On 30 Sep and 1 Oct two new advisories (brace-expansion
GHSA-q2hr-2g5m-vwhr, DOMPurify GHSA-p98j-92pf-mc4p) failed the required
frontend audit on every PR across main, release/v6.4 and release/v6.5,
holding the v6.5 RC for days and blocking the v6.4.6 preparation. The
existing scheduled npm-audit is informational and only sees main. This
adds a daily workflow that runs the same complete frontend audit as
Build and Test on main and every active release line, fails on any
finding, and names the branch, advisories and fix. The maintainer's
release-path health check raises it to Delivery immediately.
On 30 Sep-1 Oct 2026 GHSA-q2hr-2g5m-vwhr (brace-expansion) and
GHSA-p98j-92pf-mc4p (DOMPurify) failed the required "Audit complete
frontend dependency graph" step on every pull request to main,
release/v6.4 and release/v6.5. That held the v6.4.6 preparation PR and
the v6.5 RC for days with no owner. The scheduled audit in
security-scan.yml only informs and runs on the default branch, so
release lines were never checked.
dependency-advisory-watch.yml runs daily and on dispatch. It lists main
plus every release/v<major>.<minor> line at or newer than the latest
stable's line (all lines if that lookup fails), then audits each in a
fail-fast-free matrix. Each job fetches only that line's
frontend-modern/package.json and package-lock.json with git and runs
scripts/npm-audit-retry.sh all on them under the same Node.js pin that
build-and-test requires. npm audit reads the lockfile, so nothing is
installed. The job never checks out or runs the audited branch's code,
because a scheduled run holds the default branch's cache scope and
CodeQL flagged running npm ci there as cache poisoning.
A job fails when the audit fails, and its step summary and annotation
name the branch, the GHSA ids and the fix (npm audit fix
--package-lock-only plus raised floors in dependencySecurity.test.ts).
Read-only, hosted-only, no secrets, no uploads.
Accept the exact Product intelligence candidate with private-file API recipes, accurate export and recovery guidance, scoped key revocation and retirement wording. Preserve existing authentication and entitlement authority; retained focused source and browser evidence covers the unchanged documentation content.
Change-source: pulse-maintainer
## What changed and why
PBS setup safety checks now match the credential-safe guide without
treating explanatory TLS warnings as executable commands. The checks
retain read-only API identities, private token-file permissions,
inspected HTTPS downloads and failure-stop requirements; they cover
bash, sh and shell examples. The synthetic TLS server explicitly
requires TLS 1.2 and has a regression assertion for that floor.
This reconciles reviewed fixture repairs with the previously published
safe guidance. No product runtime, dependency, version or release
metadata changes are included.
## Included source
Complete `pulse` range
`a7a4a9aa417a1cd73e016d7448b8d2428bbfba00..cafe38823f6db9864bb671c0ab3ea3a87cf887ba`:
- Reviewed Delivery candidate
`0955ddf9e0b48b9571771c04a27aa354db796055`, containing TLS fixture
`ff3d05be49a3b067637107f83298066745dc5a1e` and bootstrap guards
`2a8134035846a3bb3e0097a921a0f068edee1394` /
`0955ddf9e0b48b9571771c04a27aa354db796055`.
- Additive integration `ac34b6f4618161485df40fb7bb12d4c2bf949cf7`
retains the stronger canonical safety assertions; upstream
reconciliation `cafe38823f6db9864bb671c0ab3ea3a87cf887ba` retains the
current published main frontier. Every reviewed commit identity is
preserved.
## Validation and limits
Recorded candidate evidence includes ten executable PBS controls
(`source-ozwv0j9x`); final candidate `source-rf2cmnzr` passed the
selected Go packages and PBS cases before failing a renderer import
invocation. Corrected renderer-only `source-h5pd_tbz` passed 44 cases on
the same candidate; the failed wrapper is not an overall pass.
Fresh publication provenance, whitespace and all three non-merge
per-commit completion/browser guards pass; browser checks skip correctly
because no frontend source changed. All 62 shipped-document mirrors and
211 public Markdown checks pass.
A fresh broad repoctl attempt (`source-axg1lvbp`) failed two
cross-repository evidence tests because the single-module disposable
guest has no Pro/Enterprise sibling checkout; its chained Python phase
did not run. It is retained as failed evidence, not a complete suite
pass. The narrowed reconciliation proof below tests the actual changed
assertions and TLS recipes without bypassing those cross-repository
checks.
Exact-head required checks and independent review still govern landing.
Synthetic credentials and guest-local TLS are not actual PBS
installation, reporter acceptance, release qualification or availability
in a release.
Fresh exact integrated-head reconciliation `source-nr9x7ary` passes both
changed Go assertion tests and all ten executable PBS recipe/TLS
controls (exit 0) at `cafe38823f6db9864bb671c0ab3ea3a87cf887ba` in the
standard offline source-proof VM.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
## What changed and why
This batch repairs existing setup, administration and History surfaces:
- PBS and agent guides keep tokens out of shell history and process
arguments, prefer read-only identities, and require verified HTTPS
downloads saved for inspection. Fleet/action, RBAC, audit and
organisation examples use private header files, supported schemas,
signed-in session-only mutations, custom-role operations and private
exports.
- Generated Proxmox setup separates credential reveal from copied
commands and uses private-file handoffs. Download/preflight, permission,
identity and cleanup boundaries remain intact.
- Shared tables regain first-touch activation without swallowing
embedded controls or keyboard disclosure. Sparse drawer History displays
real stored observations without inventing trends, labels current
fallbacks honestly, and explains empty windows.
- Demo chart series reuse graph-version-bound metric samplers rather
than rebuilding the whole estate for every series, preserving values and
isolation.
- Release-note validation accepts authored grouped notes while retaining
identity and safety checks; qualification binds the complete current
source rather than an incomplete filesystem list.
These are repairs to existing behaviour and unsafe or inaccurate
guidance, not new features or permissions. PBS source/browser
improvements do not establish complete installed resolution of the mixed
#1723 report.
## Included source
Complete unpublished `pulse` range
`e5082c5fb1be8f8882275338d8b9f088b6a41cc4..f047d7b5db78ef1e3ca0b84de4fe2f6c43a9311c`.
This extends the former PR #2362 head
`704f4eeb4ef4f29cb0341d847665516b315cc24a`, whose workflows have
completed, rather than restarting an actively checking proposal.
Reviewed candidates and their additive integrations:
- PBS guidance `a5c8b5d59799c7cf43af0f0fc7e796722c95fe7f`, integrated at
`6a47dad9ce60a3814ad08de0814dff84493b5453`.
- Touch-row candidate `88f52387af1fe6ebd6554acd49320a2e5927c0e8` and
lint correction `12c8a7aba39bd8457f541ca0b1cc045893aed5db`, integrated
at `36418af66beac94204276f7dc73de2c41e297fb1`.
- Agent guidance `d5c187613a68e6e891ae9a5b6dbfd6154cea1844`, integrated
at `9bbbc7a817274ab13b9c20b2119f46edd94d2109`; fleet/action guidance
`704f4eeb4ef4f29cb0341d847665516b315cc24a`.
- Sparse History candidate `b405f8d99b252bfc0e8773914fe07c96e2ab7f59`,
retaining runtime `ec372845541fd0a79800b9ccadd7f4972be5e836`, integrated
at `a5347278430342fd805e758897c00ce187579d66`.
- Release-note/qualification candidate
`90c80acb493eb4ff6a789b184a794b87b4a6d538`, integrated at
`22380a35460a255ac4d60e20549e959875ccbc21`.
- Private-bootstrap/demo sampler candidate
`cf12c37e6302883e66039078d6e504b1014b26cc`, integrated at
`0832be112f024f5a6dd695da42b134e9039c2840`.
- Administration guidance `0c3cd4fb3ad1a32cb7ddb00b0992a53991594b79`
(three own commits), integrated at
`7d5c6eb0045f94481ae3147476187e9ad2eeccda`.
- Additive corrections `0fd47f7ebf5da8588d62b9f81b336b5267e3430d` and
`5116c2a2d9e49e83e794d23cf99e40c240e51ad9` reconcile the PBS guard and
explicit TLS fixture floor with accepted safe guidance and current
release direction.
- Upstream merges `f5e305d4c9494830743a140bbb1f951694555c38` and
`f047d7b5db78ef1e3ca0b84de4fe2f6c43a9311c` retain published ancestry,
including upstream's independent shadow lifecycle rehearsal. No accepted
identity was rewritten.
## Validation and adverse evidence
Sufficient existing candidate evidence is reused, with fresh bounded
reconciliation checks:
- PBS `source-1bj5m4w1`: 28 checks; frontend documentation/build/budgets
`source-dz1jcq79`. Fleet/action `source-cb0mkbhb`: nine executable guide
tests; frontend `source-qynvs3_n`, 32 browser checks/four inspected
screenshots. Agent guidance has six executable fixture tests, including
private-file permissions and filename-only handoffs.
- Touch candidate: four WebKit/Chromium/Firefox phone/desktop cases,
embedded-control and keyboard assertions, 12 inspected screenshots.
Sparse History final `source-nha4kbvo`: formatting and 121 affected
tests; predecessor full type/lint/test/build/budget proof and four
browser passes/32 inspected screenshots. Parallel `source-_d931osk`
failed one existing window-test timeout; that result remains adverse,
not an overall pass.
- Bootstrap/demo `source-rlyqg2wg`: full affected
configapi/hostagent/mock/monitoring/installtests race suites and
affected API cases; `source-p2vo7bpw`: affected vet and actual
frontend/server/agent builds. `source-l681cvrh` records frontend
type-check and 21,612 tests; browser matrix covers PVE/PBS desktop and
emulated phones with eight inspected screenshots. Earlier full API
timeout and output-limit attempts remain unresolved, not passing
receipts.
- Release-note closure `source-ig3ted7j`: complete install suite and 942
Python cases/eight skips on its recorded source. Final fixture
correction `source-in4fqcsx` passes authored-note tests and seven
negative safety/identity subcases.
- Administration `source-_klnz0rf`: 55 documentation tests, 26 API
tests, authentication tests and documentation audits. Frontend
`source-lrr0gmox`: 50 documentation tests/build/budgets; 41 browser
checks/eight inspected images.
Fresh full-range provenance and whitespace pass. All 23 unpublished
non-merge commits pass the prescribed per-commit completion/browser
checks using their recorded Contract-Neutral reasons where applicable;
aggregate browser coverage binds all six changed frontend runtime paths.
All 62 shipped-doc mirrors and 211 public Markdown checks pass. A naive
aggregate shape check fails because it cannot honour those per-commit
reasons; the workflow-prescribed per-commit check passes. The repaired
PBS required/forbidden source assertions were separately checked against
the final text. An optional additional source-VM check was cancelled
while queued, before execution: no receipt or pass is claimed.
Former-head CI runs `36829661316` and `36829661309` failed the retired
credential-bearing PBS assertion; the accepted additive corrections
replace it. The former CodeQL finding concerned the local TLS fixture's
implicit protocol floor, now explicit. Former advisory benchmark
`ConcurrentReadWrite-4` remains failed: 906.4→1007.7 µs, +11.17%,
p=.011, n=10. Its former candidate and base have identical Go
sources/manifests, but this does not prove the cause or turn the
measurement green. The observation is retained for independent Delivery
assessment; fresh exact-head CI remains necessary for the expanded
batch.
Required exact-head checks and independent review govern landing. These
are synthetic/source proofs, not physical-device acceptance, native
installation/recovery, complete PBS reporter acceptance, deployed
activation, release qualification or availability in a release.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Use private header and passphrase files for copied API requests, check protected access instead of public health, and preserve actual transfer and lockout permissions. Replace unsafe legacy credential setup and key cleanup, explain deployment-specific recovery, and align existing mobile security guidance with retirement.
Contract-Neutral: Existing security guidance, shipped mirrors and executable documentation fixtures only; authentication, encryption, scopes, entitlements and runtime behaviour are unchanged.
Change-source: pulse-maintainer
Preserve the complete reviewed maintenance tip and published upstream source unchanged. Combine their installability contract and subsystem registry entries without changing runtime behaviour.
Change-source: pulse-maintainer
The executable overflow regression and a bounded Bash PTY probe show canonical terminals truncate long input before the size check. Read a bounded character count with echo held off, drain an invalid line before returning to the calling shell, and restore its modes on every exit. Pin maximum-size preservation, overflow history safety and terminal restoration.
Contract-Neutral: Repair bounded private terminal entry, overflow draining and mode restoration; no issuance, scope, install transport or response-shape delta.
Change-source: pulse-maintainer
The exact-source validation found that the safety warning names the forbidden curl option. Scope the negative checks to fenced shell examples, while retaining certificate, private-token and canonical-installer assertions.
Contract-Neutral: Documentation regression assertions only; no installer, API or runtime contract change.
Change-source: pulse-maintainer
Adds a shadow release-lifecycle rehearsal (workflow_dispatch plus a
daily run) that installs the latest stable with its signature-verified
install.sh in a systemd container, seeds auth, a webhook and a node,
upgrades through the real /bin/update path, and rolls back, asserting
version, health, units, auth, settings and byte-identical encrypted
config at each phase. It gates nothing yet and runs only on the free
hosted ubuntu-24.04 runner with read-only permissions and no uploads. It
is the first step toward making the lifecycle a pre-publication gate,
and it already found that the documented rollback command turns
auto-updates on by default.
Reuse the complete-download and preflight private-token entry boundary for both monitoring modes. Keep issued credentials separate and no-store, use the installer-owned token path in the diagnostic service reference, and reject structural unit injection before minting. Add executable root/sudo, history, transport, failure cleanup and systemd grammar regressions alongside the subsystem contracts.
Change-source: pulse-maintainer
The exact source proof exposed a guard incorrectly rejecting prose that forbids insecure TLS flags and a stale control-plane target assertion after the reviewed release-reliability documentation update. Check executable shell fences for unsafe forms, and require the current target in its documentation. Disposable proof lacks sibling repository evidence for two full-suite status checks; that context is retained, not treated as a pass.
Contract-Neutral: Regression-test reconciliation only; accepted product and governance source remains unchanged.
Change-source: pulse-maintainer
Completed PR 2362 CI still required the retired credential-bearing PBS bootstrap command, and CodeQL reported an implicit TLS protocol floor in its local fixture. Assert the accepted read-only and private-file guidance instead, forbid the unsafe forms, and explicitly require TLS 1.2 or later in the fixture. No product or permission changes.
Contract-Neutral: Documentation regression assertions and local TLS test fixture only; runtime and public contracts unchanged.
Change-source: pulse-maintainer
Install a published release (latest stable by default) with its signed
install.sh, seed auth, a webhook and a PVE node through the API, upgrade with
the installed /bin/update --version helper, then roll back with the documented
/bin/update --version command. Each step checks /api/version and the binary
version, /api/health, unit state, the seeded settings against fixed
expectations and the pre-upgrade read-back, and data-dir survival, then
reports a phase table in the step summary.
The workflow is read-only, hosted-only, uploads nothing and no release job
depends on it.
CodeQL on PRs 2361 and 2362 flags the fixture's implicit protocol floor. Require TLS 1.2 explicitly and test that same context; retain trusted, untrusted and wrong-host certificate controls without changing product TLS or documentation.
Contract-Neutral: Synthetic TLS test fixture only; no runtime or subsystem contract delta.
Change-source: pulse-maintainer
Merge Core candidate cf12c37e63 unchanged onto 22380a3546. Resolve only the shared browser receipt to the candidate receipt; changed frontend source exactly matches its non-merge proof-bearing commit. Preserve newer safe API recipes and sparse History source.
Retained focused configapi, hostagent, mock, monitoring and installtests race suites, affected API cases, frontend suite and type-check, builds and PVE/PBS desktop and phone-emulated browser checks cover the changed behaviour. Broad API timeout and output-limit attempts remain unresolved, not passes. No installed recovery, release qualification, publication or deployment is claimed.
Change-source: pulse-maintainer
Initialise the real persistent auth stores for the guide lifecycle and prove user removal revokes its session and CSRF token. Clarify that an empty role list clears built-in assignments too; no runtime authority changes.
Contract-Neutral: Documentation and test-fixture correction only; session revocation, role assignment and authorization runtime contracts are unchanged.
Change-source: pulse-maintainer
Preserve exact Delivery candidate 90c80acb49, including bounded grouped notes, operator safety checks and complete qualification source closure. No product or published release changes.
Change-source: pulse-maintainer
Use the accepted organisation ID alphabet and canonical resource types, and expect the documented role assignments to return 204. Keep the guide lifecycle checks at the existing API contract.
Contract-Neutral: Documentation and test expectations only; API methods, validation, authentication and tenant isolation are unchanged.
Change-source: pulse-maintainer
Keep RBAC, audit and organisation tokens out of process arguments. Use signed-in organisation mutations, actual schemas and acceptance rules, a custom role ID, and private audit exports. Exercise copied commands and handler lifecycles without changing runtime authority.
Contract-Neutral: Documentation and documentation tests only; authentication, RBAC, tenant isolation, licensing and API runtime contracts are unchanged.
Change-source: pulse-maintainer
Remove only the extra trailing blank line that rejected the candidate's base-to-head diff. The release prose, validation behaviour and published notes are unchanged.
Contract-Neutral: Fixture whitespace only; no release-note validation, qualification policy or product behaviour changes.
Change-source: pulse-maintainer
Complete the prior sparse-History candidate without changing its reviewed commit identity or renderer bytes. Wrap only the existing empty-window assertion for the locked formatter.
Contract-Neutral: Test assertion formatting only; no runtime, API or canonical boundary changes.
Change-source: pulse-maintainer
Exact-source validation found two unbound compiled packages after composing the retained notes repair with current main. Include both in the source manifest and report the whole dependency closure without weakening the check.
Change-source: pulse-maintainer
The full API race run timed out while cloning the entire mock estate and rebuilding every persona for each chart series. Cache one immutable sampler against the canonical graph data version under its publication lock. Preserve values, current revisions, disabled-mode fallback and isolation from private/global persona updates. Pin zero-allocation warm acquisition, reference equivalence and concurrent snapshot binding; compare both paths with the same thousand-VM sample.
Contract-Neutral: Avoid repeated canonical graph cloning and persona reconstruction without changing metric formulas, identity, graph freshness, retention, endpoints or permissions.
Change-source: pulse-maintainer
Require the exact shared artifact command, stdin PVE authorization and correctly delimited normalized URL instead of legacy pipe/header forms or an over-broad path substring. These corrections retain installer, ACL and transport assertions; no runtime change.
Change-source: pulse-maintainer
Use the existing HTTP routes with private header files, JSON on stdin and curl defaults disabled. Separate plan, decision and execution, explain their real permissions and retain uncertain-execution safety. Extend the executable guide tests to cover all seven recipes, both header formats, auth failures and trace-enabled local curl settings.
Contract-Neutral: API routes, authentication, scopes, action authority and runtime execution are unchanged; only existing guidance and its executable documentation checks change.
Change-source: pulse-maintainer
Compose the exact earlier source repair on the current reviewed base for final validation. No published release or source routing is changed.
Change-source: pulse-maintainer
Render lone stored observations at their actual time instead of blank collecting panels. Label live legend fallbacks as current and describe empty windows without claiming collection is active. Preserve source/range isolation and failed-refresh recovery.
Add sparse-observation regressions and scoped browser evidence, and align both canonical contracts with the shared renderer's verification boundary.
Change-source: pulse-maintainer
Retain configured-origin and proxy-spoofing coverage while requiring separate credentials, identical tokenless script URLs and private-input renderers. This aligns remaining routed setup assertions with the credential-safe response; no runtime change.
Change-source: pulse-maintainer
Replace the last pre-repair credentialed-command and hidden-token copy assertions with the implemented separate-input contract. All other architecture and runtime assertions remain; browser-verified frontend content is unchanged.
Change-source: pulse-maintainer
Bind the new compiled notes helper and authored fixture in the rootful source manifest. Repair the visual rollback fixture's missing version and align the internal control-plane page with the active release-reliability target, without changing source routing or published packets.
Change-source: pulse-maintainer
The root parser's legacy no-token alias accepted a new private-file command beside a legacy download URL. Reject every mixed alias, as the existing coherent-transport contract requires. Preserve backup-permission URL bindings. Align older secret-in-command and shared type fixtures, and exercise the actual wrong server installer parser.
Contract-Neutral: Enforce the already-declared coherent bootstrap transports and correct verification fixtures; no API, scope or documented behaviour delta.
Change-source: pulse-maintainer
Use existing Unix and Windows token-file installers, verified HTTPS downloads and inspection before execution across setup, retarget, profile and cleanup examples. Exercise private files, all profile arguments, rejected TLS and failed downloads with synthetic guest-local fixtures.
Contract-Neutral: Documentation and executable documentation tests only; installer behaviour, privileges and runtime contracts are unchanged.
Change-source: pulse-maintainer
Bind stable notes to version and operator disclosures rather than obsolete prose. Support bounded grouped customer sections for v6.4.6 and later, align generation and rendering, and preserve published history and all qualification gates.
Change-source: pulse-maintainer
## What changed and why
TrueNAS reporting can return only some metrics, no metrics, or genuine
zero readings. Treating a timestamp as evidence that every metric was
present fabricated zero CPU/network/I/O samples; zero available memory
could also disappear. This repair follows the failed CORE 13 retest in
#2077 and reproduced source cases. It tracks presence per metric through
REST/realtime collection, host rows and History, preserves measured
zero, and keeps optional telemetry failures separate from successful
inventory collection. Diagnostics expose bounded categories/status, not
raw provider text.
The pinned-TLS pipeline fixtures exercise partial readings, failures and
recovery through the client, poller, registry, metric writer and History
readback. A test-only notification receipt watchdog now permits the
existing autonomous queue's two polling cycles while still requiring the
actual webhook payload and incident identity; production scheduling and
latency assertions are unchanged.
## Included source
Complete range
`bfe2b39ee0d110bb2a1fdaf582e04a1d72003126..78f2b7c0323fa130da5ef6313804688e51df10f1`.
Core candidate `20261001T020238Z-core-runtime`: runtime
`22ca07ba7171686f1e0904d1d14eb1f08101e134`, fixture corrections
`dc6a66a62cb18a976ce3e4a6e399e629fdeba16f`,
`00ed443d002b697f21874a4fa2758822ca47a448`,
`5c6e826cc49825fb235a3c5b68a798c8e8081be8`, and final
`28cdde7299364678e00abf33e9f531ea0d47b5c5`. Additive integration
`6b23876ec8104965c7842e194e055f3206134d4f` and upstream reconciliation
`78f2b7c0323fa130da5ef6313804688e51df10f1` preserve every reviewed
identity and published ancestor.
## Validation and limits
Recorded baseline `source-0pul7g9o` reproduced ten faulty cases. Final
`source-_4msx_t4` passed five focused race repetitions, complete
TrueNAS/monitoring race suites, vet and affected-library builds. Earlier
fixture and receipt-watchdog failures remain recorded. The composed
head's entire `internal`, `pkg`, `cmd`, `go.mod` and `go.sum` inputs
equal that tested candidate, so sufficient source validation was not
repeated.
Publication provenance, aggregate canonical completion and whitespace
checks pass. Browser guard correctly skips this backend-only range.
Proof used Go 1.26.7 rather than declared 1.26.8; exact-head CI must
establish the declared toolchain and all required results before
landing. These synthetic proofs are not native appliance acceptance, a
diagnosis of the reporter's response shape, complete #2077 resolution,
installed recovery or release qualification. No release placement is
claimed.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Separate PVE/PBS setup and telemetry credentials from shell source and download URLs. Use silent root/sudo input, private-file handoff, complete downloads and the agent preflight; preserve scope, TLS defaults, single-line paste and coherent rolling-upgrade metadata. Reveal tokens through the existing dialog and discard late issuance after close. Pin executable shell, history, TLS/registration and browser contracts without using real credentials.
Change-source: pulse-maintainer
Preserve the exact Web candidate, parent-bound browser receipt and lint correction. Restore first-touch disclosure while retaining delegated nested controls and keyboard behaviour.
Change-source: pulse-maintainer
Preserve the exact product-intelligence candidate and its tested private-file recipes. Existing PBS setup and troubleshooting now prefer read-only API access and verified TLS.
Change-source: pulse-maintainer
pulse-triage[bot]