Keep PULSE_TOKEN out of the direct-token flag default. Refuse an unreadable or empty selected file instead of silently borrowing other credentials, while preserving enrolled runtime-token restarts and implicit token-optional startup.
Cover actual flag loading and a synthetic host issuer, private installer-writer, compiled agent and trusted HTTPS lookup/report journey. This repairs an independent source-selection defect; it does not establish the cause or recovery of Discussion #2769.
Change-source: pulse-maintainer
Use the same Compose configuration before and after best-effort evaluation issuance. Preserve two-client unsigned evaluation, signed renewal restarts, explicit invalid-file refusal and the Pulse-hosted licence requirement.
Add real release-daemon restart/readback controls and secret-free hosted Compose acceptance for the actual placeholder and licensed mounts.
Change-source: pulse-maintainer
Incorporate the exact upstream frontier observed during publication while preserving every reviewed local commit. The upstream correction separates attention lifecycle mutation admission from reads and action planning; combined final-source validation remains required.
Change-source: pulse-maintainer
Follows the token scope fixes. POST /api/security/regenerate-token now
needs an instance-wide full-access token from API-token callers and
replaces every stored token; the reference says so and points scoped
tokens at the per-token rotate route. POST /api/resources/{id}/link,
/unlink and /report-merge need monitoring:write.
test_api_reference_routes.py pins each of these to the code that
enforces it, so the reference and the gates cannot drift apart again.
Each pin fails when the code or the reference is reverted.
Contract-Neutral: Customer docs corrected to match shipped behaviour; no runtime, API or contract change.
The API reference marked the Patrol stream, manual run, acknowledge,
snooze, suppress, suppressions and dismissed routes "(Pro)" and promised
a 402 when unlicensed. None of them is licence-gated: Patrol and
managing its findings are free (ai_patrol is a free feature, and the
frontend offers these controls on every plan). Only governed fixes need
Pro. The routes now show the scope they actually require and the
reference says what Community gets, including the one-full-run-per-hour
cap on manual runs.
Also corrects the findings routes: reinvestigate is Pro and needs the
ai_autofix entitlement and a Patrol mode above Watch only, and
reapprove is retired and always answers 410.
scripts/tests/test_api_reference_routes.py gains checks that a Patrol
route documented without a paid label has no licence wrapper in its
registration, and that reapprove is documented as retired. Each fails
when its claim is reverted.
Contract-Neutral: Customer docs corrected to match shipped behaviour; no runtime, API or contract change.
Incorporate the exact upstream head observed during publication without rewriting accepted integrations or the additive safety-help test correction.
Change-source: pulse-maintainer
Audited every HTTP route the server registers against docs/API.md.
Where a documented route and the code disagreed, or an integrator-facing
route was missing, the reference now matches the code.
- Auth and scope labels: notifications, SSO providers, license
activate/clear, security reset-lockout, availability targets, agent
profiles (every method needs settings:write for tokens), relay settings
and the resource metadata routes (no admin requirement).
- Behaviour: POST /api/notifications/test targets one channel per request,
the storage detail route is GET /api/storage/{storageId} (not a list at /api/storage/), token
rename-only updates are accepted, validate-token moved out of the Audit
Log (Pro) section because it has no licence gate, and the setup script
is public.
- Retired routes: /api/ai/remediation/execute and /rollback always answer
410 Gone, as approve already documented.
- Newly documented: GET /api/ai/patrol/runs/{id}, POST
/api/availability-history, POST /api/agents/agent/{id}/allow-reenroll,
PUT /api/truenas/connections/{id} and its /test route.
scripts/tests/test_api_reference_routes.py pins the corrections to the
router so later drift fails a test: every scope named on a route line must
exist in pkg/auth/scopes.go, the newly documented routes must exist in the
router, and the retired routes must say 410. It fails on the previous
reference and passes on this one.
Each doc is mirrored under frontend-modern/public/docs and updated in
both places. Labels where the docs and the code disagree about licence
gating are left alone; that needs a product decision, not a doc edit.
Contract-Neutral: Customer docs corrected to match shipped behaviour; no runtime, API or contract change.
Use the supplied Doctor wording to separate collector privilege, credential scope and runner posture. Preserve both supported command paths and working monitoring; make profile choice deliberate rather than a connection diagnostic.
Contract-Neutral: Documentation and rendered-guide checks only; no command authority, credential issuance, admission, dispatch or recovery contract changes.
Change-source: pulse-maintainer
Accept exact Delivery commits with retained source-z6bm51cn installer, race, vet and real-embed proof. Active forward and restored service acceptance now require stable MainPID and matching process bytes; uncertainty retains the backup without a new restart or rollback grant. Native containing-source follow-through remains separate.
Change-source: pulse-maintainer
Incorporate the upstream frontier recorded at the start of this coordination batch; retain reviewed local history and independent proof bindings.
Change-source: pulse-maintainer
Audited the customer-facing docs against the code: about 5,200 concrete
claims (env vars, endpoints, flags, defaults, ports, UI labels), plus every
environment variable the code reads. Each discrepancy was re-verified
against the source before editing, and every edit was reviewed again.
What users would have hit following the old text:
- UI paths and labels that no longer exist (Settings > Relay, Platform
connections, Access Control, SSO Providers, Create Organization) and
Patrol mode names (now Ask first, Safe auto-fix, Autopilot).
- Wrong values and behaviour: LOG_MAX_AGE=0 does not disable cleanup,
Patrol evidence budget is 10 calls and 12 turns, ALLOW_UNPROTECTED_EXPORT
covers private networks too, PULSE_AUDIT_ASYNC defaults on.
- Agent install: install.sh ignores PULSE_ENABLE_KUBERNETES and
PULSE_ENABLE_PROXMOX, rejects --disable-auto-update, and the token
fallback lives in the state directory.
- API: audit endpoints answer 402 on Community, onboarding QR is GET,
type=container is rejected, several routes need admin plus a scope.
- HTTP_REDIRECT_PORT was not documented anywhere.
Docs are mirrored under frontend-modern/public/docs, so each change is
applied to both copies. The tests that pinned the old wording (including
three that asserted claims the code contradicts) are updated alongside.
Contract-Neutral: Customer docs corrected to match shipped behaviour; no runtime, API or contract change.
Use the existing planning error and Agent Doctor authority wording before workload inspection. Keep an earlier sent action and missing receipt unresolved, and route command-capable hosts to connection/admission help without retries or wider grants. Check rendered links, stage ordering and the implementation evidence.
Contract-Neutral: Existing workload-update help and documentation checks only; no action, authentication, command-admission or recovery contract changes.
Change-source: pulse-maintainer
Preserve all reviewed local maintenance commits while incorporating the current published main. Upstream removes unused Assistant handlers; local updater, guest admission and help changes remain additive.
Change-source: pulse-maintainer
An installed target version and active service can conceal an old managed executable. Compare the actual process bytes between complete bounded MainPID observations before accepting an update or restored active service. Retain the backup and current service on uncertainty without an automatic restart or rollback grant. Register real owned-process and conditional transaction controls; keep synthetic/native and customer acceptance distinct.
Change-source: pulse-maintainer
Accept exact Product Intelligence commits de4751f25a and 1761f602f0. Existing disclosure-page maintenance matches standing community policy; final retained doc, renderer, type-check, build and desktop/phone browser proof is adequate. No runtime behaviour or release availability is claimed.
Change-source: pulse-maintainer
pulse_control only plans typed resource actions into Pulse Actions
(executeControlResource -> typedActionPlanner). The handlers that sat
behind the retired model-authored command, file and container paths
stayed in the tree with no production caller: run command, guest
control, app-container control, Docker control and container update,
Kubernetes scale/restart/delete-pod/exec, and file append/write.
registerFileTools was never called either, so pulse_file_edit is not
registered at all; calls to it are denied by the mutation registry
before any tool lookup.
A whole-program reachability run over cmd/... lists each of them as
unreachable, and so is everything only they used: approval-record and
preflight authoring, the command and native-action audit lanes with
their remediation-lock gate and plan-hash helpers, the Docker host
resolvers, and the file write verification. The executor's autonomous
flag, whose only readers were those handlers, goes with them (the
executor's SetAutonomousMode and the flag argument of SetContext).
Delete them with their tests and the constants, types and test helpers
they stranded. The contract prose that described the removed broker now
says that plan freshness and the operator remediation lock are enforced
by internal/actionlifecycle. Two source pins that named deleted code go
(the publishActionCompleted dispatch sites and the pulse_file_edit
declaration), the standards tests drop their expectations of an
ActionPlan construction in action_audit.go and of the legacy app_container
rejection in the deleted file-edit test, and the RA35 evidence entry for
the deleted run-command test goes with them.
Left alone on purpose: the saved autonomous control level and its
entitlement and approval-admission checks, which stay as legacy
compatibility, Service.SetAutonomousMode and the chat clamp,
SetOnActionCompleted and its router wiring (no dispatcher is left, the
contract prose says so), and the protected-guests plumbing.
Rebuilt on current main: the first version had 213 commits of drift.
Two conflicts, both on code this change deletes. tools_control.go takes
the deletion over the Protected guests cleanup that landed inside
executeRunCommand. action_audit_remediation_lock_test.go goes with the
audit lanes, including the test added for the dispatch gate's read
through a succession; that gate is deleted here, and
TestLockMovedBySuccessionStillRefusesTheIDThePreviousGenerationLists in
internal/actionlifecycle covers the same refusal on the live path.
A reporter reply of any kind interrupts the silence condition, and another human's continuing failure after day fourteen must still prevent timeout closure. Make those standing conditions explicit in the public explanation and its renderer/doc checks; do not limit the evidence window to the first fourteen days.
Contract-Neutral: Refines documentation of the existing retest-timeout conditions only; no runtime or wire contract changes.
Change-source: pulse-maintainer
The standing triage-link destination explains source and release availability but omits what a retest-timeout close means. Document every-symptom resolution, the stable-release contact clock and exclusions, and returning to the original issue with safe existing evidence. Keep timeout separate from confirmed recovery, with shipped-mirror and production-renderer coverage.
Contract-Neutral: Documents existing issue resolution and stable retest-timeout policy only; no runtime or wire contract changes.
Change-source: pulse-maintainer
Preserve both exact Product Intelligence commits, the tests-only rendering correction, and parent-bound keyboard/browser proof. Existing documentation content and routes are retained; guidance is not native recovery.
Change-source: pulse-maintainer
Preserve the exact Delivery candidate and its retained normal, race, parent-control and embedded-build evidence. This repairs hidden logger failures, not the reported LXC stop cause.
Change-source: pulse-maintainer
IPv4-mapped IPv6 and literal IPv4 reach the same numeric guest channel. Share only per-VM admission so another spelling cannot bypass an in-flight or uncertain command. Preserve the previous certificate origin identity, URL, proxy and first-use trust behaviour.
Change-source: pulse-maintainer
Preserve the exact Core candidate commits and their retained source proof. Learn OS through existing metadata before optional Linux memory polling while retaining filesystem-first ordering and guest-command safety. Native Pro/PVE restart recovery and containing-release availability remain separate.
Change-source: pulse-maintainer
Put existing symptom and incident guidance ahead of the long troubleshooting recipes. Keep server and workload updates, agent acceptance, unknown readings and disclosure recovery distinct; validate every destination through the shipped Docs renderer.
Contract-Neutral: Existing troubleshooting navigation and link controls only; no runtime or subsystem contract delta.
Change-source: pulse-maintainer
Accept the exact Product intelligence candidate as existing-flow guidance maintenance. Preserve passive collection and uncertainty; guidance does not establish runtime memory recovery.
Change-source: pulse-maintainer
Conditional Bash callers hid a failed logger write behind successful stdout. Attempt both sinks, return the first failed sink, and exercise the unchanged draining collector and recovery path with the real log primitive and confined external logger. Preserve the distinction between observed pipeline completion and native or customer recovery.
Change-source: pulse-maintainer
Keep filesystem collection first, then use ordinary metadata to bootstrap and refresh the existing Windows exclusion. Do not send an inapplicable meminfo command that perpetually fences cold or expired OS discovery. Preserve operation locks, shared-channel and in-flight exclusion, unknown completion, non-replay, evidence ages and independent memory sources. Validate real direct/cluster clients, both collectors, fresh processes, History and Linux/unknown/replacement controls.
Change-source: pulse-maintainer
The latest memory report is about a higher steady baseline, not a leak. Keep steady regressions actionable, separate unlike process ages and CPU savings from RSS recovery, and preserve existing evidence without another restart, downgrade or profile. Keep the shipped guides, optional intake and regression controls aligned.
Contract-Neutral: Clarifies interpretation of existing memory reports and documentation only; no runtime, API, route, collection recipe, label synchronizer or subsystem contract changes.
Change-source: pulse-maintainer
Distinguish cancelled or timed-out probes from certificate faults before classifying error text. Replace verification-bypass advice with endpoint, chain and independently verified fingerprint checks across PVE and PBS diagnostics, including scheduler errors and support JSON.
Exercise real loopback trust refusal and operator-supplied pin recovery without changing stored trust, credentials or scheduler authority.
Contract-Neutral: Restore existing TLS/timeout diagnosis and safe recovery guidance; errorKind/schema, saved trust enforcement/settings, agent lifecycle and scheduler/recovery authority remain unchanged.
Change-source: pulse-maintainer
The source-bound hosted receipt stops before any native phase because its new ephemeral signer is mode 0644. Establish owned regular-file and verified 0600 mode before signing, without adopting existing keys or relaxing OpenSSH. Keep Linux ELF execution in both native Linux jobs; macOS still runs the portable signer/admission/recovery controls, and the bridge requires the exact platform verdict instead of staging Mach-O as Linux.
Change-source: pulse-maintainer
Preserve every reviewed maintenance commit while incorporating the current published Alert History table and its layout controls. Existing PR2817 remains unchanged pending its recorded CI repair; this composition stays local for the next verified batch.
Change-source: pulse-maintainer
Alerts > History is where an operator looks back at what happened, and its
table hid the answer. At a 1024px window the card is 600px wide and the Message
column got about 110px, so rows read "Docker servi…" and "Last reading…". Three
action buttons stacked on three lines made every row 75-105px tall, while
Duration, Status and Actions held wide, mostly empty tracks. The row has no
disclosure of its own, so the only way to read the message was to hover.
- Resource and Message now wrap inside a line-clamp-2 wrapper below an 80rem
card (the wrapper sets whitespace-normal itself, because .table-fixed td
forces nowrap) and return to a one-line clamp from 80rem, where the message
track is wide enough and the old 39px row is kept.
- The four density blocks are re-derived from measured natural widths
("08:27 AM" in a 14px monospace, the Resource/Severity/Duration headers, a
119px "acknowledged" badge, three one-line actions at 177px, Type and Node)
at the narrowest card each density serves. The time column is headed "Time",
as on the phone card, because "Timestamp" needed 93px.
- Message keeps a two-line minimum height. The windowing hook sizes its
spacers from one measured row; scrolling a 600-row history in 60px wheel
steps moved a tracked row exactly the scroll distance with uniform 49px rows
and showed 46 jumps up to 20px once rows were 39px and 49px.
Measured in a real browser against an unpatched build of the same tree, at nine
windows from 1024px to 2000px with a 12-hour locale: messages ending in an
ellipsis fell from 82 of 88 rows to 24 of 90 at 1024px, 54 to 17 at 1280px, 24
to 8 at 1440px and 32 to 4 at 1700px; the median row fell from 75px to 49px
from 1280px to 1700px; no time cell or header ended in an ellipsis at any
width. The phone card list is untouched, and Timeline and Resource open and
close as before. Cards under 600px stay cramped; a container-driven switch to
the card list is the remaining fix.
Proofs: the row test pins the wrapper classes, Alerts.helpers pins the header
and class constants, App.architecture asserts the pixel minimums per density,
the 18% Message floor and that each block sits inside its 50rem, 64rem or
80rem container query. Putting the base row markup, header, widths or 50rem
switch point back fails the matching proof.
Replace the copyable guessed stop/run sequence with mounted-data backup and original-deployment recreation guidance. Quote the pull target as one literal shell argument, retaining manual-only and private-image boundaries. Add real-shell controls and a real handler-path check; no Docker daemon or installed recovery claim.
Change-source: pulse-maintainer
Refuse redirect scheme, host, port and userinfo changes before any redirected request. Preserve same-origin proxy paths, canonical default ports and IPv6 literals, zone identity, the ten-redirect budget and existing CA/pin/explicit-opt-out policy. PVE and PBS password/token/ticket controls reproduce the previous exposure on actual synthetic sockets.
Change-source: pulse-maintainer
Keep explicit URL defaults aligned with the API client and join IPv6 socket addresses correctly. Preserve the legacy bare-host port and credential-free capture without weakening any established pin or verification choice. Cover endpoint parsing, actual IPv4/IPv6 leaves and invalid-authority rejection.
Change-source: pulse-maintainer
Separate a registered Docker reporting token from the scopes needed by the host module. Keep scope rejection distinct from HTTP 401 and identify the token-generation screen before changing credentials or reinstalling.
Contract-Neutral: Documentation and source-alignment controls only; no authentication, token authority, runtime or install contract changes.
Change-source: pulse-maintainer
A normal-host enrolment report supplies lookup and host-report 401s, repeated installs and an absent inventory record. Document one named server-side registration check before touching the affected agent, with separate limits for persistence, credential hand-off and accepted reports.
Contract-Neutral: Existing authentication help and its source-alignment controls only; no runtime, API, scope, route or credential-policy change.
Change-source: pulse-maintainer
Cap server and agent excerpts at 256 KiB before display or request-ID search. Buffer only a bounded owner-only temporary file, preserve reader failures, and apply the hard deadline to the complete read-only pipeline. Exercise exact-size, overflow, stream, privacy, cleanup and closed-pipe deadline controls without accessing a real journal, daemon or service.
Contract-Neutral: Documentation-only passive log recipe bounds and executable copied-recipe tests; no runtime, API, authentication, installer or monitoring contract change.
Change-source: pulse-maintainer
Preserve Core's exact initialization repair and additive corrections. Retained final-source normal/race ownership controls, complete normal API population, genuine embed build and vet support source acceptance; installed behavior and reported baseline relief remain separate.
Change-source: pulse-maintainer
The latest daily advisory watch passes main and fails only retained release branches, then recommends backports that no longer have a delivery route. Keep the complete strict main audit, read-only/cache-free execution and security proof, remove obsolete line discovery and give accurate main repair and containing-release guidance. Add fixed-main recipe, retired-branch refusal and preserved strict-audit controls.
Change-source: pulse-maintainer
Preserve every reviewed commit while incorporating current upstream main additively before exact final-source publication checks.
Change-source: pulse-maintainer
Capture store, tenant and provider selection once across source ownership, records and consume-once changes. Keep provider callbacks outside locks, refuse replaced collections, and order non-queueing read refreshes with ingest. Preserve admitted history and leave skipped changes pending.
Contract-Neutral: Internal dependency/publication ownership only; resource schemas, tenant authorization, notification policy, thresholds, retention and shutdown semantics are unchanged.
Change-source: pulse-maintainer
A VM that Pulse can only read through Proxmox's own memory value (no guest
agent, no Pulse agent inside it) shows a cache-inclusive percentage that can
sit near 100% on a healthy guest. Patrol already treats those sources as "may
include cache" for pressure and recovery; the Workloads row and drawer gave no
hint, so the red bar read as memory pressure (#2762, #2639).
A current reading from status-mem, status-freemem, cluster-resources or
derived-total-minus-used keeps its numbers, colour and thresholds, and is now
qualified: VM rows show "May include cache" ("Cache?" in compact layouts), the
bar tooltip and the drawer's "About this reading" explain it, and the drawer
says what can supply the guest's own figure (a Pulse agent in the guest, or
the QEMU guest agent on a Linux VM, worded as "can" because source selection
does not guarantee a replacement). Every running container reads the cgroup
value, so containers carry the note in the tooltip and drawer only, not a
label on every row. Retained, unknown and unavailable readings keep their own
labels and are never called current.
Mock guests now carry memory provenance and a refreshed observation time;
before, every mock VM and container read "Freshness unknown", which hid this
cue from the demo and from screenshots. Windows VMs never claim Linux meminfo
provenance, and scenario-stopped guests read powered-off.
Refs #2762, #2639
pulse-triage[bot]