Require a blank destination instead of using nodes.enc as a first-run sentinel. Recheck before writes, retain unknown or unreadable state, and leave deliberate authenticated transfer unchanged. Keep deployment .env provisioning and encrypted file precedence; explain the separate archive path in canonical and served help.
Change-source: pulse-maintainer
Document the existing nodes.enc gate, replacement scope, file precedence and non-fatal import errors. Preserve agent identity and excluded state, isolate provisioning from live traffic, and keep one-shot inputs private rather than forcing a reset.
Contract-Neutral: Existing bootstrap and encrypted-import behaviour is unchanged; this corrects canonical and served help, with documentation regression controls.
Change-source: pulse-maintainer
Audited the customer-facing docs against the code: about 5,200 concrete
claims (env vars, endpoints, flags, defaults, ports, UI labels), plus every
environment variable the code reads. Each discrepancy was re-verified
against the source before editing, and every edit was reviewed again.
What users would have hit following the old text:
- UI paths and labels that no longer exist (Settings > Relay, Platform
connections, Access Control, SSO Providers, Create Organization) and
Patrol mode names (now Ask first, Safe auto-fix, Autopilot).
- Wrong values and behaviour: LOG_MAX_AGE=0 does not disable cleanup,
Patrol evidence budget is 10 calls and 12 turns, ALLOW_UNPROTECTED_EXPORT
covers private networks too, PULSE_AUDIT_ASYNC defaults on.
- Agent install: install.sh ignores PULSE_ENABLE_KUBERNETES and
PULSE_ENABLE_PROXMOX, rejects --disable-auto-update, and the token
fallback lives in the state directory.
- API: audit endpoints answer 402 on Community, onboarding QR is GET,
type=container is rejected, several routes need admin plus a scope.
- HTTP_REDIRECT_PORT was not documented anywhere.
Docs are mirrored under frontend-modern/public/docs, so each change is
applied to both copies. The tests that pinned the old wording (including
three that asserted claims the code contradicts) are updated alongside.
Contract-Neutral: Customer docs corrected to match shipped behaviour; no runtime, API or contract change.
Replace installer-rerun and unchecked capability advice with bounded private property checks, a narrow existing-ceiling override and deliberate prior-active maintenance. Distinguish configured settings, process startup and ordinary ICMP recovery without weakening sandbox policy.
Contract-Neutral: Existing ICMP administration guidance and copied-command controls only; no availability runtime, privilege, API or frontend behaviour changes.
Change-source: pulse-maintainer
Separate hypervisor footprint, Linux availability and process RSS in existing troubleshooting, FAQ and threshold help. Keep comparisons on the same guest, kernel, time and units, preserve unknown or retained evidence, and avoid diagnostic probes, restarts, cache drops and blanket suppression.
Contract-Neutral: Documentation and source-bound help regressions only; memory collection, Patrol decisions, alert controls and access contracts are unchanged.
Change-source: pulse-maintainer
Replace the obsolete Storage scope warning while preserving saved-rule, current-reading, SMART and passive private-reporting boundaries. Record the fresh inspected desktop and phone browser result for actual composed runtime bytes, including the page-model merge with current main.
Contract-Neutral: Documentation, document controls and fresh browser evidence only; no further subsystem contract or runtime delta.
Change-source: pulse-maintainer
Distinguish current and last-known heat, saved alert tiers, Off and native SMART risk. Name the Storage display scope limit and keep mismatch reporting passive and private.
Change-source: pulse-maintainer
Contract-Neutral: Documents existing disk policy and a current display limitation; no alert, collection or subsystem contract delta.
System Logs pauses and clears only its browser display, while Support Bundle exports server logs and configuration. Explain those existing limits, warn about Debug's private guest details, and qualify warn-level suppression without changing runtime or recommending new probes. Keep the three shipped guides in sync and exercise their safety boundaries in the existing docs check.
Contract-Neutral: Documentation and focused guidance checks only; existing log controls, exports, monitoring, API and backup policy are unchanged.
Change-source: pulse-maintainer
Keep wrong-node errors, backup attribution and lost agent-backed Docker monitoring separate. Provide passive existing-view comparisons and native fallbacks without renaming hosts, re-enrolling agents or recreating the incident. Bind the help entry points and privacy limits to rendered documentation checks.
Contract-Neutral: Existing help maintenance only; no runtime, identity or provider contract changes.
Change-source: pulse-maintainer
The appliance VM report distinguishes unwanted memory alerts from a request to ignore the displayed reading. Clarify the existing per-resource rule without disabling unrelated monitoring or prescribing appliance changes. Extend the actual Docs renderer check and bind the narrow override to the live threshold display model.
Contract-Neutral: Documentation and rendered-help verification only; no alert, collection or display behaviour changes.
Change-source: pulse-maintainer
Configuration help did not say that disabling backup-record polling leaves ordinary PVE guest-agent reads running, or that zero selects automatic cadence. Explain the limits beside both configuration forms and link to the existing deployment-specific precaution, preserving independent recovery checks and prior-active restoration.
Contract-Neutral: Documentation and rendered regression tests only; no runtime, API, setting semantics or subsystem contract delta.
Change-source: pulse-maintainer
Correct the empty-filter delivery claim and explain non-exclusive minimum severity, exact all/any tag matching and per-member grouped routing. Bind the existing help and copied examples to the real saved settings and ordinary delivery job builder, without changing routing behaviour.
Contract-Neutral: Documentation and verification only; existing notification routing, alert policy, runtime and API contracts are unchanged.
Change-source: pulse-maintainer
Document once-per-occurrence cooldown-off semantics, the independent hourly limit and recovery eligibility without treating missing messages as workload health. Verify rendered links, shipped mirrors and the actual saved/reloaded schedule.
Contract-Neutral: Documentation and verification only; existing alert policy, notification routing, runtime and API contracts are unchanged.
Change-source: pulse-maintainer
Document existing incident holds, hidden active alerts, bulk scope and the local-calendar snooze preset. Link delivery troubleshooting to the controls and verify the rendered help and acknowledgement readback.
Contract-Neutral: Existing help and verification only; no alert runtime, API, schema or frontend control changes.
Change-source: pulse-maintainer
Document saved metric Off values, override inheritance, inclusive hysteresis boundaries, pending saves and separate delivery verification. Bind the copied CPU example to actual metric evaluation and test the rendered bundled guidance.
Contract-Neutral: Existing help and example verification only; no alert runtime, API, schema or editor behaviour changes.
Change-source: pulse-maintainer
Complete the existing copied schedule with explicit days, timezone and critical-category choices. Explain calendar boundaries, held delivery and safe configuration preservation, and test the example against the actual delivery policy.
Contract-Neutral: Existing quiet-hours behaviour and API are unchanged; this repairs shipped setup guidance and tests its copied configuration.
Change-source: pulse-maintainer
Correct the FAQ, configuration, proxy help and existing Network settings field together. Distinguish same-origin proxy routing from cross-origin browser access, explain wildcard credential limits, preserve authentication and private diagnostics, and link actual rendered guidance. Verify desktop and phone input/override/help states without an API or proxy mutation.
Change-source: pulse-maintainer
Contract-Neutral: Existing CORS guidance, accessible description and renderer coverage only; API, origin policy, settings persistence and authentication contracts are unchanged.
Fresh editor and API inspection shows that local and remote paths can coexist, including in published v6.4.5. Explain the actual location picker, per-path uncertainty and safe canonical-versus-legacy update fields, and validate the linked target-field instructions in the Docs renderer.
Contract-Neutral: Documentation, shipped mirrors and guidance verification only; existing observation and API semantics are unchanged.
Change-source: pulse-maintainer
Separate remote check execution from server-side alert delivery, explain indeterminate and bounded-buffer behaviour, and link independent watchdog coverage without a permanent Mobile or Relay promise. Preserve the existing probe and notification contracts and verify both shipped guides and their keyboard help paths.
Contract-Neutral: Existing help, its shipped mirrors and verification only; no runtime, entitlement, alert policy or API changes.
Change-source: pulse-maintainer
Correct the existing configuration help against the live preset model and token client: reporting does not include lifecycle authority, exposed credentials need prompt revocation, and kiosk display preferences do not restrict credentials or guarantee persistence. Keep the shipped mirror and add runtime-model-bound documentation controls and browser help validation.
Contract-Neutral: Documentation and test fixtures only; no runtime token, authorization, navigation or delivery contract changes.
Change-source: pulse-maintainer
Explain immediate-peer trust before proxy setup, constrain copyable HTTPS examples and preserve authentication during diagnostics. Keep both shipped guides in sync and cover the missing guidance in the documentation regression checks.
Contract-Neutral: Documentation and regression checks only; proxy trust, authentication, routing and runtime behaviour are unchanged.
Change-source: pulse-maintainer
Remove the shared-password override from German and Spanish Compose setup and the password-on-argv example from configuration help. Default to bootstrap setup; exercise private-file permissions, argument boundaries and failed preparation with synthetic credentials.
Contract-Neutral: Help and regression fixtures only; authentication, container and API contracts are unchanged.
Change-source: pulse-maintainer
Distinguish failed verification from a tampering diagnosis, unsigned history, query errors and runtime gates. Remove live-key replacement and regeneration advice, correct default store paths, and preserve matching keys and history for isolated recovery. Bind the shipped guides to regression checks and exercise recovery distinctions with the real signer and encryption manager on synthetic temporary data.
Contract-Neutral: Audit documentation and synthetic regression controls only; no signing, storage, entitlement, API or frontend runtime behaviour changes.
Change-source: pulse-maintainer
Align manually created Agent tokens with the runtime lifecycle minimum, expose agent:manage in custom create/edit flows, and document the backend-owned scope boundary.
Change-source: pulse-maintainer
Discovering Docker inside Proxmox LXC guests previously required an
undocumented environment variable plus a hand-edited systemd unit,
which is how the surface kept shipping invisible. The opt-in is now a
persisted system setting with an admin-only toggle in Settings →
System → General, presented as its own "Docker in Proxmox LXCs" card
under the existing Docker/Podman updates card, with the requirements
(node agent with command execution) and data-collection bounds stated
inline.
The setting rides the admin-gated system settings endpoint
(RequireAdmin + settings:write, matching every other server-wide
toggle). Flipping it persists first, then applies to the runtime
config and fires a reconfigure hook so the router rebuilds the
monitor's Docker checker and inventory collector immediately — no
restart. PULSE_ENABLE_PROXMOX_GUEST_DOCKER_INVENTORY remains
authoritative: when set it locks the toggle (EnvironmentLockBadge in
the UI, HTTP 400 from the API), and an unrelated settings save can
never clobber the runtime value. The opt-in guardrail test now pins
the settings path, the env lock, and the persisted field.
Installer and node setup-guide callouts now point at the toggle first
with the environment variable as the locking override, and the docs,
their public mirrors, and the agent-lifecycle subsystem contract say
the same. New i18n strings shipped for en/de/es.
Verified live in mock mode: toggle off/on from the UI drives the
collector teardown/setup log lines, the value survives a server
restart, and all three touched surfaces render at desktop and mobile
widths (receipt in frontend-modern/browser-verification.json).
The pct exec socket probe that discovers Docker inside LXC guests
failed invisibly: errors logged at debug only, and a failed probe never
set DockerCheckedAt, so the guest stayed in first-check state and was
re-probed on every poll forever. On a node where lxc-attach could not
enter unprivileged guests that meant ~49 pct execs per minute of
steady-state churn, with nothing at default log level to say why the
Proxmox page showed no Docker.
Track consecutive probe failures per guest in the monitor. The first
failure of a streak, and the point where the backoff reaches its cap,
log at warn with the guest, node, and error; repeats stay at debug.
Failed probes retry with exponential backoff from one minute to a
thirty-minute ceiling, a success clears the streak with an info log,
and reconfiguring the checker resets all streaks so command execution
enabled from the UI at runtime still retries immediately. Entries not
refreshed for a day belong to deleted guests and are pruned.
PULSE_PROXMOX_GUEST_DOCKER_INVENTORY_VMIDS now gates the socket probe
as well as inventory collection. It previously only limited inventory,
so opting into specific guests still probed every running LXC on every
cycle; now guests outside the allowlist are never pct exec'd at all.
Subsystem contract and configuration docs updated to match.
Found while triaging #1643 and #1637: both fields were stored via
system.json and accepted, validated, and echoed by the settings API,
but nothing ever consumed them. The unattended update schedule is owned
entirely by the systemd timer install.sh renders, and no UI control ever
set the fields, so the API persisted a schedule preference that could
never take effect.
Remove the fields from config.Config, SystemSettings, the settings
handlers, and the frontend config type, along with the interval
validation and the .env AUTO_UPDATE_CHECK_INTERVAL rewrite (a legacy
line is now preserved verbatim). Legacy clients that still send the
keys get them silently ignored instead of validated, and a system.json
written before the removal still loads cleanly - both behaviors are
pinned by new tests. User docs no longer describe the phantom schedule
settings.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Add availability_probe_targets and availability_probe_agents to the
telemetry ping - counts only, no agent names or addresses - with the
disclosure table updated in both privacy doc copies. Document the
feature in the availability-checks configuration guide and the
unified agent guide, including the ICMP capability caveat for
containerized probes.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The installer's unit hardens with NoNewPrivileges=true, which strips the
ping binary's setuid/file capabilities, so ICMP availability probes could
never work on a systemd install. Grant the capability ambiently instead,
document the systemctl edit override for existing units, and pin the
hardening block with an install test and contract clause.
Addresses #1554 (discussion)
v5 documented PORT as a legacy alias for FRONTEND_PORT. v6 dropped the
fallback silently, so an install configured with PORT=8080 upgrades to
v6 and comes up on 7655 with no explanation, unreachable behind its
existing port mapping or reverse proxy.
Honor PORT again at lowest precedence (FRONTEND_PORT wins when both are
set) and log a deprecation warning at startup, mirroring the existing
legacy DISABLE_AUTH handling. Document PORT as deprecated in
CONFIGURATION.md and note the compatibility behavior in the v6
changelog.
PULSE_AGENT_INGEST_PORT existed in code but was absent from operator-facing
docs, so the network-isolation feature (dedicated agent-ingest port serving
only /api/agents/*, firewalled from the web UI/management API) was
undiscoverable. Adds it to CONFIGURATION.md (env-var row + Split-Port Agent
Ingest section with the security model and agent wiring via
PULSE_AGENT_CONNECT_URL) and an API Security cross-reference in
AGENT_SECURITY.md. Also aligns WEBHOOKS.md multi-tenant licensing wording with
MULTI_TENANT.md / API.md (Enterprise license + multi_tenant capability).
These two env vars were documented as relay overrides in v6 docs since
March 18 (CONFIGURATION.md, RELAY.md, and the frontend-served doc copy)
but no code ever read them. Operators trying to bootstrap relay headlessly
saw no effect.
Implement them rather than remove the documentation. Headless and
container deployments now have a real path to enable relay and point it
at a private endpoint without going through Settings → Relay.
internal/relay/config_env.go:
- ApplyEnvOverrides(*Config) mutates relay.Config in place.
- PULSE_RELAY_ENABLED accepts true/false/yes/no/1/0/on/off (case-
insensitive). Unrecognized values log a warning and leave the file
value untouched — important so "unset" reads differently from
"explicit false."
- PULSE_RELAY_SERVER goes through the existing validateRelayServerURL
check; invalid URLs log a warning and fall through.
internal/config/persistence_relay.go:
LoadRelayConfig calls ApplyEnvOverrides after the file load and after
the default-fallback when relay.enc is absent, so the env override
applies on every load.
Tests cover unset / true / false / garbage-bool / valid-URL / invalid-URL
/ both-together / nil-config paths in the relay package, plus two
end-to-end tests in internal/config that prove the override flows through
LoadRelayConfig against a real persisted file and against the
missing-file default branch.
Restore the env-var docs with the correct default URL (the full
wss://relay.pulserelay.pro/ws/instance, not the bare hostname the
original aspirational table claimed) and add an explicit precedence note:
saving from the UI after an env override persists the env-effective state
to disk, so clearing the env alone does not revert.
Add internal/relay/config_env_test.go to the relay-runtime registry's
desktop-relay-runtime exact_files so the new code surface is proof-tracked.
Update the matching pin in subsystem_lookup_test.py. Extend the
relay-runtime contract Extension Point 3 to document the override
semantics LoadRelayConfig must satisfy.
pulse-triage[bot]