The setup panel brought the AI settings client, provider configs and cost
helpers into the Patrol page chunk, which pushed AIIntelligence to
73.42 kB gzip against its 70.86 kB budget. Only an install that cannot
run Patrol needs that code, so the workspace now loads the panel
lazily and passes the readiness provider in, and the panel resolves its
starting provider itself. AIIntelligence is 70.38 kB (main 69.89 kB).
The legacy History fallback read a canonical row ID as a native metric key.
Use the shared provider key independently, with backend targets taking
priority. Keep topology and duplicate-resource proofs on canonical row IDs.
Route selection owns initial positioning. Measure selected-row geometry
without replacing its reveal window, then let real scroll and resize events
follow the viewport. Local row clicks keep their existing scroll position.
Refs #1669
A connection label can contain the metadata-key delimiter. Retiring site must not cancel reads or erase OS-command suppression, backoff and diagnostic origins for site|other. Read metadata ownership from its fixed suffixes and use each diagnostic record's exact Instance. Exercise cached, in-flight and ordinary HTTP collector paths with unrelated labels.
Contract-Neutral: Preserve existing connection-isolated retirement; internal cache ownership only, with no public wire, endpoint, TTL, guest-command completion, backup-lock or TLS policy delta.
Change-source: pulse-maintainer
18 of 60 paid installs on the current telemetry schema have no AI
provider. Getting Patrol running meant three pages: turn on Pulse
Intelligence, pick one of 14 providers and paste a key, choose a model
from a raw list, then find Check Patrol model on another page.
When Patrol is blocked because no provider is connected, Pulse
Intelligence is off, or the provider refused the saved key, the setup
card now connects a provider in place. It covers a cloud API key
(Anthropic, OpenAI, Gemini, DeepSeek, OpenRouter) or Ollama, names the
model Pulse will use from the Patrol guidance table, prices it before
anything is saved, then saves it, runs the provider test and the Patrol
model check, and offers the first run. A per-token model on the
untouched 6-hour schedule gets the same slower schedule Patrol settings
would propose. Everything else stays on Provider & Models.
The panel stays mounted once started, because polling flips the
readiness cause mid-setup and would otherwise remove the verdict. A
refused key (provider_auth) now routes to Provider & Models instead of
the model check, which could not fix it.
Do not imply that this beta contains the later SCALE, Unraid or QNAP boot-ownership repairs. Its systemd, OpenRC and SysV source fences remain distinct from native and whole-issue removal acceptance.
Contract-Neutral: Customer note scope correction only; no runtime, tag, version, assets, release maturity, latest identity or cadence change.
Change-source: pulse-maintainer
Hide the permanent History sliders for fine-pointer mouse use. Native
controls stay in the tab order and appear on keyboard focus. Touch
retains 44-pixel inputs, including when a touchscreen laptop switches
between touch and mouse.
Verified the expanded guest History view at 1600×1000, 1024×900 and
390×844 with the running development backend. Chromium, Firefox and
WebKit checks cover native keys, touch, hybrid input, sparse or empty
history and failed refreshes. The frontend type-check, scoped lint and
formatting checks, 24 History tests, and governance and browser-evidence
guards passed.
The retained browser result measures 42px phone rows, not the transcribed 37px. Correct only that evidence account and bind the corrected receipt to this own parent; runtime, tests, manifests and preview bytes are unchanged. No browser run or source suite is replayed.
Change-source: pulse-maintainer
Mouse users can inspect points directly on the chart. Keep the native
range controls in the tab order and reveal them on focus or touch,
including hybrid devices. Returning to a mouse clears unfocused touch
selection without replacing a focused keyboard selection.
Browser checks cover native inspection at desktop, phone and tablet
widths in Chromium, Firefox and WebKit.
Contract-Neutral: Input-modality presentation and pointer handoff only. The labelled native range controls, keyboard and touch stepping, exact stored timestamps, timestamp retention and source isolation remain intact, verified by existing History tests and fresh browser proof.
Expose the existing qualified disk and memory cues through the shared read-only dialog. Preserve safe source/time copy, canonical row ownership and compact table geometry; opening evidence does not refresh or run diagnostics. Cover source replacement, current-reading withdrawal, focus and row-action boundaries, with bound desktop and touch-phone browser proof.
Change-source: pulse-maintainer
Preserve the complete reviewed maintenance tip and current published Pro Patrol default. Retain both independent agent-lifecycle contract additions when resolving their shared insertion point; no runtime change is introduced by the resolution.
Change-source: pulse-maintainer
Pro sells Patrol investigation, but every install starts in Watch only
and stays there unless the operator finds the mode control. In the paid
telemetry read on 12 October, 20 of 35 Pro installs with Patrol on ran
Watch only, and none of those 20 ran an investigation in 30 days.
**What changes**
- A Pro install that never saved a Patrol mode now runs **Ask first**.
Patrol investigates new and re-detected warning and critical findings
and proposes a fix. Nothing changes without approval.
- The default needs a positive licence answer
(`Service.PatrolInvestigationLicensed`). A missing licence checker
counts as unlicensed. Free installs and explicit choices are unchanged.
- `GET /api/ai/patrol/autonomy` adds `default_mode_applied`.
- The Patrol header shows a one-time notice that names the cost: the
operator's AI provider and 30-day budget. It has two actions, **Keep Ask
first** and **Switch to Watch only**, and either one saves the choice.
The notice never renders on a plan-locked install.
- While Patrol cannot run yet, the header reads "Patrol is not running
yet" instead of "Watching your infrastructure".
**Verification**
- Go: `internal/config`, `internal/ai` and `pkg/server` pass in full.
`internal/api` passes in full except
`TestServerInfoEndpointReportsDevelopment`, which failed only because
that tree had no `.git`; it passes in the real clone. The new proofs are
`service_patrol_default_test.go`, `ai_config_test.go` and
`patrol_autopilot_test.go`.
- Frontend: types, lint and related tests pass. Four related files timed
out under load and all passed when rerun on their own.
- Browser: I checked a private Pro stack at 1280px and 375px (receipt
`855a760ea737cd57`). Covered: the notice, both save actions, the free
plan-locked state and the not-running header.
Treat only an observed HTTP 429 as a temporary request refusal, preserving metadata backoff and real command-safety suppression. Cover ordinary clients and collectors, stale identity, Windows recovery and quoted-status negative controls.
Change-source: pulse-maintainer
Contract-Neutral: Existing OS-command suppression classification only; no public wire shape, capability, deadline, retention or guest-command safety delta.
Replace generic fallback notes with source-bound customer changes, preserve signed installer and rollback advice, and correct the canonical cumulative changelog range. Cover meaningful notes, source range and safe rendering with regression checks. This is a notes-only candidate, not a live release edit.
Contract-Neutral: Customer notes, changelog introduction and note-content regression tests only; no runtime, source tag, version, asset, maturity, latest-release or release-cadence change.
Change-source: pulse-maintainer
Accept all six exact Delivery commits with complete installer and NAS caller proof. Boot activation and watchdog closure now precede recovery erasure; native Linux, PowerShell and appliance acceptance remain separate.
Change-source: pulse-maintainer
Preserve the own-parent browser receipt and exact Web candidate. Existing Workloads disclosures and drawer identify the same UTC instant without extra polling.
Change-source: pulse-maintainer
Accept the exact Core candidate and retained HTTP, race and consuming proof. Legacy grants, history limits and subscriber terms remain unchanged.
Change-source: pulse-maintainer
Preserve reviewed local History help and the published backup safety range without rewriting either history. Source reconciliation is bounded to the frontier observed at batch start.
Change-source: pulse-maintainer
Pro sells Patrol investigation, but every install starts in Watch only
and stays there unless the operator finds the mode control. In the paid
telemetry read on 12 October, 20 of 35 Pro installs with Patrol on ran
Watch only, and none of those 20 ran an investigation in 30 days, so
the feature they paid for never ran.
An install that never saved a Patrol mode now runs Ask first when it
holds a positive investigation licence. Patrol investigates new and
re-detected warning and critical findings and proposes a fix; nothing
changes without approval. The default only applies to a positive
licence answer: a missing licence checker counts as unlicensed, so a
startup window cannot spend provider budget on a free install. Free
installs and explicit choices are unchanged.
The Patrol header says so once, with the cost (the operator's AI
provider and 30-day budget) and two actions that save Ask first or
Watch only. The notice never renders on a plan-locked install. The
header also stops claiming "Watching your infrastructure" while Patrol
cannot run yet and reads "Patrol is not running yet" instead.
## What changed
- Open guest drawers now age completed-backup evidence on the shared
passive clock without another API poll. Elapsed age and saved-policy
tone stay current, and the UTC completion time wraps without clipping.
Running activity, absent evidence and invalid times remain distinct from
completed backups.
- Concurrent Proxmox password-authenticated polling now shares one
session renewal and publishes ticket, CSRF and expiry as a locked
snapshot. Late 401 responses cannot renew an already-replaced session;
caller cancellation, token/TLS policy and guest-command no-replay
controls are preserved.
- TrueNAS SCALE uninstall now disables and independently verifies every
exact owned middleware boot task before stopping services or removing
the server record. Task, unit, collector and bootstrap closure precedes
credential/state erasure; missing targets, refused observations and
concurrent activation retain recovery without automatically restarting.
The drawer and session changes repair reproduced existing monitoring
behavior. The SCALE change addresses unsafe removal ordering within the
remaining installed-removal work.
Related to #1099
Native Linux/PowerShell removal, trusted transport and cleanup
acceptance remain unfinished. This source safety step makes no
whole-issue closure claim.
## Included source
Complete unpublished reviewed range, composed against current upstream:
`064458a7410a0837315fe0feae3644f2207b1d47..5693100d92cf5ca6ef5e74983f7b22d1cdb71c4f`.
- Web candidate `174a32ca3d7aaa89e1f1b7718543b1f79342bbce`, with
test-only corrections `40c8f64fe763bec50514a9ec198f4d4cdd1dae4a` and
`9cde497ff3e8c8469a7bad16ca52a92df4310d96`.
- Core candidate `97e4c8eac7caa9c6f6634ac27667ede337645530`.
- Delivery candidates `59ff0dabcf84d354cf8a8367626e6f1eec6395d8` and
`3f63e2021638b2466a2ce7a1318698ac91fb0ea0`.
- Accepted integration merges `1eb1020b4b`, `875daf24ae` and starting
reviewed tip `60bd0ffc62` are preserved. Additive merge `5693100d92`
incorporates upstream star-prompt timing PR #2881; no reviewed commit
was rewritten.
## Validation and remaining limits
- Retained Core proof `source-6i2mdv7d`: full Proxmox race suite,
vet/build, cancellation/failure/token/no-replay controls and the actual
eight-node poller/read projection. Parent control demonstrated races and
16 renewals for 16 stale reads; candidate shares one renewal.
- Retained Delivery proof `source-49h1su1c`: all 16 mandatory SCALE
caller controls and full installer package with Go1.26.9, 526 passes/16
explicit skips, complete hash-bound output and stopped guest.
- Retained Web proof: connected controls, 32 desktop/phone checks, six
natively inspected final captures and 115 matching production hashes.
Earlier fixture errors were corrected; the old readiness-failed
full-suite attempt remains incomplete, not a pass.
- Final composed-source proof `source-d_xpkdb9` at
`5693100d92cf5ca6ef5e74983f7b22d1cdb71c4f`: offline dependency install,
full type-check/lint, focused drawer tests, production/embed build and
bundle budgets all pass; client/guest exit 0, complete output and
confirmed guest stop. Readiness recovered within the same attempt;
earlier readiness failures remain recorded. No full-current-suite pass
is claimed.
- Publication provenance, whitespace, contract audit and final
browser-receipt range guard pass. Unchanged Core/installer source and
tests are byte-identical at the final merge, so sufficient proofs were
not repeated.
Exact-head hosted checks remain required before landing. Source/browser
controls are not installed thaw, workload liveness/restoration, QGA
restart/every-volume recovery, native appliance removal, memory-baseline
relief or release readiness. Those original obligations remain with
their owners; no release or deployment is performed by this proposal.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Rebind its old next-platform sentinel and include the production NAS selector. The fixture otherwise reaches unrelated runtime cleanup and correctly refuses a non-fixture path. Keep that filesystem guard and every existing DSM safety assertion unchanged.
Change-source: pulse-maintainer
Preserve the exact reviewed c036461d and 594f5025 history. Retained source and production Docs desktop/narrow proof covers the unchanged guides; no monitoring, licence or release behaviour changes.
Change-source: pulse-maintainer
Require the actual NAS quiescence/retirement caller rather than the removed best-effort autorun cleanup. Preserve Upstart exclusion from SysV while requiring the NAS exclusion too. No manager or process safety control is removed.
Change-source: pulse-maintainer
The closed signal and server doubles record the current boot/process state without changing outcomes. Require exact boot absence before both signals and complete quiescence at the server boundary, so a future ordering regression cannot pass on final state alone.
Change-source: pulse-maintainer
Omit mobile connection and push offers, and advertise only current Pro history. Same-path HTTP controls preserve signed grants, public/private runtime fences and 7/14/90-day compatibility without changing subscriber terms.
Change-source: pulse-maintainer
A go shell can hold later launches in memory after its boot file changes. Treat that live mixed-purpose owner as unknown rather than signalling it or inferring quiescence from the edited file. Require the actual-caller refusal control alongside the existing NAS suite.
Change-source: pulse-maintainer
The renderer heredoc contains nested shell functions. Extract through its own EOF and outer closing brace so the real private process control executes the complete producer; retain renderer diagnostics on failure.
Change-source: pulse-maintainer
Use shared UTC completion formatting for table disclosures and guest drawers so local browser timezones cannot silently change the displayed instant or day. Keep running, unknown, absent and future evidence separate, and format table completion times only while disclosed. Record connected timestamp, keyboard/touch and non-UTC desktop/phone pixel proof without changing collection or guest operations.
Change-source: pulse-maintainer
Retire only exact Unraid and QNAP boot entries before checked watchdog-first process termination and same-instance server removal. Preserve unrelated boot owners and refuse unknown, partial or concurrent state without erasing credentials or restarting. Exercise the complete uninstall caller and generated private watchdogs.
Change-source: pulse-maintainer
The GitHub star prompt now appears on the first return on a later day
with connected infrastructure, rather than after fourteen active days.
It stays compact, appears once, and supports permanent dismissal.
The banner follows the published bottom navigation height at every
viewport so it does not cover navigation on intermediate widths. Opening
a blocking dialog suppresses it for the rest of the session.
Validation: 121 banner and shared primitive tests, full frontend
type-check and formatting. Playwright exercised `/proxmox/overview` at
1440×900, 800×900 and 390×844, including first-day and returning visits,
dismissal and reload, the GitHub action, keyboard focus, dialog priority
and empty/loading/error fixtures.
Retain the executed production Docs consumer, final guide and source hashes, keyboard fragment navigation, eight native capture inspections and browser/server cleanup on the containing source. The prior History help bytes and successful source tests are unchanged; this completes the missing browser acceptance without repeating native recovery or release proof.
Contract-Neutral: Verification receipt only for existing help; no runtime, guide, collector, permission or product route changes.
Change-source: pulse-maintainer
Use unified resource IDs for workload rows and selection so moving a guest
between Proxmox nodes retains its open drawer and History range. Resolve
existing bookmarks through the registry instead of rebuilding client IDs.
Migrate guest metadata before accepted inventory publication and retain its
operator fields in memory if persistence fails. Native metadata and metrics
coordinates remain explicit compatibility inputs. Operator policy and paid
execution behavior remain intact.
Register the focused publication and writer proofs once. Check proof
acceptance and rejection without copying the registry catalog into tests.
Refs #1669
Returning users should not need fourteen days of use before they can
support the project. Offer the existing compact prompt on the second
connected day and retain permanent dismissal and notice priority.
Use the published mobile navigation height at every width so the prompt
does not cover navigation on intermediate screens.
Validation: 121 banner and shared primitive tests, frontend type-check,
and Playwright on /proxmox/overview at 1440px, 800px and 390px.
Preserve the exact Web candidate and its own-parent browser receipt. Retained connected controls, final focused checks and desktop/phone pixel proof cover the bounded presentation delta; the readiness-failed full-suite attempt remains incomplete.
Change-source: pulse-maintainer
## What changed and why
- DSM agent removal now confirms stopped processes, disabled automatic
activation and retirement of the Upstart job before erasing recovery
state. Atomic no-clobber restoration protects concurrent configuration.
This advances the safe-removal work reported in #1099.
- Proxmox guest polls skip disk-inventory copies for unrelated or
offline host agents while preserving linked-host evidence and guest
selection. This removes unnecessary allocation from repeated polling; it
does not establish installed memory relief.
- PBS help distinguishes inventory timestamps, point verification, the
point's Protected flag and workload protection. The comparison uses
existing evidence without replaying jobs, addressing the help gap
exposed by #2864.
- VM/LXC drawer History defaults now show readings from one dated stored
observation, rather than mixing independent latest times or live
fallback. Missing siblings remain explicit dashes; empty panels retain
qualified fallback.
## Included reviewed source
Complete publication range:
`70ae4c7e0eb3d5ce2c7f3c1d7610b97f6eb8e36e..1779434f0253e3e1e6240284ada2cf6c33e37636`.
- Delivery: `a6527d9ae3..da597d34d6`, eight DSM commits, integrated by
`c253560830`.
- Core: `345ed2da6a715dd0e274c97b2817fb091cdfa7e3`, integrated by
`fc5df2a4b0`.
- Help: `3573abbf0e..422fd81c62`, three commits, integrated by
`348d2eca6d`.
- Web: `58d6e6d591..6cf9b197aa`, two commits, integrated by
`0d8ade2b3b`.
- Additive merge `1779434f02` incorporates current upstream Discovery
contract consolidation without rewriting any reviewed commit.
## Validation and limits
- Retained DSM proof `source-p77gpfj5`: 15 production-function/EXIT
controls and complete installer package on Go 1.26.9, with 524 passes
and 16 explicit native/resource skips; complete output and guest stop
retained.
- Retained Web proof `source-8gfraepz`: types, lint, 308 connected
tests, production/embed build and budgets; 48 desktop/phone browser
checks, six inspected captures and 254 matching production hashes.
Earlier full frontend evidence retained five old-default assertion
failures; the reviewed test follow-up corrects those controls, not a
claim of a full final-suite pass.
- Retained help evidence: recipe/entrypoint/link/mirror controls, 36
frontend tests and types, exact Docs consumption and inspected
desktop/phone pixels.
- Publication provenance, whitespace, per-commit canonical completion
history/guards and final-range browser verification pass. Exact-byte
comparisons preserve all candidate code/tests after the document-only
upstream merge. Public documentation (247 Markdown files) and shipped
mirrors (62 files) pass at the composed source.
- Supplementary VM checks remained queued for capacity, with no terminal
receipt available; they are not passing evidence. The retained candidate
proofs and final-source byte/guard checks are the validation used. No
browser or build replay was needed.
Native DSM/Windows removal, workload thaw/restoration, QGA
restart/OS/every-volume recovery, installed memory relief and the actual
PBS discrepancy remain separate unfinished outcomes. Source publication
is not released or installed acceptance. Exact-head hosted checks and
required review remain necessary before landing.
Related to #1099
Related to #2864
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Publish ticket, CSRF and expiry as one locked snapshot, and bind expiry/401 renewal to the rejected session generation. Concurrent readers share one authentication attempt while retaining their own cancellation and ordinary single-retry behaviour. Keep guest commands single-attempt and token/TLS policy unchanged.
Contract-Neutral: Synchronise existing Proxmox password-session renewal without changing API fields, TLS policy or guest-command admission and replay rules.
Change-source: pulse-maintainer
The development protocol required blanket contract and proof-artifact
diffs for runtime edits without explaining the existing contract-neutral
declaration used by local hooks and CI. That encouraged validation
receipts and repeated boundary rules to accumulate in current contracts.
Put current responsibilities and invariants at their contract owner,
replace superseded text, and keep task evidence in existing proof
artifacts or delivery history. Document the established explicit
declaration and its limits, with the README and source-of-truth pointing
to the protocol. Runtime behavior and all existing checks and gates are
unchanged.
Validation: the scoped commit runs the staged governance audits and
existing guard regression suites.
A missing SCRIPT path or empty COMMAND target cannot establish that a task is unrelated or absent. Retain recovery before any task or service mutation when those fields are unavailable. Add three actual-caller adverse controls to the mandatory sixteen-method hook and both owning contracts.
Change-source: pulse-maintainer
Supply the required lock and lastSeen fields after committed-source type checking identified the incomplete fixture. Keep both fields fixed so policy-age tests still prove time-only invalidation. Production bytes and browser proof are unchanged.
Change-source: pulse-maintainer
The development protocol described blanket runtime documentation and test
diffs but omitted the existing contract-neutral declaration carried into CI.
That encouraged task receipts and unchanged boundary rules to accumulate in
current contracts.
Document the established declaration and its limits at the protocol owner.
Keep current behavior and invariants in contracts, replace superseded text,
and retain validation evidence in proof artifacts and delivery history.
Point the source-of-truth and entry README to that policy.
The completion guard, browser verification, ownership, security and release
gates remain in effect. No runtime or paid-feature behavior changes.
Disable and independently verify every exact owned middleware activation task before systemd stop and server removal. Close task, unit and process state after the full stop and after task deletion, retaining recovery on refusals or concurrent changes without restarting. Ordinary Linux state directories are not appliance identity. Register all fifteen actual-function/full-caller controls and update both owning contracts in this coherent candidate.
Change-source: pulse-maintainer
Use parsed numeric completion timestamps and non-finite numeric adverse inputs for the typed WorkloadGuest fixture. Preserve the existing policy, clock, completion, activity and absence assertions; production source and its own-parent browser receipt are unchanged.
Change-source: pulse-maintainer
Age the existing completed-backup readout and policy tone on the shared passive clock. Show elapsed age and the validated UTC completion time without clipping; keep activity, absence and invalid times separate. Cover default and custom policy boundaries, clock changes, tab round trips and retained completion with connected controls and desktop/phone browser proof.
Change-source: pulse-maintainer
Denied update queries left users without an explanation while ordinary
monitoring still worked. Add visible guidance through the shared help
contract, preserve the read-only choice, and wrap update evidence on phones.
Keep help open through polling and contain it through resize and scrolling.
Refs #1802
rcourtman