staged_verification_files_for_requirement() matches
allow_same_subsystem_tests against a subsystem's
owned_prefixes/owned_files, but both commit guards passed it the
impacted entry, which carried neither. Since the v6 import (778a2577b6)
a same-subsystem test never satisfied a requirement, while
subsystem_lookup.py (which passes the registry rule) and the guard's own
BLOCKED message ("same-subsystem test/spec files are also accepted")
said it would.
Honouring the 12 flags would have loosened the guard well past their
apparent intent. Every rule requires explicit path-policy coverage, so
the five rule-level flags are never consulted, and on the seven path
policies the flag reaches every test the subsystem owns: a
mutation-registry change would accept any internal/ai or AI Chat test
(~455) instead of its 4 listed proofs, and a frontend Actions change any
Go test under internal/unifiedresources. Six of the seven already list
their own directory in test_prefixes.
So the strictness stays and the tools now agree on it: the registry sets
the 12 flags to false (what has always been enforced), registry_audit
rejects true and points at test_prefixes/exact_files, and the impacted
entry carries the rule's ownership so the completion and commit-shape
guards read the flag the same way subsystem_lookup does.
No requirement accepts a proof it rejected before. subsystem_lookup
stops reporting matches the guard refused: a new internal/hostagent test
no longer claims three agent-lifecycle policies.
Preserve the exact published frontier alongside reviewed canonical work. No publication or deployment is performed by this merge.
Change-source: pulse-maintainer
Audit Webhooks is the only webhook page in Settings, so people who want
alerts in Discord or Slack land there. In #1344 a user tried to add a
Discord webhook from it and filed a bug when that didn't work. Alert
delivery lives in Alerts, Notifications, which Settings never mentions.
The panel now opens, gated or enabled, with one line saying these
webhooks carry security events only, linking to alert notifications.
Verified at 1440 and 390. The link lands on /alerts/notifications
without a page reload.
The Security Overview tagged the HTTPS tile red and Critical on every
install, directly above a hardening card that calls HTTPS Recommended on
a private network and says local HTTP is acceptable. The same flag
counted plain HTTP as a missing critical control in the posture score,
so a typical LAN install read 55 percent.
The tile now uses the hardening card's rule: critical once the instance
is publicly reachable, recommended otherwise. A private install with a
password and protected exports reads 79 percent (still Moderate). A
public one still shows HTTPS as Critical.
Verified at 1440 and 390 on a private-network instance.
Preserve existing reviewed integrations and published attention-reason presentation without re-parenting source commits.
Change-source: pulse-maintainer
The shared-template rule required every TrueNAS table to use the shared
title-case helper. The storage table used it only for the risk-level
pill, which the Health reason replaced, so it no longer formats any raw
provider value and the required-consumer check failed. The scope-wide
guard against a local titleCase helper still covers the file.
Match QNAP guidance to existing data-volume relocation, create private per-attempt staging and preserve diagnostic logs and identity. Exercise copied commands for preparation and installer failures without an appliance operation.
Contract-Neutral: Clarifies existing installer storage and private staging guidance; no runtime, permission or data-contract change.
Change-source: pulse-maintainer
Audit Webhooks is the only webhook page in Settings, so people looking to
send alerts to Discord or Slack land there. Issue 1344 tried to add a
Discord webhook from it and filed a bug when that did not work. Alert
delivery lives in Alerts, Notifications, which Settings never mentions.
The panel now opens, gated or enabled, with one line saying these webhooks
carry security events only and linking to alert notifications.
On a phone the TrueNAS Storage Health column is hidden, so the row
drawer is where a user learns why a row is amber. It fell short in three
ways:
- A read-only dataset said only "Observed state Degraded", because a
read-only dataset raises no incident.
- A pool showed one of its two incidents, because the health presenter
read only the rollup, plus a generic "Resource Health Issue" line.
- When an open alert matched the first reason, the drawer dropped every
other reason.
The fix:
- The shared health presenter keeps every incident summary.
- It adds a TrueNAS dataset's state, through a small shared util the
storage table will also use.
- It uses the rollup's category label only when nothing more specific
exists.
- The Overview's Needs attention list skips only the reasons an open
alert already states, ignoring a trailing full stop.
Verified on the phone and desktop drawers for the read-only dataset and
the degraded pool, and on the Machines table, which is unchanged.
Preserve the exact reviewed documentation candidate and its retained privacy/query proof; no runtime or storage changes.
Change-source: pulse-maintainer
Additively incorporate the exact observed main frontier without advancing PR2486 or rewriting accepted work. The newer canonical range remains deferred pending its existing source-check and composition-proof routes.
Change-source: pulse-maintainer
The Security Overview tagged the HTTPS tile red and Critical on every
install, directly above a hardening card that calls HTTPS Recommended on
a private network and says local HTTP is acceptable. The same flag also
counted plain HTTP as a missing critical control in the posture score, so
a typical LAN install read 55 percent.
The tile now uses the hardening card's rule: critical once the instance
is publicly reachable, recommended otherwise. A private install with a
password and protected exports reads 79 percent, still Moderate, and a
public one still shows HTTPS as Critical.
On a phone the TrueNAS Storage Health column is hidden, so the row drawer
is where a user learns why a row is amber, and it fell short. A read-only
dataset said only Observed state Degraded, because it raises no incident.
A pool showed one of its two incidents, because the health presenter read
only the rollup, plus a generic Resource Health Issue line. And when an
open alert matched the first reason, the drawer dropped every other one.
The presenter now keeps every incident summary, adds a TrueNAS dataset's
state (the provider's only reason for a read-only dataset, read through a
shared util), and uses the rollup's category label only when nothing more
specific exists. The Overview's Needs attention list skips only the
reasons an open alert already states, ignoring a trailing full stop.
Reuse the tested API helper, explain point/source and access distinctions, and preserve data before storage tuning. Copied examples now exercise private success/error responses, redirects, incomplete transport and encoded IDs.
Contract-Neutral: Documentation and recipe checks align with existing history API behaviour; no runtime, storage, entitlement or authentication contract changes.
Change-source: pulse-maintainer
Share the original memory observation policy with the dedicated guest drawer and carry filesystem deferrals through the existing History presentation. Preserve measured zero, stored samples, source and access isolation, and same-ID read budgets. Record fresh eight-state browser proof; native thaw and workload recovery remain independent.
Change-source: pulse-maintainer
The Storage tab put a green Healthy pill on every pool, dataset and disk,
repeating the status dot, while the few amber rows gave no reason. The
pool said Warning where the dataset said Attention for the same bucket,
and in the disk scope the pill clipped past the phone edge.
Healthy rows now leave Health empty. A non-healthy row says why in the
Health column, on the row's single line as the shared platform-table
rhythm requires: TrueNAS's own alert text first, Pulse's risk summary when
TrueNAS raised no alert, then the dataset state tag (read-only datasets
raise no incident, so the tag is the provider's only reason), and a plain
fallback so no amber row is silent. Stale TrueNAS data leads when it is
the cause. A count stands in for further reasons, with every reason on
hover and for screen readers. Health sorts by severity and is
desktop-only in every scope, so phones keep the status dot and the drawer.
The earlier change named the alert type on a second line under the
gateway name. The shared platform-table contract keeps summary rows on one
line, with context in an operational column, a tooltip or the drawer.
Each gateway alert is about one number in the row, so that number now
carries it: queue, hold and message-age alerts colour Queue, deferred
alerts colour Deferred, quarantine alerts Quarantine, and inbound spam and
virus anomalies their columns, with the message on hover and for screen
readers. Alerts with no column of their own, such as offline or outbound
anomalies, stay on the status dot, a screen-reader summary, the row tint
and the drawer.
The Services tab gave a red dot to SMART with no reason, beside the same
Stopped pill as SSH, and spent a column on process IDs. The VMs tab spent
two columns on the bootloader and device counts. None of those columns
answers whether something is wrong.
A service stopped while set to start at boot, and a VM set to autostart
that is stopped, now say "should be running" beside the state, with the
full sentence on hover. Services also gain a drawer Condition row, since
the State column is hidden on phones. A VM stopped without autostart gets
no note, because someone stopped it on purpose. Process IDs, bootloader
and device counts stay in the drawers. Rows stay single-line, as the
shared platform-table rhythm requires.
Retain the three-sample baseline-plus-ten bound in an isolated copy of the same test binary. Add full-publication copying controls and exact complete admission-content parity, rather than attributing independent registry allocation variation to ignored metadata.
Contract-Neutral: Test measurement correction only; no runtime, identity, freshness, publication or allocation-limit contract changes.
Change-source: pulse-maintainer
Retain the batch-start main frontier before integrating the independently reviewed documentation-test candidate. No publication or deployment.
Change-source: pulse-maintainer
Settings said "2 down" where Machines said "1 offline, 3 need
attention" for the same checks. Settings counted any failed latest
probe as down, while Machines and the alert engine count a check offline
only once it has failed its threshold number of times in a row.
Settings now classifies each check with the Machines status of its
resource when that is loaded, and otherwise reads the target the way the
availability poller does, so both pages report the same counts in the
same words. A check that is failing but not yet offline is amber, with
the threshold on hover.
The Machines table shows 24h uptime beside the latest result (it existed
only in the Fleet view), and only when most of the window had a
determinate answer, refreshing every five minutes. Failures read "3 in a
row" instead of "3/2", polling cadence moves to the widest tables, and
the duplicate Manage link is gone.
A gateway Proxmox reported online could be failing its job: mail held
in the queue past the configured age. The Mail Gateway table ignored
alerts, so that gateway rendered green and counted as Healthy while the
problem sat only on the Alerts page. Alerts are keyed by the PMG
instance id and rows by the unified id, so nothing joined them.
Rows now match unacknowledged alerts across the gateway's identity
aliases. An alerted, reachable gateway reads and filters as needing
attention (red when an alert is critical) and names the alert type under
its name. Its expansion leads with the exact alert message. On phones,
six tracks truncated "mail-gateway-eu" and "mail-gateway-us" to the same
text; the node count moves into the expansion so names stay whole.
Settings said "2 down" where Machines said "1 offline, 3 need
attention" for the same checks. Settings counted any failed latest
probe as down, while Machines and the alert engine count a check offline
only once it has failed its threshold number of times in a row.
Settings now classifies each check with the Machines status of its
resource when that is loaded, and otherwise reads the target the way the
availability poller does, so both pages report the same counts in the
same words. A check that is failing but not yet offline is amber, with
the threshold on hover.
The Machines table shows 24h uptime beside the latest result (it existed
only in the Fleet view), and only when most of the window had a
determinate answer, refreshing every five minutes. Failures read "3 in a
row" instead of "3/2", polling cadence moves to the widest tables, and
the duplicate Manage link is gone.
Preserve exact Core candidate ab15c4db8a and its two prerequisite commits. Retained connected proof and complete cost samples support allocation and scaling gains, not native CPU/RSS relief.
Change-source: pulse-maintainer
The note sat before the same frontend-primitives heading another lane used and conflicted with main. Taking main's file with the note folded into the existing object-drawer clause lets main merge cleanly.
Compose exact upstream a82a8e0474 additively without changing accepted commits. Resolve the append-only registry-test conflict by retaining both the reviewed metadata invalidation control and upstream stale-health control. Existing PR2486 remains unchanged while normal source-check corrections are pending.
Change-source: pulse-maintainer
The Coverage tooltip and expansion render the posture explanation
verbatim, and it read like the model: "a current subject-linked
backup", "older than the configured freshness window", "a newer
provider failure", "a stronger protection claim".
Each explanation now says what Pulse found in plain words and stays true
to its branch: the stale case names the window ("the newest confirmed
backup is older than 7 days"), the failure case no longer claims a
timing it cannot know, and partial history without a backup no longer
says a backup exists. The window formatter never rounds a sub-hour or
fractional window up. The frontend fallbacks for checking, unrated and
unknown rows and the snapshot-only tooltip use the same voice.
The Kubernetes overview said "2/3 nodes" in amber on the cluster row
but no surface on the page named the node, and active health signals
rendered at the bottom, after every healthy deployment, pod and
controller. On the Nodes tab a node's state was a hover title on a
dot that screen readers never heard.
Health signals and the nodes that are not Ready, cordoned or degraded
now lead the overview, each only while it has rows, using the existing
Kubernetes alerts and nodes tables. The full node inventory stays on
the Nodes tab, and the attention list keeps its own sort. The nodes
table names the state in a Status column beside the name, as kubectl
does, and announces it on phones where that column is demoted.
A gateway Proxmox reported online could be failing its job: mail held
in the queue past the configured age. The Mail Gateway table ignored
alerts, so that gateway rendered green and counted as Healthy while the
problem sat only on the Alerts page. Alerts are keyed by the PMG
instance id and rows by the unified id, so nothing joined them.
Rows now match unacknowledged alerts across the gateway's identity
aliases. An alerted, reachable gateway reads and filters as needing
attention (red when an alert is critical) and names the alert type under
its name. Its expansion leads with the exact alert message. On phones,
six tracks truncated "mail-gateway-eu" and "mail-gateway-us" to the same
text; the node count moves into the expansion so names stay whole.
A Docker host whose agent stopped reporting kept showing its last CPU,
memory and disk bars as if they were live, with only an orange dot to
hint otherwise. The tables now read the backend's telemetry_stale
reason: that host's metric cells are dimmed, Uptime shows how long it
has been silent, and its container group header says "No report for 1h".
Health could only carry that reason when nothing outranked it, so a
silent host with an offline alert lost the signal. The verdict still
leads with the alert, and a stale source now adds a trailing
telemetry_stale reason. The first reason, which the state summary
reports, is unchanged.
Grouped by host, the containers table also repeated the host name and
engine on every row, about a quarter of its width. Those columns are
dropped in grouped mode and the group header names the engine once;
flat mode keeps them, and a saved sort on either hidden column no longer
reorders grouped rows.
Verified in a browser on a mock estate at 1440 and 390 with the rebuilt
backend (receipt included). Go: internal/unifiedresources, internal/api
summary and internal/monitoring health tests pass; full frontend suite
passes apart from the known Mac-only agentInstallCommand cases.
Maximum-priority roots cannot be better than any group in a snapshot, so leave them out of the temporary owner indexes while retaining every resource and group. Correct new fixtures to respect existing attachment semantics: differently ranked hosts may already merge, and an agent's first-pass IP attachment must remain ambiguous until its two owners merge. Cover equal-priority Proxmox cost before any timing run.
Contract-Neutral: Candidate-only priority pruning and faithful regression fixtures preserve all stored/published resources, identity, strict attachment ambiguity, evidence precedence, public schemas and counted-system admission.
Change-source: pulse-maintainer
Patrol's Inbox, Protection and Activity views and the Actions Open and
History views lived in component state. A bookmark, a shared link or a
reload always opened the default view, and back/forward did nothing.
Each view is now a route: /patrol, /patrol/protection,
/patrol/activity, /actions and /actions/history. Tabs navigate without
scrolling the page. Lifecycle-driven switches in Actions (a deep-linked
review whose action has settled) replace history instead of pushing.
The Patrol finding handoff scrolls to the findings once Activity has
mounted. The Inbox's ?attention= selection is read from the real address
when leaving the Inbox and restored on return, because the attention
workbench writes it straight to history and the router's copy can be
stale.
Build complete hostname/IP/form owner indexes once in priority order, visit only strictly better owners and reject once two distinct qualifying roots prove ambiguity. Preserve exact/short/IP evidence precedence, metadata freshness, exclusions and all resources. Bind the immediate-parent algorithm and enumerate targets independently; exercise real provider grouping and connected Infrastructure output.
Contract-Neutral: Pass-local representation and cost only; complete inventory, strict better-priority and ambiguity rules, evidence ordering, identity, public schemas, observations and alert policy are unchanged and covered by exhaustive and connected reference controls.
Change-source: pulse-maintainer
rcourtman