Make the existing connection guide fail closed before editing credentials, ignore curl configuration, bound each single POST and retain sensitive responses in new private files. Explain actual test/save status and uncertain-save readback without retrying setup as diagnostics.
Contract-Neutral: Documentation-only credential handling and copied-recipe regression tests; no runtime API, TrueNAS polling, authentication or connection-management contract changes.
Change-source: pulse-maintainer
Reviewed exact PI candidate 5e6d5af3b5. Existing guidance and shipped mirror now use private header files, verified HTTPS and bounded read-only checks. Retain source-e1x7r92a installer/vet, source-oypceg0j docs tests and Chromium/WebKit rendering evidence; no native tenant isolation or publication claim.
Change-source: pulse-maintainer
Release preparation for `v6.5.0-rc.1`, made by the release train
(`pulse-maintainer-ship`). After this merges the train dispatches the
release workflow at this exact head
`c0b3ddf1e586982ed8dc7c1e8722f468fb2e42d4`.
Scope the inherited mounted-drawer disk resumption assertions to disk. Explicitly preserve unknown legacy memory and prove unchanged coordinates retain one History read. This corrects the old all-metric assertion rather than accepting disk freshness as authority for memory.
Contract-Neutral: Test-only refinement for the existing independent memory/disk provenance contract; no runtime, route, API, monitoring policy or permission delta.
Change-source: pulse-maintainer
Replace inline token arguments and certificate bypasses with private header files and verified HTTPS. Bound the read-only probes, discard bodies, preserve failed curl exits and distinguish an invalid token from a checked tenant boundary. Keep the shipped guide byte-synchronised. Exercise copied commands with a synthetic TLS peer, private-header canaries, hostile curl configuration and refusal/redirect controls; no customer endpoint is used.
Contract-Neutral: Existing diagnostic guidance and regression coverage only; no runtime, public API, token scope or tenant-isolation contract change.
Change-source: pulse-maintainer
Preserve the existing authoritative selected-memory annotation through raw, API, unified and canonical frontend projections. Qualify current, last-known, unknown and unavailable drawer context from its own original source/time, not disk deferral or renewed guest LastSeen. Keep retained numbers separate from current legends and stored points, including measured zero, denied history and independent live readings.
Memoize History reads by actual target/range coordinates so same-guest snapshot replacements update without extra reads or chart remounts. Complete connected source controls and owning subsystem contracts; record the inspected 24-case Chromium/WebKit desktop and narrow light/dark proof against this commit's own parent. No route, collector, threshold, retention, permission or native recovery claim.
Change-source: pulse-maintainer
Release candidate cut from main at 2e9404504b. It carries every change merged since stable v6.4.5.
Contract-Neutral: Release-only v6.5.0-rc.1 version, notes and packet metadata generated by pulse-maintainer-release-metadata; no public install or runtime contract changes.
Change-source: pulse-maintainer
Project verified guest status and decoded output instead of qm transport success. Reject ambiguous terminal outcomes without replay; retain known failed or truncated results as failures without inventing uncertainty. Admit only successful stdout to Discovery and preserve saved results when attempted probes yield no evidence. Keep backup precautions, source bounds and native acceptance dependencies unchanged.
Change-source: pulse-maintainer
Add source controls for actual guest exit/output projection, ambiguous terminal receipts, failed probe evidence exclusion, and saved manual/background Discovery through explicit recovery. The fixtures never invoke PVE or QGA.
Contract-Neutral: Test-only regression controls exercise existing command and Discovery boundaries without changing production code, payloads, capabilities or budgets.
Change-source: pulse-maintainer
Exercise original-age and selected-source provenance through both owned projections and mounted History. Pin retained, unavailable and unknown values, same-guest transitions, independent live readings, dated inspection and denied History without starting diagnostics.
Contract-Neutral: Test-only controls for the existing optional guest-memory observation contract. No runtime, route, selection, history or permission change.
Change-source: pulse-maintainer
Replace the synthetic backup-warning semicolon with separate sentences. Keep the exact original reproduction and service-alert runtime ancestry and unchanged production content; complete the previously failed copy audit additively.
Contract-Neutral: Test-fixture punctuation only. No runtime, API, identity, monitoring, notification or frontend contract delta.
Change-source: pulse-maintainer
Preserve the exact reviewed candidate ancestry and compose current assigned main. The previous runtime and synthetic fixture require additive copy-audit completion, not rewritten history.
Change-source: pulse-maintainer
## What changes and why
- Keep backup-age checks fast and make failed or partial evaluations
visible through one existing system warning, without clearing retained
age alerts. Indexed latest-observation reads preserve retention, schema
and the read budget. This responds to the recurring missed checks
reported in #2465; synthetic timing is not proof of relief on the
reporter's Pi.
- Defer guest-agent commands after uncertain HTTP results and require
same-target, unambiguous backup-lock evidence before guest reads. Keep
guest coverage truthful when only remembered versions or a parent-node
assignment exist. Preserve the original observation time/source of
retained memory through existing backend projections. These changes
advance #2439 safety, but do not establish native thaw or recovery.
- Attribute Proxmox backups using native connection/node and unique PBS
namespace evidence, retaining ambiguous artifacts rather than assigning
them by substring or display name. Show unreliable PBS capacity as
Unknown/Unavailable, while retaining valid measured zero and readable
phone warnings.
- Restore existing TrueNAS and VMware connection alerts using the
constructed runtime pollers. This does not resolve the distinct
monitoring cause reported in #2382.
- Keep safe report collection and attachment guidance self-contained,
and make manual backup pause/resumption precautions usable. Repair the
Diagnostics integration journey's outdated controls, download assertions
and session capability, without changing production authorization.
## Included source
Published base `61146105c74a5968d877691e02963c41f8e66076` → exact final
head `af73b0e6c618da83c4fc5e702ba464257481851c`.
The previous proposal head `dcde1d0157d5e3c4cd626d6b920a45016a3f0437`
and all reviewed ancestry remain unchanged. This advances the proposal
once after its workflows completed with demonstrated failures; it does
not interrupt a checking head.
Reviewed candidates include:
- Previous batch: guest HTTP `cd1e3ba12f`, runtime alerts `7f5c8a0cf1`,
safe intake `496ba1e73e`, PBS capacity/render sequence `8f09a59996`
through `d2f7e456b3a`.
- Manual pause `3fd44b8325`; native backup ownership `c5e83ceb3a` /
`6198a3ce22`; authoritative locks `b77e6908e6`; truthful guest coverage
`ba3e2d2c1c` / `8f9a9a6a1e` / `f9f53befbb`.
- Backup evaluation/query `5774b6bc4b` / `7a19a06631`; Diagnostics
sequence `ed168c8d7e` through `a3bbcae0c9`; memory provenance
`abee023634` through `80d8ad0f59`; self-contained intake `7c9922f55d`.
- Starting reviewed canonical tip
`8003a4037bf2e6628d47ca6c7da239a11096168e` is retained. Four additive
publication corrections (`745ddc982a` through `79091f7b03`) supply the
report-form contract, connected docsLinks regression and exact
historical completion pair. The first completion's section placement
failed the checker; its substantive-section correction passes. No
accepted commit was amended or recreated.
## Validation and remaining gates
The previous proposal's completed runs remain adverse: Build/Test
`37204956836` failed the documentation drift assertion; E2E
`37204956824` failed Diagnostics shards 3/6/8 (download/obsolete
Run-control timeouts). These warrant the admitted changed-source
repairs, not an unchanged retry.
Retained reviewed evidence includes guest transport/connected/race/build
(`source-5_ta7via`), runtime alert connected proof (`source-s0xmdftf`),
PBS source/render evidence (`source-_9ekxhcy`), manual-pause
source/render (`source-ifgmfzhw`), all-reader authoritative-lock proof
(`source-41amnzmb`), guest coverage's 1,901 connected tests/full
types/lint/build and inspected Chromium/WebKit desktop/phone renders
(`source-3y6kfagt`), backup recovery/alerts/monitoring/races/vet/real
builds (`source-vc1jlsz9`), and memory
models/unified-resource/alerts/monitoring/races/vet/types/real
embed/build (`source-5swnugj9`). Diagnostics retains nine passing
full-app journeys with matching source hashes; catalogue
`source-cyehgbio` discovers 916 test/project identities, including all
nine Diagnostics cases, but is not runtime acceptance. Intake
`source-stznewur` retains two intended parent failures and passing
policy/documentation/mirror checks.
Publication checks: provenance, clean retained ancestry, per-commit
canonical completion/history, registry/contract audits and final
browser-content coverage (nine changed production frontend files) pass.
Earlier proposal-head (`79091f7b`) offline VM proof `source-1fn6chab`
passes 36 docsLinks tests, formatting, 27 intake cases, 211 public
Markdown checks and 62 mirrors, with complete hash-matched output and
guest stop. Its line-index bound is explicit. Earlier `source-yj300mm2`
passed docsLinks but exited 1 when a browser script was mistakenly
invoked in a source VM without Playwright; no browser result is claimed
from that attempt. Earlier local preparation failures and prior
API/embed limitation remain evidence at their own bindings, not green
aggregate results.
Required exact-head CI must run the complete backend/build/frontend,
audit and protected E2E checks, with independent source review, before
landing. Existing sufficient connected/render proof was not repeated
solely for batching. This is source publication, not release
qualification, deployment, native appliance/guest acceptance or
completion of the linked reports. The containing all-main release, Pi
evaluation/failure/recovery, native backup/thaw/covered writes/liveness,
remaining memory drawer consumption and installed whole-panel/alert
results remain separate.
Related to #2465
Related to #2439
Related to #2382
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
## Completed workflow reconciliation and additive smoke repair
The starting proposal head `79091f7b0317807fcc76e36cde52c4ee1cc4c928`
and every reviewed commit remain ancestors of this head. Build/Test
`37219920651` has now completed. All backend partitions, frontend,
governance, security and all eight E2E shards/verdict passed, but script
smoke failed two obsolete whole-guide assertions in
`test_vm_disk_diagnostics.py`; backend build was consequently skipped.
The reviewed manual backup precaution deliberately adds six server/timer
examples. The old passive-helper test counted all seven guide examples
and banned `systemctl` throughout the whole guide. This source mismatch
warrants changed-source repair, not an unchanged retry. Additive
test-only `c4a72995c6bf2465a6540a1b546a9dcd732944af` scopes
passive-helper execution to its named section and admits only the exact
six reviewed manual-pause blocks. Its first local run retained one
failure because a shell comment was mistaken for a heading. Additive
`af73b0e6c618da83c4fc5e702ba464257481851c` parses headings only outside
fenced blocks. All 17 diagnostics/safety controls now pass, including
missing/duplicate headings, shell comments and five prohibited-command
mutations. The passive helper still rejects active guest requests and
service mutations. Production and guidance bytes remain unchanged;
mirrored docs and connected intake checks pass. Both failed
correction/control observations remain recorded, not relabelled.
Final publication provenance, clean retained ancestry, additive
contract/registry audits and the unchanged nine-production-file
browser-content coverage pass. Lightweight confined fixture proof
supplies the full 17-case suite; existing heavy/render proof was not
repeated for this test-only delta. This proposal advances only after the
previous head's workflows completed. Exact new-head CI must rerun its
required checks before landing.
The completed advisory benchmark job is also adverse:
`RefreshPlatformScopes` 294.1 → 325.0 ns (+10.51%) and
`ClassifyResourceSensitivity` 67.68 → 77.20 ns (+14.07%), each p=0.000
with ten samples. Their implementation and benchmark source are
unchanged across the batch; that does not prove noise, intentional cost
or lack of regression. Delivery owns a bounded evidence-based
disposition through the existing lane handoff. No favourable repeat,
threshold change or performance/release approval is claimed.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Releases are cut from the head of main since 2 October, but three things
still made every release need hand edits before it could pass:
- the control plane routed 6.5.x to the abandoned `release/v6.5` line;
- main lacked the published 6.4.4 to 6.4.6 release packets, so rollback
derivation on main still found 6.4.1;
- the packet tests pinned prose from old 6.4.x notes (named highlights,
issue numbers, one release's mobile decision) and per-release sentences
in the deployment-installability contract, which changes several times a
day on main.
This maps 6.5 to main, carries the published packets over from
`release/v6.4`, and keeps the packet tests to what the release tooling
generates: version pins, packet pointers, required sections, and the
rollback, signing and mobile sentences.
Checked by preparing 6.5.0-rc.1 and then 6.5.0 on top of this branch
with the release metadata tool: static checks and `go test
./scripts/installtests` pass for both.
Retain both exact completion histories and combine their self-contained safety obligations with the parsed-YAML and connected docsLinks controls. Use the reviewed corrected f8c5e988 completion pair; guards and frontend source remain unchanged.
Change-source: pulse-maintainer
Keep the generic catalogue-error fixture distinct from unknown timed-out guest handoff, and require the existing canceled-VM control to expose a safety deferral without dispatch. The new completion/cancellation parent failures and full-source adverse result remain retained; no production behavior changes in this commit.
Contract-Neutral: Test-only correction records the existing guest cancellation and ordinary-command error contracts without changing production source, APIs, protocol or time budgets.
Change-source: pulse-maintainer
The first publication correction retained the two original defects as history but its heading matcher treated the reviewed shell comment as a boundary. Parse headings only outside fenced blocks, and pin comment, duplicate-heading and missing-heading controls. All 17 passive diagnostics and safety-boundary fixtures now pass; no production or guidance bytes changed.
Change-source: pulse-maintainer
The completed PR smoke job demonstrates two obsolete whole-guide assertions after the reviewed manual backup precaution added six server-control examples. Select the unique passive preflight section for helper execution, constrain planned pause examples exactly, and reject active probes or service operations outside that section. Production code and safe guidance remain unchanged.
Change-source: pulse-maintainer
Releases are cut from the head of main since 2 October, but three things
still made every release need hand edits before it could pass:
- the control plane routed 6.5.x to the abandoned release/v6.5 line;
- main lacked the published 6.4.4 to 6.4.6 packets, so rollback
derivation on main still found 6.4.1;
- the packet tests pinned prose from old 6.4.x notes (named
highlights, issue numbers, one release's mobile decision) and the
per-release sentences in the deployment-installability contract,
which changes several times a day on main.
Map 6.5 to main, carry the published packets over from release/v6.4,
and keep the packet tests to what the release tooling generates: version
pins, packet pointers, required sections and the rollback, signing and
mobile sentences.
Contract-Neutral: Release routing and release-packet test scope only; no runtime, install or public contract changes.
Cancellation before dispatch or server-side expiry before a final agent result must not turn optional VM probes into completed fresh evidence or saved metadata fallback. Preserve the original error and stop subsequent probes while the agent retains its independent uncertainty fence.
Contract-Neutral: Completes the existing Discovery unavailable-evidence and cancellation requirements without changing API identity, statuses, protocol, command catalogue, approvals or non-VM execution.
Change-source: pulse-maintainer
The connected suite exposed three public-host success cases that depended on external DNS. Resolve fixture-only public, private, mixed and missing names through in-process DNS responses while exercising the real parser/resolver and all existing SSRF checks; production resolution and its failures are unchanged.
Contract-Neutral: Test-only deterministic DNS fixtures preserve production URL resolution, SSRF address policy, fetch transport and public interfaces.
Change-source: pulse-maintainer
A zero qm CLI exit may return only a handed-off PID or an unverified guest result. Preserve actual CLI output/exit semantics but pause uncertain terminal dictionaries without another QGA command; accept complete canonical termination evidence and keep native thaw acceptance separate.
Change-source: pulse-maintainer
A cancellation before or during postflight config verification must not become an ordinary optional Discovery failure with usable output, especially on the final probe. Preserve fixed safety classification and no-handoff truth on canceled local admission.
Contract-Neutral: Completes the existing cancellation and unavailable-evidence requirements without changing protocol fields, guard version, lock/identity admission, time budgets or command catalogues.
Change-source: pulse-maintainer
Retain nested Docker VM scanner deferral controls without treating that execution-only type as a public Discovery/store identity. Exercise saved/manual/background preservation on canonical VM requests; runtime and API scope are unchanged.
Change-source: pulse-maintainer
Use the exact additive completion that satisfies the unchanged canonical checker. Retain the earlier failed completion and every reviewed commit as history.
Change-source: pulse-maintainer
Correct the completion section placement rejected by the canonical checker and apply the established test formatter. Keep the safety assertions and production source unchanged.
Change-source: pulse-maintainer
Register the exact historical completion pair for governance CI; preserve the intermediate repair and all later accepted source unchanged. Completion checks still require ancestry, substantive contract text and registry-accepted proof.
Change-source: pulse-maintainer
Record the self-contained feedback precautions and a connected docs-link regression so the accepted intermediate form repair has an additive canonical completion. Preserve all final form text, reviewed identities and release gates.
Change-source: pulse-maintainer
The first exact proof established all ten parent no-admission failures and registered-session controls, then stopped on a missing strings import. Complete that import and preserve ordinary hyphenated PVE dictionary keys while keeping duplicate/case-conflicting lock rejection.
Contract-Neutral: Preserves the guest safety protocol and its lock, identity, budget and dispatch requirements; completes compilation and accepts canonical hyphenated config keys.
Change-source: pulse-maintainer
Keep the inherited report-form commit untouched and bind its additive completion to the tree with the actual optional attachment field IDs. The existing real guard still requires the contract and executable verification together; no release or runtime acceptance is asserted.
Change-source: pulse-maintainer
The first exact-source suite reached an erroneous common evidence-field assumption: the bug form uses logs while the prerelease form uses evidence. Verify both real identities and their shared label without changing either form, requiring new diagnostics or weakening the optional-evidence assertion. Retain the original failed proof.
Change-source: pulse-maintainer
Require local current-node lock evidence and registered guard support before QGA execution. Serialise VM probes, stop on deferral, retain actual in-flight outcomes and saved Discovery evidence, and pause uncertain completion without replay. Config checks do not reserve QGA or prove native thaw; the existing backup monitoring-outage precaution remains.
Change-source: pulse-maintainer
Use the existing exact-commit completion registry and exercise its real guard, ancestry and substantive verification requirements. Preserve the original documentation-link commit and the final self-contained forms; no history is rewritten and no completion or release check is weakened.
Change-source: pulse-maintainer
Record self-contained collection and privacy safeguards for installed releases and parse both forms to protect their actual inline advice. This additively supplies the missing deployment-installability contract and accepted verification for the retained documentation-link correction without rewriting reviewed history or changing any runtime safeguard.
Change-source: pulse-maintainer
Approvals and trusted Discovery commands currently cross QGA handoff without evidence of a local unlocked guest. Assert explicit no-handoff deferral without contacting a native target.
Change-source: pulse-maintainer
Present backup-evaluation and existing service warnings without a fictional resource link, policy action, Patrol target or zero-value metric. Preserve service scope through active and retained History explanations; keep exact warning identity, message, acknowledgement and timeline, with ordinary resource controls and narrow keyboard/touch browser proof.
Contract-Neutral: Frontend enforcement of existing system-alert scope only; no API, schema, resource identity, monitoring policy, operator permission or notification contract delta. Semantic subsystem contracts and connected verification are included.
Change-source: pulse-maintainer
Preserve exact 7c9922f55d history. Resolve the two form-link overlaps to its reviewed self-contained text, retaining every safety/privacy warning and all fields. Source-stznewur proves the intake and documentation contracts; catalogue proof is discovery, not runtime acceptance.
Change-source: pulse-maintainer
Exercise real overview, history and Assistant paths with canonical system warning payloads and monitored-resource controls. Retain backup evaluation and existing notification/watchdog conditions.
Contract-Neutral: Test-only reproduction of the existing system-alert contract; no runtime, API, identity, policy or notification delta.
Change-source: pulse-maintainer
Correct the report-form branch-tip documentation links rejected by PR2463 script smoke tests. Pin both links to the retained reviewed troubleshooting guide and keep its safe-collection fragment and all reporting guidance unchanged.
Change-source: pulse-maintainer
An online source status without a valid original receipt time cannot assert current memory freshness. Preserve its numeric availability and existing selection while omitting unknown/future time; cover both cases at the linked view. Remove the stray adapter-test comment copied during test relocation.
Contract-Neutral: Completes the optional memory-observation semantics and wire shape documented with 43ccc6c39a; no new contract or selection delta.
Change-source: pulse-maintainer
Expose current, last-known and unavailable memory through raw guest and selected unified metrics without renewing QGA evidence during repeated backup deferrals. Preserve independent PVE/linked-agent source times, numeric selection, History and alert policy. Annotate selected metrics as well as raw facets so cross-source fallback cannot inherit another source freshness. Add connected observation, source ownership, clone and wire controls and update the shared subsystem contracts.
Change-source: pulse-maintainer
The first control panicked at an uninitialised synthetic Monitor map before reaching the provenance assertions. Supply the same map as production and retain that failed attempt without claiming a product regression.
Change-source: pulse-maintainer
Remove the redundant main-branch troubleshooting links from both report forms while retaining live-collection precautions and local attachment privacy review. Regression controls reject branch-tip guidance without weakening the repository drift guard.
Contract-Neutral: Report form guidance and its safety regressions only; diagnostic runtime, public API, and installation contracts are unchanged.
Change-source: pulse-maintainer
Exercise normal cache reads, repeated backup deferrals, expired evidence, source-independent PVE memory and resumption through the shared guest builder and real unified broadcast conversion. These are synthetic monitoring controls, not native thaw acceptance.
Change-source: pulse-maintainer
pulse-triage[bot]