## What changed and why
This batch repairs existing setup, administration and History surfaces:
- PBS and agent guides keep tokens out of shell history and process
arguments, prefer read-only identities, and require verified HTTPS
downloads saved for inspection. Fleet/action, RBAC, audit and
organisation examples use private header files, supported schemas,
signed-in session-only mutations, custom-role operations and private
exports.
- Generated Proxmox setup separates credential reveal from copied
commands and uses private-file handoffs. Download/preflight, permission,
identity and cleanup boundaries remain intact.
- Shared tables regain first-touch activation without swallowing
embedded controls or keyboard disclosure. Sparse drawer History displays
real stored observations without inventing trends, labels current
fallbacks honestly, and explains empty windows.
- Demo chart series reuse graph-version-bound metric samplers rather
than rebuilding the whole estate for every series, preserving values and
isolation.
- Release-note validation accepts authored grouped notes while retaining
identity and safety checks; qualification binds the complete current
source rather than an incomplete filesystem list.
These are repairs to existing behaviour and unsafe or inaccurate
guidance, not new features or permissions. PBS source/browser
improvements do not establish complete installed resolution of the mixed
#1723 report.
## Included source
Complete unpublished `pulse` range
`e5082c5fb1be8f8882275338d8b9f088b6a41cc4..f047d7b5db78ef1e3ca0b84de4fe2f6c43a9311c`.
This extends the former PR #2362 head
`704f4eeb4ef4f29cb0341d847665516b315cc24a`, whose workflows have
completed, rather than restarting an actively checking proposal.
Reviewed candidates and their additive integrations:
- PBS guidance `a5c8b5d59799c7cf43af0f0fc7e796722c95fe7f`, integrated at
`6a47dad9ce60a3814ad08de0814dff84493b5453`.
- Touch-row candidate `88f52387af1fe6ebd6554acd49320a2e5927c0e8` and
lint correction `12c8a7aba39bd8457f541ca0b1cc045893aed5db`, integrated
at `36418af66beac94204276f7dc73de2c41e297fb1`.
- Agent guidance `d5c187613a68e6e891ae9a5b6dbfd6154cea1844`, integrated
at `9bbbc7a817274ab13b9c20b2119f46edd94d2109`; fleet/action guidance
`704f4eeb4ef4f29cb0341d847665516b315cc24a`.
- Sparse History candidate `b405f8d99b252bfc0e8773914fe07c96e2ab7f59`,
retaining runtime `ec372845541fd0a79800b9ccadd7f4972be5e836`, integrated
at `a5347278430342fd805e758897c00ce187579d66`.
- Release-note/qualification candidate
`90c80acb493eb4ff6a789b184a794b87b4a6d538`, integrated at
`22380a35460a255ac4d60e20549e959875ccbc21`.
- Private-bootstrap/demo sampler candidate
`cf12c37e6302883e66039078d6e504b1014b26cc`, integrated at
`0832be112f024f5a6dd695da42b134e9039c2840`.
- Administration guidance `0c3cd4fb3ad1a32cb7ddb00b0992a53991594b79`
(three own commits), integrated at
`7d5c6eb0045f94481ae3147476187e9ad2eeccda`.
- Additive corrections `0fd47f7ebf5da8588d62b9f81b336b5267e3430d` and
`5116c2a2d9e49e83e794d23cf99e40c240e51ad9` reconcile the PBS guard and
explicit TLS fixture floor with accepted safe guidance and current
release direction.
- Upstream merges `f5e305d4c9494830743a140bbb1f951694555c38` and
`f047d7b5db78ef1e3ca0b84de4fe2f6c43a9311c` retain published ancestry,
including upstream's independent shadow lifecycle rehearsal. No accepted
identity was rewritten.
## Validation and adverse evidence
Sufficient existing candidate evidence is reused, with fresh bounded
reconciliation checks:
- PBS `source-1bj5m4w1`: 28 checks; frontend documentation/build/budgets
`source-dz1jcq79`. Fleet/action `source-cb0mkbhb`: nine executable guide
tests; frontend `source-qynvs3_n`, 32 browser checks/four inspected
screenshots. Agent guidance has six executable fixture tests, including
private-file permissions and filename-only handoffs.
- Touch candidate: four WebKit/Chromium/Firefox phone/desktop cases,
embedded-control and keyboard assertions, 12 inspected screenshots.
Sparse History final `source-nha4kbvo`: formatting and 121 affected
tests; predecessor full type/lint/test/build/budget proof and four
browser passes/32 inspected screenshots. Parallel `source-_d931osk`
failed one existing window-test timeout; that result remains adverse,
not an overall pass.
- Bootstrap/demo `source-rlyqg2wg`: full affected
configapi/hostagent/mock/monitoring/installtests race suites and
affected API cases; `source-p2vo7bpw`: affected vet and actual
frontend/server/agent builds. `source-l681cvrh` records frontend
type-check and 21,612 tests; browser matrix covers PVE/PBS desktop and
emulated phones with eight inspected screenshots. Earlier full API
timeout and output-limit attempts remain unresolved, not passing
receipts.
- Release-note closure `source-ig3ted7j`: complete install suite and 942
Python cases/eight skips on its recorded source. Final fixture
correction `source-in4fqcsx` passes authored-note tests and seven
negative safety/identity subcases.
- Administration `source-_klnz0rf`: 55 documentation tests, 26 API
tests, authentication tests and documentation audits. Frontend
`source-lrr0gmox`: 50 documentation tests/build/budgets; 41 browser
checks/eight inspected images.
Fresh full-range provenance and whitespace pass. All 23 unpublished
non-merge commits pass the prescribed per-commit completion/browser
checks using their recorded Contract-Neutral reasons where applicable;
aggregate browser coverage binds all six changed frontend runtime paths.
All 62 shipped-doc mirrors and 211 public Markdown checks pass. A naive
aggregate shape check fails because it cannot honour those per-commit
reasons; the workflow-prescribed per-commit check passes. The repaired
PBS required/forbidden source assertions were separately checked against
the final text. An optional additional source-VM check was cancelled
while queued, before execution: no receipt or pass is claimed.
Former-head CI runs `36829661316` and `36829661309` failed the retired
credential-bearing PBS assertion; the accepted additive corrections
replace it. The former CodeQL finding concerned the local TLS fixture's
implicit protocol floor, now explicit. Former advisory benchmark
`ConcurrentReadWrite-4` remains failed: 906.4→1007.7 µs, +11.17%,
p=.011, n=10. Its former candidate and base have identical Go
sources/manifests, but this does not prove the cause or turn the
measurement green. The observation is retained for independent Delivery
assessment; fresh exact-head CI remains necessary for the expanded
batch.
Required exact-head checks and independent review govern landing. These
are synthetic/source proofs, not physical-device acceptance, native
installation/recovery, complete PBS reporter acceptance, deployed
activation, release qualification or availability in a release.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Preserve the complete reviewed maintenance tip and published upstream source unchanged. Combine their installability contract and subsystem registry entries without changing runtime behaviour.
Change-source: pulse-maintainer
The exact-source validation found that the safety warning names the forbidden curl option. Scope the negative checks to fenced shell examples, while retaining certificate, private-token and canonical-installer assertions.
Contract-Neutral: Documentation regression assertions only; no installer, API or runtime contract change.
Change-source: pulse-maintainer
Adds a shadow release-lifecycle rehearsal (workflow_dispatch plus a
daily run) that installs the latest stable with its signature-verified
install.sh in a systemd container, seeds auth, a webhook and a node,
upgrades through the real /bin/update path, and rolls back, asserting
version, health, units, auth, settings and byte-identical encrypted
config at each phase. It gates nothing yet and runs only on the free
hosted ubuntu-24.04 runner with read-only permissions and no uploads. It
is the first step toward making the lifecycle a pre-publication gate,
and it already found that the documented rollback command turns
auto-updates on by default.
The exact source proof exposed a guard incorrectly rejecting prose that forbids insecure TLS flags and a stale control-plane target assertion after the reviewed release-reliability documentation update. Check executable shell fences for unsafe forms, and require the current target in its documentation. Disposable proof lacks sibling repository evidence for two full-suite status checks; that context is retained, not treated as a pass.
Contract-Neutral: Regression-test reconciliation only; accepted product and governance source remains unchanged.
Change-source: pulse-maintainer
Completed PR 2362 CI still required the retired credential-bearing PBS bootstrap command, and CodeQL reported an implicit TLS protocol floor in its local fixture. Assert the accepted read-only and private-file guidance instead, forbid the unsafe forms, and explicitly require TLS 1.2 or later in the fixture. No product or permission changes.
Contract-Neutral: Documentation regression assertions and local TLS test fixture only; runtime and public contracts unchanged.
Change-source: pulse-maintainer
Install a published release (latest stable by default) with its signed
install.sh, seed auth, a webhook and a PVE node through the API, upgrade with
the installed /bin/update --version helper, then roll back with the documented
/bin/update --version command. Each step checks /api/version and the binary
version, /api/health, unit state, the seeded settings against fixed
expectations and the pre-upgrade read-back, and data-dir survival, then
reports a phase table in the step summary.
The workflow is read-only, hosted-only, uploads nothing and no release job
depends on it.
CodeQL on PRs 2361 and 2362 flags the fixture's implicit protocol floor. Require TLS 1.2 explicitly and test that same context; retain trusted, untrusted and wrong-host certificate controls without changing product TLS or documentation.
Contract-Neutral: Synthetic TLS test fixture only; no runtime or subsystem contract delta.
Change-source: pulse-maintainer
Merge Core candidate cf12c37e63 unchanged onto 22380a3546. Resolve only the shared browser receipt to the candidate receipt; changed frontend source exactly matches its non-merge proof-bearing commit. Preserve newer safe API recipes and sparse History source.
Retained focused configapi, hostagent, mock, monitoring and installtests race suites, affected API cases, frontend suite and type-check, builds and PVE/PBS desktop and phone-emulated browser checks cover the changed behaviour. Broad API timeout and output-limit attempts remain unresolved, not passes. No installed recovery, release qualification, publication or deployment is claimed.
Change-source: pulse-maintainer
Initialise the real persistent auth stores for the guide lifecycle and prove user removal revokes its session and CSRF token. Clarify that an empty role list clears built-in assignments too; no runtime authority changes.
Contract-Neutral: Documentation and test-fixture correction only; session revocation, role assignment and authorization runtime contracts are unchanged.
Change-source: pulse-maintainer
Preserve exact Delivery candidate 90c80acb49, including bounded grouped notes, operator safety checks and complete qualification source closure. No product or published release changes.
Change-source: pulse-maintainer
Use the accepted organisation ID alphabet and canonical resource types, and expect the documented role assignments to return 204. Keep the guide lifecycle checks at the existing API contract.
Contract-Neutral: Documentation and test expectations only; API methods, validation, authentication and tenant isolation are unchanged.
Change-source: pulse-maintainer
Keep RBAC, audit and organisation tokens out of process arguments. Use signed-in organisation mutations, actual schemas and acceptance rules, a custom role ID, and private audit exports. Exercise copied commands and handler lifecycles without changing runtime authority.
Contract-Neutral: Documentation and documentation tests only; authentication, RBAC, tenant isolation, licensing and API runtime contracts are unchanged.
Change-source: pulse-maintainer
Remove only the extra trailing blank line that rejected the candidate's base-to-head diff. The release prose, validation behaviour and published notes are unchanged.
Contract-Neutral: Fixture whitespace only; no release-note validation, qualification policy or product behaviour changes.
Change-source: pulse-maintainer
Complete the prior sparse-History candidate without changing its reviewed commit identity or renderer bytes. Wrap only the existing empty-window assertion for the locked formatter.
Contract-Neutral: Test assertion formatting only; no runtime, API or canonical boundary changes.
Change-source: pulse-maintainer
Exact-source validation found two unbound compiled packages after composing the retained notes repair with current main. Include both in the source manifest and report the whole dependency closure without weakening the check.
Change-source: pulse-maintainer
The full API race run timed out while cloning the entire mock estate and rebuilding every persona for each chart series. Cache one immutable sampler against the canonical graph data version under its publication lock. Preserve values, current revisions, disabled-mode fallback and isolation from private/global persona updates. Pin zero-allocation warm acquisition, reference equivalence and concurrent snapshot binding; compare both paths with the same thousand-VM sample.
Contract-Neutral: Avoid repeated canonical graph cloning and persona reconstruction without changing metric formulas, identity, graph freshness, retention, endpoints or permissions.
Change-source: pulse-maintainer
Require the exact shared artifact command, stdin PVE authorization and correctly delimited normalized URL instead of legacy pipe/header forms or an over-broad path substring. These corrections retain installer, ACL and transport assertions; no runtime change.
Change-source: pulse-maintainer
Use the existing HTTP routes with private header files, JSON on stdin and curl defaults disabled. Separate plan, decision and execution, explain their real permissions and retain uncertain-execution safety. Extend the executable guide tests to cover all seven recipes, both header formats, auth failures and trace-enabled local curl settings.
Contract-Neutral: API routes, authentication, scopes, action authority and runtime execution are unchanged; only existing guidance and its executable documentation checks change.
Change-source: pulse-maintainer
Compose the exact earlier source repair on the current reviewed base for final validation. No published release or source routing is changed.
Change-source: pulse-maintainer
Render lone stored observations at their actual time instead of blank collecting panels. Label live legend fallbacks as current and describe empty windows without claiming collection is active. Preserve source/range isolation and failed-refresh recovery.
Add sparse-observation regressions and scoped browser evidence, and align both canonical contracts with the shared renderer's verification boundary.
Change-source: pulse-maintainer
Retain configured-origin and proxy-spoofing coverage while requiring separate credentials, identical tokenless script URLs and private-input renderers. This aligns remaining routed setup assertions with the credential-safe response; no runtime change.
Change-source: pulse-maintainer
Replace the last pre-repair credentialed-command and hidden-token copy assertions with the implemented separate-input contract. All other architecture and runtime assertions remain; browser-verified frontend content is unchanged.
Change-source: pulse-maintainer
Bind the new compiled notes helper and authored fixture in the rootful source manifest. Repair the visual rollback fixture's missing version and align the internal control-plane page with the active release-reliability target, without changing source routing or published packets.
Change-source: pulse-maintainer
The root parser's legacy no-token alias accepted a new private-file command beside a legacy download URL. Reject every mixed alias, as the existing coherent-transport contract requires. Preserve backup-permission URL bindings. Align older secret-in-command and shared type fixtures, and exercise the actual wrong server installer parser.
Contract-Neutral: Enforce the already-declared coherent bootstrap transports and correct verification fixtures; no API, scope or documented behaviour delta.
Change-source: pulse-maintainer
Use existing Unix and Windows token-file installers, verified HTTPS downloads and inspection before execution across setup, retarget, profile and cleanup examples. Exercise private files, all profile arguments, rejected TLS and failed downloads with synthetic guest-local fixtures.
Contract-Neutral: Documentation and executable documentation tests only; installer behaviour, privileges and runtime contracts are unchanged.
Change-source: pulse-maintainer
Bind stable notes to version and operator disclosures rather than obsolete prose. Support bounded grouped customer sections for v6.4.6 and later, align generation and rendering, and preserve published history and all qualification gates.
Change-source: pulse-maintainer
## What changed and why
TrueNAS reporting can return only some metrics, no metrics, or genuine
zero readings. Treating a timestamp as evidence that every metric was
present fabricated zero CPU/network/I/O samples; zero available memory
could also disappear. This repair follows the failed CORE 13 retest in
#2077 and reproduced source cases. It tracks presence per metric through
REST/realtime collection, host rows and History, preserves measured
zero, and keeps optional telemetry failures separate from successful
inventory collection. Diagnostics expose bounded categories/status, not
raw provider text.
The pinned-TLS pipeline fixtures exercise partial readings, failures and
recovery through the client, poller, registry, metric writer and History
readback. A test-only notification receipt watchdog now permits the
existing autonomous queue's two polling cycles while still requiring the
actual webhook payload and incident identity; production scheduling and
latency assertions are unchanged.
## Included source
Complete range
`bfe2b39ee0d110bb2a1fdaf582e04a1d72003126..78f2b7c0323fa130da5ef6313804688e51df10f1`.
Core candidate `20261001T020238Z-core-runtime`: runtime
`22ca07ba7171686f1e0904d1d14eb1f08101e134`, fixture corrections
`dc6a66a62cb18a976ce3e4a6e399e629fdeba16f`,
`00ed443d002b697f21874a4fa2758822ca47a448`,
`5c6e826cc49825fb235a3c5b68a798c8e8081be8`, and final
`28cdde7299364678e00abf33e9f531ea0d47b5c5`. Additive integration
`6b23876ec8104965c7842e194e055f3206134d4f` and upstream reconciliation
`78f2b7c0323fa130da5ef6313804688e51df10f1` preserve every reviewed
identity and published ancestor.
## Validation and limits
Recorded baseline `source-0pul7g9o` reproduced ten faulty cases. Final
`source-_4msx_t4` passed five focused race repetitions, complete
TrueNAS/monitoring race suites, vet and affected-library builds. Earlier
fixture and receipt-watchdog failures remain recorded. The composed
head's entire `internal`, `pkg`, `cmd`, `go.mod` and `go.sum` inputs
equal that tested candidate, so sufficient source validation was not
repeated.
Publication provenance, aggregate canonical completion and whitespace
checks pass. Browser guard correctly skips this backend-only range.
Proof used Go 1.26.7 rather than declared 1.26.8; exact-head CI must
establish the declared toolchain and all required results before
landing. These synthetic proofs are not native appliance acceptance, a
diagnosis of the reporter's response shape, complete #2077 resolution,
installed recovery or release qualification. No release placement is
claimed.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Separate PVE/PBS setup and telemetry credentials from shell source and download URLs. Use silent root/sudo input, private-file handoff, complete downloads and the agent preflight; preserve scope, TLS defaults, single-line paste and coherent rolling-upgrade metadata. Reveal tokens through the existing dialog and discard late issuance after close. Pin executable shell, history, TLS/registration and browser contracts without using real credentials.
Change-source: pulse-maintainer
Preserve the exact Web candidate, parent-bound browser receipt and lint correction. Restore first-touch disclosure while retaining delegated nested controls and keyboard behaviour.
Change-source: pulse-maintainer
Preserve the exact product-intelligence candidate and its tested private-file recipes. Existing PBS setup and troubleshooting now prefer read-only API access and verified TLS.
Change-source: pulse-maintainer
Preserve reviewed TrueNAS telemetry and exact source identities while incorporating the published integration present at batch start.
Change-source: pulse-maintainer
Test caller-native and bound delegated click handlers on separate rows rather than combining JSX event props rejected by the existing duplicate-prop rule. The touch-row runtime and its parent-bound browser receipt are unchanged.
Change-source: pulse-maintainer
Mark clickable table rows as native WebKit touch targets without moving their actions out of Solid's delegated event ordering. Preserve keyboard disclosure, embedded controls, dynamic action removal and explicit native handlers; cover the shared table and data grid, and record production PBS drawer browser proof.
Change-source: pulse-maintainer
## What changed and why
- **Safer TrueNAS troubleshooting.** Existing help put Pulse tokens and
TrueNAS keys in shell arguments and requested unbounded logs. It now
uses private credential files, tests before saving, bounds logs, and
distinguishes hardware capacity from actual CPU/memory usage and
History. This also addresses the misleading capacity-versus-usage
evidence seen in #2077 without claiming to fix that appliance's missing
metrics.
- **Accurate drawer History timelines.** Sparse observations were
stretched independently across each panel, making five minutes look like
a full day. Panels now share the fulfilled, dated time window, preserve
real edge observations, retain matching bounds on failed refresh, and
clear them when the target or range changes. Existing keyboard/touch
inspection and polling limits remain.
- **Honest release-watchdog observations.** After stable publication, a
release branch can retain the stable VERSION while repairs accumulate.
The watchdog now observes that exact source and its preceding stable
reference instead of treating it as a new promotion. Candidate promotion
gates remain unchanged; watchdog artifacts cannot serve as
promotion-readiness evidence.
## Included candidates and complete range
Pulse main:
`e085c2e583fde3af58699ccc9c87f28bcb24715b..920aa2f27c6cb717cca7eb8e2cd3f1379d0fdf73`
(four source commits and four additive integration/reconciliation
commits).
- TrueNAS guidance: `19fa6b1c8dffacd10c0a9dbf025b039844eebbce`,
candidate 20261001T010405Z-product-intelligence.
- Dated History window: `5e886b04d67fbf9edf555d7379db932d28117c3b`,
candidate 20261001T010405Z-web-product.
- Watchdog observation and fixture correction:
`4101c37db548ca85ca8500f433b15a3c45fba2ab..e2fb6b2faee62f6da75b62249da85aced3b71fe6`,
including both commits, candidate 20261001T014538Z-delivery-trust.
The reviewed identities and ancestry are preserved. Reconciliation
`ffb6443862e038d5a050e8a941913f9617f46bd8` already incorporates current
published main; no additional upstream merge or source correction was
needed at this gate.
## Validation and limits
Existing sufficient exact-source evidence is reused:
- TrueNAS: `source-kqbglj0r` passes 23 Python/synthetic-recipe checks;
`source-n7uk8dco` passes 22 docs-link tests. Three Docs-renderer browser
cases pass across Chromium/Firefox desktop and WebKit phone emulation;
six screenshots were recorded as inspected.
- History: regression-first `source-fbz6bjig` records ten failures.
`source-4inm_uzq` passes type-check/lint but retains an AIChat
import-hook timeout; `source-x5tvsgds` passes the complete serial suite
(21,604 tests, three existing skips), embed build, bundle budgets,
formatting, headers and duplication checks without loosening assertions.
Eight production-renderer browser cases pass, with 40 screenshots
recorded as inspected. WebKit whole-row touch opening and screen-reader
speech remain unproved.
- Watchdog: final `source-z97o6_t2` passes 121 Python tests and five Go
regressions. The earlier fixture failure remains recorded; its additive
correction copies the existing checkout ignore policy without weakening
the clean-source assertion.
- Combined tip: provenance and whitespace pass; per-source-commit and
aggregate canonical completion checks pass. The range-aware browser
guard confirms both final changed frontend source blobs are covered by
parent-bound in-range receipts. Final blobs match the reviewed
candidates; intervening upstream changes affect alerts, not these
candidates' source or dependency graphs. A confined native-Git fixture
check passes 74 rehearsal/promotion tests. Its initial incorrect Python
import-path invocation failed before running the suites and is retained
separately.
These are synthetic/offline source and UI checks, not actual TrueNAS/PBS
acceptance, restored hosted watchdog coverage, installed update/rollback
proof or release qualification. Exact-head required CI and independent
review still govern landing. This PR changes no release version or tags
and makes no release-readiness claim. The separate v6.5 proposal #2344
remains unchanged and dependency-audit-blocked under its existing repair
ownership; it is not part of this main batch.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Prefer read-only API access, grant Audit to both PBS identities, keep tokens in private files and verify TLS before sending them. Exercise the documented recipes with synthetic tokens, HTTP failures and certificate rejection controls.
Contract-Neutral: Documentation and synthetic recipe checks only; no runtime API, installer, PBS identity or permission contract changes.
Change-source: pulse-maintainer
The complete race run observed a successful PBS recovery webhook after the functional test watchdog expired. Match the existing notification recovery contract watchdog: two autonomous five-second polls plus callback scheduling, while still requiring the actual HTTP payload and incident identity. No production queue, delivery policy or performance assertion changes.
Contract-Neutral: Test-only functional receipt watchdog for the existing autonomous notification queue; production delivery and API unchanged.
Change-source: pulse-maintainer
Drive each modeled response through a due deadline instead of zeroing it, which legitimately reconstructs the existing future cadence. The production scheduling policy is unchanged.
Contract-Neutral: Test-only due-deadline setup for the telemetry pipeline; production polling and API unchanged.
Change-source: pulse-maintainer
pulse-triage[bot]