Distinguish global cancellation from quiet-hours holds, queued policy skips from provider receipt, and settings changes from recall or credential revocation. Add connected sender and persistent-queue controls, and run the existing notification guidance suites in docs-only CI.
Contract-Neutral: Documentation, mirrors, tests and documentation-only CI describe existing notification behaviour; no runtime, API, permission, schema, dependency or user-visible feature contract changes.
Change-source: pulse-maintainer
Describe the integrated collector gates, explicit opt-out readback, legacy mail defaults and next-poll limits without treating dataset switches as a connection pause. Retain the verified v6.5.0 warning and incomplete-reading/alert safeguards in the existing guide and shipped mirror.
Contract-Neutral: Documentation and source-bound guidance tests only; no runtime, API, schema, permission or navigation change.
Change-source: pulse-maintainer
Preserve the exact reviewed candidate. Combine PBS and audit safety selections without dropping prior agent-profile coverage, matching both trigger lists, command and adapter. Pro remains unchanged; source help is not installed delivery acceptance.
Change-source: pulse-maintainer
Preserve the exact two-commit candidate and retained final documentation proof. Resolve safety-list conflicts by retaining both agent-profile and PBS suites in triggers, command and adapter; no frontend source resolution.
Change-source: pulse-maintainer
Distinguish audit forwarding from alert notifications, document bounded best-effort delivery and safe reconciliation, and correct receiver, signature and key-storage advice. Bind the existing guide to source and run its safety checks in docs-only CI.
Contract-Neutral: Documentation and static guidance checks only; no audit runtime, API, signature, queue, authority or deployment behaviour changes.
Change-source: pulse-maintainer
Correct the inherited PBS-via-PVE badge assumption using the production source presentation and inventory read states. Preserve the existing help anchor, distinguish PVE files from guest snapshots, and bind guidance regressions to actual source labels.
Change-source: pulse-maintainer
Replace the unconditional direct-connection fix with existing-source, evaluation and identity checks. Preserve backups, credentials and deployment state while collecting bounded evidence, and select the existing PBS recipe suite in docs-only CI.
Change-source: pulse-maintainer
Distinguish metrics from commands, live host refresh from startup-only settings, and desired configuration from verified application. Preserve local privacy opt-outs and make profile API IDs, scopes, uncertain writes and removal limits explicit in both existing help entry points. Exercise the source-bound safety guidance in docs-only CI.
Contract-Neutral: Documentation and static guidance checks only; no agent authority, runtime, API or deployment contract changes.
Change-source: pulse-maintainer
Keep failed age evaluation separate from backup failure, retained alerts and native recovery. Reuse bounded incident logs and preserve the intended policy, backup data and guest-safety checks. Cover the missing guidance and reconcile its existing cleanup source assertions with the reviewed fail-closed helper.
Change-source: pulse-maintainer
Include the new production boundary suite in the existing Public docs path triggers and smoke command. Check actual command selection and fail-closed handling with disposable adapters, without dependency installation or provider operations.
Contract-Neutral: Registers the production documentation regression suite in existing read-only docs CI; no runtime, release or deployment behaviour changes.
Change-source: pulse-maintainer
Make API-only guest-agent activity and backup precautions explicit, isolate disruptive rollout checks, preserve paid runtime and recovery data during updates, and remove retired Relay/Mobile upgrade claims. Bind the existing guide and shipped mirror to safety and edition guidance.
Contract-Neutral: Existing production guidance and regression checks only; no runtime, entitlement, route or deployment contract changes.
Change-source: pulse-maintainer
Additively incorporate exact upstream main 533027ee06 without rewriting accepted maintenance. Resolve the storage-recovery contract insertion by retaining both the reviewed silent-source History fence and upstream SAML/method constraints. No runtime conflict resolution is introduced; final-content evidence and exact-head checks remain required before publication.
Change-source: pulse-maintainer
Observe every timer, updater and server before mutation; refuse configuration deletion on uncertain quiescence and restore only prior-active servers and recorded timer states. Keep roles independent of accepted custom service names and never replay an interrupted updater. Exercise actual sourced paths and adverse controls. Move existing Windows native-exit assertions unchanged to their registry-named completion file without relaxing checks.
Change-source: pulse-maintainer
Share existing list time validation across audit reads so malformed, empty or non-increasing supplied bounds cannot silently widen an investigation. Preserve absent filters, access and tenant gates, export formats and existing pagination boundaries; reject invalid export success booleans before reading events. Pin actual handlers and exporter with fake persistent loggers, including no-query rejection and tenant isolation, and update both copies of the audit guide.
Change-source: pulse-maintainer
Since 4edf5f8265, ChatRequest in internal/api/ai_handler.go has no
autonomous_mode field: Go's decoder drops it and HandleChat passes
approval-required mode into the chat service for every /api/ai/chat
request. The browser still serialized autonomous_mode from its send
options, and the eval runner kept a per-step override that sent it too,
so both read as if the client chose the execution mode while the server
ignored it.
Drop the field from AIChatAPI.chat, SendMessageOptions,
ChatMessageRequestContext and the clone, retry and restore helpers, and
Step.AutonomousMode from internal/ai/eval. aiChatStore.context's
autonomousMode stays as a drawer-only flag, so scoped handoffs still show
"Ask first" and "Approval required before any action." Tests now assert
the request carries no autonomous_mode; the backend test proving a stale
client's autonomous_mode:true cannot elevate a request stays.
Contract prose that described autonomous_mode:false as a per-request
override set by the browser now describes the server-set mode and the
drawer disclosure.
Use the existing API helper for list, summary, export and verify examples. Explain list pagination versus export scope and preserve partial/error evidence. Exercise the copied recipes with private synthetic bodies, both auth headers, HTTP errors, redirects and incomplete transfers.
Contract-Neutral: Documentation and copied-recipe safety tests only; no audit runtime, API or frontend behaviour changes.
Change-source: pulse-maintainer
Contain destructive installer removal when systemd observation, stop or disable is uncertain. Stop the updater before the server, reconcile default aliases and local legacy units, and preserve files on refusal. Propagate failed legacy-key replacement even in conditional cleanup. Exercise both removal entrypoints and instance isolation in confined fixtures.
Change-source: pulse-maintainer
Preserve Delivery exact candidate 99d7b5e671 and both independently reviewed installability contract sections. The only conflict resolution combines documentation; runtime and verification bytes remain exactly as proved. Retained component suites pass while two enclosing assertions fail, and no native workload recovery is established.
Change-source: pulse-maintainer
Preserve Core exact candidate 0b9bd4beb6 and its retained source proof; installed recovery and the historical timeout cause remain separate.
Change-source: pulse-maintainer
Retain the upstream contract and lookup repair already present when review began, without expanding candidate source scope.
Change-source: pulse-maintainer
Separate browser-cookie lifetime, sliding server sessions and request-driven token refresh. Remove the false provider-change revocation promise, preserve administrator access and document the existing targeted user-removal boundary and private diagnosis.
Contract-Neutral: Documentation and source-consistency tests only; no authentication, session, authorisation or deployment contract changes.
Change-source: pulse-maintainer
Contract prose still described surfaces that no longer exist:
- `frontend-primitives.md` told new route-level copy to extend
`problemResourcePresentation` (deleted in ae65c5e9a2), tied that helper
to `ProblemResourcesTable.tsx` (deleted with the dashboard overview in
c743a231b8), and kept a readability rule for that table and the
dashboard Pulse Brief. No live surface implements the rule; Patrol's
grouping and affected-resource counts are governed in
`patrol-intelligence.md`. The ownership paragraph and the rule are
dropped, and problem-resource joins the list of deleted dashboard
helpers that must not return.
- `unified-resources.md` said the change and correlation summary cards
default Infrastructure resource-filter links for the Patrol page and the
problem-resource dashboard panels. Since the 2026-05-16 drilldown
retirement the cards have no link default and render only in the
resource drawer, which passes no link builder.
- `api-contracts.md` named the dashboard Pulse Brief as a sender of
`autonomous_mode:false` and described the field as a client override.
Since 4edf5f8265, `ChatRequest` has no such field: the server runs every
`/api/ai/chat` exchange in approval-required mode (pinned by
`TestHandleChat_CannotElevateAutonomousModePerRequest`), and the field
is dropped at decode.
The new `subsystem_lookup_test.py` case pins the deleted helper as
unowned, next to the other retired dashboard paths.
Verification: `contract_audit.py`, `registry_audit.py` and
`status_audit.py` pass with `--check`; the retired-path lookup tests
pass (9/9); the full pre-commit battery passed. No frontend or backend
runtime files change.
Account for every byte in the root-boundary compatibility reader, preserving descriptor-first recovery and rejecting oversized valid prefixes, multiple identities and discarded NULs. Keep the original two-second fixture budget, contain descendant processes and report build/probe timing separately. Add real-agent, legacy and cancellation controls without claiming a cause for the retained timeout.
Change-source: pulse-maintainer
Replace incomplete provider snippets with the existing authenticator and header-replacement requirements. Surface the all-users-admin default before enablement and stop copied diagnostics on bounded transport failure, preserving credentials and actual access checks.
Contract-Neutral: Documentation and synthetic recipe tests only; proxy authentication semantics and runtime contracts are unchanged.
Change-source: pulse-maintainer
Require stopped-state readback before each LXC mutation, reject failed pct set fallback, preserve snapshot entries and only-prior-active restoration, and return incomplete cleanup without removing recovery files. Add isolated adverse lifecycle and completion controls.
Change-source: pulse-maintainer
Retain exact commit 18df4c1b46. Executable identity and bounded successful version probes replace metadata-only acceptance, retaining rollback and prior-active restoration. Source-uy8hwdan contains passing 24 focused methods and 191 subcases with vet; enclosing exit 1 from the incorrect control count and the independent broad installer failure remain adverse evidence, not cleared.
Change-source: pulse-maintainer
Retain exact commits 953e0c6dec and 2ffb4eb8ab. Existing cleanup guidance discloses LXC disruption, preserves recovery evidence and API access, and requires planned maintenance and real postconditions. Hash-bound source-4e_1ht9i proves the documentation controls, not native cleanup or shipped relief.
Change-source: pulse-maintainer
Reject successful installers whose replacement cannot identify itself as the target community runtime. VERSION metadata and failed or unrecognised probes cannot establish acceptance; retain the existing verified rollback and prior-active restoration. Exercise the complete locally signed installer transaction and bounded executable read.
Change-source: pulse-maintainer
The existing argv test now exercises the one documented non-purging cleanup instead of the two removed destructive examples. Retarget and ordinary agent uninstall checks are retained.
Contract-Neutral: Documentation test expectations only; no runtime or installer change.
Change-source: pulse-maintainer
Treat the existing helper as disruptive Proxmox host maintenance: disclose its LXC stop/start and key-removal scope, omit purge and API-account deletion, and require pre-state, private backups and actual postconditions. Exercise copied success/failure arguments with a synthetic helper and bind safety prose to current source.
Contract-Neutral: Documentation and documentation tests only; the cleanup helper, privileges and runtime contracts are unchanged.
Change-source: pulse-maintainer
Accept the exact Delivery candidate and its complete source-s468dla1 installer proof. The final repair removes only contract EOF whitespace; installer and regression-test bytes are unchanged. Native installed recovery and protected publication remain separate.
Change-source: pulse-maintainer
Accept product-intelligence candidate 20261007T180421Z-product-intelligence at exact tip 2209c65e8c. Preserve the existing ZFS row and health contract while replacing blanket permission grants and masked log reads with configured-token, deployment-scoped guidance. Retained source-3rssfcmh passes fifteen affected methods and rejects parent plus adverse controls; this is source help, not native recovery or publication.
Change-source: pulse-maintainer
The installer rereads saved preferences without an explicit selector. Forward the parsed stable default as well as RC, and prove the containing installer's actual channel-selection functions against the same signed fixtures.
Change-source: pulse-maintainer
The exact-source adverse control restored a guessed-account ACL command in inline Markdown without rejection. Parse fenced shell and single-line inline commands separately so triple backticks cannot hide a later permission mutation.
Contract-Neutral: Documentation safety test repair only; no runtime or permission contract delta.
Change-source: pulse-maintainer
Additively incorporate upstream 843daf7ae3 without removing accepted source. Resolve the overlapping AI documentation assertion by preserving its whitespace-normalized compatibility check together with upstream dead-Patrol guidance. The focused documentation policy tests pass; browser and final-source validation dependencies remain explicit.
Change-source: pulse-maintainer
Keep the same safety assertion with the lower-case clause used by the guide; the first local assertion failed on capitalisation, not reader behaviour.
Contract-Neutral: Documentation test wording only; no runtime or contract delta.
Change-source: pulse-maintainer
Separate missing storage rows, capacity and pool health; remove blanket guessed-account ACL advice and user-only permission checks. Reuse bounded server log guidance on the actual Pulse host, preserving native health checks and private evidence.
Contract-Neutral: Existing documentation and safety controls only; no runtime, API, feature or permission contract change.
Change-source: pulse-maintainer
Stop the generated helper before downloads when saved channel evidence is malformed or unreadable. Preserve explicit selectors, source-marker precedence and signed-installer verification; exercise the actual helper with signed local fixtures.
Change-source: pulse-maintainer
Preserve the three reviewed Web commits and their exact source proof. Existing help separates classification from stale inventory without disruptive diagnostics.
Change-source: pulse-maintainer
frontend-primitives.md still told new route-level copy to extend
problemResourcePresentation, deleted in ae65c5e9a2, and kept a paragraph
tying that helper to ProblemResourcesTable.tsx, deleted with the dashboard
overview in c743a231b8. It also kept a readability rule for that table and
the dashboard Pulse Brief. Neither surface exists and no live surface
implements the rule; Patrol's grouping and affected-resource counts are
governed in patrol-intelligence.md. Drop the ownership paragraph and the
rule, and list problem-resource among the deleted dashboard helpers that
must not return.
unified-resources.md still said the change and correlation summary cards
default Infrastructure resource-filter links for the Patrol page and the
problem-resource dashboard panels. Since the 2026-05-16 drilldown
retirement the cards have no link default and render only in the resource
drawer, which passes no link builder, so labels show as plain text.
api-contracts.md named the dashboard Pulse Brief as a sender of
autonomous_mode:false and described that field as a client override. Since
4edf5f8265 ChatRequest has no autonomous_mode field: the server runs every
/api/ai/chat exchange in approval-required mode, as
TestHandleChat_CannotElevateAutonomousModePerRequest pins, and the field
that scoped handoffs still send is dropped at decode. Say so, and stop
calling Patrol finding handoffs stricter than ordinary chat.
The new lookup test pins the deleted helper as unowned, next to the other
retired dashboard paths, so the dropped ownership claim cannot come back
through the registry unnoticed.
Replace indefinite journal followers, a failure-masking search and diagnostic debug/restart advice with one shared deadline-bounded reader. Preserve failed reads and both streams, identify the affected agent host and keep raw errors private. Exercise copied commands with missing-tool, partial-failure, timeout and termination controls; no native recovery claim.
Contract-Neutral: Existing agent-help recipes and executable documentation controls only; agent, installation, collection, command-channel, permission and notification runtime contracts are unchanged.
Change-source: pulse-maintainer
Clarify Test versus ordinary delivery and message identity in the existing optional evidence fields. Preserve original queue context without sending, replaying or exposing destination secrets; pin both form schemas and the mirrored triage guide.
Contract-Neutral: Report guidance and its static checks only; no runtime, notification delivery or intake automation change.
Change-source: pulse-maintainer
pulse-triage[bot]