Accept exact candidate 6809ca2b23. Keep attempted upgrades, failing runtimes and later recovery distinct while preserving passive, private evidence collection. No runtime or release outcome is asserted.
Change-source: pulse-maintainer
Keep the failing runtime, intended release, original updater result, host stop and later recovery separate. Accept unknowns and existing redacted evidence without a repeat update, reboot, restore or loss of rollback backups. Guard both forms and preserve version classification when attempted and recovered versions differ.
Change-source: pulse-maintainer
Contract-Neutral: Community intake guidance and regression tests only; installer, updater, runtime and triage automation contracts are unchanged.
The helper selects and passes an explicit service name, bypassing installer discovery. Apply the same bounded exact-unit admission there and preserve its error before any prior-active query, backup, installer call or restart trap. Execute both producers and the real helper handoff in the registered unattended updater proof artifact.
Refs: #2785
Change-source: pulse-maintainer
Consume one bounded inventory of exact historical unit names without early pipe closure. Preserve legacy and explicit-instance selection, and stop replacement, unit creation, reset and removal after unknown inventory even when Bash errexit is disabled. Distinguish this source defect from the unconfirmed cause of the reported LXC stop.
Refs: #2785
Change-source: pulse-maintainer
Existing forms warn against uploading secrets but stop at prevention. Explain issuer revocation, separate attachment removal, surviving copies, private follow-up and independent monitoring coverage without asking for another diagnostic or credential test.
Change-source: pulse-maintainer
Contract-Neutral: Documentation and guidance coverage only; runtime, API, storage and deployment contracts are unchanged.
The full documentation proof counted all 18 current recipes, including the newly documented standalone action runner removal. Keep the exact inventory assertion and shell parsing rather than retaining the old 17-command expectation.
Contract-Neutral: Test inventory correction for the documented runner-only recipe; no runtime, lifecycle, API or authority behaviour changes.
Change-source: pulse-maintainer
Settings > Assistant offered a Protected guests list (protected_guests)
that was saved and pushed into the Assistant tool executor, but its only
reader was executeControlGuest, which nothing calls. pulse_control plans
through the shared action lifecycle and never consulted the list, so a
guest named in it (by VMID and by name) was planned like any other. The
"legacy" label added in #2765 states that limit; this removes the
setting instead of keeping a field that cannot do its job.
The canonical way to keep Pulse off a resource is its operator lock
(Never auto-remediate, or a Retired lifecycle). It is keyed by canonical
resource id, applies to every platform, and the action lifecycle refuses
dispatch for it even for approved plans. The one gap was planning: the
lifecycle plans without reading operator state, so the Assistant could
leave a plan in Actions that can never run. assistantTypedActionPlanner
now reads the state through the tenant-scoped lifecycle store (the same
read Patrol's broker uses) and declines before Plan, and pulse_control
reports the block with how to clear it. A state that cannot be read does
not refuse planning, because dispatch re-checks.
Removed: AIConfig.ProtectedGuests and its getter, the settings API
field, the executor field/setter/config, the chat service plumbing, the
Settings field and form state, and the legacy copy, pins and prose from
#2765. A stored value still loads (tolerant decode) and is dropped the
next time the settings are written; older PUT bodies that send the key
are ignored. The Settings panel points at the guest's Manage tab.
Preserve exact Delivery candidate 13206d2fa7 and use its fully qualified nine-request catalogue in place of the earlier narrower section-boundary integration fix. Resolve the sole test-file conflict to the candidate bytes already covered by full-package and race source receipts; no frontend resolution or runtime change.
Change-source: pulse-maintainer
Explain evidence loss, saved-state trust, platform differences and partial removal before administrators act. Keep whole-agent removal separate from the Linux action runner, preserve deliberate path protections, and exercise copied commands with bounded synthetic recorders.
Contract-Neutral: Documentation and synthetic source-bound recipe checks only; no runtime, lifecycle, authority, platform or API behaviour changes.
Change-source: pulse-maintainer
PR2768 run 38026567559 failed four guidance roots because the newly reviewed node request became a ninth action recipe. Scope the existing eight action/authentication specimens to their reference section, retaining unexpected-request and curl-bypass rejection controls. The dedicated node suite still executes the node recipe and private request preparation.
Contract-Neutral: Integration-only documentation-test boundary repair; no shipped API, authentication, action or node-setup contract change.
Change-source: pulse-maintainer
Repair the deterministic PR2768 backend failure after the safe node guide added its ninth request. Exercise that private-file POST alongside the existing recipes without positional method/path assumptions, and reject missing, duplicate or unqualified examples while preserving privacy, trust, one-shot and real deadline controls.
Contract-Neutral: Copied-guidance regression test and synthetic fixture reconciliation only; no runtime, API, TLS, workflow, frontend or shipped documentation contract changes.
Change-source: pulse-maintainer
Separate a rejected lookup credential from a missing reporting scope, missing host and ordinary reporting failure. Distinguish the normal silent-token install from bootstrap enrolment, reuse the bounded private log reader and preserve credentials and identity while finding the failing stage.
Contract-Neutral: Documentation-only authentication triage; no runtime, API, authorization or installer behaviour changes.
Change-source: pulse-maintainer
Use an exclusive mode-0600 temporary file before writing the fixed non-credential body marker. Keep copied-command, redaction, redirect, denial and partial-response assertions unchanged; no CodeQL rule or security gate is suppressed.
Contract-Neutral: Documentation-test fixture creation only; no shipped API, authentication, permission or guide contract changes.
Change-source: pulse-maintainer
Preserve the exact reviewed Delivery commits and their source-bound proofs; retain existing test tiers, waits and verdict.
Change-source: pulse-maintainer
The smoke runner invokes shell recipes directly. Preserve the tested admission bytes and set the new recipe's executable bit, then validate the final-source entrypoint through that actual runner rather than relying only on direct Node checks.
Change-source: pulse-maintainer
Contract-Neutral: Test recipe execute permission only; source bytes and readiness and workflow contracts are unchanged.
Replace installer-rerun and unchecked capability advice with bounded private property checks, a narrow existing-ceiling override and deliberate prior-active maintenance. Distinguish configured settings, process startup and ordinary ICMP recovery without weakening sandbox policy.
Contract-Neutral: Existing ICMP administration guidance and copied-command controls only; no availability runtime, privilege, API or frontend behaviour changes.
Change-source: pulse-maintainer
Main E2E 38020587365 exhausted twenty shared-readiness/login failures over 47 minutes, then probation hit the job limit before stable report uploads. Admit the same authenticated inventory and pool/disk history once before either tier, without retries or ignored failures, and upload completed stable failures before observational work. Share the existing readiness predicates and cover every identity/history requirement, actual spec cleanup and the workflow fail-fast command. Preserve phase thresholds, test tiers, pins and the stable verdict. This does not diagnose the hosted runtime failure.
Change-source: pulse-maintainer
Accept Product Intelligence candidate 20261010T034626Z-product-intelligence with both original commits preserved. Retain source-20heiox1 documentation and copied-command proof; no product runtime or new surface changes.
Contract-Neutral: Merge reviewed documentation guidance and regression controls without runtime contract changes.
Change-source: pulse-maintainer
The npm Playwright entrypoint exited inside setup and bypassed its finally block, leaving a partial managed runtime and verification lock behind. Keep the setup failure, skip tests, attempt existing teardown once, and release only the handoff this invocation wrote when its contents still match. Preserve primary failures through teardown errors and do not stop a runtime after lock preparation fails. Add real child-process controls to exhaustive script smoke; test tiers, acquisition deadlines and browser coverage are unchanged.
Change-source: pulse-maintainer
The first exact documentation run found two fixture-selection failures: the Nodes and Config section also contains export/import JSON. Read only the existing Add Node subsection for its single configuration specimen; retain all transport, trust and original-document controls.
Contract-Neutral: Documentation recipe test extraction only; no product runtime, subsystem contract or guide content change.
Change-source: pulse-maintainer
Replace root-password and implicit-TLS examples with a private JSON-file recipe using the existing bounded helper. Distinguish live tests, persisted changes, platform credentials and uncertain results; exercise copied commands with synthetic success, denial, redirect and incomplete responses.
Contract-Neutral: Documentation, mirrored guidance and copied-recipe regression tests only; no runtime API, authentication, TLS or frontend contract changes.
Change-source: pulse-maintainer
Canonical Governance run 38016670825 passed browser admission but failed strict temporary .git cleanup during the two-order receipt-pruning test. Isolate both disposable fixture builders from runner configuration and disable automatic GC, maintenance and fsmonitor locally, including bare Git calls made by the guard. Trace real pruning merges and test hostile ambient configuration without suppressing cleanup errors or weakening receipt checks.
Change-source: pulse-maintainer
Merge exact Delivery tip c592c69b4d, including 82f6257d45. Resolve the overlapping formatter guard by retaining canonical main's stronger GuestMemoryEvidence assertion. Preserve automatic complete suite discovery, existing recipe deadlines and the fail-closed required backend check. Retained source-bk4g0rip covers 93 available suites; historical Git context and hosted timing remain explicit limits.
Contract-Neutral: CI scheduling and assertions only; no application, shipped guidance, dependencies or release policy change.
Change-source: pulse-maintainer
Merge exact Web tip b908be2e55 with launch upstream 0289e8b648. Preserve both independent memory-evidence and Assistant-control contract sections in two internal documentation conflicts; all reviewed frontend content remains byte-identical. Retained sensitive race, browser, build and completed source observations are adequate for the changed control boundary. Broad affected-package race remains unproved after its recorded observation timeout; no aggregate pass or publication is claimed.
Change-source: pulse-maintainer
The first complete smoke-shard proof exposed the old inline-Patrol wording assumption after the reviewed query/observer qualifier move. Keep the unknown and unavailable safety assertions and verify the real caller-to-qualifier-to-formatter chain instead. Guidance and runtime source are unchanged.
Contract-Neutral: CI assertion follows the existing reviewed formatter; no guidance, runtime, memory semantics, dependency, release or subsystem contract delta.
Change-source: pulse-maintainer
The reviewed guest-memory consumer repair moved warning strings out of Patrol into unifiedresources. Preserve the documentation assertions and verify Patrol still delegates qualification and display to that shared formatter. This reconciles the combined batch without changing runtime or guidance.
Contract-Neutral: Test-only integration reconciliation; guest memory, documentation, access and collection contracts are unchanged.
Change-source: pulse-maintainer
The current containing main run executes all 93 smoke suites sequentially for 679 seconds. Partition the discovered inventory without maintaining an allowlist or changing recipe deadlines, and keep the existing required build check fail-closed on every shard. Exercise complete coverage, discovery failure, child failure collection and actual workflow commands.
Contract-Neutral: Product CI smoke scheduling and exhaustive gating only; no installer, application, shipped guidance, dependency, release policy, safety deadline or subsystem contract delta.
Change-source: pulse-maintainer
The current canonical resource planner does not consult the retained guest list. Label that compatibility data honestly and link its accessible limitation without discarding saved policy. Keep the review-only mode menu within the composer on phones, with geometry and resize controls.
Reconcile the old autonomous-mode test with the explicit core-owned investigation flag, preserving saved preferences and legacy approvals. Mounted settings, parent-discriminating copy/menu checks, help mirrors and final-byte browser receipts cover the existing flow.
Change-source: pulse-maintainer
Retain exact PI candidate and its desktop/phone documentation evidence. Clarify guest cache, availability and Pulse process scope without changing collection or Patrol behavior.
Change-source: pulse-maintainer
Two complete containing runs spent 717 and 719 seconds in rest-1, with the installer binary near its end. Refresh whole-package costs from uncached passing rest-shard reports and emit heavier binaries first. Preserve both required checks, source-derived exhaustive coverage, race tests, failure propagation and internal/api ordering.
Contract-Neutral: Schedule existing independent CI package binaries only; no runtime, required-check, exhaustive coverage, race-test or dependency-admission contract changes.
Change-source: pulse-maintainer
Separate hypervisor footprint, Linux availability and process RSS in existing troubleshooting, FAQ and threshold help. Keep comparisons on the same guest, kernel, time and units, preserve unknown or retained evidence, and avoid diagnostic probes, restarts, cache drops and blanket suppression.
Contract-Neutral: Documentation and source-bound help regressions only; memory collection, Patrol decisions, alert controls and access contracts are unchanged.
Change-source: pulse-maintainer
The completed PR2761 native run spent 243 runner-seconds acquiring and building frontend assets before its deterministic immutable-image source check failed in four Unix jobs. Execute the existing uncached bounded image checks immediately after Go setup, before Node and native runtime work. Keep real frontend assets, exhaustive installer groups, pins, all native gates and their deadlines unchanged; guard order, selection and terminal failures.
Contract-Neutral: Additional early execution of existing immutable-image source assertions only; no public contract, agent runtime/lifecycle, Windows behaviour, image pin, complete-suite coverage, existing gate or deadline changes.
Change-source: pulse-maintainer
Project interactive Assistant controls to Read-only and Ask first without migrating legacy stored preferences or relaxing entitlement, legacy command approval, scoped execution or Patrol policy. Preserve stored policy even when an older client echoes the projected mode on an unrelated save. Explain saved Actions plans and operator review in existing Settings, Chat and help.
Add saved-client and encrypted-config compatibility, authenticated plan-only access, active-stream and scope regression controls with parent comparisons. Record inspected final-byte desktop/phone browser proof and the affected subsystem contracts.
Change-source: pulse-maintainer
Retain exact Delivery commit db9743a84e and canonical fix 08b30faf14. Resolve their overlapping test-file edits to the reviewed Delivery file with its broader pin-form controls; preserve immutable defaults, same-run admission and every existing gate.
Change-source: pulse-maintainer
Completed PR2761 native run 37998632049 and backend run 37998632126 reject the reviewed Compose interpolation although its local Alpine fallback remains digest-pinned. Recognise only the fixed same-run override with an immutable governed default. Add positive and malformed, mutable, retired-line and lookalike controls; retain runtime pins, bundle admission and all native gates.
Contract-Neutral: Regression-only reconciliation of the existing installer source assertion with reviewed same-run E2E image composition; no runtime, workflow, contract or permission changes.
Change-source: pulse-maintainer
Native Unix CI rejects the fixed compose override even though its local default remains digest-pinned. Recognise only that existing override or a literal complete governed pin, with malformed and mutable-default controls. Keep images, producer admission, required gates and deadlines unchanged.
Change-source: pulse-maintainer
The complete documentation proof observed a synthetic reader still in state R after the command pipes closed. Keep the 80-second group kill and 83-second test ceiling unchanged, but observe gone or zombie for at most half a second before declaring completion. Persistent live states, observation errors and malformed records still fail; deterministic transition and bound controls cover the witness.
Contract-Neutral: Documentation verification witness only; copied collector recipes, runtime behaviour and subsystem contracts are unchanged.
Change-source: pulse-maintainer
Preserve the exact Delivery candidate ancestry. Resolve the overlapping canonical fixture correction to the candidate’s reviewed final bytes, retaining all three groups, exact invocation counts, odd and Unicode inventories, selectors and terminal-failure controls. Production runner and frontend source are unchanged.
Contract-Neutral: Test-only merge of the reviewed smoke reconciliation; installer runtime, contracts, deadlines and gates are unchanged.
Change-source: pulse-maintainer
The initial complete documentation proof failed only because Local administrators begins a sentence. Preserve every required privacy boundary while ignoring its letter case; the guide and runtime remain unchanged.
Contract-Neutral: Documentation regression assertion only; no runtime, endpoint, scope or subsystem contract delta.
Change-source: pulse-maintainer
The exact-parent comparison needs a failed safety assertion, not an incidental missing-heading exception. Assert the heading before checking its order; the guide and runtime are unchanged.
Contract-Neutral: Documentation regression assertion only; no runtime, endpoint, scope or subsystem contract delta.
Change-source: pulse-maintainer
PR2761 script smoke checks failed because the existing Python fixture still unpacked two groups after the reviewed runner began returning general-0, general-1 and reset. Assert all three exact commands, deterministic exact-once selection, insufficient-inventory refusal and terminal failure in every group without changing runner behaviour or deadlines.
Contract-Neutral: Fixture correction only; installer runtime and runner contracts are unchanged.
Change-source: pulse-maintainer
Replace the credential-argument probe recommendation with private, bounded reads. Explain least-scope client setup, private configuration and preserved proxy access; distinguish scope-only writes, terminal events and partial verification from recovered workloads. Keep the adapter entry point and shipped guide consistent without changing runtime behaviour.
Contract-Neutral: Existing external-agent documentation and its copied/rendered regression checks only; no endpoint, scope, policy, adapter or runtime contract changes.
Change-source: pulse-maintainer
Preserve the exact reviewed guidance and formatting commits. The existing Cloud guide now bounds export scope, identity, endpoint trust and single-active recovery; retained documentation and rendered-help proof cover unchanged final content.
Change-source: pulse-maintainer
The production runner now emits two general groups and a reset group, but its independently discovered Python smoke suite still unpacks two. Repair the required smoke check, assert the complete invocation count before zipped comparisons and cover terminal failures in every group. Preserve exact-once inventory, Unicode names, selectors, count and deadlines without changing runtime or workflow gates.
Contract-Neutral: Test-only reconciliation of the existing three-group native installer runner; production source, installer contracts, invocation deadlines and required checks are unchanged.
Change-source: pulse-maintainer
pulse-triage[bot]