PR #2341 Core E2E run 36660586289 fails its desktop and phone PBS target assertions because the old fixture supplies only labels and a non-contract pbs.hostname. The reviewed identity repair requires reported pbs.nodeName or an explicit Agent link. Supply nodeName and retain the expected guest/standalone History targets and wrong-target rejection. No runtime behavior changes.
Contract-Neutral: Integration-fixture machine identity only; existing History assertions and runtime contracts are unchanged.
Change-source: pulse-maintainer
Advance the provider control-plane source builder and integration mock builder
on Pulse PR #2275's reviewed 1.26.8 Alpine digest. Keep their exact compiler
image locked by an installability proof and record what this does not qualify.
The published prebuilt runtime path is unchanged.
Change-source: pulse-maintainer
#2309 reworded the empty setup-complete next step so it no longer
promises temperatures and SMART on every Proxmox host, but the
stable-tier E2E spec `30-setup-platform-connections-handoff` still
waited for the old sentence. Core E2E has failed on main since that
merge. This expects the current English copy; every other string the
spec asserts is present in source.
#2309 reworded the empty setup-complete next step so it no longer
promises temperatures and SMART on every Proxmox host, but the stable
tier E2E spec still waited for the old sentence. Core E2E has failed on
main since that merge. Expect the current English copy.
Contract-Neutral: Test copy follows #2309; no runtime change
Issue #905 asked for every AI entry point to disappear when AI is
switched off, and the Assistant launcher still honours that through the
assistantEnabled session capability. Patrol did not: v6 added it as a
permanent top-level tab, mobile bottom-bar slot, g r shortcut and
command-palette entry, and the palette also kept offering Assistant
commands. Patrol cannot run without a configured provider, so an AI-off
install carried a tab that only led to an "off" page.
Gate all of those on the same capability as the Assistant launcher.
Settings keeps its Patrol and Assistant items and /patrol stays
reachable, so the path back to turning AI on is unchanged.
Also rename the System settings item "Pulse server updates" to
"Updates" and drop "runtime" from its description. The item already sits
in the System group, and the description still sends agent updates to
Infrastructure, which was the reason for the longer name.
The first rewrite told users that Proxmox, TrueNAS and VMware need
nothing installed, which reads as "do not put the agent on them". On
Proxmox that is wrong: the API does not report node temperatures or SMART
disk health, and the agent on each node does. TrueNAS already reports
both through its API, and ESXi hosts take no agent, so the copy now says
to start with the API and add the agent on Proxmox nodes.
Contract-Neutral: copy-only: correct first-source copy about the agent on Proxmox nodes; no runtime, API or primitive change
After security setup, the screen asked new users to choose "how the first
system should enter the unified infrastructure model: platform API
inventory, Pulse Agent telemetry, or both", under a "Choose the first
source strategy" heading. Someone who only wants their Proxmox server on
screen knows none of those terms, and this is where most never-activated
installs stop: in the week to 2026-09-28, 280 of 596 persistent installs
that never monitored anything had finished security setup and then never
configured a connection.
The screen keeps its structure and routing. The copy now says what to
do and what each path shows: connect Proxmox, TrueNAS or VMware by API
with nothing to install, add the agent for temperatures, disk health and
Docker, or both. German and Spanish follow, and the agent-lifecycle
contract records the plain-words rule.
Contract-Neutral: copy-only: plain-language first-source setup copy; owning agent-lifecycle clause updated; no runtime, API or primitive change
A failed update check never reaches the update history, because nothing
was applied, so telemetry could not tell an install whose check is broken
from one that was offered an update and ignored it. The 6.4.3-rc.1 installs
looked healthy while their check failed on every call (#2282).
The update manager now records a closed outcome for every check on the
install's effective channel (up_to_date, available, no_release,
rate_limited, network_error, metadata_error, skipped, error), tagging
lookup failures without changing their error text, and ignores previews of
another channel from Settings. Telemetry schema v18 exports update_channel,
update_check_outcome and update_available. No version, URL or error text
leaves the install. The Settings preview type, privacy disclosure, adoption
report and subsystem contracts are updated to match; the Pulse Pro receiver
change lands separately and the parity check passes against it.
The agent registration journey posts a second host report about a
second after the first and read /api/state at once. Report-driven store
refreshes now fold into one trailing refresh per 2-second window, so
the update is published within the window rather than before the report
response returns, and the journey read the first report's 42.5% CPU
instead of 75% (Core E2E "Agent registration lifecycle"). Poll
/api/state for up to 10 seconds until the update appears, then check
the remaining fields as before.
Dependabot npm-minor-patch #2189 raises @types/node 26.6.1 -> 26.6.2 in frontend-modern and tests/integration, but Canonical Governance blocks the manifest/lock change for a missing deployment-installability contract entry and frontend dependency security proof. The portal frontend part of the same group is a separate ws override refresh that needs a portal bundle decision and is owned separately, so it is not carried here.
Carry the frontend-modern and tests/integration @types/node 26.6.2 bump with a Current State contract entry and a dependencySecurity floor raise. @types/node is a dev-only declaration package and does not enter the shipped bundle; @playwright/test stays pinned at 1.56.1, so browser-test parity is unchanged. The frontend-modern offline dependency snapshot is bound to 26.6.1, so npm ci --offline cannot resolve the 26.6.2 tarball in this assignment; a host dependency acquisition is required before the suite can run against the new lockfile.
Change-source: pulse-maintainer
Refresh the pinned digests for the governed node:24-alpine, golang:1.26.8-alpine
and alpine:3.24 tags used by the release, control-plane and mock-github-server
images. Tag versions are unchanged; this picks up the current rebuilt base
layers, matching the docker dependabot policy that refreshes immutable digests
automatically while keeping tag upgrades in explicit work.
Supersedes Dependabot #2104 (node), #2137 (golang) and #2150 (alpine).
Contract-Neutral: digest-only refresh of unchanged governed image tags; no public-contract delta
Change-source: pulse-maintainer
Dependabot's npm-minor-patch group (#2138) bumps frontend-modern and tests/integration but is blocked by Canonical Governance, which requires the deployment-installability contract update and the frontend dependency security proof in the same commit. The portal frontend in the same group is split out: it needs a portal bundle rebuild and is owned separately.
Carry the frontend-modern manifest/lock bump (dompurify 3.4.15, highlight.js 11.12.0, solid-js 1.9.15, @types/node 26.6.1, typescript-eslint 8.70.0, autoprefixer 10.6.1, eslint-plugin-solid 0.18.0, postcss 8.5.28, prettier 3.9.8, vite-plugin-solid 2.11.14, vite-plugin-sri-gen 1.7.4) and the tests/integration @types/node 26.6.1 bump with a Current State contract entry and dependencySecurity floor assertions. @playwright/test stays pinned at 1.56.1, so browser-test parity is unchanged.
Change-source: pulse-maintainer
Backups fetched only PBS service rows, leaving standalone host telemetry unavailable, and rejected agents merged into PVE guests. Include PBS agent rows and reuse the deduplicated Overview inventory for unique correlation without changing the PBS drawer identity. Keep guests without agent telemetry and ambiguous identities excluded. Focused drawer and surface regressions cover missing disk data and canonical history targets.
Change-source: pulse-maintainer
Invalidate in-flight preview generations when the import plan changes or the editor unmounts. Ignore stale success, error and completion updates so another endpoint cannot inherit the prior request's impact.
The deferred-error regression fails before repair. Record the preview lifetime and unchanged setup authority in both owning contracts, with consumer boundary coverage. All 87 focused tests and two source-built Chromium desktop/narrow interaction cases pass; retain exact-content browser evidence.
Change-source: pulse-maintainer
Separate Docker SDK maintenance from the grouped dependency update so unrelated modules remain pinned. Preserve older-daemon negotiation and container recreation payloads with real HTTP compatibility fixtures, and ensure dependency-only changes invalidate cached development binaries.
Change-source: pulse-maintainer
Activate the offline default context before mobile organization audits. Preserve visible session controls without page overflow, with real-backend Chromium and WebKit proof.
Change-source: pulse-maintainer
Keep a loopback ephemeral issuer alive for source-built managed browser runs and activate each organisation through the authenticated API. Verify installation bindings without billing-state injection or signature bypass, and retain a narrow CI provisioning proof separately from quarantine acceptance.
Change-source: pulse-maintainer
Retained Safari failures scroll window even though the app shell owns Settings overflow. Traverse and measure the same content owner, and include its horizontal scroll width so nested overflow cannot falsely pass. Add Chromium/WebKit geometry proof at three phone widths with a window-scroll negative control.
Change-source: pulse-maintainer
The retained Chromium failure snapshot contains the warning and all capability evidence. Match its current sentence punctuation without relaxing readiness checks or changing production behaviour.
Change-source: pulse-maintainer
The hosted Settings failure stalls during bootstrap without enough evidence to separate server delay from browser scheduling. Attach redacted, bounded cookie-session HTTP timings alongside browser response timings without weakening readiness or layout assertions.
Change-source: pulse-maintainer
The real-backend persistence check covered only the saved path. Assert that reload discards an unsaved recovery edit before saving it, so browser-only state cannot be mistaken for persisted operator intent. Retain reload and real startup checks after Save.
Change-source: pulse-maintainer
Exercise the production Schedule control and real configuration API on an owned local backend without alert endpoint mocks. Keep persistence evidence distinct from installed notification delivery.
Change-source: pulse-maintainer
The application preflight stayed visible because Playwright enabled focus emulation on another CDP session. Disable that override in an opt-in loopback transport without fabricating visibility or weakening assertions. Preserve the ordinary fixtures and prior adverse evidence.
Change-source: pulse-maintainer
Exercise the real history row before native background and explicit refresh. Keep the opt-in headed check and its observed visibility failure distinct from passing component coverage and installed acceptance.
Change-source: pulse-maintainer
A canonical snapshot can omit memory after the producer marks its Proxmox
facet unavailable. Retaining the previous display metric hides withdrawal
and leaves a stale percentage visible. Clear that explicit transition in
full and fast merges and emit the corresponding store operation, preserving
ordinary partial omission and trusted canonical metrics including zero.
Pin withdrawal and recovery with adapter tests and desktop/narrow Chromium
acceptance. Workload details remain canonical-only; do not invent raw totals
or Usage UI. Record inspected screenshots and matching subsystem contracts.
Change-source: pulse-maintainer
Exercise canonical REST and socket snapshots through the Proxmox table and guest drawer for issue #1962. Preserve platform fallback and measured-zero presentation without substituting nested agent memory; backend polling remains separately qualified.
Change-source: pulse-maintainer
The populated Ceph thresholds browser test reproduced Space on the disclosure moving focus to search instead of collapsing it. Leave Space to buttons, summaries and role buttons, while preserving ordinary type-to-search input. Protect the keyboard journey with a full collapsed focus cycle and reopened action focus, plus focused hook coverage. Chromium failed before this repair and passes after it; 59 focused unit tests pass.
Change-source: pulse-maintainer
Fresh multi-tenant browser runs reproduced desktop-title expectations on mobile organization panels. Match the compact navigation labels, update the server-updates title, and assert canonical URLs including the legacy AI route redirect. All 33 settings-shell checks pass across Chromium, mobile Chrome and mobile Safari; production presentation policy is unchanged.
Change-source: pulse-maintainer
The multi-tenant bootstrap granted white_label, which security/status maps to commercial suppression. Settings shell tests then reached General instead of the expected billing pages. Keep the shared fixture non-white-label and assert that both general-purpose profiles exclude this presentation-changing entitlement. Dedicated commercial-boundary tests and production policy are unchanged.
Change-source: pulse-maintainer
The setup fixtures omitted the owner identity required by supported API-key authentication, so they stopped at local validation rather than exercising test, preview, save and capacity denial. Supply the owner and assert it reaches test and create payloads; retain a browser assertion that a missing owner sends no test request.
Validation: reproduced both original Chromium failures and inspected the missing-owner screenshot; corrected spec passes 3/3 with no retries using pulse-heavy-run. Focused TrueNAS state tests pass 36/36 and E2E tier selection passes. No runtime or tier changes.
Change-source: pulse-maintainer
Run 34005581846 reports duplicate incident-count matches in the main page and mobile investigation sheet. Scope the existing count assertion to the active surface without selecting an arbitrary count match or changing product behaviour. Remove the unused panel locator. Browser requalification remains required; only diff whitespace validation was run locally.
Change-source: pulse-maintainer
Existing browser qualification only compared unchanged navigation. Exercise genuine backend acknowledgement and empty active-alert responses while browser reads are interrupted, then assert rendered recovery without reload. Bind the target to the current generated estate and follow acknowledgement through list windowing. Both focused cases and the complete ten-case recovery matrix pass.
Change-source: pulse-maintainer
Existing phone receipts cover 390px, whereas reflow guidance includes 320px cell content. Extend the opt-in navigation and text-bound checks without changing product behaviour. Preserve the stronger single-line label requirement at 390px while allowing wrapping at 320px. Record the initial one-pass/one-failure diagnostic and the cancelled queued final rerun explicitly; final test revision remains browser-unqualified.
Change-source: pulse-maintainer
Chromium receipts showed that the phone table clipped update badges without any horizontal path to recover the text. Wrap existing labels within reduced cell padding and allow expanded drawer names to wrap, preserving Android page-owned scrolling and existing action semantics. Add real text-bound and heading assertions and retain six passing reconnect cases plus inspected synthetic screenshots.
Change-source: pulse-maintainer
Close the missing third-organisation and real shell SIGTERM evidence without expanding product scope. Retain measured narrow-table clipping and accessible-name evidence so follow-up repairs preserve Android vertical gesture ownership rather than assuming horizontal scroll access.
Validation: eight Chromium admission cases, two local-backend narrow socket/access runs, real Compose/Playwright SIGTERM cleanup, twelve focused shell tests, and diff checks passed. No installed release or physical-device qualification.
Change-source: pulse-maintainer
Close the unfinished browser evidence gap without extending UI scope. Exercise admission races and subsequent current-organisation reconnect requests, and use 390x844 for populated socket recovery so retained screenshots expose the remaining table clipping rather than implying mobile layout acceptance.
Change-source: pulse-maintainer
Process fixtures did not prove that browser-generated artefacts finish before supervisor cleanup. Exercise real Chromium late cookie, screenshot, trace and video writers for all three catchable signals, while keeping full-stack qualification limits explicit.
Change-source: pulse-maintainer
Shell-only signal traps could leave browser descendants writing sensitive state after cleanup, and simultaneous runs shared the same cookie cache. Give the Linux qualification runner an invocation-owned cookie root and a child-subreaper supervisor so catchable interruption waits for writers before removing owned artifacts. Preserve normal reports for inspection and fail closed if writers cannot be reaped. Focused fixtures cover all three signals, late detached writers, concurrent isolation and forced termination; no real-browser cleanup or release readiness is claimed.
Change-source: pulse-maintainer
Scoped local sessions correctly lose privileged security-status fields, but Settings relied on the configured admin username and hid owner controls. Expose the validated current principal without broadening capabilities, and use it for organisation identity.
Include the API and dependent subsystem contracts, recognised payload and settings-shell tests, and a source-bound desktop/narrow browser receipt in this commit. Fresh matrices each pass six scenarios with one expected disabled-feature skip. Admission/reconnect and interruption cleanup remain separate unfinished qualification.
Change-source: pulse-maintainer
Reproduced the restricted primary token being refused after organisation reload. Keep token isolation intact and exercise the sharing flow with a cookie session, with explicit authentication preconditions.
The diagnostic still fails on missing acceptance controls; retain that failure, quarantine and exact runtime receipts. Record process-group TERM cleanup limits rather than claiming complete artifact cleanup.
Change-source: pulse-maintainer
The shell multi-tenant suite previously selected a spec ignored by every project, preventing real backend diagnosis. Add an explicit desktop-only configuration that rejects tier identity, while retaining the normal quarantine. Cover discovery and tier refusal and document the evidence boundaries. A local source-built diagnostic returned five passes, one failure at organisation-switch login, and one skip; this is not release qualification.
Change-source: pulse-maintainer
Concurrent qualification runs could overwrite shared browser artifacts and authentication state, while an inherited PLAYWRIGHT_BASE_URL could send browser traffic outside the shell-owned stack. Scope outputs and fixture credentials to each invocation and clear that endpoint override so isolation evidence refers to the intended stack.
Focused runner checks cover inherited overrides and cleanup. Recorded concurrent Docker diagnostics reached healthy stacks but browser execution remained blocked by the existing multi-tenant quarantine; this test-only repair does not claim browser or release qualification and changes no user-visible application surface.
Change-source: pulse-maintainer
Integrate the reviewed source-stage selection and run-owned entitlement targeting on top of the existing teardown-failure guard. The merge preserves the candidate commit unchanged and combines compatible qualification harness repairs.
Change-source: pulse-maintainer
The integration runner otherwise selects the final prebuilt-agent Docker stage, which requires release payload inputs and prevents source-server qualification. Entitlement helpers also use a legacy container variable and inherited overrides that can target an unrelated runtime. Select the source-server stage explicitly and bind the managed shell path to its run-owned server, with regression assertions for both behaviours.
Contract-Neutral: integration harness and regression tests only; no product surface or runtime contract changes.
Change-source: pulse-maintainer
Reproduced startup, health and entitlement failures continuing through all ten suites despite failed teardown. Use the same fatal teardown guard on setup and port discovery failures so later scenarios cannot inherit dirty state.
Contract-Neutral: qualification harness only; no user-visible product surface. Focused stubbed runner tests and bash syntax checks pass; no runtime qualification claimed.
Change-source: pulse-maintainer
The independently reviewed runner changes add per-invocation project flags, generated identities, and allocated-port discovery before teardown. Model those calls so the teardown regression reaches and verifies the failure it is intended to guard.
Contract-Neutral: combined integration-harness test correction only; no product surface changes.
Change-source: pulse-maintainer
pulse-triage[bot]