Align existing removal and orphan-service help with credential-first Unix admission. Explain same-instance recovery, keep older served scripts and Windows behaviour distinct, and prevent stopping retries from being mistaken for revocation or completed removal.
Contract-Neutral: Existing operator guidance and regression assertions only; no runtime, schema, lifecycle or trust-boundary change.
Change-source: pulse-maintainer
Do not count actual access refusals or exact stopped-QGA replies as failures of guest-get-osinfo. Preserve prior command failures, unsupported-command suppression, normal refresh backoff and all backup/uncertainty fences. Cover ordinary cold and retained identity recovery through both collectors and HTTP client paths.
Change-source: pulse-maintainer
Credential-bearing removal currently short-circuits its confirmation gate when connection recovery leaves no URL, allowing local teardown without durably removing the server record. Check credential presence first and stop with same-instance recovery guidance before any process, service or state teardown. Keep credential-free local-only removal and existing exact-record/path authority intact.
Execute the real admission and initial teardown with private transport/service doubles, including every saved credential form, refusal, unknown response, identity mismatch and authorised cleanup. Register the portable Python controls in the installer inventory and describe the boundary in both owning contracts. Native Windows/TLS and whole installed lifecycle acceptance remain separate.
Change-source: pulse-maintainer
Accept original failure evidence without another reproduction or a diagnostic export, and place public-sharing precautions before readers leave for GitHub. Keep the shipped documentation index in sync and guard both entrypoints within the README page budget.
Contract-Neutral: Documentation-only intake guidance and regression checks; no runtime, API, collection, authentication or release contract changes.
Change-source: pulse-maintainer
Preserve exact Web commits 171579a878 and 4256aeea1e. Retained source-x828flaq and own-parent desktop/phone browser proof cover the maintenance repair; native guest restoration is not claimed.
Change-source: pulse-maintainer
Use the explicit VM power state before accepting a retained platform or linked-agent disk reading. Rows, filesystem detail, capacity sorting and current History share the correction; real stored history, running-VM deferrals, measured zero and independent LXC storage stay intact.
Reproduce the old presentation across eight adverse cases, then verify production components in desktop Chromium and phone WebKit with inspected captures and an own-parent content-bound receipt.
Change-source: pulse-maintainer
Accept exact product-intelligence candidate 5db15c9366. Retained source-stb_euh2 verifies all 46 selected documentation checks, public links and shipped mirrors; token generation and hint semantics agree with source. Runtime and credential policy are unchanged.
Change-source: pulse-maintainer
The Pi authentication report identified duplicated token characters despite a matching partial hint. Check correct, duplicated-middle and legacy input through the real generated terminal prompt and installer writer, including restoration of the original synthetic value and private hand-off cleanup. Clarify the existing guide without imposing a token-shape rule or claiming installed reporting recovery.
Contract-Neutral: Documentation and regression coverage only; command generation, credential selection, authentication, scopes, trust and runtime behaviour are unchanged.
Change-source: pulse-maintainer
The current host installer issues a 64-character lowercase hexadecimal token, but a bare file and matching inventory hint can still hide duplicated or changed middle characters. Explain the private whole-value check before first installation and its limits during authentication triage. Preserve other credential families, installation state, scopes and trust.
Contract-Neutral: Existing setup and authentication guidance only, with source-bound documentation checks. Runtime behaviour, credential formats, scopes and trust are unchanged.
Change-source: pulse-maintainer
Apply the existing ten-second deadline to both qm and its response reader. Stop only the local collection group even when a producer exits with an inherited pipe or a reader ignores TERM. Preserve byte limits, independent failures, private output and the refusal to probe or change a guest; test actual owned-reader termination and the mirrored help.
Contract-Neutral: Passive operator diagnostics and existing help only; Proxmox polling, guest-agent admission, APIs, storage, permissions and service behaviour are unchanged.
Change-source: pulse-maintainer
Accept exact Web commits 35bb23bebf and e30977c3ca. Retain final source and browser evidence; Windows runtime failure-retention and installed removal remain separate Delivery work.
Change-source: pulse-maintainer
Preserve exact Core candidate 02ec15178b and all reviewed ancestry. Retained source-wx_utmf1 and source-hztok9vt cover full affected packages normally and under race, vet and cross-builds; this is source acceptance, not installed guest or Docker recovery.
Change-source: pulse-maintainer
Compose the exact observed upstream additively without rewriting reviewed tip 805ea6d712 or any accepted ancestry. The new Go 1.26.9 and x/net graph need matching final-source evidence before this batch can be proposed.
Change-source: pulse-maintainer
Beta cut from main at f42b2d7e88. It carries every change merged since stable v6.5.0.
Contract-Neutral: Release-only v6.6.0-beta.1 version, release notes and distribution metadata; no public install or runtime contract changes.
Change-source: pulse-maintainer
govulncheck on the pinned Go 1.26.8 reports twelve reachable standard
library vulnerabilities in Pulse (net/http, crypto/tls, html/template,
os, net/textproto), published 2026-10-08 and fixed in Go 1.26.9, plus
x/net advisories fixed in v0.60.0. With both bumped, govulncheck v1.1.4
and v1.7.0 report no affecting vulnerabilities.
Pulse's own govulncheck job last ran on 2026-10-05, so nothing flagged
it. The private Enterprise test job did: once the scan finds reachable
advisories it exceeds the 4 GiB CI VM and the guest kernel kills it,
which has failed every Enterprise pair check since 2026-10-08.
All release builders and local toolchain guards move together, as for
1.26.8. Only x/net changes in the module graph; the modules are
deliberately not re-tidied.
Checked on pulse-dev against this exact tree: the readonly dependency
graph and the full build pass, the four installtests that pin the
toolchain digests pass, and the root pair diagnostic tests pass.
Compose the exact observed current upstream additively. Keep starting reviewed tip 805ea6d712 and all accepted identities in history; the workload tap-target paths are disjoint from the local maintenance corrections.
Change-source: pulse-maintainer
At phone width the Workloads name cell shows the backup shield below the
guest name when the Backup column is hidden. Since 02e6a90374 it carried a
44x44 touch target. On phones the whole guest row is the disclosure target
(the expand chevron is screen-reader only), so that box covered the lower
left of every row's tap area: a tap there opened the backup sheet instead of
the guest drawer. It also grew every phone row from 33.5px to 63.5px.
Give the name-cell indicator a 24x24 target (the WCAG 2.2 AA minimum) and
keep the 44px target on the Backup column badge, which owns its own cell.
Measured on a 375px mock stack: rows are 43.5px, a tap beside the shield
opens the drawer, and a tap on the shield still opens the backup sheet. The
guest drawer already shows the last completed backup, so a row tap reaches
the same evidence. Desktop and the 768px layout are unchanged.
govulncheck on the pinned 1.26.8 toolchain reports twelve reachable
standard library vulnerabilities in Pulse (net/http, crypto/tls,
html/template, os, net/textproto), published on 2026-10-08 and fixed in
Go 1.26.9. golang.org/x/net v0.58.0 carries further advisories fixed in
v0.60.0. With 1.26.9 and x/net v0.60.0 the scan reports no affecting
vulnerabilities under both govulncheck v1.1.4 and v1.7.0.
Pulse's own govulncheck job last ran on 2026-10-05, so nothing flagged
this. The private Enterprise build and test job notices it: once the scan
finds reachable advisories it needs more than the 4 GiB CI VM holds, the
guest kernel kills govulncheck, and the job is cancelled. That has failed
every Enterprise pair check since 2026-10-08, including the first
beta's.
Move every release builder and local toolchain guard together, as 1.26.8
did, so no candidate artifact keeps an older compiler: go.mod, the
builder image digests (index digest for 1.26.9-alpine), the release and
dev scripts, the devcontainer, and the root pair diagnostic. Only x/net
is raised in the module graph; go mod tidy is deliberately not run, so
unrelated indirect requirements stay as they were.
Contract-Neutral: Toolchain and indirect dependency patch update that clears reported advisories; no product or runtime contract changed.
Separate Unix and Windows removal from installation-token state across the installer, source manager and removed Agent Doctor handoffs. Preserve saved connection, canonical identity and trust, bypass ambient installation credentials, and keep install private-input/preflight behaviour unchanged. Bind command regressions and parent/final desktop and phone browser evidence; retain Windows installer failure-retention with Delivery.
Change-source: pulse-maintainer
AI Discovery ran a separate model-backed service scanner beside Patrol
and the Assistant: its own store, scheduler, model route, API, tool and
drawer UI. No telemetry counter ever measured its use (the telemetry
discovery_enabled flag OR'd it with network subnet discovery), the
maintainer judged it a flop, and the context it produced is already
available to the models through pulse_query, pulse_read and the
unified-resource context sections.
This deletes internal/servicediscovery, internal/ai/infradiscovery, the
pulse_discovery tool, the /api/discovery routes, the mock Discovery
fixtures, the Discovery tabs in the resource, guest, node and Docker host
drawers, the identified-service cards, readiness badges, provenance
markers, suggested web-interface URLs, the Workloads AI Context column,
the chat "Discovery is off" hint and the AI Service Context settings page.
The old settings route redirects to Assistant settings. The model-bound
sanitizer allow-list existed only to pass Discovery context through, so it
goes too, along with the CopyableCodeRow primitive that only the
Discovery tab used.
Network subnet discovery (/api/discover, the Infrastructure discovery
settings) and the discoveryTarget agent coordinates are separate features
and stay. Stored discovery_enabled, discovery_interval_hours and
discovery_model AI settings are ignored on load; the settings API decoder
is lenient, so older frontends saving those fields still succeed.
Normalize Hub aliases and official repositories before token, manifest and cache lookup. Keep custom registries and ports distinct, preserve digest and platform comparison, reject non-manifest failures and exclude the managed Pulse image under every Hub spelling. Pin ordinary, credentialed and adverse metadata-only paths for issue #2840.
Change-source: pulse-maintainer
Preserve the complete reviewed maintenance tip and upstream release metadata additively before final-source validation and protected publication.
Change-source: pulse-maintainer
Retain the original source and adverse proofs; complete final client validation on the assigned additive source before returning the candidate.
Change-source: pulse-maintainer
Preserve Delivery tip 00680c9c5a exactly in merge ancestry. Resolve the overlapping startup helper to the candidate implementation and retain the canonical diagnostic controls and existing documentation. Frontend test formatting is already present; no runtime UI or workflow changes.
Change-source: pulse-maintainer
Beta cut from main at 413449306f. It carries every change merged since stable v6.5.0.
Contract-Neutral: Release-only v6.6.0-beta.1 version, release notes and distribution metadata; no public install or runtime contract changes.
Change-source: pulse-maintainer
Beta cut from main at 7520daae8e. It carries every change merged since stable v6.5.0.
Contract-Neutral: Release-only v6.6.0-beta.1 version, release notes and distribution metadata; no public install or runtime contract changes.
Change-source: pulse-maintainer
Reconcile the overlapping single and fleet narration documentation with current upstream route assertions, retaining CSV refusal and the actual shared ai:execute guard. Record the incorporated diagnostics token visibility boundary in its dependent contracts without changing runtime authority.
Change-source: pulse-maintainer
Completed PR2825 CI reports Windows Unix-type compilation failures and three Prettier fixture failures. Compile the existing Linux-only MSP daemon fixture only on Linux and format the unchanged frontend assertions. Separate successful CLI stdout from retained stderr diagnostics so Compose warnings cannot corrupt container identities, ports or bootstrap facts; add three executable controls without changing deadlines or acceptance gates.
Change-source: pulse-maintainer
Preserve every accepted maintenance commit while incorporating human-authored diagnostics token visibility. Resolve API guide overlap by retaining the shared ai:execute narration gate, explicit deterministic fallback and CSV refusal in both mirrors.
Change-source: pulse-maintainer
The refreshed proposal compiles the Linux-only control-plane startup fixture during Windows installer tests, failing on Unix-only dependencies before lifecycle assertions run. Exclude the fixture and its controls at compile time outside Linux, check Go file selection, and preserve required native Windows/macOS execution. Format only the three test files rejected by the exact containing CI, with Prettier AST-equivalence checks; no assertion, timeout, production source or workflow gate changes.
Change-source: pulse-maintainer
The discriminating Machines clock test and parent desktop/phone control exposed button remounting when option objects refreshed. Keep the shared primitive keyed by its logical value, update current metadata and preserve distinct numeric/string values. Cover wrapper projection, disabled/removal boundaries and bind the production-page browser receipt to this parent.
Change-source: pulse-maintainer
The exact-head hosted startup check reaches Docker exec with readback taken from CombinedOutput. Separate stdout from successful stderr warnings for identities, endpoints, mount hashes, bootstrap facts and cleanup, while retaining warnings and both failed-command streams. Add real-child-process controls and the matching deployment acceptance contract; hosted Compose acceptance remains required.
Change-source: pulse-maintainer
Follows the token authority fixes. The API reference now says:
- agent uninstall is a collector's own-token removal, or an admin session;
- AI narration of reports needs ai:execute from API-token callers, for
single and fleet reports, and otherwise falls back to the deterministic
summary;
- API-token callers manage only the tokens in their own organizations,
and only an instance-wide token can create, edit, rotate or delete
another instance-wide token;
- quick setup that would change credentials needs an instance-wide
token from API-token callers.
Adds the missing entry for POST /api/security/tokens/<id>/rotate, which
the regenerate entry already points scoped tokens to.
test_api_reference_routes.py pins each statement to the code that
enforces it, so the reference and the gates cannot drift apart. Each pin
fails when the code or the reference is reverted.
Contract-Neutral: Customer docs corrected to match shipped behaviour; no runtime, API or contract change.
Compose the three retained monitoring repairs and finish the existing health surface: counts, selected results and accessible status labels follow the row classifier on the shared clock, without changing observations. Preserve search, page-owned filter state and offline/unknown handling. Reuse complete-guide test fixtures with isolated clones instead of repeated sanitisation; keep all advice assertions and deadlines.
Change-source: pulse-maintainer
Preserve the published shared ai:execute gate while integrating the reviewed report help. Correct only source-shape assertions and the internal contract description; report behaviour and browser-verified guide contents remain unchanged.
Change-source: pulse-maintainer
A host-report 401 cannot diagnose lost upgrade credentials, and a 403 does not require disabling host monitoring or granting command execution. Direct operators to the existing instance, record and access policy instead of another installation. Preserve rejection buffers, throttles, identities and monitoring-only ceilings; prove ordinary same-credential recovery for primary and observer reporting. This diagnostic repair does not establish Discussion #2769's cause or native recovery.
Change-source: pulse-maintainer
Preserve the exact PI candidate and its retained renderer and desktop/phone help proof. Existing help only; no alert or Patrol runtime change and no installed relief claim.
Change-source: pulse-maintainer
Retain exact Core commits and scoped normal/race/vet/ARMv7 and trusted-HTTPS process evidence. This independent repair does not establish the Pi reporter cause or installed recovery.
Change-source: pulse-maintainer
The native Unix inventory tests the root installer, unattended updater and their Python service/readback fixtures, but the workflow's event filters omit those inputs. Include each on push and pull_request, preserving all jobs, tools and deadlines. Decode both events in regression controls and reject removal or exclusion of each input.
Contract-Neutral: Native CI admission coverage only; installer/updater behaviour, agent and Windows lifecycle, service authority and recovery contracts are unchanged.
Change-source: pulse-maintainer
Keep generation's read scope distinct from the ai:execute permission needed for single-resource and fleet PDF narration. Preserve the bounded PR2836 runtime guard unchanged, mirror the canonical API/MSP help into shipped assets, and record the actual contract including token-triggered versus server-run schedules. Replace the old unconditional-POST source assertion with both method and spending-scope checks, and cross GET with all five caller types. The production Docs browser fixture checks the public guidance on desktop and touch phone without API requests or mutations.
Change-source: pulse-maintainer
pulse-triage[bot]