Failed setup now yields local-only, topology-free diagnostics. Require recognised Running state and successful tailnet ping before TCP, retain probe exits without raw private output or fallback probes, and exercise twenty synthetic readiness/privacy cases. Parent controls expose false success and private output on both channels. Keep workflow identities, secrets, action pins, mutation gates and release scope unchanged.
Change-source: pulse-maintainer
Resolve overlapping copy assertions by retaining main’s stronger retirement and license-boundary checks plus the candidate’s continuing paired-access and FAQ/plan coverage. User-visible documentation is unchanged from the reviewed candidate; no runtime frontend source changed.
Change-source: pulse-maintainer
Current PR2368 fails four native installer jobs and the backend shard because the old assertion still requires the unused v6 API_TOKENS server Secret. Preserve all Helm SCC, read-only RBAC and socket controls, and require server bootstrap before scoped private-file agent provisioning with eleven unsafe or incomplete flow negative controls.
Contract-Neutral: Test-only repair for the reviewed Kubernetes guidance; no runtime, chart, permission, installation or frontend contract change.
Change-source: pulse-maintainer
The existing FAQ and linked entitlement guide still advertise Relay purchases and remote web access after the reviewed retirement change. Explain continuing app access, subscriber Pro continuity, current plans and phone-alert alternatives; distinguish old Relay payloads without changing their runtime gates. Preserve shipped mirrors and enforce the accepted security guidance's continuing-access boundary.
Contract-Neutral: Documentation and copy assertions reflect existing retirement policy; runtime entitlements, routes and access controls are unchanged.
Change-source: pulse-maintainer
Merge the exact reviewed Web tip and retain its stronger retirement copy assertions where concurrent test-only maintenance overlaps. Runtime frontend content remains exactly browser-verified; existing credential issuance, identity and transport policy are preserved.
Change-source: pulse-maintainer
PR #2368 run 36860746715 failed two obsolete Relay tier assertions after reviewed credential-safe security guidance. Verify the accepted retirement date, continuing pairings and subscriber entitlements instead of restoring retired sales copy. No runtime or documentation change.
Contract-Neutral: Test-only reconciliation with accepted security guidance; no runtime contract change.
Change-source: pulse-maintainer
The complete frontend run exposed one remaining Unix instruction assertion and two inherited assertions requiring the retired Relay sales tier. Enforce separate Unix credential entry and the existing approved retirement, subscriber entitlement, app-only and paired-access guidance instead. Canonical and shipped copy must still match. No runtime, docs, native mobile behaviour or browser source changes.
Change-source: pulse-maintainer
The focused executable probes passed, but four legacy wording/outer-quoting assertions failed. Decode the exact POSIX-quoted Bash child before asserting the existing full identity literals, and pin the truthful token-entry ordering text. Runtime source and its parent-bound browser receipt are unchanged.
Change-source: pulse-maintainer
Replace literal credential bootstraps with the exercised bounded Core private-entry pattern, preserve a checked local private-file route for non-terminal FreeBSD command fields, and consolidate Unix repair, upgrade and removal transport without changing token issuance, TLS choice or host identity. Removal does not depend on a new binary preflight. Windows credential transport remains the next rework step. Add executable PTY/file/lifecycle proofs and the missing DOMPurify after-attributes detached-subtree regression, with parent-bound browser evidence.
Change-source: pulse-maintainer
Adapt PR2351 to current main without losing bounded probe deadlines, retries, explicit binds or confidentiality. Inspect IPv6 wildcard socket mode so unrelated servers sharing the port cannot determine Pulse health. Apply the telemetry callback only after a persisted explicit boolean transition, including stale-disk and null-input boundaries.
Retain real HTTP/HTTPS wildcard and same-port isolation regressions, callback persistence-order tests, and the owning subsystem contracts. No dependency manifests, frontend source or telemetry payload schema change. Exact runtime proof remains dependent on the unavailable root graph; it is not represented as passed.
Change-source: pulse-maintainer
Original-source: https://github.com/rcourtman/Pulse/pull/2351
Original-commit: f50c4d6e3b
Co-authored-by: rcourtman <8825017+rcourtman@users.noreply.github.com>
Replace token arguments, an ignored API_TOKENS bootstrap and plaintext DaemonSet credentials with scoped UI-created tokens, private files and a pre-created Secret. Route hosted installation to the existing private-file flow and retain HTTP errors and encoded resource identities in metrics queries. Exercise copied recipes, failure stops and actual curl requests with synthetic credentials.
Contract-Neutral: Documentation-only private-file setup and metrics access guidance; no runtime, API, entitlement or deployment contract delta.
Change-source: pulse-maintainer
Preserve exact Core candidate c0525852f8 and its differential, affected-race and benchmark evidence. Compose with the fixed initial main frontier; installed CPU and release follow-through remain separately owned.
Change-source: pulse-maintainer
The residual whole-broadcast profile attributes about 80 percent of synthetic allocation to connected-infrastructure grouping. Request only its unchanged 0.90 identity floor, and discard equal or worse-priority fallback peers before allocating and sorting them. Keep general matching and all group identity, ambiguity, explanation and review semantics against independent pre-repair oracles. Update the obsolete broadcast-wrapper source assertion to the prepared single-pass path.
Change-source: pulse-maintainer
On 30 Sep and 1 Oct two new advisories (brace-expansion
GHSA-q2hr-2g5m-vwhr, DOMPurify GHSA-p98j-92pf-mc4p) failed the required
frontend audit on every PR across main, release/v6.4 and release/v6.5,
holding the v6.5 RC for days and blocking the v6.4.6 preparation. The
existing scheduled npm-audit is informational and only sees main. This
adds a daily workflow that runs the same complete frontend audit as
Build and Test on main and every active release line, fails on any
finding, and names the branch, advisories and fix. The maintainer's
release-path health check raises it to Delivery immediately.
The first exact candidate proof compiled and passed frontend snapshot tests, but rejected two monitoring fixture fields that only exist on frontend projections. Use the canonical resource name and tags to test the same sort/freshness boundaries. Preserve that failed aggregate result; no production code or expectation is relaxed.
Change-source: pulse-maintainer
An update, rollback or reinstall must not silently enable unattended updates. Share the existing-install opt-in prompt and retain affirmative CLI and interactive choices without changing helper refresh or fresh-install defaults.
Exercise all five existing main flows and add bounded configuration/timer intent observations to the signed published lifecycle rehearsal, including changed and unavailable negative controls.
Change-source: pulse-maintainer
On 30 Sep-1 Oct 2026 GHSA-q2hr-2g5m-vwhr (brace-expansion) and
GHSA-p98j-92pf-mc4p (DOMPurify) failed the required "Audit complete
frontend dependency graph" step on every pull request to main,
release/v6.4 and release/v6.5. That held the v6.4.6 preparation PR and
the v6.5 RC for days with no owner. The scheduled audit in
security-scan.yml only informs and runs on the default branch, so
release lines were never checked.
dependency-advisory-watch.yml runs daily and on dispatch. It lists main
plus every release/v<major>.<minor> line at or newer than the latest
stable's line (all lines if that lookup fails), then audits each in a
fail-fast-free matrix. Each job fetches only that line's
frontend-modern/package.json and package-lock.json with git and runs
scripts/npm-audit-retry.sh all on them under the same Node.js pin that
build-and-test requires. npm audit reads the lockfile, so nothing is
installed. The job never checks out or runs the audited branch's code,
because a scheduled run holds the default branch's cache scope and
CodeQL flagged running npm ci there as cache poisoning.
A job fails when the audit fails, and its step summary and annotation
name the branch, the GHSA ids and the fix (npm audit fix
--package-lock-only plus raised floors in dependencySecurity.test.ts).
Read-only, hosted-only, no secrets, no uploads.
List the continuity-aware registry once, decorate one owned host projection, and sort final frontend rows rather than a second estate-sized conversion array. Encode concrete frontend resources directly into immutable snapshot buffers, decoding every authoritative ID from those bytes; leave generic marshalers and all other fields on the existing path. Keep live freshness, alert and lifecycle semantics without a cache.
Change-source: pulse-maintainer
Pin a reproducible 1000-resource completed-ingest fixture with zero, one and four viewers before changing projection or encoding. Measure real monitor registry reads, projection, snapshot, per-client delta and queues, excluding persistence, timers and network transport.
Change-source: pulse-maintainer
Accept the exact Product intelligence candidate with private-file API recipes, accurate export and recovery guidance, scoped key revocation and retirement wording. Preserve existing authentication and entitlement authority; retained focused source and browser evidence covers the unchanged documentation content.
Change-source: pulse-maintainer
## What changed and why
PBS setup safety checks now match the credential-safe guide without
treating explanatory TLS warnings as executable commands. The checks
retain read-only API identities, private token-file permissions,
inspected HTTPS downloads and failure-stop requirements; they cover
bash, sh and shell examples. The synthetic TLS server explicitly
requires TLS 1.2 and has a regression assertion for that floor.
This reconciles reviewed fixture repairs with the previously published
safe guidance. No product runtime, dependency, version or release
metadata changes are included.
## Included source
Complete `pulse` range
`a7a4a9aa417a1cd73e016d7448b8d2428bbfba00..cafe38823f6db9864bb671c0ab3ea3a87cf887ba`:
- Reviewed Delivery candidate
`0955ddf9e0b48b9571771c04a27aa354db796055`, containing TLS fixture
`ff3d05be49a3b067637107f83298066745dc5a1e` and bootstrap guards
`2a8134035846a3bb3e0097a921a0f068edee1394` /
`0955ddf9e0b48b9571771c04a27aa354db796055`.
- Additive integration `ac34b6f4618161485df40fb7bb12d4c2bf949cf7`
retains the stronger canonical safety assertions; upstream
reconciliation `cafe38823f6db9864bb671c0ab3ea3a87cf887ba` retains the
current published main frontier. Every reviewed commit identity is
preserved.
## Validation and limits
Recorded candidate evidence includes ten executable PBS controls
(`source-ozwv0j9x`); final candidate `source-rf2cmnzr` passed the
selected Go packages and PBS cases before failing a renderer import
invocation. Corrected renderer-only `source-h5pd_tbz` passed 44 cases on
the same candidate; the failed wrapper is not an overall pass.
Fresh publication provenance, whitespace and all three non-merge
per-commit completion/browser guards pass; browser checks skip correctly
because no frontend source changed. All 62 shipped-document mirrors and
211 public Markdown checks pass.
A fresh broad repoctl attempt (`source-axg1lvbp`) failed two
cross-repository evidence tests because the single-module disposable
guest has no Pro/Enterprise sibling checkout; its chained Python phase
did not run. It is retained as failed evidence, not a complete suite
pass. The narrowed reconciliation proof below tests the actual changed
assertions and TLS recipes without bypassing those cross-repository
checks.
Exact-head required checks and independent review still govern landing.
Synthetic credentials and guest-local TLS are not actual PBS
installation, reporter acceptance, release qualification or availability
in a release.
Fresh exact integrated-head reconciliation `source-nr9x7ary` passes both
changed Go assertion tests and all ten executable PBS recipe/TLS
controls (exit 0) at `cafe38823f6db9864bb671c0ab3ea3a87cf887ba` in the
standard offline source-proof VM.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
## What changed and why
This batch repairs existing setup, administration and History surfaces:
- PBS and agent guides keep tokens out of shell history and process
arguments, prefer read-only identities, and require verified HTTPS
downloads saved for inspection. Fleet/action, RBAC, audit and
organisation examples use private header files, supported schemas,
signed-in session-only mutations, custom-role operations and private
exports.
- Generated Proxmox setup separates credential reveal from copied
commands and uses private-file handoffs. Download/preflight, permission,
identity and cleanup boundaries remain intact.
- Shared tables regain first-touch activation without swallowing
embedded controls or keyboard disclosure. Sparse drawer History displays
real stored observations without inventing trends, labels current
fallbacks honestly, and explains empty windows.
- Demo chart series reuse graph-version-bound metric samplers rather
than rebuilding the whole estate for every series, preserving values and
isolation.
- Release-note validation accepts authored grouped notes while retaining
identity and safety checks; qualification binds the complete current
source rather than an incomplete filesystem list.
These are repairs to existing behaviour and unsafe or inaccurate
guidance, not new features or permissions. PBS source/browser
improvements do not establish complete installed resolution of the mixed
#1723 report.
## Included source
Complete unpublished `pulse` range
`e5082c5fb1be8f8882275338d8b9f088b6a41cc4..f047d7b5db78ef1e3ca0b84de4fe2f6c43a9311c`.
This extends the former PR #2362 head
`704f4eeb4ef4f29cb0341d847665516b315cc24a`, whose workflows have
completed, rather than restarting an actively checking proposal.
Reviewed candidates and their additive integrations:
- PBS guidance `a5c8b5d59799c7cf43af0f0fc7e796722c95fe7f`, integrated at
`6a47dad9ce60a3814ad08de0814dff84493b5453`.
- Touch-row candidate `88f52387af1fe6ebd6554acd49320a2e5927c0e8` and
lint correction `12c8a7aba39bd8457f541ca0b1cc045893aed5db`, integrated
at `36418af66beac94204276f7dc73de2c41e297fb1`.
- Agent guidance `d5c187613a68e6e891ae9a5b6dbfd6154cea1844`, integrated
at `9bbbc7a817274ab13b9c20b2119f46edd94d2109`; fleet/action guidance
`704f4eeb4ef4f29cb0341d847665516b315cc24a`.
- Sparse History candidate `b405f8d99b252bfc0e8773914fe07c96e2ab7f59`,
retaining runtime `ec372845541fd0a79800b9ccadd7f4972be5e836`, integrated
at `a5347278430342fd805e758897c00ce187579d66`.
- Release-note/qualification candidate
`90c80acb493eb4ff6a789b184a794b87b4a6d538`, integrated at
`22380a35460a255ac4d60e20549e959875ccbc21`.
- Private-bootstrap/demo sampler candidate
`cf12c37e6302883e66039078d6e504b1014b26cc`, integrated at
`0832be112f024f5a6dd695da42b134e9039c2840`.
- Administration guidance `0c3cd4fb3ad1a32cb7ddb00b0992a53991594b79`
(three own commits), integrated at
`7d5c6eb0045f94481ae3147476187e9ad2eeccda`.
- Additive corrections `0fd47f7ebf5da8588d62b9f81b336b5267e3430d` and
`5116c2a2d9e49e83e794d23cf99e40c240e51ad9` reconcile the PBS guard and
explicit TLS fixture floor with accepted safe guidance and current
release direction.
- Upstream merges `f5e305d4c9494830743a140bbb1f951694555c38` and
`f047d7b5db78ef1e3ca0b84de4fe2f6c43a9311c` retain published ancestry,
including upstream's independent shadow lifecycle rehearsal. No accepted
identity was rewritten.
## Validation and adverse evidence
Sufficient existing candidate evidence is reused, with fresh bounded
reconciliation checks:
- PBS `source-1bj5m4w1`: 28 checks; frontend documentation/build/budgets
`source-dz1jcq79`. Fleet/action `source-cb0mkbhb`: nine executable guide
tests; frontend `source-qynvs3_n`, 32 browser checks/four inspected
screenshots. Agent guidance has six executable fixture tests, including
private-file permissions and filename-only handoffs.
- Touch candidate: four WebKit/Chromium/Firefox phone/desktop cases,
embedded-control and keyboard assertions, 12 inspected screenshots.
Sparse History final `source-nha4kbvo`: formatting and 121 affected
tests; predecessor full type/lint/test/build/budget proof and four
browser passes/32 inspected screenshots. Parallel `source-_d931osk`
failed one existing window-test timeout; that result remains adverse,
not an overall pass.
- Bootstrap/demo `source-rlyqg2wg`: full affected
configapi/hostagent/mock/monitoring/installtests race suites and
affected API cases; `source-p2vo7bpw`: affected vet and actual
frontend/server/agent builds. `source-l681cvrh` records frontend
type-check and 21,612 tests; browser matrix covers PVE/PBS desktop and
emulated phones with eight inspected screenshots. Earlier full API
timeout and output-limit attempts remain unresolved, not passing
receipts.
- Release-note closure `source-ig3ted7j`: complete install suite and 942
Python cases/eight skips on its recorded source. Final fixture
correction `source-in4fqcsx` passes authored-note tests and seven
negative safety/identity subcases.
- Administration `source-_klnz0rf`: 55 documentation tests, 26 API
tests, authentication tests and documentation audits. Frontend
`source-lrr0gmox`: 50 documentation tests/build/budgets; 41 browser
checks/eight inspected images.
Fresh full-range provenance and whitespace pass. All 23 unpublished
non-merge commits pass the prescribed per-commit completion/browser
checks using their recorded Contract-Neutral reasons where applicable;
aggregate browser coverage binds all six changed frontend runtime paths.
All 62 shipped-doc mirrors and 211 public Markdown checks pass. A naive
aggregate shape check fails because it cannot honour those per-commit
reasons; the workflow-prescribed per-commit check passes. The repaired
PBS required/forbidden source assertions were separately checked against
the final text. An optional additional source-VM check was cancelled
while queued, before execution: no receipt or pass is claimed.
Former-head CI runs `36829661316` and `36829661309` failed the retired
credential-bearing PBS assertion; the accepted additive corrections
replace it. The former CodeQL finding concerned the local TLS fixture's
implicit protocol floor, now explicit. Former advisory benchmark
`ConcurrentReadWrite-4` remains failed: 906.4→1007.7 µs, +11.17%,
p=.011, n=10. Its former candidate and base have identical Go
sources/manifests, but this does not prove the cause or turn the
measurement green. The observation is retained for independent Delivery
assessment; fresh exact-head CI remains necessary for the expanded
batch.
Required exact-head checks and independent review govern landing. These
are synthetic/source proofs, not physical-device acceptance, native
installation/recovery, complete PBS reporter acceptance, deployed
activation, release qualification or availability in a release.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Use private header and passphrase files for copied API requests, check protected access instead of public health, and preserve actual transfer and lockout permissions. Replace unsafe legacy credential setup and key cleanup, explain deployment-specific recovery, and align existing mobile security guidance with retirement.
Contract-Neutral: Existing security guidance, shipped mirrors and executable documentation fixtures only; authentication, encryption, scopes, entitlements and runtime behaviour are unchanged.
Change-source: pulse-maintainer
Preserve the complete reviewed maintenance tip and published upstream source unchanged. Combine their installability contract and subsystem registry entries without changing runtime behaviour.
Change-source: pulse-maintainer
The executable overflow regression and a bounded Bash PTY probe show canonical terminals truncate long input before the size check. Read a bounded character count with echo held off, drain an invalid line before returning to the calling shell, and restore its modes on every exit. Pin maximum-size preservation, overflow history safety and terminal restoration.
Contract-Neutral: Repair bounded private terminal entry, overflow draining and mode restoration; no issuance, scope, install transport or response-shape delta.
Change-source: pulse-maintainer
The exact-source validation found that the safety warning names the forbidden curl option. Scope the negative checks to fenced shell examples, while retaining certificate, private-token and canonical-installer assertions.
Contract-Neutral: Documentation regression assertions only; no installer, API or runtime contract change.
Change-source: pulse-maintainer
Adds a shadow release-lifecycle rehearsal (workflow_dispatch plus a
daily run) that installs the latest stable with its signature-verified
install.sh in a systemd container, seeds auth, a webhook and a node,
upgrades through the real /bin/update path, and rolls back, asserting
version, health, units, auth, settings and byte-identical encrypted
config at each phase. It gates nothing yet and runs only on the free
hosted ubuntu-24.04 runner with read-only permissions and no uploads. It
is the first step toward making the lifecycle a pre-publication gate,
and it already found that the documented rollback command turns
auto-updates on by default.
Reuse the complete-download and preflight private-token entry boundary for both monitoring modes. Keep issued credentials separate and no-store, use the installer-owned token path in the diagnostic service reference, and reject structural unit injection before minting. Add executable root/sudo, history, transport, failure cleanup and systemd grammar regressions alongside the subsystem contracts.
Change-source: pulse-maintainer
The exact source proof exposed a guard incorrectly rejecting prose that forbids insecure TLS flags and a stale control-plane target assertion after the reviewed release-reliability documentation update. Check executable shell fences for unsafe forms, and require the current target in its documentation. Disposable proof lacks sibling repository evidence for two full-suite status checks; that context is retained, not treated as a pass.
Contract-Neutral: Regression-test reconciliation only; accepted product and governance source remains unchanged.
Change-source: pulse-maintainer
Completed PR 2362 CI still required the retired credential-bearing PBS bootstrap command, and CodeQL reported an implicit TLS protocol floor in its local fixture. Assert the accepted read-only and private-file guidance instead, forbid the unsafe forms, and explicitly require TLS 1.2 or later in the fixture. No product or permission changes.
Contract-Neutral: Documentation regression assertions and local TLS test fixture only; runtime and public contracts unchanged.
Change-source: pulse-maintainer
Install a published release (latest stable by default) with its signed
install.sh, seed auth, a webhook and a PVE node through the API, upgrade with
the installed /bin/update --version helper, then roll back with the documented
/bin/update --version command. Each step checks /api/version and the binary
version, /api/health, unit state, the seeded settings against fixed
expectations and the pre-upgrade read-back, and data-dir survival, then
reports a phase table in the step summary.
The workflow is read-only, hosted-only, uploads nothing and no release job
depends on it.
CodeQL on PRs 2361 and 2362 flags the fixture's implicit protocol floor. Require TLS 1.2 explicitly and test that same context; retain trusted, untrusted and wrong-host certificate controls without changing product TLS or documentation.
Contract-Neutral: Synthetic TLS test fixture only; no runtime or subsystem contract delta.
Change-source: pulse-maintainer
Merge Core candidate cf12c37e63 unchanged onto 22380a3546. Resolve only the shared browser receipt to the candidate receipt; changed frontend source exactly matches its non-merge proof-bearing commit. Preserve newer safe API recipes and sparse History source.
Retained focused configapi, hostagent, mock, monitoring and installtests race suites, affected API cases, frontend suite and type-check, builds and PVE/PBS desktop and phone-emulated browser checks cover the changed behaviour. Broad API timeout and output-limit attempts remain unresolved, not passes. No installed recovery, release qualification, publication or deployment is claimed.
Change-source: pulse-maintainer
Initialise the real persistent auth stores for the guide lifecycle and prove user removal revokes its session and CSRF token. Clarify that an empty role list clears built-in assignments too; no runtime authority changes.
Contract-Neutral: Documentation and test-fixture correction only; session revocation, role assignment and authorization runtime contracts are unchanged.
Change-source: pulse-maintainer
Preserve exact Delivery candidate 90c80acb49, including bounded grouped notes, operator safety checks and complete qualification source closure. No product or published release changes.
Change-source: pulse-maintainer
Use the accepted organisation ID alphabet and canonical resource types, and expect the documented role assignments to return 204. Keep the guide lifecycle checks at the existing API contract.
Contract-Neutral: Documentation and test expectations only; API methods, validation, authentication and tenant isolation are unchanged.
Change-source: pulse-maintainer
Keep RBAC, audit and organisation tokens out of process arguments. Use signed-in organisation mutations, actual schemas and acceptance rules, a custom role ID, and private audit exports. Exercise copied commands and handler lifecycles without changing runtime authority.
Contract-Neutral: Documentation and documentation tests only; authentication, RBAC, tenant isolation, licensing and API runtime contracts are unchanged.
Change-source: pulse-maintainer
Remove only the extra trailing blank line that rejected the candidate's base-to-head diff. The release prose, validation behaviour and published notes are unchanged.
Contract-Neutral: Fixture whitespace only; no release-note validation, qualification policy or product behaviour changes.
Change-source: pulse-maintainer
pulse-triage[bot]