Correct the PI wording assertion after preserving newer canonical help in the merge. Require command-free LXC/systemd entries, linked ownership and installed-path checks, private Pro protection and retained chart/software guidance rather than restoring an older copied command.
Contract-Neutral: Integration-only documentation assertion alignment; update behaviour, routes and trust boundaries are unchanged.
Change-source: pulse-maintainer
Retain exact reviewed PI commit af6cc9019f and its software-versus-chart explanation. Resolve AUTO_UPDATE overlap by retaining the newer canonical text byte-for-byte, including installed paths, private-edition and failed-helper safeguards; align the inherited wording assertion additively next.
Change-source: pulse-maintainer
Accept exact reviewed Delivery commit 56fec40f2d with retained offline selector, signed-recipe and resilience controls. No third-party helper repair or installed update is claimed.
Change-source: pulse-maintainer
Use one complete-metadata selector for installer URLs and server archives. Exclude chart and draft releases, reject unusable metadata and transport bodies, and preserve explicit pins, signed assets and downgrade refusal. Exercise the actual selectors with bounded offline controls and retain native installation as separate acceptance.
Change-source: pulse-maintainer
Contract-Neutral: Restore server-only discovery within existing stable/preview channels; installer authority, signatures, architecture admission, downgrade refusal and state contracts are unchanged.
Accept the exact reviewed Web candidate d96ab64e01. Retain its focused documentation checks and inspected desktop/phone evidence; no updater repair or installed recovery is claimed.
Change-source: pulse-maintainer
Merge exact upstream 7f466fc183 without re-parenting its reviewed history. Retain both independent contract sections in the two documentation conflicts; no frontend resolution or runtime correction.
Change-source: pulse-maintainer
Use the ownership-checked existing-installation procedure for LXC and systemd update help instead of unconditional /bin/update commands. Explain chart selection without asserting a latest-pointer cause, and preserve exact signed downloads, private editions and existing state.
Contract-Neutral: Documentation-only update guidance and regression checks; no installer, updater, API or frontend runtime behaviour changes.
Change-source: pulse-maintainer
Keep server-update help from treating a community helper as Pulse's signed updater or choosing a Helm chart as a server archive. Preserve current-state checks, full-state backup precautions and the existing signed route after a failed update.
Contract-Neutral: Clarifies existing update routes and release identities; no runtime, API, release policy or subsystem contract change.
Change-source: pulse-maintainer
Host filesystem alerts identify a disk child that Patrol does not collect as
a separate resource. Bind an exact collected alert to its current canonical
owner through the shared inventory contract, including linked agents, and
retain its filesystem, threshold and breach evidence in the scoped prompt.
Keep missing owners, ambiguous source identities and uncollected child
subjects fail-closed. Add evaluator-to-handler, repeated scope resolution
and browser admission coverage.
Preserve the one-agent, repeated-short-guest-name case without conflating a full connection hostname or an ambiguous automatic link with stopped Docker reporting. Keep diagnostics observational and both shipped guide copies aligned.
Contract-Neutral: Intake guidance and its documentation assertions only; no runtime, API, identity policy or release contract changes.
Change-source: pulse-maintainer
The managed proof pack behind `npm run dev:verify` still named
tests/17-recovery-layout.spec.ts, which 1c38d79937 replaced with
tests/17-proxmox-backups-layout.spec.ts in July. The registered proof for
scripts/hot-dev-bg.sh pinned the stale path, so nothing flagged it.
The stale path did not fail the pack. Playwright treats each spec path as
a filter, so `test --list` with main's arguments reports 10 tests in 2
files and exits 0: the Proxmox backups layout guard had silently dropped
out of dev:verify.
The replacement spec reads the mock-mode estate, while dev:verify attaches
to the managed runtime in whatever mode it was left in. Under the managed
runtime it now skips with a `npm run mock:on` hint when mock mode is off,
instead of flipping modes in place: Monitor.SetMockMode clears the
runtime's active alerts and in-memory history on every switch. The Core
E2E harness runs mock mode and is unaffected.
test-hot-dev-bg.sh now pins the new spec and checks that every spec the
default verify command names exists under tests/integration; against
main's hot-dev-bg.sh that check fails on the retired path. The integration
README and its pin, the deployment-installability contract clause, and two
unused RECOVERY_PRODUCT_SURFACE_EXACT_FILES lists naming deleted files are
brought in line.
Distinguish global cancellation from quiet-hours holds, queued policy skips from provider receipt, and settings changes from recall or credential revocation. Add connected sender and persistent-queue controls, and run the existing notification guidance suites in docs-only CI.
Contract-Neutral: Documentation, mirrors, tests and documentation-only CI describe existing notification behaviour; no runtime, API, permission, schema, dependency or user-visible feature contract changes.
Change-source: pulse-maintainer
Retain exact Delivery commits, bounded SCM refusal before destructive continuation, and focused PowerShell 5.1 lifecycle controls. Linux proof does not establish native Windows acceptance.
Change-source: pulse-maintainer
Repair the candidate preflight failure without changing the PowerShell control tokens or runtime assertions. Validate whitespace across the complete candidate range.
Contract-Neutral: Removes one trailing ASCII space after a closed string literal in an existing test control; no runtime, assertion, coverage or subsystem contract delta.
Change-source: pulse-maintainer
Exercise removal of the actual preflight-to-environment wiring in the native acceptance contract, and accurately count the fourteen adverse structural controls.
Change-source: pulse-maintainer
Describe the integrated collector gates, explicit opt-out readback, legacy mail defaults and next-poll limits without treating dataset switches as a connection pause. Retain the verified v6.5.0 warning and incomplete-reading/alert safeguards in the existing guide and shipped mirror.
Contract-Neutral: Documentation and source-bound guidance tests only; no runtime, API, schema, permission or navigation change.
Change-source: pulse-maintainer
Reject missing Windows engines and pre-existing or unknown runner state. Independently verify first and repeated uninstall, propagate failed SCM/listener reads, preserve captured machine settings and fail unconfirmed owned server cleanup. Add actual-function controls alongside the unchanged production removal and native-exit checks.
Change-source: pulse-maintainer
Preserve both the explicit PMG-scope readback contract and the Windows destructive-continuation contract. Production source and its existing failure controls are imported unchanged.
Change-source: pulse-maintainer
Preserve the exact reviewed candidate. Combine PBS and audit safety selections without dropping prior agent-profile coverage, matching both trigger lists, command and adapter. Pro remains unchanged; source help is not installed delivery acceptance.
Change-source: pulse-maintainer
Preserve the exact two-commit candidate and retained final documentation proof. Resolve safety-list conflicts by retaining both agent-profile and PBS suites in triggers, command and adapter; no frontend source resolution.
Change-source: pulse-maintainer
Distinguish audit forwarding from alert notifications, document bounded best-effort delivery and safe reconciliation, and correct receiver, signature and key-storage advice. Bind the existing guide to source and run its safety checks in docs-only CI.
Contract-Neutral: Documentation and static guidance checks only; no audit runtime, API, signature, queue, authority or deployment behaviour changes.
Change-source: pulse-maintainer
Correct the inherited PBS-via-PVE badge assumption using the production source presentation and inventory read states. Preserve the existing help anchor, distinguish PVE files from guest snapshots, and bind guidance regressions to actual source labels.
Change-source: pulse-maintainer
Replace the unconditional direct-connection fix with existing-source, evaluation and identity checks. Preserve backups, credentials and deployment state while collecting bounded evidence, and select the existing PBS recipe suite in docs-only CI.
Change-source: pulse-maintainer
Distinguish metrics from commands, live host refresh from startup-only settings, and desired configuration from verified application. Preserve local privacy opt-outs and make profile API IDs, scopes, uncertain writes and removal limits explicit in both existing help entry points. Exercise the source-bound safety guidance in docs-only CI.
Contract-Neutral: Documentation and static guidance checks only; no agent authority, runtime, API or deployment contract changes.
Change-source: pulse-maintainer
Keep failed age evaluation separate from backup failure, retained alerts and native recovery. Reuse bounded incident logs and preserve the intended policy, backup data and guest-safety checks. Cover the missing guidance and reconcile its existing cleanup source assertions with the reviewed fail-closed helper.
Change-source: pulse-maintainer
Replace suppressed stop/delete failures with bounded SCM stop and absence evidence before replacement or uninstall. Retain binary and agent state on uncertainty, and report incomplete local cleanup. Add production-function failure controls to the existing native Windows test route and pin both destructive callers.
Change-source: pulse-maintainer
Include the new production boundary suite in the existing Public docs path triggers and smoke command. Check actual command selection and fail-closed handling with disposable adapters, without dependency installation or provider operations.
Contract-Neutral: Registers the production documentation regression suite in existing read-only docs CI; no runtime, release or deployment behaviour changes.
Change-source: pulse-maintainer
Make API-only guest-agent activity and backup precautions explicit, isolate disruptive rollout checks, preserve paid runtime and recovery data during updates, and remove retired Relay/Mobile upgrade claims. Bind the existing guide and shipped mirror to safety and edition guidance.
Contract-Neutral: Existing production guidance and regression checks only; no runtime, entitlement, route or deployment contract changes.
Change-source: pulse-maintainer
Additively incorporate exact upstream main 533027ee06 without rewriting accepted maintenance. Resolve the storage-recovery contract insertion by retaining both the reviewed silent-source History fence and upstream SAML/method constraints. No runtime conflict resolution is introduced; final-content evidence and exact-head checks remain required before publication.
Change-source: pulse-maintainer
Observe every timer, updater and server before mutation; refuse configuration deletion on uncertain quiescence and restore only prior-active servers and recorded timer states. Keep roles independent of accepted custom service names and never replay an interrupted updater. Exercise actual sourced paths and adverse controls. Move existing Windows native-exit assertions unchanged to their registry-named completion file without relaxing checks.
Change-source: pulse-maintainer
Share existing list time validation across audit reads so malformed, empty or non-increasing supplied bounds cannot silently widen an investigation. Preserve absent filters, access and tenant gates, export formats and existing pagination boundaries; reject invalid export success booleans before reading events. Pin actual handlers and exporter with fake persistent loggers, including no-query rejection and tenant isolation, and update both copies of the audit guide.
Change-source: pulse-maintainer
Since 4edf5f8265, ChatRequest in internal/api/ai_handler.go has no
autonomous_mode field: Go's decoder drops it and HandleChat passes
approval-required mode into the chat service for every /api/ai/chat
request. The browser still serialized autonomous_mode from its send
options, and the eval runner kept a per-step override that sent it too,
so both read as if the client chose the execution mode while the server
ignored it.
Drop the field from AIChatAPI.chat, SendMessageOptions,
ChatMessageRequestContext and the clone, retry and restore helpers, and
Step.AutonomousMode from internal/ai/eval. aiChatStore.context's
autonomousMode stays as a drawer-only flag, so scoped handoffs still show
"Ask first" and "Approval required before any action." Tests now assert
the request carries no autonomous_mode; the backend test proving a stale
client's autonomous_mode:true cannot elevate a request stays.
Contract prose that described autonomous_mode:false as a per-request
override set by the browser now describes the server-set mode and the
drawer disclosure.
Use the existing API helper for list, summary, export and verify examples. Explain list pagination versus export scope and preserve partial/error evidence. Exercise the copied recipes with private synthetic bodies, both auth headers, HTTP errors, redirects and incomplete transfers.
Contract-Neutral: Documentation and copied-recipe safety tests only; no audit runtime, API or frontend behaviour changes.
Change-source: pulse-maintainer
Contain destructive installer removal when systemd observation, stop or disable is uncertain. Stop the updater before the server, reconcile default aliases and local legacy units, and preserve files on refusal. Propagate failed legacy-key replacement even in conditional cleanup. Exercise both removal entrypoints and instance isolation in confined fixtures.
Change-source: pulse-maintainer
Preserve Delivery exact candidate 99d7b5e671 and both independently reviewed installability contract sections. The only conflict resolution combines documentation; runtime and verification bytes remain exactly as proved. Retained component suites pass while two enclosing assertions fail, and no native workload recovery is established.
Change-source: pulse-maintainer
Preserve Core exact candidate 0b9bd4beb6 and its retained source proof; installed recovery and the historical timeout cause remain separate.
Change-source: pulse-maintainer
Retain the upstream contract and lookup repair already present when review began, without expanding candidate source scope.
Change-source: pulse-maintainer
Separate browser-cookie lifetime, sliding server sessions and request-driven token refresh. Remove the false provider-change revocation promise, preserve administrator access and document the existing targeted user-removal boundary and private diagnosis.
Contract-Neutral: Documentation and source-consistency tests only; no authentication, session, authorisation or deployment contract changes.
Change-source: pulse-maintainer
Contract prose still described surfaces that no longer exist:
- `frontend-primitives.md` told new route-level copy to extend
`problemResourcePresentation` (deleted in ae65c5e9a2), tied that helper
to `ProblemResourcesTable.tsx` (deleted with the dashboard overview in
c743a231b8), and kept a readability rule for that table and the
dashboard Pulse Brief. No live surface implements the rule; Patrol's
grouping and affected-resource counts are governed in
`patrol-intelligence.md`. The ownership paragraph and the rule are
dropped, and problem-resource joins the list of deleted dashboard
helpers that must not return.
- `unified-resources.md` said the change and correlation summary cards
default Infrastructure resource-filter links for the Patrol page and the
problem-resource dashboard panels. Since the 2026-05-16 drilldown
retirement the cards have no link default and render only in the
resource drawer, which passes no link builder.
- `api-contracts.md` named the dashboard Pulse Brief as a sender of
`autonomous_mode:false` and described the field as a client override.
Since 4edf5f8265, `ChatRequest` has no such field: the server runs every
`/api/ai/chat` exchange in approval-required mode (pinned by
`TestHandleChat_CannotElevateAutonomousModePerRequest`), and the field
is dropped at decode.
The new `subsystem_lookup_test.py` case pins the deleted helper as
unowned, next to the other retired dashboard paths.
Verification: `contract_audit.py`, `registry_audit.py` and
`status_audit.py` pass with `--check`; the retired-path lookup tests
pass (9/9); the full pre-commit battery passed. No frontend or backend
runtime files change.
Account for every byte in the root-boundary compatibility reader, preserving descriptor-first recovery and rejecting oversized valid prefixes, multiple identities and discarded NULs. Keep the original two-second fixture budget, contain descendant processes and report build/probe timing separately. Add real-agent, legacy and cancellation controls without claiming a cause for the retained timeout.
Change-source: pulse-maintainer
Replace incomplete provider snippets with the existing authenticator and header-replacement requirements. Surface the all-users-admin default before enablement and stop copied diagnostics on bounded transport failure, preserving credentials and actual access checks.
Contract-Neutral: Documentation and synthetic recipe tests only; proxy authentication semantics and runtime contracts are unchanged.
Change-source: pulse-maintainer
pulse-triage[bot]