Keep the original failed transaction command distinct from any later cleanup command. Retain fixed operation labels and require portable controls for command, timeout, assertion, cleanup-only and successful receipts, without changing update transactions or disclosing command output.
Change-source: pulse-maintainer
Current exact-head CI exposes outdated PBS proof inventory, omitted bounded-download helper extraction, closed transport rejecting the production HTTPS flags, and Darwin's truncated comm column in Linux NAS fixtures. Preserve exact transport and process ownership, restoration and migration safety assertions while binding the controls to the actual producer.
Contract-Neutral: Test and offline CI-fixture alignment only; no installed runtime, trust, credentials, deadlines, source safety or public contract changes.
Change-source: pulse-maintainer
The legacy grant-pct path deliberately permits only list and df outside the typed helper. Keep that distinction instead of calling every fallback a full-trust collector, and describe configured mounts rather than promising every mounted filesystem.
Contract-Neutral: Guidance wording only; no telemetry, privilege, API, installer or availability contract delta.
Change-source: pulse-maintainer
The deployment table still calls the typed helper a pct reader, while the implementation uses socket-free discovery and command fallback cannot recover within PrivateNetwork. Link the deployment choice, collector help and support matrix to one shipped explanation of partial, unavailable and older-helper readings, without recommending privilege or state changes.
Contract-Neutral: Guidance and consuming-proof coverage only; no telemetry, privilege, API, installer or availability contract delta.
Change-source: pulse-maintainer
Main Secret Scan job 115618327497 on 90a8b890 passed after scanning zero commits and bytes with --log-opts=-1. Bind the exact checkout, scan the complete introduced commit range plus first-parent merge resolution, and use full reachable history when the incremental base is unavailable or divergent. Preserve the pinned detector, checksum, redaction, fatal findings, ignore fingerprints and unconditional per-push admission. Real Git fixtures cover earlier removed bytes, merge-only changes, complete-history fallback and failure exits.
Contract-Neutral: Restore existing per-push secret-scanning coverage; detector rules, security exceptions, permissions, application and deployment contracts are unchanged.
Change-source: pulse-maintainer
Classify the complete tree diff before builds or browser setup. Only nonempty top-level browser receipt JSON changes are exempt; mixed source, graphs, controls, docs and unavailable diffs keep ordinary runtime checks. Keep per-push secret scanning, independent canonical receipt validation and a strict E2E verdict which never calls skipped tests passing. Exercise real Git ranges and both workflow admission/result paths.
Contract-Neutral: Only browser-evidence-only tree diffs omit redundant runtime CI; application, dependency, trust and required source-proof contracts are unchanged.
Change-source: pulse-maintainer
Keep the negative, partial-repair and nested-resolution controls beside the actual locked-graph check so future edits cannot silently disable the intended safeguard.
Contract-Neutral: Run the existing serialization regression suite in its pre-install CI check; no additional contract or user-visible runtime change.
Change-source: pulse-maintainer
Bind the existing qualified security override to its exact consumer and serializer pair instead of letting npm overrides silently carry it into a newer Solid runtime. Resolve nested lock edges, retain the strict complete audit and security floors, and cover the two stale dependencies actually present in PR 2759 with positive, partial-repair and nested-resolution controls.
Change-source: pulse-maintainer
Additive upstream composition retired the visible N/A caption and retains Usage unavailable plus actionable permission and agent errors. Assert the actual documented states without weakening producer, expiry, keyboard, phone, same-guest or safe-recovery checks. The first five-test fixture run failed on its obsolete N/A requirement; all five corrected controls pass.
Contract-Neutral: Documentation regression labels only; runtime, guidance, provenance and recovery contracts are unchanged.
Change-source: pulse-maintainer
Preserve accepted 0efe3f7a12 and exact upstream ebfdc9d669 additively. Keep quiet unavailable captions, keyboard and touch reading explanations, stopped-agent provenance and primary CPU readings. Preserve stable denied-update help outside Details and all regression assertions.
Change-source: pulse-maintainer
Give each installer and signature transfer a five-second connection and sixty-second total budget, ignore ambient curl settings and preserve HTTPS through redirects. Failed or partial downloads leave the prior install, service and identity unchanged; pinned signature admission and recovery deadlines are unchanged.
Change-source: pulse-maintainer
The Workloads table put a second line under memory and disk cells on
every stopped guest ("N/A / Unavailable", "- / Unavailable"), on every
agentless VM's disk, and "May include cache" under every agentless VM's
memory bar, even at 20%. None of them said why or what to do, and they
broke the row rhythm.
Memory that cannot be read now renders the same dash as an unreadable
disk, with its reason in the cell title, the sparkline's hover title
and assistive text. Disk shows a visible label only for a retained
reading (Last known) or a read the user can fix (No permission, Agent
error). The cache caption appears only when the guest's own memory is
at its warning or critical threshold, the figure that colours the bar
in host-share mode too, which is the case #2762 and #2639 were about;
below that the caveat stays in the title and assistive text.
An unavailable memory explanation names what is known instead of
"Unknown source": a powered-off guest reads "Unavailable while the
guest is powered off." MetricMiniSparkline gains an optional tooltip
so the chart covering the cell can carry that reason without changing
its accessible name.
The copyable healthcheck previously also imposed a 256 MB memory limit and half a CPU, without workload qualification. Preserve the check, separate sizing from health and repair, and retain existing deployment policies. Link the bounded read-only interpretation and cover the shipped document and actual Docs consumer.
Contract-Neutral: Existing documentation and offline consuming fixtures only. No runtime defaults, deployment policy, API, retention, polling, resource enforcement or subsystem contract changes.
Change-source: pulse-maintainer
Retain the exact Delivery commit and its complete source-el4dto5p proof. The CI-only partition preserves all checks and deadlines; native recovery and upstream drawer reconciliation remain separate owning-lane work.
Change-source: pulse-maintainer
Move the existing generated watchdog and collector contract to an early, fail-closed native CI phase. Discover the complete inventory in both phases, execute every check exactly once, and preserve the remaining group assignments, native runtime tools and safety deadlines. Exercise phase admission, omission, duplicate and failure controls.
Contract-Neutral: Native CI phase ordering and inventory partition only; production installers, runtime behaviour, required checks and safety deadlines are unchanged.
Change-source: pulse-maintainer
Preserve the three exact PI commits and retained real-curl plus consuming Docs proof. The change disables curl URL globbing in the existing copied helper; API runtime and authentication contracts are unchanged.
Change-source: pulse-maintainer
The private-response helper promises one request, but real curl expands quoted brace lists and bracket ranges into two or three requests, including POST, PUT and DELETE. Disable URL globbing without changing token-file transport, response privacy, scopes, TLS, deadlines or no-retry rules. Explain the literal-path and separate URL-encoding boundary.
Exercise the copied helper with both authentication headers, every supported method, encoded identifiers and adverse write responses. Add consuming desktop and narrow Docs/router verification.
Contract-Neutral: Documentation and synthetic recipe/browser checks only; API authentication, endpoint and runtime contracts are unchanged.
Change-source: pulse-maintainer
Accept exact Delivery candidate 00f0cbeb56 with retained complete documentation proof and consuming desktop/phone browser evidence. Preserve current main proxy-auth safety changes; no native QGA recovery or human PR delivery is claimed.
Change-source: pulse-maintainer
The guest-reading docs control required a literal Unavailable caption even though the reading state and its explanation are the contract. Keep retained labels, disk-specific title/assistive wiring and unavailable producer checks; negative controls reject lost reasons while permitting caption-only changes. Guide keyboard and phone users through the existing reading indicator and same-guest details without treating a dash as an agent-installation diagnosis. Add a consuming current-source Docs browser check. No human PR is imported, amended or re-authored; its source and independent integration remain separate.
Contract-Neutral: Align existing filesystem guidance and its executable checks with unchanged reading states and accessible reasons; no polling, telemetry, runtime, access, safety or recovery contract changes.
Change-source: pulse-maintainer
The copied loopback recipe inherits http_proxy and ALL_PROXY even with curl --disable. Real-curl parent controls sent the synthetic administrator-capable header to the proxy and could report its denial as a Pulse role result. Explicitly bypass proxies for the selected backend and keep the protocol boundary clear.
Exercise both response directions and three proxy environment selectors, preserving privacy, deadlines, cleanup and the existing role/IdP trust boundary. Add a repeatable production Docs/browser check for the exact copied guide.
Contract-Neutral: Documentation and synthetic recipe/browser checks only; proxy authentication semantics and runtime contracts are unchanged.
Change-source: pulse-maintainer
The exact-source broader audit suite exposed ENOEXEC differences in the direct Python exec path. Retain the former Bash executable-script fallback with a fixed exec program and literal argv, including whitespace and shell metacharacters in the executable path. Isolate the two path-lookalike fixtures so each still asserts its own one-commit guard result.
Contract-Neutral: Restore the existing Bash command compatibility within the new audit process group; audit classification, retry rules, dependency graphs, command arguments and external authority are unchanged.
Change-source: pulse-maintainer
Both required CI and the local gate must treat the new subprocess owner as audit runtime, not an unchanged dependency graph. Carry the actual helper into the isolated local-gate fixture and test positive findings, missing results, large change lists and exact-path lookalikes through both consumers.
Contract-Neutral: Extend the existing strict audit-runtime path classification to its new owned helper; advisory rules, dependency graphs, public runtime, credentials and external permissions are unchanged.
Change-source: pulse-maintainer
The existing helper leaves TERM-resistant children running after npm finishes or its attempt expires. Give each attempt its own process group and monotonic deadline, stop the owned group on every terminal path, and preserve the captured report and observed exit. An npm TERM handler returning zero cannot turn an expired attempt into a clean verdict. Exercise normal completion, failure, timeout, cancellation, positive findings and an unrelated live process through the actual shell helper.
Contract-Neutral: Repair the existing audit deadline and child ownership only; invocation arguments, manifests, strict and unchanged-graph advisory verdicts, retry budgets and external access remain unchanged.
Change-source: pulse-maintainer
The browser gate now uses the shared repository I/O module. Exercise its
real dependency in the prepush fixture so smoke tests reach qualification
checks instead of failing during import.
Contract-Neutral: Test fixture dependency only, no application or contract behavior changes.
Bind removal guidance to checked NAS quiescence and boot retirement instead of retired installation markers. Model DSM hard-link semantics through real exclusive link syscalls so macOS contract jobs no longer depend on GNU ln, retaining raced-directory adverse controls and every existing manager/recovery assertion.
Contract-Neutral: Tests only; production removal, documentation and teardown contracts are unchanged.
Change-source: pulse-maintainer
Compose upstream bed5052eb5 without replacing reviewed history. Keep the accepted one complete stdout/stderr observation and blank-line refusal instead of upstream second-sample replacement. Retain upstream real-systemctl fresh-host assertions and its platform-availability decorator alongside every reviewed failure-retention control. No release, installed recovery or LXC stop-cause claim.
Change-source: pulse-maintainer
The previous commit inserted a new real-systemctl test above the old one
and took over its skipUnless decorator, so on macOS, which has no
systemctl, the new test skipped and the old one ran unprotected and
failed. Restore the decorator on the old test.
The installer proof required the real-systemctl control to have passed.
Where systemctl does not exist it must instead report skipped, so the
proof now checks for ok on a host with systemctl and for skipped on one
without, and still fails if the control is absent from the output.
Refs: #2785
The 2026-10-10 server service discovery change lists the two historical
unit names with one pattern read and refuses to continue when that read
exits non-zero. systemctl list-unit-files exits 1, printing nothing on
stdout or stderr, when none of the named unit files exist. That is every
fresh host, so install.sh refused with "Cannot identify the Pulse systemd
service: unit inventory failed" before it did any work. The first beta's
install.sh smoke test caught it on a clean Debian 12 container; no
release carries it, and v6.5.0 listed the whole inventory and grepped it.
The tests could not see it. Their systemctl double reports "no units" as
exit 0, and test_partial_failed_inventory_is_not_absence asserted that an
empty inventory with exit 1 must be refused, which is the defect itself.
Add one inventory read shared by the installer and the unattended
updater, and use it for the auto-update mask check, which had the same
hazard. It accepts exactly the silent exit 1 as an empty inventory, and
only after a second read confirms there is still no output and no
message. A timeout, a signal, any other status, or an exit 1 that carries
output or a message stays a failed inventory, so a real failure still
cannot pass as absence.
Make the doubles model systemd: a failure now prints its message, silent
exit 1 is absence, and a new test runs real systemctl --root over an
empty unit root for both scripts. Run against the unfixed scripts, the
four new fresh-host tests fail; the rest of the suite is unchanged.
The registered runtime proofs for install.sh and the unattended updater,
which drive this suite, now require the fresh-host controls to have run
and passed, so they cannot be skipped or deleted unnoticed.
Refs: #2785
Read optional intake precautions at their expandable report fields, bind OpenShift Secret tests to the validated private file, and target helper workflow negative controls by step. Preserve the prepared GNU timeout in the private teardown probe on macOS and keep the actual security migration boundaries mandatory. Production guidance, installer behaviour and platform coverage are unchanged.
Contract-Neutral: Fixture-only integration repair; no product, installer, workflow, deployment or safety contract delta.
Change-source: pulse-maintainer
Combined-source validation found the removal-help assertion still looking for a direct systemctl stop after accepted teardown moved that operation into its fail-closed shared helper. Verify the actual helper call before revocation and retain stop, disable and complete-set readback assertions, with missing, late and ignored-call adverse controls.
Contract-Neutral: Test-fixture reconciliation only; no installer, help, lifecycle, schema or authority change.
Change-source: pulse-maintainer
SSO operators can hold permitted non-administrative write capabilities. The guide now checks the actual instance-administration boundary, without instructing a settings mutation or changing roles.
Change-source: pulse-maintainer
Preserve the exact reviewed candidate and its portable proof. Hosted native systemd receipts, matching Go compilation, signed installed-agent transport and Windows recovery remain separate acceptance obligations.
Change-source: pulse-maintainer
Copy generated callbacks only after provider save, align group-claim advice with provider-specific scopes, and retain administrator access until separate-session permission checks pass. Keep shipped documentation and regression checks in step without changing authentication or provider behaviour.
Change-source: pulse-maintainer
Preserve the exact reviewed guide and regression-test commits. Retained command controls and browser evidence establish safer credential paths and permission diagnostics without cluster or privilege changes.
Change-source: pulse-maintainer
Preserve the five reviewed Core commits exactly. Blank-only bootstrap admission and the matching persistence path retain existing access; authenticated transfer remains unchanged.
Change-source: pulse-maintainer
Run the accepted Unix teardown functions on fresh public Linux x64 and ARM64 CI, with real stop refusal, socket activation, batch reactivation and independent process/file readback. Retain bounded source-bound phase and owned-cleanup receipts; keep synthetic revocation separate from installed TLS, signed-agent and Windows acceptance.
Change-source: pulse-maintainer
The copied token recipe followed linked paths and continued without its own failure boundary. Reject unsafe paths before editing or contacting the cluster, preserve scoped file-only provisioning, and distinguish Kubernetes RBAC from local pod privilege and missing usage. Exercise the exact copied recipes with synthetic inputs and render the served guidance.
Contract-Neutral: Existing Kubernetes help and its regression tests only; no runtime, API, chart, role, deployment profile or feature change.
Change-source: pulse-maintainer
Require a blank destination instead of using nodes.enc as a first-run sentinel. Recheck before writes, retain unknown or unreadable state, and leave deliberate authenticated transfer unchanged. Keep deployment .env provisioning and encrypted file precedence; explain the separate archive path in canonical and served help.
Change-source: pulse-maintainer
The v4-to-v5 entry point still offered privileged download-and-purge cleanup and duplicate update shortcuts despite safer current procedures. Preserve configuration, credential and workload recovery evidence, separate server and agent paths, and link the inspected local cleanup without broadening it.
Contract-Neutral: Existing customer guidance, shipped Markdown and focused regression checks only; no runtime, API, permission, installer or cleanup contract changes.
Change-source: pulse-maintainer
Retain exact PI candidate identity and its proof; existing configuration-transfer help now states the real admission gate and replacement limits.
Change-source: pulse-maintainer
Document the existing nodes.enc gate, replacement scope, file precedence and non-fatal import errors. Preserve agent identity and excluded state, isolate provisioning from live traffic, and keep one-shot inputs private rather than forcing a reset.
Contract-Neutral: Existing bootstrap and encrypted-import behaviour is unchanged; this corrects canonical and served help, with documentation regression controls.
Change-source: pulse-maintainer
Retain the exact Delivery candidate b3b368c21b and its attributed PR2855 adaptation. Independent review verifies one-read failure retention and unchanged runtime-proof bytes; no native installation or published availability is claimed.
Change-source: pulse-maintainer
Adapt rcourtman’s Pulse PR2855 (aef53d0d3e), which diagnosed systemd’s silent exit-one absence. The original contributor commit is unchanged and explicitly credited, not imported, amended or re-parented in this maintainer candidate.
One bounded stdout/stderr observation accepts genuine absence but retains failed first reads, other statuses and blank-line output. Include the existing registered installer/updater verification hooks, real-empty-root controls and missing-unit recovery double in this same source commit. This replaces the rejected foreign-history composition with a normal maintainer-reviewed implementation; no provenance policy, credential or host installation changes.
Source-attribution: rcourtman, https://github.com/rcourtman/Pulse/pull/2855, aef53d0d3e
Change-source: pulse-maintainer
Align existing removal and orphan-service help with credential-first Unix admission. Explain same-instance recovery, keep older served scripts and Windows behaviour distinct, and prevent stopping retries from being mistaken for revocation or completed removal.
Contract-Neutral: Existing operator guidance and regression assertions only; no runtime, schema, lifecycle or trust-boundary change.
Change-source: pulse-maintainer
Accept original failure evidence without another reproduction or a diagnostic export, and place public-sharing precautions before readers leave for GitHub. Keep the shipped documentation index in sync and guard both entrypoints within the README page budget.
Contract-Neutral: Documentation-only intake guidance and regression checks; no runtime, API, collection, authentication or release contract changes.
Change-source: pulse-maintainer
pulse-triage[bot]