Preserve exact Web candidate c8e4276ca4 with published alert navigation. Retain its complete source and per-content browser proof; native guest safety and restart recovery remain separate owning work.
Change-source: pulse-maintainer
Final whole-package proof retained a SCALE caller failure and showed its missing nas_agent_removal_platform definition. Extract the real platform reader through the existing redirected vendor paths and require an ordinary-Linux negative scope read without command-not-found noise. Preserve all sixteen task/process/manager controls and production refusal deadlines; this closure repair does not diagnose the observed service-quiescence failure.
Contract-Neutral: Complete test fixture namespace and negative-scope assertion only; no production installer, service, removal, credential or timeout delta.
Change-source: pulse-maintainer
Share byte-reading admission across host summaries and filesystem drawers. Keep unavailable rows neutral without counting missing capacity or unknown usage as healthy space, while preserving genuine omitted-zero bytes and independent aggregate readings. Exercise canonical resource refreshes through desktop and phone host tables and register the contract regression proofs.
Change-source: pulse-maintainer
The full package proof ran all nineteen NAS methods successfully but its Go caller still required the old eighteen-test count. Require the new named control as well as the nineteen-test OK verdict; keep every original case and fail-closed wrapper. The original failed full run remains recorded and the corrected containing source is revalidated.
Contract-Neutral: Test verdict accounting only; no installer, removal, credential, timeout or native acceptance contract change.
Change-source: pulse-maintainer
The new macOS native jobs fail NAS boot-filter positive controls and never recognise the generated private collector. Supply binary-aware GNU awk only to the existing Linux server fixtures and retain real safe/NUL/control-byte probes plus missing/non-GNU-tool refusals. Recognise both Unix comm formats while keeping the exact owned executable argument and cleanup controls. No installer or service source, skipped test or native-appliance acceptance changes.
Contract-Neutral: CI prerequisites and test fixtures only; production install, removal, credential retention and process-owner safety contracts are unchanged.
Change-source: pulse-maintainer
Keep closed inline backtick spans, escaped comment markers and quoted logs from hiding subsequent visible form declarations. Match backtick lengths exactly and keep genuine hidden comments, stale-event controls and Community labels unchanged. Regressions exercise the label consumer without a release lookup or public contact.
Contract-Neutral: No product runtime, API, rendered UI or triage authority change; preserve literal report evidence within the existing label classifier.
Change-source: pulse-maintainer
Preserve current upstream and every accepted local commit additively; proposal 2888 remains unchanged pending source-bound browser and native installer remedies.
Change-source: pulse-maintainer
A VM or container alert's name on the Alerts overview linked to the top
of its platform page, so after a notification you had to find the guest
among every other guest.
Guest alerts on Proxmox and vSphere now link to their page with
`?resource=<alert resource id>`. The shared workloads table already
resolves that id through the resource registry (including Proxmox source
ids like `<cluster>-<node>-<vmid>`), opens the guest's drawer and
reveals it. The card adds no identity mapping of its own.
Unchanged: hosts, storage, Docker, Kubernetes, TrueNAS and Pulse system
alerts keep their platform link (those pages do not read `?resource=`),
as do per-filesystem guest alerts (`<guest>-disk-<key>`) and orphaned
backup alerts (`backup-subject:...`), whose ids name nothing the
registry can open. Linking per-filesystem alerts needs the backend to
stamp the owning guest; that is a separate change.
Verification: browser receipt
`frontend-modern/browser-verification/c1fd06198765e0e2.json` (phone taps
open the guest in view; desktop opens the drawer and reveals the row;
vSphere source and unified ids both open the VM; Back returns to
Alerts). Alerts suite passes (1423 tests); the six new link expectations
fail on the previous card.
Publish ticket, CSRF and expiry together and share only an expired session renewal. Preserve independent requests, context cancellation without false credential errors, JSON/form authentication, token authority and terminal API refusals without replay. Add registered pinned HTTPS race, failure and recovery controls plus a canonical consuming projection. Keep exact verification paths sorted as required by candidate admission; runtime and tests are unchanged from the source-proven candidate.
Change-source: pulse-maintainer
Preserve all reviewed starting commits and incorporate exact current upstream PR2892 additively. The combined source requires final validation before publication.
Change-source: pulse-maintainer
A VM or container alert's name linked to the top of its platform page,
so after a notification the operator had to find the guest among every
other guest on Proxmox or vSphere.
The card now adds ?resource=<alert resource id> for guest alerts whose
page is Proxmox or vSphere. The shared workloads table already resolves
that id through the resource registry, opens the guest's drawer and
reveals it, so the card adds no identity mapping of its own. Other alert
types, per-filesystem guest alerts and orphaned backup alerts keep their
platform page link because their ids name nothing the table can open.
The monitoring policy menu still reads its platform from the page path.
The containing full frontend proof found one failed suite because Vitest imported the Node-only protocol controls. Preserve their exact bytes under a non-Vitest filename and document the explicit Node runner, without excluding any Vitest controls or changing product runtime.
Contract-Neutral: Rename byte-identical Node-only fixture tests and document their runner; no product runtime or subsystem contract delta.
Change-source: pulse-maintainer
Selected mentions were rebuilt from node names and provider IDs, and
later lookup could choose a different resource with the same name.
Assistant now keeps the registry ID through selection, current context,
session registration and command routing. Unknown and ambiguous
references fail closed, and governed fields stay withheld. Realtime
compatibility uses source ownership before synthesizing provider facets,
so VMware storage coordinates cannot become Proxmox ownership.
Native executor coordinates, bounded legacy inputs, Assistant, all four
Patrol modes and paid entitlements remain supported.
Validation: registry, tools, chat, paid runtime, model-boundary and
contract suites passed. Six controls fail against the old code. 323
frontend tests, type-check and the production build passed. The final
browser matrix covers /proxmox/overview at 1280x800, 900x800 and
390x844, including actual pixel inspection.
Browser inventories and provider transport are controlled fixtures. No
native infrastructure action or provider inference is claimed.
Refs #2681
Both the Backup-column badge and hidden-column shield now disclose the existing current guest-read state and backup precaution, rather than leaving that context only in the guest drawer. Read-only keyboard/touch guidance stays reachable; no live probe or health verdict is added.
Contract-Neutral: Carry the existing allowlisted guest-read interpretation and safety guidance into the read-only backup disclosure; no API, identity, monitoring, History or action-contract delta.
Change-source: pulse-maintainer
Preserve the exact reviewed Delivery commits and their final notes proof. The change adds the approved Mobile retirement notice beside compatibility and replaces the misleading immutable changelog pointer with the existing stable-based comparison. No release identity or runtime changes.
Change-source: pulse-maintainer
Keep selection on the registry ID through context, sessions and command
routing so same-name resources cannot cross provider boundaries.
Retain native executor coordinates, legacy inputs that resolve uniquely,
policy redaction and paid execution modes.
Refs #2681
Use the current Check details label when opening the produced first run, after navigating Activity and History. The runtime being exercised is unchanged.
Contract-Neutral: Corrects a test-only locator to the existing rendered heading; no runtime or contract delta.
Change-source: pulse-maintainer
The containing install-metadata gate requires the existing companion-release disclosure. Retain it alongside, not instead of, the approved retirement notice; do not relax the gate or change the served runtime. Preserve the failed first proof and verify the final notes and actual producer.
Contract-Neutral: Notes-only compatibility disclosure and its assertion; no runtime, protocol, release identity, asset, maturity, latest pointer or cadence change.
Change-source: pulse-maintainer
Exercise the public router, persisted settings, streaming readiness evaluator and Watch-only tool execution from the production desktop and touch UI. Use a credential-free local Ollama protocol double, with a rejected context control and an actual persisted run opened through Activity and History.
Contract-Neutral: Test-only journey fixtures verify the existing Patrol setup, provider transport, settings ownership and read-only first-run contract; no runtime, route, model policy, feature gate, notification or collector behaviour changes.
Change-source: pulse-maintainer
Use the stable-based source comparison rather than a contradictory immutable changelog introduction. Preserve the reviewed bounded monitoring outcomes and the explicit guest-safety limitation, and include the approved Mobile retirement notice in the existing beta correction. Regression assertions bind the exact notice and comparison without changing release identity, assets or cadence.
Contract-Neutral: Published-note maintenance and its regression assertions only; no runtime, protocol, release identity, assets, maturity, latest pointer or cadence change.
Change-source: pulse-maintainer
Governance now reports explicit completion, residuals, evidence and
ownership availability. It no longer computes lane grades, completion
percentages or weighted candidate priority. Release qualification,
security assertions and lease boundaries stay enforced.
The frontend contract also drops obsolete Discovery surface catalogs and
preserves the live Assistant handoff and execution contracts.
Validation: 93 focused Python tests, repository-control Go tests, and
control-plane, status, registry and contract audits. Full delivery hooks
passed, including 164 helper tests and frontend audits after integration
with current main.
System names and versions must be readable by touch and keyboard without relying on a hover title. Denied package-update queries need the existing read-only explanation and a link to the installed troubleshooting section, not GitHub main.
Preserve rcourtman's node-update and shared-help source from cbec132640, including its contract and controls, and our wrapping/local-doc repair. The rejected unshared candidate imported that contributor committer; recreate it on the assigned base through the normal maintainer source route, without changing the imported object or anyone's identity.
All non-receipt runtime, tests, configuration, dependencies, scripts and contract bytes match the previously verified 9b359836 source. The cumulative browser receipt binds its original 22 checks and six actual captures to the unchanged final content and this own parent. Source-jmqvgzzm's prefix and failed driver, source-z1w_7ijm's complete suite/build, and their original SHA bindings remain explicit; no test or browser execution is replayed or invented.
Refs: #1802
Contract-Neutral: Only the guest System wrapping has no performance/API/policy contract delta. The cumulative denied-update/shared-help changes include their substantive frontend-primitives contract and registered controls; trust, access grants, freshness and entitlements remain unchanged.
Change-source: pulse-maintainer
The first beta's release page listed no changes, and the full changelog
file is neither attached to nor linked from any release page, so a
reader could not look up a change the summary did not name. This adds a
pointer, advisory and additive. It is stage 1 of a larger design;
enforcement and a row-level inventory are deliberately deferred.
The renderer appends a `## Source comparison` section after Roll back: a
link to GitHub's comparison of the release tag with the stable rollback
target the workflow already passes (`--rollback-target`,
`--candidate-tag`). It is a pointer, not a list. GitHub shows at most
250 commits in a comparison and this beta had 328 changes, so the
section says larger comparisons may omit commits and is not called a
full list.
It never fails a release on its own. The helper renders nothing, and
raises nothing, for a missing or malformed tag, a base that is not a
lower stable release, a trailing newline, non-ASCII digits, or numbers
too large to convert. Bodies without the section, including every
earlier release and any frozen in-flight one, keep validating, because
the validator already permits a trailing section and is unchanged. The
post-update changelog dialog reads only recognised category headings, so
a separate heading after Roll back is ignored by it.
Review findings, all addressed: a crash on a 5000-digit tag (bounded
ASCII digits now), a final newline that would land inside the URL
(`fullmatch`), overclaiming contract text, and a spacing assertion that
accepted an extra blank line. A `tags/` prefix was suggested to avoid a
branch that shares a tag's name, but GitHub's web comparison URL
returned 404 for it on existing tags (checked against v6.5.0 and
v6.6.0-beta.2, with a nonexistent tag as a control), so bare refs are
used and the limit is recorded in the contract.
Checked on pulse-dev: 54 renderer tests (10 new, running the real
renderer on the v6.5.0 notes), 71 release policy tests, 19 preflight
tests, and the Go installer tests that pin the release workflow and
renderer. The new tests fail against the original renderer and against
the first draft of this change.
Not done here, on purpose: a required section, and a generated,
validated row-level inventory. Both need a declarative contract record
in the preparation snapshot, because a body marker can be deleted to
restore legacy acceptance and a frozen in-flight release keeps its own
renderer. Not verified: the frontend extraction of the what's-new dialog
was read, not run.
The first beta's page listed no changes, and the full changelog file is
neither attached to nor linked from any release page, so a reader could
not look up a change the summary did not name. Add a pointer, advisory
and additive.
The renderer appends a "## Source comparison" section after Roll back: a
link to GitHub's comparison of the release tag with the stable rollback
target the workflow already passes (--rollback-target and --candidate-tag).
It is a pointer, not a list. GitHub shows at most 250 commits in a
comparison and this beta had 328 changes, so the section says larger
comparisons may omit commits and is not called a full list.
It never fails a release on its own. The helper renders nothing, and
raises nothing, for a missing or malformed tag, a base that is not a
lower stable release, a trailing newline, non-ASCII digits, or numbers
too large to convert. Bodies without the section, including every
earlier release and any frozen in-flight one, keep validating, because
the validator already permits a trailing section and is unchanged. The
post-update changelog dialog reads only recognised category headings, so
a separate heading after Roll back is ignored by it.
Every consumer of the rendered body was audited (the renderer's
validators, create-release, validate-release-assets,
recover-release-activation, the updater backend, the what's-new model and
the Go and TypeScript tests): no regression. Review of the first draft
found a crash on a 5000-digit tag, a newline that would land inside the
URL, and overclaiming contract text; all fixed and pinned by tests that
fail against the first draft. A tags/ prefix would avoid a branch that
shares a tag's name, but GitHub's web comparison URL returned 404 for it
on existing tags, so bare refs are used and the limit is recorded.
Tests run the real renderer on the v6.5.0 notes: placement after Roll
back, exact spacing, numeric ordering, ten edit and annotation cycles
with CRLF and the extra jq newline, expected-body rejection of a changed
or deleted section, and absence still validating. They fail against the
original renderer. Making the section required, and a generated
row-level inventory that proves completeness, need a declarative contract
record in the preparation snapshot and are deliberately deferred; the
contract explains why.
Contract-Neutral: Adds an advisory link to rendered release pages; no published artifact, tag, signing, install or customer contract changes.
Preserve current Patrol setup and provider connection behavior alongside
the explicit governance completion and evidence contract. Inherited
application states retain their qualified main content.
Preserve exact Core candidate bd0220d6be and the starting canonical frontier. Ended callers no longer create unstarted OS-command failures; genuine started outcomes and existing suppression remain intact. Retained source/build and consuming-surface proof support the bounded repair; native thaw and restart recovery remain separate.
Change-source: pulse-maintainer
Retain every reviewed starting commit and the refreshed exact published workload identity source additively. PR2888 remains unchanged pending its completed qualification defects; this unproposed composition requires exact final-source checks before the later publication batch.
Change-source: pulse-maintainer
A Proxmox node move changed the workload row key, reset an open drawer’s
History view and could publish new coordinates before saved guest
metadata migrated. Rows now use the stable unified resource ID,
bookmarks resolve through the registry, and the selected resource owns
its drawer tab and History range across regrouping.
Accepted publication migrates metadata before exposing the new node. A
failed write retains operator fields in memory and the last successful
disk snapshot, with recovery through the existing writer. Native
metadata and History coordinates remain separate from row identity.
Backend metrics targets take precedence over the legacy native fallback.
Route focus owns initial positioning. Viewport initialization measures
the selected row without replacing its reveal window. Local row clicks
retain their scroll position, while later scroll and resize events
follow the viewport. Operator policy, Assistant, all four Patrol modes
and paid entitlements are preserved.
The proof registry owns the focused publication and writer tests. Its
guard verifies acceptance and rejection without duplicating the catalog.
Canonical and browser guards share exact Git inheritance reads, so
updating a branch retains parent qualification for unchanged content.
New resolutions and mode changes still need current proof, and range
checks qualify the complete proposed change.
Validation:
- Regression controls reproduce publication ordering and persistence
failures. Targeted backend and race tests pass.
- Final repair checks pass: 476 tests across 15 frontend files,
type-check, production frontend build and embedded build.
- Current-source browser checks on /proxmox/overview at 1280x800,
900x800 and 390x844 cover VM and LXC, canonical and legacy links, node
regrouping, native and explicit History targets, saved links, reload,
keyboard selection, Collapse, Escape and search reselection.
- Additional desktop and phone checks cover operator policy persistence,
metadata write failure, delayed lookup cancellation and refused
references. The final browser matrix passes 196 checks.
- Merge-qualification regression reproduces inherited additions, renames
and deletions being misclassified. All 216 focused guard tests pass,
including retained mode changes, new resolutions and ordinary commits.
Browser node movement uses controlled resource updates. Publication and
metadata ordering are verified independently with filesystem barriers
and failure injection.
Refs #1669
The script-smoke fixture includes the shared repository I/O dependency.
All 23 prepush fixture tests pass.
Preserve the starting reviewed e5c1f39636 and current published Patrol setup/provider guidance additively. Existing PR2888 remains unchanged while its completed qualification defects return to their owner.
Change-source: pulse-maintainer
When Pulse cannot reach the saved provider (wrong Ollama URL, server
down, network fault), readiness reports `provider_connection`. The
Patrol setup card offered **Check Patrol model**, with a hint that
provider connectivity can be healthy. That's a dead end, because the
model check cannot fix an unreachable provider.
The card now sends the operator to **Provider & Models**, where the URL
and the provider test live, with the subtitle "Pulse cannot reach your
AI provider. Check its address and status on Provider & Models." It
deliberately does not open the setup panel added in #2887: a passing
network blip must not ask a cloud user to re-enter a key that works.
**Verification**
- **Tests:** types, lint and related tests pass. Three files timed out
on pulse-dev at load average 27 and passed when rerun on their own (295
tests).
- **Browser:** checked against a private Pro stack with a saved Ollama
URL that has nothing listening, at 1280px and 375px (receipt
`1968a550db2b2cdf`).
The complete installer suite exposed a stale assertion requiring a beta.1 comparison after the reviewed changelog correctly named its actual v6.5.0 base. Keep the existing packet, signing, installer, rollback and compatibility checks, and require both the truthful stable-based introduction and matching changelog heading.
Contract-Neutral: Test-only correction for the unchanged, already-recorded beta.2 changelog range; no release or runtime contract changes.
Change-source: pulse-maintainer
Numeric lane grades and weighted candidate rankings duplicate model
judgment without adding a qualification invariant. Keep explicit completion,
residuals, evidence, assertions and ownership availability as the current
state contract. Remove duplicated prose catalogs and stale retired-surface
obligations while retaining their canonical owners.
The browser gate now uses the shared repository I/O module. Exercise its
real dependency in the prepush fixture so smoke tests reach qualification
checks instead of failing during import.
Contract-Neutral: Test fixture dependency only, no application or contract behavior changes.
When Pulse cannot reach the saved provider (a wrong Ollama URL, a server
that is down, a network fault), readiness reports provider_connection
and the Patrol setup card offered "Check Patrol model", with a hint that
provider connectivity can be healthy. The model check cannot fix an
unreachable provider. The card now sends the operator to Provider &
Models, where the URL and the provider test live, with a subtitle that
says Pulse cannot reach the provider. It does not open the setup panel,
because a passing network blip must not ask a cloud user for a key that
works.
An exhausted caller context can reach metadata enrichment after its network read completes. Invoking the OS callback with that ended budget records a failure even though no OS command started; repeated polls then permanently suppress OS discovery. Refuse callbacks once their caller budget has ended and retain explicit unstarted evidence, without reclassifying any started command outcome. Exercise both HTTP clients, ordinary collectors, expired and cancelled contexts, cold and retained identity, real rejection suppression and independent readings.
Contract-Neutral: Preserve existing guest read/publication, backoff and OS-command suppression contracts; distinguish an unstarted local callback without changing wire, lock, uncertainty, TLS or retention policy.
Change-source: pulse-maintainer
Ignore HTML comment delimiters inside the fenced and indented code already excluded from issue declarations. An unfinished copied response must not erase the actual failing-version, feedback or additional-topic fields that follow it. Keep genuine hidden comments hidden, preserve community labels and verify the existing GitHub label consumer without posting or closing reports.
Contract-Neutral: Restore existing visible-declaration intake semantics only; no Pulse runtime, public API, workflow identity, contact, disposition or release-policy delta.
Change-source: pulse-maintainer
Bind removal guidance to checked NAS quiescence and boot retirement instead of retired installation markers. Model DSM hard-link semantics through real exclusive link syscalls so macOS contract jobs no longer depend on GNU ln, retaining raced-directory adverse controls and every existing manager/recovery assertion.
Contract-Neutral: Tests only; production removal, documentation and teardown contracts are unchanged.
Change-source: pulse-maintainer
18 of 60 paid installs on the current telemetry schema have no AI
provider. Getting Patrol running took three pages:
1. Turn on Pulse Intelligence and pick one of 14 providers.
2. Paste a key and choose a model from a raw list.
3. Find Check Patrol model on another page.
**What changes**
- **Where it appears:** when Patrol is blocked because no provider is
connected, Pulse Intelligence is off, or the provider refused the saved
key (`provider_auth`), the Patrol page's setup card now sets up a
provider in place.
- **Routes:** a cloud API key (Anthropic, OpenAI, Gemini, DeepSeek,
OpenRouter) or Ollama. Subscription CLIs, custom endpoints and other
providers stay on Provider & Models, which the panel links to.
- **Before saving:** the panel names the model Pulse will use, taken
from the Patrol model guidance table, and prices it with the existing
cost preview. A per-token model on the untouched 6-hour default gets the
same slower schedule Patrol settings would propose.
- **Connect:** saves the key or URL, then runs the existing provider
test. Only a `provider_*` cause stops setup, because the test probes the
provider's default model.
- **Model choice:** picks the guided model from the provider's own list
(undated alias first, never a caution model) and saves it as the Patrol
model. It's saved as the shared model only when there isn't one.
- **Check:** runs the Patrol model check, shows its verdict and offers
the first run.
- **Stays on screen:** once started, the panel stays mounted through
polling, which flips the readiness cause mid-setup.
- **Refused keys:** `provider_auth` now routes the setup action to
Provider & Models instead of the model check, which could not fix it.
No backend change: the panel only uses existing endpoints.
**Verification**
- **Frontend checks:** types, lint and related tests pass on Node 24 (46
files, 1608 tests). New proofs are `patrolSetupModel.test.ts` and
`PatrolSetupPanel.render.test.tsx`, both registered for the patrol page
policy.
- **Browser, private stack:** Vite on this branch against a private Pro
stack, plus a local fake Ollama, at 1280px and 375px (receipt
`f9b9b8c51cc0bbd9`). Covered:
- Ollama unreachable, model not pulled, and model present: the real
model check ran and failed because the fake model makes no tool calls;
- an invalid Anthropic test key;
- reload with the refused key;
- the verdict staying on screen through polling;
- phone layout.
- **Not exercised end to end:** a passing check and a real first Patrol
run. The pass response was stubbed in the page.
Bind the combined drawer model and state to a current-source browser matrix
covering canonical and legacy selection, History, saved metadata, node moves
and lookup refusal on desktop, intermediate and phone viewports.
Refs #1669
Preserve both exact reviewed commits and their source-bound browser receipt. Retain the original full-suite timeout and bounded comparison/build evidence; this integration does not establish installed guest recovery.
Change-source: pulse-maintainer
Keep the current clock and stored-History readout alongside canonical row
selection and resource-owned drawer state.
Use one Git inheritance reader for browser and canonical qualification.
Inherited modes and objects keep their parent proof, while new resolutions
and mode changes remain subject to current contract and proof requirements.
Range checks still qualify the complete proposed change.
Refs #1669
pulse-triage[bot]