Repair deterministic governance and script-smoke failures against the reviewed guides without restoring public response output, literal credential commands or clobbering downloads. Exercise the actual shared API helper and independently verify private, unique response files, methods, bodies and hostile curl defaults.
Contract-Neutral: Update test adapters for the existing reviewed credential-private guide contract; no runtime or guide change.
Change-source: pulse-maintainer
Assert refreshed status and CPU on the same canonical VM instead of requiring a Proxmox rename that the existing source-priority merge intentionally rejects. Use the mock runtime's supported maximum cadence. The initial fixture and assertion failures remain retained; no production behaviour is changed.
Refs: #2199
Contract-Neutral: Correct independent test assumptions only; no runtime or resource contract delta.
Change-source: pulse-maintainer
Keep the assigned-base typed-view rebuild as an independent benchmark reference. Measure warm reads, dirty List-only reads and dirty List plus typed views rather than claiming that moving derivation removes cold cost. Pin stale and between-record freshness, canonical policy detachment and arbitrary clone refresh.
Refs: #2199
Contract-Neutral: Extend independent validation of unchanged resource schemas and existing freshness/ownership guarantees; runtime source is unchanged.
Change-source: pulse-maintainer
Keep full inventory and arbitrary clone refresh. Detach materialized identity and policy under the existing registry lock, invalidate between batch records and on stale-source transitions, and keep List-only reads independent of typed view construction. Compare every field and wire payload with an independent fresh-clone oracle across all demo providers.
Refs: #2199
Change-source: pulse-maintainer
Contract-Neutral: Registry-internal copying and invalidation repair existing freshness and ownership guarantees; canonical resource fields, wire schemas, identity rules, policy derivation, telemetry and alert evaluation are unchanged.
Retain the pre-change fresh-clone oracle for every derived field, incremental ingestion and detached reads. Expose repeated canonical derivation in a 1000-resource bulk read before altering production code.
Refs: #2199
Contract-Neutral: Add independent regression controls and paired measurements; runtime and public contracts are unchanged.
Change-source: pulse-maintainer
Preserve exact Core candidate history and complete published monitoring inventory while removing unrelated temporary metadata copies.
Change-source: pulse-maintainer
Freeze the source expectation as serialized bytes before mutating returned records. A broken clone cannot change both the tested state and its reference, so module, update and applied-config alias regressions must be detected.
Change-source: pulse-maintainer
The unchanged-parent allocation controls fail as intended. Its semantic oracle also compared separate wall-clock registry construction timestamps. Retain all source timestamps and canonical payloads while excluding only Resource.UpdatedAt from the full-reference comparison.
Change-source: pulse-maintainer
Avoid cloning and ingesting twenty known non-host Kubernetes metadata kinds in temporary per-report matching registries, while preserving all publication and canonical matching. Clone only the selected native record for exact host reads and detach mutable host update, module and config state. Pin reference equivalence, live report publication, ownership and allocation scaling with connected controls.
Change-source: pulse-maintainer
Compare complete canonical host views with a full-snapshot reference and pin current replacement. Measure unrelated Kubernetes metadata and peer-host allocation growth before repairing report lookups.
Change-source: pulse-maintainer
Resolve the prior non-Linux skip in favor of the exact reviewed real-registration refusal fixture. Preserve candidate a2608c9 and runtime safety contracts.
Change-source: pulse-maintainer
PR2472 build run 37239183545 extracts no wrapped TrueNAS recipes; exercise all three current blocks and retain synthetic HTTP response bodies only in private files, including 201 save and error controls. Native run 37239183481 expects a Linux QGA capability on macOS and Windows; assert non-Linux agents do not advertise it and scope the connected PVE fixture to its actual Linux runtime. Production safety and documentation remain unchanged.
Contract-Neutral: Test-only reconciliation of already-reviewed private-response recipes and existing Linux-only guest-execution capability; no product contract change.
Change-source: pulse-maintainer
The demo scenario renamed every generated deployment to one of four
curated names and every pod to one of ten, cycling by index. With the
default 14 deployments and 40 pods per cluster the Kubernetes overview
listed checkout-api four times in one namespace, and the curated
pending and crash-looping pods appeared more than once. Kubernetes
itself refuses duplicate names in a namespace, so the public demo
looked broken.
Ten more healthy services fill out the default deployment count, a
numeric suffix keeps any larger count unique, and pods past the curated
story become healthy ReplicaSet-style replicas of the cluster's own
deployments on ready nodes, so each curated failure appears once.
Contract-Neutral: Mock fixture naming only: demo Kubernetes deployments and pods get unique names; no runtime contract delta.
Retain metadata values and the last useful observation time through failed, empty and unusable refreshes. Apply the existing retry backoff separately instead of making retained identity new guest-agent evidence or a fresh complete-cache hit. Preserve useful partial responses, normal cache hits and OS failure policy, with HTTP polling and recovery controls.
Contract-Neutral: Behavioural correction to existing guest metadata observation timestamps and retry scheduling; no schema, API, route, field, guest command, admission, duration, retention or numeric source-selection contract delta.
Change-source: pulse-maintainer
Native Windows and macOS correctly advertise no PVE guest guard, so their real-server fixture must assert refusal before any config or QGA handoff. Keep the existing Linux admission, outcome and resumption assertions and exercise foreign platform labels without changing runtime capability policy.
Contract-Neutral: Test-only platform evidence repair; guest execution and Discovery runtime contracts, capability advertisement and safety gates are unchanged.
Change-source: pulse-maintainer
Use the existing producer-owned memory observation and filesystem validity in the native Proxmox History writer. Preserve old points and legacy unannotated policy while keeping independent current memory, CPU, valid I/O and measured-zero recovery. Controls reproduce the unchanged-parent failures through real HTTP polling, in-memory and persisted series, and short/long chart reads.
Contract-Neutral: Behavioural repair consuming existing guest observation and filesystem validity in the existing History path; no schema, API, route, numeric source selection, guest-agent admission, alert threshold, timestamp precision or retention contract delta.
Change-source: pulse-maintainer
Separate operator policy from retained numeric evidence. Apply a filesystem disable override without evaluating its old usage or treating absent deferred inventory as authoritative removal.
Change-source: pulse-maintainer
Use selected memory observation state and filesystem read validity at both threshold and filter boundaries. Retained or failed inventory cannot open or resolve incidents, refresh their evidence or remove per-filesystem alerts. Independent current metrics, legacy readings and deliberate disablement retain their existing policy.
Change-source: pulse-maintainer
Exercise production memory/filesystem alert admission, delayed breaches, filters, canonical recovery and the connected HTTP backup-lock polling boundary. Retained evidence is not a new observation or an authoritative filesystem removal.
Change-source: pulse-maintainer
A zero test deadline reinstates the real connection interval, so it did not make subsequent cycles due. Use a nonzero expired fixture deadline and assert each cycle reaches the disk endpoint; keep production scheduling and failure/recovery assertions unchanged.
Change-source: pulse-maintainer
Project verified guest status and decoded output instead of qm transport success. Reject ambiguous terminal outcomes without replay; retain known failed or truncated results as failures without inventing uncertainty. Admit only successful stdout to Discovery and preserve saved results when attempted probes yield no evidence. Keep backup precautions, source bounds and native acceptance dependencies unchanged.
Change-source: pulse-maintainer
Add source controls for actual guest exit/output projection, ambiguous terminal receipts, failed probe evidence exclusion, and saved manual/background Discovery through explicit recovery. The fixtures never invoke PVE or QGA.
Contract-Neutral: Test-only regression controls exercise existing command and Discovery boundaries without changing production code, payloads, capabilities or budgets.
Change-source: pulse-maintainer
Keep the generic catalogue-error fixture distinct from unknown timed-out guest handoff, and require the existing canceled-VM control to expose a safety deferral without dispatch. The new completion/cancellation parent failures and full-source adverse result remain retained; no production behavior changes in this commit.
Contract-Neutral: Test-only correction records the existing guest cancellation and ordinary-command error contracts without changing production source, APIs, protocol or time budgets.
Change-source: pulse-maintainer
Cancellation before dispatch or server-side expiry before a final agent result must not turn optional VM probes into completed fresh evidence or saved metadata fallback. Preserve the original error and stop subsequent probes while the agent retains its independent uncertainty fence.
Contract-Neutral: Completes the existing Discovery unavailable-evidence and cancellation requirements without changing API identity, statuses, protocol, command catalogue, approvals or non-VM execution.
Change-source: pulse-maintainer
The connected suite exposed three public-host success cases that depended on external DNS. Resolve fixture-only public, private, mixed and missing names through in-process DNS responses while exercising the real parser/resolver and all existing SSRF checks; production resolution and its failures are unchanged.
Contract-Neutral: Test-only deterministic DNS fixtures preserve production URL resolution, SSRF address policy, fetch transport and public interfaces.
Change-source: pulse-maintainer
A zero qm CLI exit may return only a handed-off PID or an unverified guest result. Preserve actual CLI output/exit semantics but pause uncertain terminal dictionaries without another QGA command; accept complete canonical termination evidence and keep native thaw acceptance separate.
Change-source: pulse-maintainer
A cancellation before or during postflight config verification must not become an ordinary optional Discovery failure with usable output, especially on the final probe. Preserve fixed safety classification and no-handoff truth on canceled local admission.
Contract-Neutral: Completes the existing cancellation and unavailable-evidence requirements without changing protocol fields, guard version, lock/identity admission, time budgets or command catalogues.
Change-source: pulse-maintainer
Retain nested Docker VM scanner deferral controls without treating that execution-only type as a public Discovery/store identity. Exercise saved/manual/background preservation on canonical VM requests; runtime and API scope are unchanged.
Change-source: pulse-maintainer
The first exact proof established all ten parent no-admission failures and registered-session controls, then stopped on a missing strings import. Complete that import and preserve ordinary hyphenated PVE dictionary keys while keeping duplicate/case-conflicting lock rejection.
Contract-Neutral: Preserves the guest safety protocol and its lock, identity, budget and dispatch requirements; completes compilation and accepts canonical hyphenated config keys.
Change-source: pulse-maintainer
Require local current-node lock evidence and registered guard support before QGA execution. Serialise VM probes, stop on deferral, retain actual in-flight outcomes and saved Discovery evidence, and pause uncertain completion without replay. Config checks do not reserve QGA or prove native thaw; the existing backup monitoring-outage precaution remains.
Change-source: pulse-maintainer
Approvals and trusted Discovery commands currently cross QGA handoff without evidence of a local unlocked guest. Assert explicit no-handoff deferral without contacting a native target.
Change-source: pulse-maintainer
An online source status without a valid original receipt time cannot assert current memory freshness. Preserve its numeric availability and existing selection while omitting unknown/future time; cover both cases at the linked view. Remove the stray adapter-test comment copied during test relocation.
Contract-Neutral: Completes the optional memory-observation semantics and wire shape documented with 43ccc6c39a; no new contract or selection delta.
Change-source: pulse-maintainer
Expose current, last-known and unavailable memory through raw guest and selected unified metrics without renewing QGA evidence during repeated backup deferrals. Preserve independent PVE/linked-agent source times, numeric selection, History and alert policy. Annotate selected metrics as well as raw facets so cross-source fallback cannot inherit another source freshness. Add connected observation, source ownership, clone and wire controls and update the shared subsystem contracts.
Change-source: pulse-maintainer
The first control panicked at an uninitialised synthetic Monitor map before reaching the provenance assertions. Supply the same map as production and retain that failed attempt without claiming a product regression.
Change-source: pulse-maintainer
Exercise normal cache reads, repeated backup deferrals, expired evidence, source-independent PVE memory and resumption through the shared guest builder and real unified broadcast conversion. These are synthetic monitoring controls, not native thaw acceptance.
Change-source: pulse-maintainer
The runtime preserves canonical backup inventory scope in recovery_rollups.go; update the existing ownership guard to follow that call and require both PVE/PBS callers rather than the former duplicated literal.
Change-source: pulse-maintainer
For #2465, select latest provider evidence with the existing scope index
rather than ranking every retained payload. Preserve history and evidence
validation. Share complete, failure-preserving backup alert evaluation
across PVE/PBS/mock polls and expose unavailable reads through the existing
deduplicated system warning; keep existing age alerts until a complete read.
Contract-Neutral: Application query and existing system-alert behaviour only; no API, schema, resource identity, agent lifecycle, entitlement or notification contract shape changes. The new warning uses the existing open system-alert type, identity and metadata contract. Semantic contracts and connected verification are included.
Change-source: pulse-maintainer
Guest lock verification used ordinary redirect-following config reads and last-key-wins JSON decoding. Refuse redirected or ambiguous lock evidence before dispatch and after a complete guest response, without changing ordinary config redirects, pooled TLS policy or session recovery. Cover all six readers and connected cache/History continuity and fresh resumption; this source hardening does not establish native backup thaw.
Change-source: pulse-maintainer
Retain the complete last-known memory value from the scoped guest snapshot only while the original successful QGA cache supports its values and age. Keep deferrals labelled previous-snapshot without renewing cache timestamps or memory History.
Exercise repeated locks after ordinary cache expiry through unified resource views, with provenance, identity, capacity and expiration controls plus fresh unlocked resumption. Native freeze-race qualification remains separate.
Install the default monitor's snapshot callback after both platform pollers exist. Settings already observes their runtime owners; alert checks must not retain startup's nil pointers. Exercise actual saved connections, loopback failures, ledger, monitor confirmation ticks, disable and ordinary scheduled inventory recovery without changing policy or adding a surface.
Contract-Neutral: Restore existing connection-alert wiring; no route, payload, authentication, persistence or detector-policy changes.
Change-source: pulse-maintainer
Preserve the actual HTTP response status rather than trusting quoted API errors. Apply the VM-wide cooldown after request timeouts and unexplained server or gateway failures, while retaining exact command-bound terminal refusals as ordinary errors. Reject ambiguous error envelopes and preserve cached guest observations alongside fresh live counters.
Change-source: pulse-maintainer
Guest-agent GETs enqueue serial work: ordinary HTTP pooling, stream recovery and redirects can resend a command despite the application single-attempt guard. Use an isolated single-use HTTP/1 transport with the configured TLS, proxy, dial and timeout policy, and defer redirects without contacting their destination. Keep ordinary API recovery and current CPU/I/O counter presence/receipts unchanged. Pin wire-level lost replies, all read/redirect paths, TLS trust and connected deferred cache/History behaviour.
Change-source: pulse-maintainer
Saved TrueNAS and VMware connections belong to validated tenant storage keys, not optional organisation metadata. A malformed org.json could prevent provider creation and block authoritative disable or removal in an unrelated tenant. Enumerate storage identities while retaining strict metadata/account readers, tenant isolation and config/credential failure handling.
Synthetic probe, polling and API controls reproduce the interval-only response family in #2382. They do not establish either reporter installation’s cause or native appliance acceptance.
Change-source: pulse-maintainer
Preserve the exact Core candidate and its retained focused, lifecycle, race, full-alert, monitoring and embedded-build evidence. Non-finite readings remain unknown rather than changing trusted incident state.
Change-source: pulse-maintainer
Treat non-finite current observations, authoritative rolling-history samples and overflowing averages as unknown. Preserve trusted incident and notification state instead of opening, recovering or poisoning JSON snapshots. Retain timestamp/duplicate authority, normal finite evaluation and explicit rule disable.
Change-source: pulse-maintainer
pulse-triage[bot]