The shell multi-tenant suite previously selected a spec ignored by every project, preventing real backend diagnosis. Add an explicit desktop-only configuration that rejects tier identity, while retaining the normal quarantine. Cover discovery and tier refusal and document the evidence boundaries. A local source-built diagnostic returned five passes, one failure at organisation-switch login, and one skip; this is not release qualification.
Change-source: pulse-maintainer
Concurrent qualification runs could overwrite shared browser artifacts and authentication state, while an inherited PLAYWRIGHT_BASE_URL could send browser traffic outside the shell-owned stack. Scope outputs and fixture credentials to each invocation and clear that endpoint override so isolation evidence refers to the intended stack.
Focused runner checks cover inherited overrides and cleanup. Recorded concurrent Docker diagnostics reached healthy stacks but browser execution remained blocked by the existing multi-tenant quarantine; this test-only repair does not claim browser or release qualification and changes no user-visible application surface.
Change-source: pulse-maintainer
Integrate the reviewed source-stage selection and run-owned entitlement targeting on top of the existing teardown-failure guard. The merge preserves the candidate commit unchanged and combines compatible qualification harness repairs.
Change-source: pulse-maintainer
The integration runner otherwise selects the final prebuilt-agent Docker stage, which requires release payload inputs and prevents source-server qualification. Entitlement helpers also use a legacy container variable and inherited overrides that can target an unrelated runtime. Select the source-server stage explicitly and bind the managed shell path to its run-owned server, with regression assertions for both behaviours.
Contract-Neutral: integration harness and regression tests only; no product surface or runtime contract changes.
Change-source: pulse-maintainer
Reproduced startup, health and entitlement failures continuing through all ten suites despite failed teardown. Use the same fatal teardown guard on setup and port discovery failures so later scenarios cannot inherit dirty state.
Contract-Neutral: qualification harness only; no user-visible product surface. Focused stubbed runner tests and bash syntax checks pass; no runtime qualification claimed.
Change-source: pulse-maintainer
The independently reviewed runner changes add per-invocation project flags, generated identities, and allocated-port discovery before teardown. Model those calls so the teardown regression reaches and verifies the failure it is intended to guard.
Contract-Neutral: combined integration-harness test correction only; no product surface changes.
Change-source: pulse-maintainer
Shared image tags, container names and host ports let concurrent checkout qualification collide or inspect another runtime. Give each shell integration invocation its own identities and allocated listeners, and scope failure cleanup to those resources so results cannot silently qualify unrelated bytes.
Contract-Neutral: Integration harness isolation and documentation only; no user-visible frontend, product contract or release surface changes.
Change-source: pulse-maintainer
Prevent a successful test command from hiding failed Docker cleanup and letting subsequent suites inherit dirty state. Stubbed core/all regressions fail on the original runner and pass with explicit termination.
Contract-Neutral: qualification harness correction only; no product surface changes.
Change-source: pulse-maintainer
Existing local test tags could silently run older server or mock API bytes. Always invoke cached Docker builds and stop on build failure. Three stubbed runner regressions fail before this repair and pass after it; no installed or browser qualification is claimed.
Contract-Neutral: Integration harness freshness only; no product or release surface changes.
Change-source: pulse-maintainer
A reproduced admission HTTP 503 after socket recovery removed platform destinations despite populated inventory. Retain the last valid facet on request failure, keep tenant resets and successful empty responses authoritative, and cover desktop/mobile interruption and recovery.
Change-source: pulse-maintainer
Keep resource snapshot receipt separate from alert hydration and tenant-scoped across reconnect. Include matching subsystem contracts, architecture coverage and fresh browser receipt.
Validation: 87 focused tests and three real-backend Chromium checks pass at 1440, 1100 and 390px. Exact release-candidate qualification remains outstanding.
Change-source: pulse-maintainer
Credential slots froze the configured-node snapshot when the editor mounted, so a later server refresh could leave an untouched form stale even after the poll-clobber remount was removed. Keep node and security inputs reactive while the existing dirty guard protects operator edits, and cover both component refresh and browser polling paths.
Contract-Neutral: frontend polling-state bugfix; no API or persisted-data change
Change-source: pulse-maintainer
Go 1.26.8 supersedes the prior patch release, so every release builder and local toolchain guard must move together to prevent candidate artifacts from retaining an older compiler and runtime.
Contract-Neutral: toolchain-only patch update; no product or runtime contract changed
Change-source: pulse-maintainer
Extend the managed browser regression to force a canonical PBS resource refresh while the expanded drawer is off-screen. Pin the selected tab and app-shell scroll position before exercising the existing close and focus-restoration checks.
Change-source: pulse-maintainer
Drive the current metadata-triggered canonical resource reload and wait for its successful response before checking the expanded History drawer and viewport. This replaces a timer-only wait that could pass without refreshing the surface.
Contract-Neutral: browser regression coverage only; no runtime or API change.
Change-source: pulse-maintainer
Exercise the always-available History tab reported in the polling regression, follow the Proxmox surface's source-scoped resource query, and drive deterministic canonical refreshes through the current metadata event path.\n\nContract-Neutral: browser regression coverage only; no runtime or API change.\nChange-source: pulse-maintainer
Only run the polling-row focus fallback while focus remains unclaimed, so closing Manage cannot override the operator's next control. Preserve recovery when the original Manage row was recreated and keep the return non-scrolling.
Contract-Neutral: frontend focus lifecycle bugfix; no API or persisted-data change.
Change-source: pulse-maintainer
A connection-ledger refresh can replace live Infrastructure context while an operator is editing authentication controls. Exercise the production polling interval in a managed browser so node names, agent strategy and SSL verification cannot regress to remounting and losing unsaved input.
Change-source: pulse-maintainer
The stable-row focus fallback ran after the shared dialog cleanup and could scroll a lower Manage trigger into view. Preserve the existing focus return without changing the operator's viewport, and cover the real desktop and narrow browser path.
Contract-Neutral: frontend focus-restoration bugfix; no API or persisted-data change.
Change-source: pulse-maintainer
Shared subtabs used scrollIntoView for horizontal visibility, allowing remounted or programmatically changed drawers to scroll the whole application shell. Reuse the horizontal rail controller instead, and restore disclosure focus without scrolling when a detail row closes.
Record the shared primitive contract and its registry-approved guardrails, with desktop and narrow Backups browser coverage for visible Overview and Manage states, off-screen tab changes, and non-scrolling focus return.
Change-source: pulse-maintainer
Core E2E shards aggregate many isolated browser sessions behind one Docker
bridge address, which can exhaust the production-sized general API limiter and
hide later assertions behind HTTP 429 responses. Raise only the explicitly
enabled development harness limit and keep malformed, unsafe, or production
overrides fail-closed.
Align the offline Proxmox journey with the reviewed native-button disclosure
ownership so adjacent links are checked against the actual disclosure control.
Change-source: pulse-maintainer
Contract-Neutral: Development-only validation isolation and regression alignment; production API limits and product behavior are unchanged.
Retain the exact browser-verified web candidate commit and integrate native disclosure ownership across platform tables.
Change-source: pulse-maintainer
Remove duplicate keyboard and disclosure semantics from static data-table rows across the platform surfaces. Preserve whole-row pointer convenience while leaving focus, accessible naming and expanded state on each existing native disclosure button.
The populated TrueNAS browser check also exposed an invalid combobox role on inline-only search completion, so keep it as a native textbox with aria-autocomplete.
Change-source: pulse-maintainer
Contract-Neutral: Accessibility semantics and regression coverage only; no product or API boundary changed
The 2026-09-01 Patrol assessment could not answer four questions from
telemetry: what share of Patrol installs run local versus cloud models,
what Patrol costs an install per month (issue 1789 estimates ~104k input
tokens per full run at ~5.5 runs a day, above the Pro fee on non-Flash
tiers), how the 240 of 255 fleet investigations that produced no plan
actually ended, and which effective Patrol mode an install runs.
Schema v17 adds closed buckets only. ai_provider_class classifies the
Patrol model route (none, local, cloud_byok, cloud_subscription,
hosted_quickstart, unknown) with a syntactic private-host check on custom
OpenAI-compatible endpoints; it never resolves DNS or carries a provider,
model, endpoint, or account. pulse_intelligence_patrol_autonomy_level is
the effective level after licence and Autopilot gating. The two token
fields bucket the existing local usage ledger's Patrol events, so exact
counts and prices stay on the install. Thirteen investigation outcome
counters partition the findings already counted as investigated, one
bucket per finding, adding no finding, resource, or session identity.
The strings are never omitted, so an empty value can only mean a pre-v17
sender; the receiver stores those as unknown. PRIVACY.md, its shipped
mirror, the Settings preview interface, and the security-privacy and
api-contracts subsystem notes carry the disclosure, and the coverage gap
is registered in status.json.
The agent-lifecycle and storage-recovery contracts name internal/api under
their extension points, so both record that this telemetry is adjacent
adoption analytics and never agent or storage state. The stable E2E tier
pins the public schema version, so the disclosure spec moves to 17, and
the Settings preview interface change carries a browser receipt from a
scratch build of this tree at 1280x800 and 390x844. status.json also drops
an identical duplicate of the ai-provider-guided-setup coverage-gap record
that two merges each appended, which the private governance audit rejects.
The bucket for a legacy config still pointing at the retired Pulse-hosted
route is named hosted_legacy: the shipped privacy document discloses the
vocabulary verbatim and the frontend copy contract keeps that document
free of the retired hosted quickstart wording, so the telemetry package
now pins the vocabulary at the source.
Core E2E has been red on main since 2026-08-29 because product changes landed
without their browser specs following:
- The desktop and mobile navigation became links (08581a2bc9, 5cfa0f26b6);
the specs still selected role=tab and tablist. helpers.ts gains
primaryNavigation and primaryNavigationLink, and every navigation
selector uses them or the navigation/link roles.
- The Patrol records disclosure became "Finding options and history" and
the per-finding Manage control became "Finding options for <title>"
(21367b655d).
- Collapsed threshold sections are now inert and aria-hidden (434f777a59).
Sections open collapsed, so the Ceph and threshold-override specs had been
asserting on invisible rows; they expand the section first and follow the
toggle button into the heading.
- The APT dialog copy changed punctuation, the backups route gained /date,
and the mobile rail no longer has separate primary and utility rails.
- The phone-width accessibility scan runs under reduced motion so it samples
the settled update banner instead of a mid-fade frame.
Validated on the pulse-dev rig against a pulse:test image built from this
branch: 17, 18, 66, 73, 83 and journeys/01 pass on chromium; 04, 53 (nav
flow), 66, 73, 81, 83 and journeys/01 on mobile-chrome and mobile-safari.
Probation specs 78, 91 and 92 still fail on Patrol workbench content that
changed in today's landings; that is product drift outside the navigation
change and is left for its lane.
Contract-Neutral: spec realignment and test-only navigation helpers with no runtime or contract change
Keep only the selected scan scope in the page Tab order and make all arrow keys move focus and selection with wrapping. Retain radio focus when Custom mode normally moves focus into the subnet field, and cover the behavior in component and desktop/mobile browser tests.
Change-source: pulse-maintainer
Contract-Neutral: Accessibility bug fix restores the documented radio-group keyboard behavior without changing product contracts.
Keyboard and screen-reader users could not reliably bypass the shell or identify two General Settings toggles, while the RC badge failed the maintained contrast contract. Restoring explicit focus transfer, accessible control names, and compliant badge contrast keeps core navigation and settings usable without changing product scope.
Change-source: pulse-maintainer
Contract-Neutral: Accessibility regression fix only; no public contract or subsystem boundary changes.
The fleet health Home surface reached main on 2026-09-01 by implementing
a July agent-handoff spec with no demand-ledger entry. Exercised live on
the 1,510-resource mock estate it rendered 572 tiles on first paint with
275 in "Needs attention", 232 of them backup age, against two real
criticals; per-node storage mounts, disks, and swarm secrets appeared as
fleet members with no host context; and the critical node tile opened
its platform overview with the node below the fold. No stable release
carries it yet, so remove the route, navigation tab, page, i18n keys,
Assistant page context, route preload, and e2e cases now rather than
spend lane turns polishing an ungraded bet.
The server-side ResourceHealth verdict, its API projection, and the
/api/state/summary verdicts and attention extension stay: they are one
canonical health boundary that #1478 asked for and that any future
surface should read. The spec is parked with the 2026-09-01 review kept
as the design record.
Browser proof: desktop and 375px shells show no Home entry, /home renders
the not-found surface and its Go to workspace button lands on the
default workspace, the narrow More sheet lists Settings only, no console
errors or horizontal overflow.
Refresh the retained browser proof receipt parent for canonical integration; intervening changes do not touch frontend runtime paths.
Change-source: pulse-maintainer
Harden release workflow input transport and make native lifecycle proof honor each platform security boundary. Refresh stale telemetry and delivery qualifications.
Contract-Neutral: Formatting-only catalog updates and browser-verified alert copy; release compiler and native lifecycle changes update their owning contracts.
Fail schema-version drift in the fast E2E preflight before starting the browser matrix, and align the stable telemetry preview proof with schema 15.
Change-source: pulse-maintainer
Treat Playwright source coordinates as presentation metadata so cold transform-cache line mappings cannot split one test across all/stable/probation listings. Pin project, spec, and full-title identity with a focused Node regression.
Change-source: pulse-maintainer
Authenticate global API tokens before cold tenant runtime resolution, lock the cross-org behavior into integration coverage, and refresh schema-14 telemetry browser proof.
Contract-Neutral: Restores bounded cross-org token authorization and records verification without changing the API contract
Change-source: pulse-maintainer
Recognize the overview request by its defining workload resource types so additive query families do not route the canonical offline-node fixture to an empty response.
pulse-triage[bot]