The required CodeQL check misclassifies two typed API-group array membership assertions as URL substring sanitization. Use one explicit exact-equality predicate for both readers and retain the existing role, resource, verb and private-token controls. Positive and lookalike-group cases protect the equivalent matching semantics without suppressing security analysis or changing runtime behaviour.
Contract-Neutral: Test-only exact API-group predicate and regression cases; Kubernetes guide, permissions, runtime and security contracts are unchanged.
Change-source: pulse-maintainer
Preserve the exact prepared graph ancestry and retained final-source qualification. Complete-graph strict audit and containing hosted CI remain required for protected publication; existing auth golden failures are not cleared.
Change-source: pulse-maintainer
`scripts/check-drawer-tab-retention.cjs` (the #1723 tab-retention proof)
and `scripts/check-pbs-host-history-correlation.cjs` share the fixture
`frontend-modern/browser-tests/pbs-host-history-correlation.tsx`. That
fixture mounted the Backups table without the app runtime context the
drawer's Overview reads alerts from, so both proofs threw "useWebSocket
must be used within WebSocketContext.Provider" before the drawer
rendered. This happened on main too: they had silently stopped proving
anything.
- The fixture now supplies an explicit offline WebSocket and dark-mode
context and a router, matching the other drawer fixtures.
- The correlation proof follows the drawer's current shape. History
charts sit on Overview, so it checks that Overview stays selected with
stable chart paths and Identity rows across refreshes. The Identity card
shows each identifier once (since 4884052bc5), so the Metrics Target row
may be absent; when it is present it must name the host series. The
intercepted history request must still name the host series in every
case.
Results on pulse-dev (Chromium 151):
| Proof | Result |
| --- | --- |
| Tab retention | Passes at 1280px and 390px |
| PBS host history correlation | Passes in all 12 cases (pbs-only,
side-by-side and guest topologies; stable and reordered; 1280px and
390px) |
| Negative control: reset the tab whenever the metrics target drops |
Retention proof fails ("tab selection was discarded") at both widths |
| Negative control: chart the PBS service key | Correlation proof fails
("expected the host history target agent/agent-proxback") |
Replace the repeatedly patched line scanner with the existing exact Marked 17.0.6 GFM lexer. Preserve real legacy values and silent current-thread label deltas while excluding quoted, nested, HTML and multiline-code declarations and upgrade-source title fallback. Install the complete one-package locked graph with scripts disabled and verify triage before minting its existing write token.
Contract-Neutral: Replace the issue metadata scanner within the existing silent classification contract; no product runtime, API, rendered Pulse UI, permissions, retest or disposition-authority change.
Change-source: pulse-maintainer
Keep the original failed transaction command distinct from any later cleanup command. Retain fixed operation labels and require portable controls for command, timeout, assertion, cleanup-only and successful receipts, without changing update transactions or disclosing command output.
Change-source: pulse-maintainer
The drawer tab-retention proof (#1723) and the PBS host history
correlation proof share browser-tests/pbs-host-history-correlation.tsx.
That fixture mounted the Backups table without the app runtime context
the drawer Overview reads alerts from, so both proofs threw before the
drawer rendered and had silently stopped proving anything.
The fixture now supplies an explicit offline WebSocket and dark-mode
context and a router, as the other drawer fixtures do. The correlation
proof follows the drawer's current shape: history charts sit on
Overview, so it checks that Overview stays selected with stable chart
paths across refreshes. Since the Identity card shows each identifier
once, the Metrics Target row may be absent; when present it must name
the host series, and the intercepted history request still must.
Both proofs pass at 1280 and 390px on every topology. Negative controls
fail as they should: resetting the tab when the metrics target drops
breaks the retention proof, and charting the PBS service key breaks the
correlation proof.
The complete prepared-graph suite timed out in the cross-picker label check while it awaited cold presentation-module imports. Load the same real disk and pool consumers with the test module, then keep every label assertion within the unchanged five-second test window.
Contract-Neutral: Test import scheduling only; no runtime, label expectation, assertion timeout, security gate or browser baseline changes.
Change-source: pulse-maintainer
Replace the old optimistic-health expectation with cached selection, failed-request and later-success controls. Advance no production clock or safety fence and avoid an irrelevant constructor attempt in the in-memory fixture.
Contract-Neutral: Test-only correction to the recovery contract established in 4147f48db3; runtime and browser inputs are unchanged.
Change-source: pulse-maintainer
Require the actual nodes/login probe to succeed at startup, recovery and lazy selection instead of accepting guest-like response text. Retain failed single-endpoint health until an ordinary request succeeds, preserving cached last-resort reads, real guest error handling, temporary rate-limit handling and trust policy. Add producing-path and connected projection regressions and revise the old nodes-as-guest fixture contract.
Change-source: pulse-maintainer
Require the renamed native process-field assertion in the complete NAS removal oracle; retain all twenty controls and their strict executed verdicts.
Contract-Neutral: Update only the required test identity after the fixture assertion rename; no production or acceptance-contract change.
Change-source: pulse-maintainer
Current exact-head CI exposes outdated PBS proof inventory, omitted bounded-download helper extraction, closed transport rejecting the production HTTPS flags, and Darwin's truncated comm column in Linux NAS fixtures. Preserve exact transport and process ownership, restoration and migration safety assertions while binding the controls to the actual producer.
Contract-Neutral: Test and offline CI-fixture alignment only; no installed runtime, trust, credentials, deadlines, source safety or public contract changes.
Change-source: pulse-maintainer
Preserve imported source and receipt ancestry while qualifying the complete dependency group against current assigned main.
Change-source: pulse-maintainer
Run the existing credential-free diagnostic regressions in tier admission before dependency installation or image/shard work. Check the actual workflow wiring alongside the read-only collector and unchanged strict goldens.
Contract-Neutral: Invoke existing auth-renderer regression controls in CI; no public contract, dependency, golden or threshold changes.
Change-source: pulse-maintainer
Retain exact reviewed Delivery and Web commits. The diagnostic collector preserves strict goldens and records bounded renderer facts; source-p67_zn71 and retained browser controls cover the new test code. No runtime frontend changes or pending graph are included.
Change-source: pulse-maintainer
The actual Docs fetch, Markdown renderer and router pass desktop Chromium and 390px WebKit navigation and reading checks. All six original captures were inspected with the native image tool; no host, agent or installed recovery is asserted.
Contract-Neutral: Browser receipt only; no runtime, guide content or subsystem contract delta.
Change-source: pulse-maintainer
Retain the useful reason to disable unneeded collectors as well as the new guest-read limits and safety guidance. Preserve the existing copy guard rather than weakening it. Recheck the final PVE producer on desktop and phone, retaining unchanged PBS/PMG branch proof. Browser evidence records actual input hashes instead of a permanently hardcoded source parent.
Contract-Neutral: Existing collection guidance and browser-proof metadata only; collector defaults, API saves, credentials, TLS and guest request behaviour are unchanged.
Change-source: pulse-maintainer
Combined publication proof source-in_pn1fq found the older five-row assertion after reviewed guidance added low-high bands and inspected peaks. Assert all seven rows and both additional uncertainty limits, preserving every existing assertion and the shipped guide.
Contract-Neutral: Test-only History guide coverage follows accepted documentation; no runtime, renderer, guide, dependency, timeout or safety-policy change.
Change-source: pulse-maintainer
The legacy grant-pct path deliberately permits only list and df outside the typed helper. Keep that distinction instead of calling every fallback a full-trust collector, and describe configured mounts rather than promising every mounted filesystem.
Contract-Neutral: Guidance wording only; no telemetry, privilege, API, installer or availability contract delta.
Change-source: pulse-maintainer
The deployment table still calls the typed helper a pct reader, while the implementation uses socket-free discovery and command fallback cannot recover within PrivateNetwork. Link the deployment choice, collector help and support matrix to one shipped explanation of partial, unavailable and older-helper readings, without recommending privilege or state changes.
Contract-Neutral: Guidance and consuming-proof coverage only; no telemetry, privilege, API, installer or availability contract delta.
Change-source: pulse-maintainer
Replace the existing full-visibility promise with the actual guest-agent availability and permission limits. Put the backup precaution beside VM collection, preserving independent thaw and every-covered-filesystem write checks rather than implying that an OK backup or a running VM proves recovery. Exercise the production connection editor with harmless fixtures, without probing a guest or replacing credentials.
Contract-Neutral: Copy and an accessible landmark on an existing form; collection defaults, guest requests, connection saves, credential handling and TLS policy are unchanged.
Change-source: pulse-maintainer
Current hosted E2E stays green with an adverse probation auth comparison, while local auth pixels use a different observed font. Attach actual heading font selection, browser and viewport identity, and complete loaded stylesheet hashes before each existing strict comparison. Keep diagnostic gaps explicit, omit page/account/URL/CSS contents, and never change styles, baselines, thresholds or assertions.
Contract-Neutral: Add read-only test diagnostics for existing auth goldens; application, permission, deployment, screenshot and security contracts are unchanged.
Change-source: pulse-maintainer
Retain the completed PBS phone receipt and coupled Solid serializers unchanged while incorporating reviewed password-session, diagnostics and source-admission repairs. The graph remains unqualified until exact installed consumers, production build, desktop and phone browser proof and strict audit/current CI are complete.
Change-source: pulse-maintainer
The projection fixture now uses the actual saved ClusterEndpoint schema. Give each malformed-filesystem fixture an independent base path so reused listener ports cannot borrow a previous live uncertainty fence; all real guard state and response assertions remain.
Contract-Neutral: Test-only schema correction and independent synthetic endpoint identity; no production policy, deadline, wire or configuration changes.
Change-source: pulse-maintainer
A completed first-use retry does not return its nodes payload. Omit that unknown diagnostic count rather than reporting zero. Concurrent ordinary reads may legitimately open additional TLS sockets, so the construction control bounds logins and probe reads rather than pooled read connections.
Contract-Neutral: Diagnostic-count fidelity and fixture-only connection counting; no wire, trust, polling, authority or consumer contract delta.
Change-source: pulse-maintainer
The shared probe must release the health mutex for first-use trust. Retain the prior single construction boundary so joined readers do not duplicate capture and password login. The actual TLS concurrency control checks eight ordinary reads and nonblocking health inspection.
Contract-Neutral: Preserve existing serialized lazy client construction while releasing only the health and trust mutex for first-use capture; no wire, authority, configuration or consumer contract changes.
Change-source: pulse-maintainer
Preserve exact Delivery candidate 3aaa967bba. Review retains the executed real-Git scope controls and workflow trust proof; the unchanged VM historical-object failure is not relabelled as a pass. No frontend source changes or security exceptions.
Change-source: pulse-maintainer
Use one bounded first-use probe for constructor and nodes-read pin failures at startup, recovery and lazy selection. Keep capture credential-free, primary and saved pins immutable, and full polling-session acceptance separate. Qualify all existing auth encodings and refusal, cancellation and consuming projection controls.
Change-source: pulse-maintainer
Bind current desktop and 390px Docs navigation, reviewed pixels and the existing empty Diagnostics panel to byte-identical shipped guides. Retain original browser fixture failures and the unmodified live-check/privacy boundaries. This records help usability, not native recovery.
Contract-Neutral: Browser receipt metadata only; no runtime, renderer, documentation content or contract delta.
Change-source: pulse-maintainer
Keep all seventeen refreshed versions and the compatible serializers, but use maintained main's existing complete lock representation for the unchanged optional WASM archive. The proposal's six extra inBundle records have no independent tarball or SRI; they add inventory, not resolutions. Preserve the exact official parent tarball, SRI, bundled names and declared dependencies instead of inventing child integrity or changing the registry-only acquisition check.
Contract-Neutral: No package, security floor or runtime dependency is removed; the unchanged bundle remains authenticated by its original parent archive, using the existing qualified lock topology.
Change-source: pulse-maintainer
The original complete Docs proof timed out in a five-second rendered-link batch. Split the same two bases, ten untrusted paths and sixteen links into separately bounded cases, retaining every setter assertion, all-path completion and the original per-base minimum of 120 rewritten links. Do not raise a timeout or change the renderer.
Contract-Neutral: Test batching only; all adversarial vectors and security predicates are preserved, with no runtime or contract delta.
Change-source: pulse-maintainer
Account for every update in PR 2759 using its complete original graph and the already verified official serializer metadata, rather than carrying the old security override into Solid 1.9.16. Lock both runtime edges to 1.6.8, preserve every security override and add installed-version checks that reject stale offline graphs. Acquisition and fresh exact-graph qualification remain required before integration.
Contract-Neutral: Compatible patch/tooling refresh within existing rendering, security and serialization contracts; no new surface or authority, and all security floors, strict audit and consumer checks remain required.
Change-source: pulse-maintainer
Main Secret Scan job 115618327497 on 90a8b890 passed after scanning zero commits and bytes with --log-opts=-1. Bind the exact checkout, scan the complete introduced commit range plus first-parent merge resolution, and use full reachable history when the incremental base is unavailable or divergent. Preserve the pinned detector, checksum, redaction, fatal findings, ignore fingerprints and unconditional per-push admission. Real Git fixtures cover earlier removed bytes, merge-only changes, complete-history fallback and failure exits.
Contract-Neutral: Restore existing per-push secret-scanning coverage; detector rules, security exceptions, permissions, application and deployment contracts are unchanged.
Change-source: pulse-maintainer
Complete the retained three phone topologies after the corrected viewport reached ordinary browser admission. Real touch, snapshot correlation, range retention, explicit target withdrawal and hidden-Overview polling pass at 390px, with all six originals inspected. Preserve the completed desktop consumers and the separate adverse authentication/native jobs.
Contract-Neutral: This records new previously missing phone consumer evidence for unchanged production contracts; no runtime, monitoring or access behaviour changes.
Change-source: pulse-maintainer
Match the current Support navigation and phone control labels, explain absent exports, and lead reporting with existing evidence. Keep live-check, full-bundle and privacy limits intact; verify the shipped guide against the actual route and state owners.
Contract-Neutral: Existing help and diagnostic-state tests only; no runtime, renderer, routes, access, exports or live-check behaviour changes.
Change-source: pulse-maintainer
The containing proof completed every client/TLS/parser race suite, vet and real-embed build, but the new monitoring fixture used only one shortened retry delay. Its next client check took the production cap, exhausting the poll context. Include both fixture checks and assert a live caller before polling; production retry/caller policy is unchanged.
Contract-Neutral: Correct the monitoring test schedule only; no production session, TLS, retry cadence, polling, guest safety or History contract delta.
Change-source: pulse-maintainer
The containing race suite observed a prior cooldown before the invalid-success matrix sent its first HTTP request. Use per-case synthetic base paths instead of recycled listener authority; prove two first admissions and preserved cross-client fences on one shared listener. Production admission keys, aliases and safety state are unchanged.
Contract-Neutral: Isolate synthetic test identities; no production guest admission, TLS, session, polling or History contract delta.
Change-source: pulse-maintainer
pulse-triage[bot]