from a registry badge clearing while a receipt is pending. Keep the action review reachable from the row, preserve inconclusive outcomes, and show completion only from the recorded audit. Add focused state tests and desktop/phone browser proof.
Change-source: pulse-maintainer
Persist measured PBS CPU and memory on the service metrics target when node status succeeds. Keep host-agent history separate and avoid false samples on unavailable status. Cover service reads, denial and recovery.
Change-source: pulse-maintainer
Advance the provider control-plane source builder and integration mock builder
on Pulse PR #2275's reviewed 1.26.8 Alpine digest. Keep their exact compiler
image locked by an installability proof and record what this does not qualify.
The published prebuilt runtime path is unchanged.
Change-source: pulse-maintainer
A supported endpoint failure may outlive its primary host incident. When synthesis removes the supported cause, dispatch its first independent notification without reopening the occurrence or duplicating a symptom previously notified before grouping.
Change-source: pulse-maintainer
The supported-cause escalation and queued callback tests live in incident_synthesis_test.go, not escalation_policy_change_test.go. Keep the verification contract aligned with the actual test file.
Change-source: pulse-maintainer
Keep route-selected action details and inbox tabs bound to their latest reads so delayed replies cannot replace a newer review or reopen one after close. Preserve server-authored identity and prove the overlap in focused tests and responsive browser navigation.
Change-source: pulse-maintainer
A verified primary infrastructure alert already owns the initial notification for its supporting symptoms. Apply that same ownership to scheduled escalation, queued callback admission, and quiet-hours replay so a late duplicate cannot be sent. Preserve independent escalation for uncorroborated observation sets.
Change-source: pulse-maintainer
Explain that the signed Proxmox server installer uses the v-tagged server archive and never asks for a GitHub PAT. Tell operators to stop when a different helper selects a chart release or requests a token, and to check for a partly created container before a fresh install.
Change-source: pulse-maintainer
Show an unknown-outcome warning for every receipt-pending review and offer a same-action status re-read without another dispatch. Keep aged audit closure behind its existing admin and server gates, and cover desktop and phone interactions.
Change-source: pulse-maintainer
Treat monitor-only as terminal before quiet-hours replay and flapping, and reject scheduled or queued escalations when the current alert is monitor-only. Align firing, recovery and delivery diagnosis with that policy; cover ordinary and critical-repeat scheduling plus a policy change after callback queueing.
Change-source: pulse-maintainer
Keep resource maintenance, mute and expected-offline policy terminal in the internal alert callback path. Quiet-hours deferral remains replayable, while delivery diagnosis and event history report the actual operator suppression. Cover pre-reconciliation active alerts and unaffected performance signals.
Change-source: pulse-maintainer
The bug and v6 pre-release forms previously required reproduction steps even when a retry could cause a host outage, duplicate update, alert storm or data loss. Ask for the original sequence and safe evidence instead, and mirror the guidance in the public triage document.
Contract-Neutral: Community intake wording only; release and installation contracts unchanged.
Change-source: pulse-maintainer
Avoid configuration-history rows when source merges only reorder identity addresses or represent an absent list as empty. Real identity changes remain recorded. The #2319 serial-bearing disk fixture and registry-generation check cover the tags-only and no-op identity paths.
Change-source: pulse-maintainer
Ask for the attempted release and installer provenance when Pulse never started, without forcing a false running-version attestation or a token-bearing command. Keep public triage guidance aligned and pin both forms in tests.
Contract-Neutral: Issue form provenance and wording change community intake only, not release promotion or artifact dispatch
Change-source: pulse-maintainer
Linked Agent SMART disks inherit a PVE instance for presentation. Restrict skipped-poll readback to actual PVE observations so an empty disks/list cannot alternate fabricated inventory, tags and history rows. Pin repeated cycles and the source boundary in the monitoring contracts.
Change-source: pulse-maintainer
Preserve the registry-corroborated PBS-to-Agent link on the service row while selecting the Agent host metrics target in the Backups drawer. Reject PVE-only name collisions and retain the target through a transient missing host row. Recompose the unchanged #1723 runtime repair on current main with fresh desktop and phone browser proof.
Change-source: pulse-maintainer
Retain the verified #2321 source and its original receipt while incorporating upstream release and browser range validation.
Change-source: pulse-maintainer
Preserve the browser-verified #2321 repair and current protected Relay changes in separate ancestry. Resolve the shared receipt to the current main version; both proofs remain in their original non-merge commits.
Change-source: pulse-maintainer
The maintainer coordinator merges reviewed candidates onto a main that
keeps moving and then ran the browser verification guard once over the
whole range with the merge tip as the commit. No lane can produce a
receipt bound to that merge's parent and covering upstream frontend work
too, so 13 of 13 coordinator browser-guard rollbacks since 28 September
failed on base_sha. This adds a range mode where every changed frontend
file's final content must match a valid receipt from a non-merge commit
inside the range, each validated against its own commit. Merge-authored
receipts never count, and the per-commit and staged modes are unchanged.
The maintainer coordinator integrates reviewed candidates by merge onto a
main that keeps moving, then ran this guard once over before..after with
--commit after. That demands one tip receipt whose base_sha is the tip's
parent and whose paths and digests cover the whole cumulative delta. The
tip is a merge and the range carries the candidate plus upstream work that
was verified on its own, so no lane could ever produce that receipt. 13 of
13 coordinator browser-guard rollbacks since 28 September failed on
base_sha for this reason.
Add --base <range-base> for range mode. Every changed user-visible
frontend file's content at the tip must equal a digest recorded by a valid
receipt in a non-merge commit inside the range, and each receipt is
validated as the per-commit guard validates it at its own commit, bound to
that commit's parent and tree. Merge-authored receipts are never evidence,
so a conflict resolution or a later correction that changes frontend
source still needs fresh proof for the final content. Replaying the three
rolled-back 29 September batches from the host passes, and the existing
per-commit and staged modes are unchanged.
Preserve upstream browser verification for the newer Relay retirement surface; earlier action recovery proof remains in reviewed ancestry. Include current CI sharding and qualification canary without rewriting accepted commits.
Change-source: pulse-maintainer
With the host-interface canary in place, v6.4.5-rc.4 passed the
schema-v7 systemd and rootful Docker lab (run 36594651903), but the
attestation step then failed with Permission denied on receipt.json,
which the privileged lab writes as root into the bind-mounted evidence
directory. Hand that directory to the runner user after a passing lab
and before attestation, without touching its content.
The immutable RC systemd lab failed before installed acceptance because
its --network none container had no non-loopback IPv4 address to prove
the helper's private network cannot reach. Add a veth canary wholly
inside that namespace and assert no default route before the lab runs.
Also check out the repository in the demo resolver before it calls
scripts/write_github_output.py, so verification-only dry runs reach
their demo checks.
Split out of #2323 so the v6.4.5 promotion is not held behind the
unrelated action-review UI work in that PR.
The weights from #2324 came from one local run and left the api shards at
4.5, 8.8, 17.1 and 12.5 minutes on CI. Most of the 17.1 was not test time.
That shard ran `-run . -skip <1231 names>`, and the test binary caches only
its last compiled pattern, so alternating the two recompiled the 62 KB skip
regex for every test and subtest (about 50 ms each under -race locally, 30s
against 1.3s for 300 trivial tests). Two runs put that shard at 887s and
875s against roughly 450s of tests. The skip path now passes -skip alone.
Every api shard now runs go test -json through
.github/scripts/record-internal-api-test-seconds.py. It prints what plain go
test would (package lines and the output of failing or unfinished tests),
exits non-zero on any failure behind pipefail, and writes each top-level
test's seconds to an internal-api-test-seconds-N artifact that is uploaded
even when the shard fails. .github/scripts/refresh-internal-api-test-seconds.py
rebuilds the weights file from those artifacts (gh run download, median
across runs, DEFAULT_WEIGHT set to the mean of the unlisted tests, which the
selector now reads from the file).
Until those artifacts exist, the weights are a local -race -json run with
each region of go test's order scaled to what CI reported for it.
Equal-count quarters averaged 107, 437, 100 and 787s over four runs, and the
weighted cut gave 131s for the first 1187 tests, 350s for the next 23 and
608s for the last 21 over two. The last quarter and the last 21 tests
disagree on how the tail splits, so the tail takes the midpoint of an exact
fit and a pooled factor.
With these weights four shards still predict a slowest shard near 10
minutes, and a 20% slower runner on the tail would take it past the 11
minutes of Frontend and rest-1. Five shards predict about 131, 325, 280-340,
330-355 and 330-365s of tests, or 4.5 to 8.5 minutes a job with about 2.3
minutes of setup, so API_SHARD_COUNT goes to 5. Every test still runs
exactly once in contiguous go test order, and all five slices passed locally
from their new starting points. The required Backend tests (api) verdict
keeps its name.
Relay left public checkout on 2026-09-29: it only ever connected the
Pulse Mobile app, which retires on 31 March 2027, and existing Relay
subscribers now carry Pro entitlements. The app still sold it. Every
Community install saw a "Get alerts on your phone ... Available with
Relay and Pro plans" upgrade panel on Alerts destinations, the plan
screen offered a Relay card with "Remote web access via Relay", and the
settings section was called Remote Access although Relay never reached
the web UI.
The Alerts push panel now renders only on instances that have the relay
feature, with no upsell. The settings section, nav, header and locale
catalogs say Pulse Mobile and carry the retirement date. Community sees
only the Pro comparison card and Relay-tier licenses see none; gated
mobile features name Pro as their minimum plan. The relay feature is
labelled "Pulse Relay (Mobile Connection)" in the catalog, plan copy no
longer claims remote web access, the backend pairing diagnostics point
at Settings > Pulse Mobile, and the user docs, including PRIVACY.md,
state that Relay does not provide remote web UI access.
Prevent unrelated estate-wide VM and storage counts from advertising Proxmox sections, while retaining direct-link hydration and the PBS-only Backups path. Revalidate the compact facet request when an all-resources cache supplies rows without scoped counts; cover mixed-source counts in component and browser proof and update both subsystem contracts.
Change-source: pulse-maintainer
An empty form field or unrelated edit cannot prove comment-raised topics were dispositioned. Only label newly declared topics, leaving removal to whole-thread triage and respecting a completed manual disposition.
Change-source: pulse-maintainer
Ask for the failing running version and a container image only where one exists. Accept symptom-appropriate screenshots or logs without forcing irrelevant log text, and state the matching triage rule.
Change-source: pulse-maintainer
pulse-triage[bot]