The create-release prepare job now verifies that pulse-enterprise declares docs/release-source-pairs/<expected_source_sha>.json and that it names the frozen public commit before any draft release object exists. Record that obligation in the deployment-installability contract and add the release-promotion policy proof that guards the step and its ordering ahead of create_release.
Change-source: pulse-maintainer
The Windows unified agent exits at startup when HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid is a braced GUID. gopsutil v4.26.6 reads the value through a fixed 74-byte buffer and rejects any length other than 36, so a braced 38-character GUID fails the whole InfoWithContext call and newAgent aborts with 'fetch host info'. Recover the host info on Windows when the host-ID read is the failing field: read MachineGuid directly, strip braces and fill the other fields from gopsutil accessors, while keeping any non-host-ID failure fatal. Canonicalise Windows machine IDs by removing braces so both forms map to one stable agent identity. Includes agent-lifecycle contract section and focused proof in the registry-accepted agent_new_test.go. Windows recovery is cross-compiled with GOOS=windows; runtime execution on Windows is not qualified in this environment.
Change-source: pulse-maintainer
Record the monitoring contract section for the TrueNAS legacy-REST memory telemetry repair and move its regression coverage into the registry-accepted internal/truenas/client_test.go proof file. The runtime commit and this contract/proof follow-up are one reviewed completion unit.
Change-source: pulse-maintainer
FreeBSD base ships sha256(1) but not GNU sha256sum or Perl shasum. Record the fallback contract for the unified and MCP installers and add the MCP installer proof the deployment-installability verification policy requires.
Change-source: pulse-maintainer
TrueNAS SCALE on AMD reports the bare `cpu` cputemp legend series at roughly 1.5x the hottest per-core reading, and the provider trusted that mapped `cpu_package` value unconditionally, firing an 80C threshold alert at a real ~60C. Compare `cpu_package` against the hottest `cpu*` per-core entry and fall back to the per-core max only when the package value exceeds it by more than 20%. Package-only and per-core-only payloads keep their existing behaviour. Adds focused provider coverage and records the selection contract for #2122.
Change-source: pulse-maintainer
Integrate the reviewed #2121 guest-drawer filesystem panel ordering fix (958eae0744) with its contract assertion and the Playwright browser receipt recomposed into the same commit. The reviewed commit's parent is 22fd851e72; this merge preserves its identity.
Change-source: pulse-maintainer
The shared DetailSectionTable span algorithm gives the earlier of the last two compact sections the wider column. GuestDrawerOverview declared Tags before Filesystems, so a guest with tags and disks but no network section rendered Tags two tiles wide and the mount-point list one tile wide, which the reporter found hard to read (#2121). Declaring Filesystems first gives the longer list the readable panel and keeps the short tag list narrow.
Recomposes the reviewed #2121 fix and its Playwright browser receipt into a single commit on the current maintenance base (22fd851e72), because the per-commit browser guard requires the receipt in the same commit as the user-visible frontend source. The GuestDrawerOverview.tsx blob is byte-identical to the previously browser-verified content (sha256 bcfebc20), so the receipt is content-addressed to the same source; the added contract assertion and performance-and-scalability ordering note are unchanged.
Refs: https://github.com/rcourtman/Pulse/issues/2121
Change-source: pulse-maintainer
Integrate the reviewed ai-runtime prompt-cache repair (248ada3cc6) with its transport contract (f08b96b968) and registered completion pair (bc3da3ad49). Merge resolved the canonical completion registry against the rehearsal-timeout completion pair already on main by keeping both entries.
Change-source: pulse-maintainer
Add the ai-runtime contract section for the Anthropic stable-system-prefix
prompt-cache reuse and its focused proof. This completes the contract obligation
for the runtime repair in 248ada3cc6 without rewriting that reviewed commit.
Change-source: pulse-maintainer
Dependabot #2099 bumps @types/node 20.19.43 to 26.5.1 in frontend-modern, but the PR is blocked twice: Frontend tsc fails with TS2550 on .at() (26 removed the compatibility polyfill), and Canonical Governance blocks the package.json/lock change for a missing deployment-installability contract update and frontend dependency security proof.
Carry the bump with its required governance artifacts in one commit. tsconfig already declares the ES2022 lib (95db35b6c3), which the source's .at() usage needs; this adds the manifest and lock bump (matching tests/integration, which already pins @types/node ^26.5.1), a Completion Obligations entry, and a dependencySecurity proof that keeps the manifest range, the locked @types/node/undici-types versions and the declared lib in step. Verified offline: the guard passes and the proof test passes.
Change-source: pulse-maintainer
Record the deployment-installability contract section for the rehearsal backend package timeout and its proof surface. This is the contract follow-up for the runtime change in d0f138cf26. Change-source: pulse-maintainer
Change-source: pulse-maintainer
Address the remaining verified findings from the pkg/metrics/store.go review
(#2079 finding 5 and the lower-impact nits):
- writeBatch now retries the whole transaction on a retryable lock error.
BEGIN is deferred, so contention is hit at the first INSERT or COMMIT; the
old loop retried only Begin() and skipped rows. While the one-time startup
maintenance (deferred identity-index rebuild and auto-vacuum VACUUM) is
active, an extended retry budget keeps upgrade-time history instead of
dropping it after the steady-state budget.
- migrateLegacyHostResourceType probes with an indexed EXISTS before opening a
write transaction, so an already-migrated store does not dirty the WAL on
every boot.
- QueryAll caps the per-series MetricPoint preallocation so a fine requested
step over a long range cannot reserve hundreds of thousands of slots.
Regressions: TestStoreStartupMaintenanceSignalsWriteRetryBudget,
TestStoreWriteBatchExtendsRetryDuringStartupMaintenance,
TestEstimateQueryAllBatchSeriesCapacityCapsPreallocation. The
performance-and-scalability contract records the invariants.
Change-source: pulse-maintainer
Distinguish independent customer-owned Community, Relay and Pro installations
from provider-owned MSP entitlements so outside IT support alone does not
trigger an MSP requirement. Preserve per-customer subscriptions and the
prohibition on pooling licences across unrelated customers.
The canonical completion guard requires the metrics-store hot-path proof in
pkg/metrics/store_additional_test.go. Move the rollup-gap, upsert-spread,
busy-retry and auto-vacuum regressions there and point the
performance-and-scalability contract at that file. The runtime change and
contract section are in the preceding fix(metrics) commit.
Change-source: pulse-maintainer
Address the remaining verified findings from the pkg/metrics/store.go review
(#2079 findings 2-4 and 6):
- rollupTier no longer leaps its checkpoint over a source gap. Previously a
trailing or interspersed gap advanced the checkpoint to the rollup cutoff, so
a lower tier that backfilled the gap later had those rows stranded below the
upper checkpoint and purged by retention.
- Retry conditions now classify SQLITE_BUSY/LOCKED by driver result code. The
modernc driver reports "database is locked (5) (SQLITE_BUSY)", which the
previous exact-string comparison never matched, so a busy writer dropped its
batch without retrying.
- The metrics upsert preserves an existing rollup row's min/max spread with
COALESCE instead of overwriting it with NULL.
- migrateAutoVacuum pins the pragma and VACUUM to one connection and verifies
the persisted mode, so the one-time conversion cannot silently repeat a
full-file VACUUM on every restart.
Regressions: TestStoreRollupTierBackfillsInterspersedGap,
TestStoreWriteBatchPreservesRollupSpread, TestIsRetryableWriteError,
TestIsRetryableWriteErrorMatchesDriverBusyCode,
TestStoreAutoVacuumPersistsAcrossRestart. The performance-and-scalability
contract records the invariants.
Change-source: pulse-maintainer
Follow-up to the physical-disk endurance precedence fix. Records the
dependent agent-lifecycle contract section and moves the regression into the
accepted physical-disk proof file so later per-commit canonical guards find
both the contract and the verification artifact.
Change-source: pulse-maintainer
The physical-disk SMART merge let a linked host agent raise a disk's
remaining life above the Proxmox inventory value. An intermittent NVMe
PercentageUsed 0 reading therefore resolved a genuine low-life disk-wearout
alert, which re-fired on the next physical-disk poll and emitted a fresh
resolved notification every poll interval (#2112).
The merge now takes the agent value only when the Proxmox value is unreported
or more pessimistic, never raising a reported remaining-life value, while
still recording the agent SMART attributes. This does not change agent
admission, token binding or removal-block behaviour.
Regression: TestMergeHostAgentSMARTIntoDisks_AgentWearoutDoesNotHideLowPVELife
and TestMergeHostAgentSMARTIntoDisks_AgentWearoutFillsUnreportedPVELife in
internal/monitoring/monitor_integration_test.go. The monitoring contract is
updated in this commit.
Change-source: pulse-maintainer
Contract-Neutral: Behavioral bug fix in the physical-disk SMART merge; no public API or external contract delta. The monitoring contract is updated in this commit and the dependent agent-lifecycle contract and accepted proof file follow in the next commit.
The ingestion worker closed writeCh when it observed stopCh. A concurrent WriteWithTier that passed its stopping check, or a WriteBatchSync/WriteBatchBounded caller (which never checks stopping), could then send on the closed channel and panic the process during shutdown. Reproduced deterministically: enqueueWrite after Close panics with send on closed channel, and 8 concurrent monitoring writers racing Close panic in boundedEnqueueAndWait (store.go:1034).
Never close writeCh. Drain already-queued requests non-blockingly, then process them. Late writes land in the buffered channel and are discarded with the store rather than crashing it. Record the invariant in the performance-and-scalability contract and pin it in the accepted store proof file.
Change-source: pulse-maintainer
A removed host agent could re-enroll under a derived base-hex identity because identity resolution forked the machine before the removal block was consulted. The block is keyed on the base machine identity, so the forked ID bypassed it and the machine was silently re-admitted (#2113). ApplyHostReport now consults the base-identity removal block when the presenting token had no prior binding, so a fresh install token clears the block and heals to the base identity while an established distinct forked host (#1753) is left alone.
Record the behaviour in the monitoring and agent-lifecycle contracts and add the focused regression to the accepted monitor.go proof file. Change-source: pulse-maintainer
Change-source: pulse-maintainer
Docker update check compared a single RepoDigest against the registry tag digest, so a current image that carries two RepoDigests (postgres:16.15-alpine3.24) reported update-available. Compare the whole local RepoDigest set in CheckImageUpdate and in the typed update preflight; the primary digest is still reported for display.
Record the behaviour in the monitoring and agent-lifecycle contracts and add focused regression tests in the accepted docker proof files. Proof: go test ./internal/dockeragent/ passes including TestRegistryChecker_MultipleLocalRepoDigestsSuppressFalseUpdate and TestAgent_getImageRepoDigests_MultipleDigestsForOneImage.
Change-source: pulse-maintainer
Read-side registry rebuilds re-run the unified metric sync as often as every two seconds, so one poll observation was re-written many times between polls. The metrics store upserts on (resource, metric, tier, timestamp), so each replay UPDATEs the same row and commits a fresh transaction for no new data, churning the SQLite WAL and driving the disk-write amplification reported in #1966.
Track the last sample handed to the store per series and skip exact timestamp+value repeats before the batch is enqueued. A corrected value at the same observation time is still written, so the guard cannot mask a real change. Record the behaviour in the monitoring and agent-lifecycle contracts and move the focused regression into the accepted monitor.go proof file.
Change-source: pulse-maintainer
Reloading configuration replaced the monitor's config pointer while API and
authentication handlers retained the original object. Tokens created afterwards
could authenticate successfully while Agent Doctor reported an unlisted token.
Refresh the canonical runtime configuration in place before constructing the
replacement manager. Cover repeated reloads, live token creation and revocation.
Use an exact runtime-file policy before the general API fallback, so setup preservation evidence cannot substitute for unrelated API changes. Assert both setup routing and unchanged organization/RBAC verification requirements. Retain the original failed broader-registry test evidence.
Change-source: pulse-maintainer
Sort the dedicated regression path into the existing exact-file list as required by the registry audit. Accepted proofs and enforcement remain identical.
Change-source: pulse-maintainer
The per-commit API guard needs the actual dedicated preservation test declared in its verification registry. Restore that tested artifact and add its exact path to the existing backend API proof list. Retain all existing requirements and reviewed commit identities; no history rewrite, contract-neutral override, or unrelated proof substitution is used.
Change-source: pulse-maintainer
Represent the retained L1 maintenance residual with the required kind and id fields so the status audit resolves its owned follow-up.
Change-source: pulse-maintainer
Link the L1 residual to an explicit owned follow-up when claiming the independent settings repair. Source admission, failed checks, installed recovery and exact-candidate observation remain unfinished rather than disappearing with the claim change.
Change-source: pulse-maintainer
Quick security setup previously replaced system.json with defaults even for authenticated force reconfiguration. Initialize only absent settings under the persistence save mutex, preserving existing bytes and read failures. Cover credential rotation, custom and malformed settings, missing settings, and read errors without changing authorization or token scopes.
Change-source: pulse-maintainer
Apply existing candidate content-drift validation to every future stable promotion, including v6.4 patches. Preserve patch and minor soak durations and the explicit hotfix reason path. Extend regression cases to maintenance releases and give historical unit fixtures explicit source paths rather than reading the live checkout.
Change-source: pulse-maintainer
Replacement PR checks were queued behind obsolete runs even after the
previous revision failed. Cancel prior validation only for pull_request
events, preserving completed verdicts for branch pushes and manual runs.
Contract-Neutral: Only PR concurrency changes. Semantic YAML comparison confirms all jobs and triggers, including frontend dependency security checks, are unchanged. No security verification change is warranted. The scheduling contract is updated.
Resolve the PR2087 frontend formatting gate without changing severity behavior or rewriting the reviewed source. Re-run the production-component browser matrix and refresh its content hashes; whole-tree formatting and local TypeScript checking pass.
Change-source: pulse-maintainer
Retain warning severity through email API save/reload and webhook editing instead of coercing it to all. Add adapter round-trip and webhook edit/save regressions for issue #2069 with alerts, API and notifications contracts. Browser verification covers production components at desktop and narrow widths using synthetic settings; backend filtering is unchanged.
Change-source: pulse-maintainer
Preserve snapshot refresh and formatted alerts when legacy args are scalar, array or null. Restrict SMART metadata to typed object fields and cover repeated snapshot collection plus error boundaries for #2077.
Change-source: pulse-maintainer
Register the focused skipped-poll regression under monitoring runtime verification as well as the shared lifecycle and read-state edges.
Change-source: pulse-maintainer
Skipped disk polls must write the Proxmox source key back into inventory rather than hashing the canonical resource ID again. Add repeated-cycle runtime and JSON projection coverage for serial-less disks, distinct node/controller scopes and removal.
Change-source: pulse-maintainer
Use an explicit status guard while requiring successful preparation and qualification. Model the beta skipped-ancestor path and adverse direct prerequisites; retain immutable identity and all release gates.
Change-source: pulse-maintainer
Probe 8.0.3.0 before the legacy spelling and older API schemas. Issue #2070 demonstrates method routing on the canonical version while Pulse reports 8.0.2.0. Retain legacy fallback and hard authentication/permission failures.
Add canonical negotiation, legacy/older fallback and auth/permission regression controls; update the runtime contract. Five reduced-function race probes fail before and pass after. Full package validation is unavailable with the installed offline dependency cache. This repairs negotiation, not the unresolved metrics/events/folder enrichment report.
Change-source: pulse-maintainer
Selecting a node filters its guests and reveals an off-screen guest
heading without moving results that are already visible. Repeating the selection
clears only the node filter. Keep node details on the
chevron and preserve other guest filters when changing or clearing nodes.
Build node filter options from inventory as well as guests so empty nodes
retain their names and selection after reload. Do not present unrelated
inventory failures as the cause of an empty filtered result.
Refs lane L8. Update the owning interaction and identity contracts.
Persistent prerelease runners can retain state from earlier source execution
and influence later admission, build output or qualification. Use the
existing hosted stable-release path for every channel while preserving
exact-source checks, resource planning, watchdogs and release gates.
Reject historical draft reuse before PATCH when its retained target is not the exact checkout SHA, including missing targets and moving refs. Preserve same-source recovery and activation guards.
Depends on PR2056 qualification-first workflow and immutable tag checks. Executable absent-tag fixtures fail before repair and pass on PR head 9e5e18f0 plus this patch; 53 policy, 6 immutability and 42 trust tests pass. Update the deployment contract in the same commit.
Change-source: pulse-maintainer
A draft GitHub release does not hide its public Git tag or registry
images. Publishing those before qualification consumed a beta identity
when the candidate later failed.
Stage drafts without Git refs, join exact-source checks before public
tag, Docker and Helm publication, and preserve exposed tag identities.
Keep final digest verification before release activation.
History requests can occupy every database connection and make cheap
statistics reads wait for seconds. Reserve one read-only connection for
current committed counts, owned and closed by the metrics store.
Keep the SQL, data model, load workload and latency budgets unchanged.
Add deterministic pool-saturation, committed-data and shutdown coverage.
The nested 140px mount list relies on a thin scrollbar to reveal additional disks, which #2051 reports as invisible in Firefox. Remove that nested scroll boundary so all mounts participate in the existing outer scroll flow without changing data or global scrollbar styling.
Validate short and long lists in light/dark Firefox and Chromium fixtures, including keyboard reachability, and retain aggregate/empty-state component coverage. This is synthetic browser proof, not reporter installation acceptance.
Change-source: pulse-maintainer
pulse-triage[bot]