The Pi authentication report identified duplicated token characters despite a matching partial hint. Check correct, duplicated-middle and legacy input through the real generated terminal prompt and installer writer, including restoration of the original synthetic value and private hand-off cleanup. Clarify the existing guide without imposing a token-shape rule or claiming installed reporting recovery.
Contract-Neutral: Documentation and regression coverage only; command generation, credential selection, authentication, scopes, trust and runtime behaviour are unchanged.
Change-source: pulse-maintainer
The current host installer issues a 64-character lowercase hexadecimal token, but a bare file and matching inventory hint can still hide duplicated or changed middle characters. Explain the private whole-value check before first installation and its limits during authentication triage. Preserve other credential families, installation state, scopes and trust.
Contract-Neutral: Existing setup and authentication guidance only, with source-bound documentation checks. Runtime behaviour, credential formats, scopes and trust are unchanged.
Change-source: pulse-maintainer
Keep bare, quoted, prefixed and unknown file forms distinct from credential selection and successful reporting. Link the existing private-file installation to non-destructive guidance, and verify its source alignment, rendered table and keyboard navigation.
Contract-Neutral: Help and regression controls only; no token parsing, authentication, permission, installer or runtime contract change.
Change-source: pulse-maintainer
Separate a registered Docker reporting token from the scopes needed by the host module. Keep scope rejection distinct from HTTP 401 and identify the token-generation screen before changing credentials or reinstalling.
Contract-Neutral: Documentation and source-alignment controls only; no authentication, token authority, runtime or install contract changes.
Change-source: pulse-maintainer
A normal-host enrolment report supplies lookup and host-report 401s, repeated installs and an absent inventory record. Document one named server-side registration check before touching the affected agent, with separate limits for persistence, credential hand-off and accepted reports.
Contract-Neutral: Existing authentication help and its source-alignment controls only; no runtime, API, scope, route or credential-policy change.
Change-source: pulse-maintainer
The installed token manager is API Access in the Security group, not an API Tokens page, and it displays Created, Last used and Scopes rather than expiry. Keep dual lookup/report rejection separate from a proven cause; preserve credentials and avoid repeating failed installs.
Contract-Neutral: Existing documentation and passive source-alignment checks only; no authentication, credential issuance, agent reporting, navigation or runtime contract changes.
Change-source: pulse-maintainer
Separate a rejected lookup credential from a missing reporting scope, missing host and ordinary reporting failure. Distinguish the normal silent-token install from bootstrap enrolment, reuse the bounded private log reader and preserve credentials and identity while finding the failing stage.
Contract-Neutral: Documentation-only authentication triage; no runtime, API, authorization or installer behaviour changes.
Change-source: pulse-maintainer
pulse-triage[bot]