Validate PVE and PBS hosts before logging them, omit url.Parse input from syntax errors, and keep cluster logging, health snapshots, recovery summaries and returned error labels separate from configured routing and TLS identity. Exercise actual rejected-host constructors, cluster routing/recovery and accepted-host controls with synthetic credentials. Connection policy, authentication and guest safety fences are unchanged.
Change-source: pulse-maintainer
Preserve exact Web candidate c8e4276ca4 with published alert navigation. Retain its complete source and per-content browser proof; native guest safety and restart recovery remain separate owning work.
Change-source: pulse-maintainer
Share byte-reading admission across host summaries and filesystem drawers. Keep unavailable rows neutral without counting missing capacity or unknown usage as healthy space, while preserving genuine omitted-zero bytes and independent aggregate readings. Exercise canonical resource refreshes through desktop and phone host tables and register the contract regression proofs.
Change-source: pulse-maintainer
Preserve current upstream and every accepted local commit additively; proposal 2888 remains unchanged pending source-bound browser and native installer remedies.
Change-source: pulse-maintainer
Publish ticket, CSRF and expiry together and share only an expired session renewal. Preserve independent requests, context cancellation without false credential errors, JSON/form authentication, token authority and terminal API refusals without replay. Add registered pinned HTTPS race, failure and recovery controls plus a canonical consuming projection. Keep exact verification paths sorted as required by candidate admission; runtime and tests are unchanged from the source-proven candidate.
Change-source: pulse-maintainer
Preserve all reviewed starting commits and incorporate exact current upstream PR2892 additively. The combined source requires final validation before publication.
Change-source: pulse-maintainer
A VM or container alert's name linked to the top of its platform page,
so after a notification the operator had to find the guest among every
other guest on Proxmox or vSphere.
The card now adds ?resource=<alert resource id> for guest alerts whose
page is Proxmox or vSphere. The shared workloads table already resolves
that id through the resource registry, opens the guest's drawer and
reveals it, so the card adds no identity mapping of its own. Other alert
types, per-filesystem guest alerts and orphaned backup alerts keep their
platform page link because their ids name nothing the table can open.
The monitoring policy menu still reads its platform from the page path.
Keep selection on the registry ID through context, sessions and command
routing so same-name resources cannot cross provider boundaries.
Retain native executor coordinates, legacy inputs that resolve uniquely,
policy redaction and paid execution modes.
Refs #2681
The containing install-metadata gate requires the existing companion-release disclosure. Retain it alongside, not instead of, the approved retirement notice; do not relax the gate or change the served runtime. Preserve the failed first proof and verify the final notes and actual producer.
Contract-Neutral: Notes-only compatibility disclosure and its assertion; no runtime, protocol, release identity, asset, maturity, latest pointer or cadence change.
Change-source: pulse-maintainer
Use the stable-based source comparison rather than a contradictory immutable changelog introduction. Preserve the reviewed bounded monitoring outcomes and the explicit guest-safety limitation, and include the approved Mobile retirement notice in the existing beta correction. Regression assertions bind the exact notice and comparison without changing release identity, assets or cadence.
Contract-Neutral: Published-note maintenance and its regression assertions only; no runtime, protocol, release identity, assets, maturity, latest pointer or cadence change.
Change-source: pulse-maintainer
Governance now reports explicit completion, residuals, evidence and
ownership availability. It no longer computes lane grades, completion
percentages or weighted candidate priority. Release qualification,
security assertions and lease boundaries stay enforced.
The frontend contract also drops obsolete Discovery surface catalogs and
preserves the live Assistant handoff and execution contracts.
Validation: 93 focused Python tests, repository-control Go tests, and
control-plane, status, registry and contract audits. Full delivery hooks
passed, including 164 helper tests and frontend audits after integration
with current main.
System names and versions must be readable by touch and keyboard without relying on a hover title. Denied package-update queries need the existing read-only explanation and a link to the installed troubleshooting section, not GitHub main.
Preserve rcourtman's node-update and shared-help source from cbec132640, including its contract and controls, and our wrapping/local-doc repair. The rejected unshared candidate imported that contributor committer; recreate it on the assigned base through the normal maintainer source route, without changing the imported object or anyone's identity.
All non-receipt runtime, tests, configuration, dependencies, scripts and contract bytes match the previously verified 9b359836 source. The cumulative browser receipt binds its original 22 checks and six actual captures to the unchanged final content and this own parent. Source-jmqvgzzm's prefix and failed driver, source-z1w_7ijm's complete suite/build, and their original SHA bindings remain explicit; no test or browser execution is replayed or invented.
Refs: #1802
Contract-Neutral: Only the guest System wrapping has no performance/API/policy contract delta. The cumulative denied-update/shared-help changes include their substantive frontend-primitives contract and registered controls; trust, access grants, freshness and entitlements remain unchanged.
Change-source: pulse-maintainer
The first beta's page listed no changes, and the full changelog file is
neither attached to nor linked from any release page, so a reader could
not look up a change the summary did not name. Add a pointer, advisory
and additive.
The renderer appends a "## Source comparison" section after Roll back: a
link to GitHub's comparison of the release tag with the stable rollback
target the workflow already passes (--rollback-target and --candidate-tag).
It is a pointer, not a list. GitHub shows at most 250 commits in a
comparison and this beta had 328 changes, so the section says larger
comparisons may omit commits and is not called a full list.
It never fails a release on its own. The helper renders nothing, and
raises nothing, for a missing or malformed tag, a base that is not a
lower stable release, a trailing newline, non-ASCII digits, or numbers
too large to convert. Bodies without the section, including every
earlier release and any frozen in-flight one, keep validating, because
the validator already permits a trailing section and is unchanged. The
post-update changelog dialog reads only recognised category headings, so
a separate heading after Roll back is ignored by it.
Every consumer of the rendered body was audited (the renderer's
validators, create-release, validate-release-assets,
recover-release-activation, the updater backend, the what's-new model and
the Go and TypeScript tests): no regression. Review of the first draft
found a crash on a 5000-digit tag, a newline that would land inside the
URL, and overclaiming contract text; all fixed and pinned by tests that
fail against the first draft. A tags/ prefix would avoid a branch that
shares a tag's name, but GitHub's web comparison URL returned 404 for it
on existing tags, so bare refs are used and the limit is recorded.
Tests run the real renderer on the v6.5.0 notes: placement after Roll
back, exact spacing, numeric ordering, ten edit and annotation cycles
with CRLF and the extra jq newline, expected-body rejection of a changed
or deleted section, and absence still validating. They fail against the
original renderer. Making the section required, and a generated
row-level inventory that proves completeness, need a declarative contract
record in the preparation snapshot and are deliberately deferred; the
contract explains why.
Contract-Neutral: Adds an advisory link to rendered release pages; no published artifact, tag, signing, install or customer contract changes.
Preserve current Patrol setup and provider connection behavior alongside
the explicit governance completion and evidence contract. Inherited
application states retain their qualified main content.
Retain every reviewed starting commit and the refreshed exact published workload identity source additively. PR2888 remains unchanged pending its completed qualification defects; this unproposed composition requires exact final-source checks before the later publication batch.
Change-source: pulse-maintainer
A Proxmox node move changed the workload row key, reset an open drawer’s
History view and could publish new coordinates before saved guest
metadata migrated. Rows now use the stable unified resource ID,
bookmarks resolve through the registry, and the selected resource owns
its drawer tab and History range across regrouping.
Accepted publication migrates metadata before exposing the new node. A
failed write retains operator fields in memory and the last successful
disk snapshot, with recovery through the existing writer. Native
metadata and History coordinates remain separate from row identity.
Backend metrics targets take precedence over the legacy native fallback.
Route focus owns initial positioning. Viewport initialization measures
the selected row without replacing its reveal window. Local row clicks
retain their scroll position, while later scroll and resize events
follow the viewport. Operator policy, Assistant, all four Patrol modes
and paid entitlements are preserved.
The proof registry owns the focused publication and writer tests. Its
guard verifies acceptance and rejection without duplicating the catalog.
Canonical and browser guards share exact Git inheritance reads, so
updating a branch retains parent qualification for unchanged content.
New resolutions and mode changes still need current proof, and range
checks qualify the complete proposed change.
Validation:
- Regression controls reproduce publication ordering and persistence
failures. Targeted backend and race tests pass.
- Final repair checks pass: 476 tests across 15 frontend files,
type-check, production frontend build and embedded build.
- Current-source browser checks on /proxmox/overview at 1280x800,
900x800 and 390x844 cover VM and LXC, canonical and legacy links, node
regrouping, native and explicit History targets, saved links, reload,
keyboard selection, Collapse, Escape and search reselection.
- Additional desktop and phone checks cover operator policy persistence,
metadata write failure, delayed lookup cancellation and refused
references. The final browser matrix passes 196 checks.
- Merge-qualification regression reproduces inherited additions, renames
and deletions being misclassified. All 216 focused guard tests pass,
including retained mode changes, new resolutions and ordinary commits.
Browser node movement uses controlled resource updates. Publication and
metadata ordering are verified independently with filesystem barriers
and failure injection.
Refs #1669
The script-smoke fixture includes the shared repository I/O dependency.
All 23 prepush fixture tests pass.
Preserve the starting reviewed e5c1f39636 and current published Patrol setup/provider guidance additively. Existing PR2888 remains unchanged while its completed qualification defects return to their owner.
Change-source: pulse-maintainer
Numeric lane grades and weighted candidate rankings duplicate model
judgment without adding a qualification invariant. Keep explicit completion,
residuals, evidence, assertions and ownership availability as the current
state contract. Remove duplicated prose catalogs and stale retired-surface
obligations while retaining their canonical owners.
When Pulse cannot reach the saved provider (a wrong Ollama URL, a server
that is down, a network fault), readiness reports provider_connection
and the Patrol setup card offered "Check Patrol model", with a hint that
provider connectivity can be healthy. The model check cannot fix an
unreachable provider. The card now sends the operator to Provider &
Models, where the URL and the provider test live, with a subtitle that
says Pulse cannot reach the provider. It does not open the setup panel,
because a passing network blip must not ask a cloud user for a key that
works.
Preserve both exact reviewed commits and their source-bound browser receipt. Retain the original full-suite timeout and bounded comparison/build evidence; this integration does not establish installed guest recovery.
Change-source: pulse-maintainer
Keep the current clock and stored-History readout alongside canonical row
selection and resource-owned drawer state.
Use one Git inheritance reader for browser and canonical qualification.
Inherited modes and objects keep their parent proof, while new resolutions
and mode changes remain subject to current contract and proof requirements.
Range checks still qualify the complete proposed change.
Refs #1669
The setup panel brought the AI settings client, provider configs and cost
helpers into the Patrol page chunk, which pushed AIIntelligence to
73.42 kB gzip against its 70.86 kB budget. Only an install that cannot
run Patrol needs that code, so the workspace now loads the panel
lazily and passes the readiness provider in, and the panel resolves its
starting provider itself. AIIntelligence is 70.38 kB (main 69.89 kB).
The legacy History fallback read a canonical row ID as a native metric key.
Use the shared provider key independently, with backend targets taking
priority. Keep topology and duplicate-resource proofs on canonical row IDs.
Route selection owns initial positioning. Measure selected-row geometry
without replacing its reveal window, then let real scroll and resize events
follow the viewport. Local row clicks keep their existing scroll position.
Refs #1669
A connection label can contain the metadata-key delimiter. Retiring site must not cancel reads or erase OS-command suppression, backoff and diagnostic origins for site|other. Read metadata ownership from its fixed suffixes and use each diagnostic record's exact Instance. Exercise cached, in-flight and ordinary HTTP collector paths with unrelated labels.
Contract-Neutral: Preserve existing connection-isolated retirement; internal cache ownership only, with no public wire, endpoint, TTL, guest-command completion, backup-lock or TLS policy delta.
Change-source: pulse-maintainer
18 of 60 paid installs on the current telemetry schema have no AI
provider. Getting Patrol running meant three pages: turn on Pulse
Intelligence, pick one of 14 providers and paste a key, choose a model
from a raw list, then find Check Patrol model on another page.
When Patrol is blocked because no provider is connected, Pulse
Intelligence is off, or the provider refused the saved key, the setup
card now connects a provider in place. It covers a cloud API key
(Anthropic, OpenAI, Gemini, DeepSeek, OpenRouter) or Ollama, names the
model Pulse will use from the Patrol guidance table, prices it before
anything is saved, then saves it, runs the provider test and the Patrol
model check, and offers the first run. A per-token model on the
untouched 6-hour schedule gets the same slower schedule Patrol settings
would propose. Everything else stays on Provider & Models.
The panel stays mounted once started, because polling flips the
readiness cause mid-setup and would otherwise remove the verdict. A
refused key (provider_auth) now routes to Provider & Models instead of
the model check, which could not fix it.
Do not imply that this beta contains the later SCALE, Unraid or QNAP boot-ownership repairs. Its systemd, OpenRC and SysV source fences remain distinct from native and whole-issue removal acceptance.
Contract-Neutral: Customer note scope correction only; no runtime, tag, version, assets, release maturity, latest identity or cadence change.
Change-source: pulse-maintainer
Expose the existing qualified disk and memory cues through the shared read-only dialog. Preserve safe source/time copy, canonical row ownership and compact table geometry; opening evidence does not refresh or run diagnostics. Cover source replacement, current-reading withdrawal, focus and row-action boundaries, with bound desktop and touch-phone browser proof.
Change-source: pulse-maintainer
Preserve the complete reviewed maintenance tip and current published Pro Patrol default. Retain both independent agent-lifecycle contract additions when resolving their shared insertion point; no runtime change is introduced by the resolution.
Change-source: pulse-maintainer
Treat only an observed HTTP 429 as a temporary request refusal, preserving metadata backoff and real command-safety suppression. Cover ordinary clients and collectors, stale identity, Windows recovery and quoted-status negative controls.
Change-source: pulse-maintainer
Contract-Neutral: Existing OS-command suppression classification only; no public wire shape, capability, deadline, retention or guest-command safety delta.
Replace generic fallback notes with source-bound customer changes, preserve signed installer and rollback advice, and correct the canonical cumulative changelog range. Cover meaningful notes, source range and safe rendering with regression checks. This is a notes-only candidate, not a live release edit.
Contract-Neutral: Customer notes, changelog introduction and note-content regression tests only; no runtime, source tag, version, asset, maturity, latest-release or release-cadence change.
Change-source: pulse-maintainer
Accept all six exact Delivery commits with complete installer and NAS caller proof. Boot activation and watchdog closure now precede recovery erasure; native Linux, PowerShell and appliance acceptance remain separate.
Change-source: pulse-maintainer
Preserve the own-parent browser receipt and exact Web candidate. Existing Workloads disclosures and drawer identify the same UTC instant without extra polling.
Change-source: pulse-maintainer
Accept the exact Core candidate and retained HTTP, race and consuming proof. Legacy grants, history limits and subscriber terms remain unchanged.
Change-source: pulse-maintainer
Pro sells Patrol investigation, but every install starts in Watch only
and stays there unless the operator finds the mode control. In the paid
telemetry read on 12 October, 20 of 35 Pro installs with Patrol on ran
Watch only, and none of those 20 ran an investigation in 30 days, so
the feature they paid for never ran.
An install that never saved a Patrol mode now runs Ask first when it
holds a positive investigation licence. Patrol investigates new and
re-detected warning and critical findings and proposes a fix; nothing
changes without approval. The default only applies to a positive
licence answer: a missing licence checker counts as unlicensed, so a
startup window cannot spend provider budget on a free install. Free
installs and explicit choices are unchanged.
The Patrol header says so once, with the cost (the operator's AI
provider and 30-day budget) and two actions that save Ask first or
Watch only. The notice never renders on a plan-locked install. The
header also stops claiming "Watching your infrastructure" while Patrol
cannot run yet and reads "Patrol is not running yet" instead.
Preserve the exact reviewed c036461d and 594f5025 history. Retained source and production Docs desktop/narrow proof covers the unchanged guides; no monitoring, licence or release behaviour changes.
Change-source: pulse-maintainer
Omit mobile connection and push offers, and advertise only current Pro history. Same-path HTTP controls preserve signed grants, public/private runtime fences and 7/14/90-day compatibility without changing subscriber terms.
Change-source: pulse-maintainer
A go shell can hold later launches in memory after its boot file changes. Treat that live mixed-purpose owner as unknown rather than signalling it or inferring quiescence from the edited file. Require the actual-caller refusal control alongside the existing NAS suite.
Change-source: pulse-maintainer
Use shared UTC completion formatting for table disclosures and guest drawers so local browser timezones cannot silently change the displayed instant or day. Keep running, unknown, absent and future evidence separate, and format table completion times only while disclosed. Record connected timestamp, keyboard/touch and non-UTC desktop/phone pixel proof without changing collection or guest operations.
Change-source: pulse-maintainer
Retire only exact Unraid and QNAP boot entries before checked watchdog-first process termination and same-instance server removal. Preserve unrelated boot owners and refuse unknown, partial or concurrent state without erasing credentials or restarting. Exercise the complete uninstall caller and generated private watchdogs.
Change-source: pulse-maintainer
The GitHub star prompt now appears on the first return on a later day
with connected infrastructure, rather than after fourteen active days.
It stays compact, appears once, and supports permanent dismissal.
The banner follows the published bottom navigation height at every
viewport so it does not cover navigation on intermediate widths. Opening
a blocking dialog suppresses it for the rest of the session.
Validation: 121 banner and shared primitive tests, full frontend
type-check and formatting. Playwright exercised `/proxmox/overview` at
1440×900, 800×900 and 390×844, including first-day and returning visits,
dismissal and reload, the GitHub action, keyboard focus, dialog priority
and empty/loading/error fixtures.
Use unified resource IDs for workload rows and selection so moving a guest
between Proxmox nodes retains its open drawer and History range. Resolve
existing bookmarks through the registry instead of rebuilding client IDs.
Migrate guest metadata before accepted inventory publication and retain its
operator fields in memory if persistence fails. Native metadata and metrics
coordinates remain explicit compatibility inputs. Operator policy and paid
execution behavior remain intact.
Register the focused publication and writer proofs once. Check proof
acceptance and rejection without copying the registry catalog into tests.
Refs #1669
Returning users should not need fourteen days of use before they can
support the project. Offer the existing compact prompt on the second
connected day and retain permanent dismissal and notice priority.
Use the published mobile navigation height at every width so the prompt
does not cover navigation on intermediate screens.
Validation: 121 banner and shared primitive tests, frontend type-check,
and Playwright on /proxmox/overview at 1440px, 800px and 390px.
pulse-triage[bot]