Compose the exact observed upstream additively without rewriting reviewed tip 805ea6d712 or any accepted ancestry. The new Go 1.26.9 and x/net graph need matching final-source evidence before this batch can be proposed.
Change-source: pulse-maintainer
govulncheck on the pinned Go 1.26.8 reports twelve reachable standard
library vulnerabilities in Pulse (net/http, crypto/tls, html/template,
os, net/textproto), published 2026-10-08 and fixed in Go 1.26.9, plus
x/net advisories fixed in v0.60.0. With both bumped, govulncheck v1.1.4
and v1.7.0 report no affecting vulnerabilities.
Pulse's own govulncheck job last ran on 2026-10-05, so nothing flagged
it. The private Enterprise test job did: once the scan finds reachable
advisories it exceeds the 4 GiB CI VM and the guest kernel kills it,
which has failed every Enterprise pair check since 2026-10-08.
All release builders and local toolchain guards move together, as for
1.26.8. Only x/net changes in the module graph; the modules are
deliberately not re-tidied.
Checked on pulse-dev against this exact tree: the readonly dependency
graph and the full build pass, the four installtests that pin the
toolchain digests pass, and the root pair diagnostic tests pass.
Compose the exact observed current upstream additively. Keep starting reviewed tip 805ea6d712 and all accepted identities in history; the workload tap-target paths are disjoint from the local maintenance corrections.
Change-source: pulse-maintainer
At phone width the Workloads name cell shows the backup shield below the
guest name when the Backup column is hidden. Since 02e6a90374 it carried
a
44x44 touch target. On phones the whole guest row is the disclosure
target
(the expand chevron is screen-reader only), so that box covered the
lower
left of every row's tap area: a tap there opened the backup sheet
instead of
the guest drawer. It also grew every phone row from 33.5px to 63.5px.
Give the name-cell indicator a 24x24 target (the WCAG 2.2 AA minimum)
and
keep the 44px target on the Backup column badge, which owns its own
cell.
Measured on a 375px mock stack: rows are 43.5px, a tap beside the shield
opens the drawer, and a tap on the shield still opens the backup sheet.
The
guest drawer already shows the last completed backup, so a row tap
reaches
the same evidence. Desktop and the 768px layout are unchanged.
Preserve the exact reviewed intake-guidance candidate and upstream reporting test repairs. The changes are disjoint and require no content resolution.
Change-source: pulse-maintainer
At phone width the Workloads name cell shows the backup shield below the
guest name when the Backup column is hidden. Since 02e6a90374 it carried a
44x44 touch target. On phones the whole guest row is the disclosure target
(the expand chevron is screen-reader only), so that box covered the lower
left of every row's tap area: a tap there opened the backup sheet instead of
the guest drawer. It also grew every phone row from 33.5px to 63.5px.
Give the name-cell indicator a 24x24 target (the WCAG 2.2 AA minimum) and
keep the 44px target on the Backup column badge, which owns its own cell.
Measured on a 375px mock stack: rows are 43.5px, a tap beside the shield
opens the drawer, and a tap on the shield still opens the backup sheet. The
guest drawer already shows the last completed backup, so a row tap reaches
the same evidence. Desktop and the 768px layout are unchanged.
Two `useReportingPanelState` tests failed deterministically on Node 20
(pulse-dev) while CI on Node 24 passed:
- posts a single-resource report as a JSON body through apiFetch
- saves a Patrol weekly summary without a resource scope
The tests flushed a fixed four microtasks after mounting the hook.
Reading a fetch `Response` body takes 8 microtasks on Node 20.20.2 and 3
on Node 24.20.0 (measured on pulse-dev). On Node 20 the catalog was
still loading when `handleGenerate` ran ("Failed to generate report").
In the schedule test the catalog landed mid-save, so the mount-time
schedules GET replaced the saved schedule with `[]`.
The tests now use `vi.waitFor` until the catalog load has finished and
no schedules load is in flight. The fetch mock also builds a fresh
catalog `Response` per call; the shared one was read twice when a test
mounted the hook twice ("Body has already been read").
Verified on pulse-dev: 11/11 pass on Node 20 and Node 24, three runs
each. Before this change it was 9/11 on Node 20 and 11/11 on Node 24.
Prettier, eslint and `tsc --noEmit` pass. The hook itself is unchanged.
govulncheck on the pinned 1.26.8 toolchain reports twelve reachable
standard library vulnerabilities in Pulse (net/http, crypto/tls,
html/template, os, net/textproto), published on 2026-10-08 and fixed in
Go 1.26.9. golang.org/x/net v0.58.0 carries further advisories fixed in
v0.60.0. With 1.26.9 and x/net v0.60.0 the scan reports no affecting
vulnerabilities under both govulncheck v1.1.4 and v1.7.0.
Pulse's own govulncheck job last ran on 2026-10-05, so nothing flagged
this. The private Enterprise build and test job notices it: once the scan
finds reachable advisories it needs more than the 4 GiB CI VM holds, the
guest kernel kills govulncheck, and the job is cancelled. That has failed
every Enterprise pair check since 2026-10-08, including the first
beta's.
Move every release builder and local toolchain guard together, as 1.26.8
did, so no candidate artifact keeps an older compiler: go.mod, the
builder image digests (index digest for 1.26.9-alpine), the release and
dev scripts, the devcontainer, and the root pair diagnostic. Only x/net
is raised in the module graph; go mod tidy is deliberately not run, so
unrelated indirect requirements stay as they were.
Contract-Neutral: Toolchain and indirect dependency patch update that clears reported advisories; no product or runtime contract changed.
Move detailed upgrade, multi-host, notification and memory advice into closed disclosures beside the inputs they help. Keep public-disclosure and unsafe-collection warnings visible, preserve every submitted field and its validation, and retain the detailed advice verbatim. Check disclosure placement and safety alongside the existing triage fixtures.
Contract-Neutral: Presentation-only issue form guidance; submitted field schema, requiredness, triage metadata and safety instructions are unchanged.
Change-source: pulse-maintainer
Two useReportingPanelState tests failed on Node 20 while CI on Node 24
passed. The tests flushed a fixed four microtasks after mounting the
hook, but reading a fetch Response body takes eight microtasks on Node
20 and three on Node 24. On Node 20 the catalog was still loading when
handleGenerate ran, and in the schedule test the catalog landed mid-save,
so the mount-time schedules GET replaced the saved schedule with [].
The tests now wait with vi.waitFor until the catalog load has finished
and no schedules load is in flight. The fetch mock also builds a fresh
catalog Response per call; the shared one was read twice when a test
mounted the hook twice ("Body has already been read").
Preserve the complete reviewed maintenance tip and upstream release metadata additively before final-source validation and protected publication.
Change-source: pulse-maintainer
Preserve Delivery tip 00680c9c5a exactly in merge ancestry. Resolve the overlapping startup helper to the candidate implementation and retain the canonical diagnostic controls and existing documentation. Frontend test formatting is already present; no runtime UI or workflow changes.
Change-source: pulse-maintainer
Beta cut from main at 413449306f. It carries every change merged since stable v6.5.0.
Contract-Neutral: Release-only v6.6.0-beta.1 version, release notes and distribution metadata; no public install or runtime contract changes.
Change-source: pulse-maintainer
Beta cut from main at 7520daae8e. It carries every change merged since stable v6.5.0.
Contract-Neutral: Release-only v6.6.0-beta.1 version, release notes and distribution metadata; no public install or runtime contract changes.
Change-source: pulse-maintainer
The release train now cuts a beta every two days before the release
candidate. Its first beta, v6.6.0-beta.1, failed its preparation checks
twice (#2835): the governance test that maps VERSION to its release
packet only matched -rc.N, and two tests required the release index to
say "current v6 release candidate packet" while the metadata tool writes
"current v6 beta packet" for a beta.
This accepts -beta.N where the packet paths are derived and derives the
expected index wording from the version. Release candidates and stable
releases are checked as before.
Checked on the exact #2835 snapshot plus this change: the governance
suite passes (69 tests) and
TestCurrentPrereleasePacketTracksInstallMetadata passes rather than
skips.
Preserve the reviewed maintenance tip and additive fixture repairs while composing the current upstream source-map-js 1.2.2 development dependency lockfile. Root Go and main frontend manifests are unchanged; the portal graph must use current upstream hosted checks rather than the stale launch snapshot.
Change-source: pulse-maintainer
Use the existing exact-completion validator for de5f541553 and bf2742cce6. The validator still requires ancestry, substantive contracts and the registry-selected proof; preserve all original commits and enforced checks.
Change-source: pulse-maintainer
Clears Dependabot alert 160 (high): `source-map-js` before 1.2.2 allows
an event-loop denial of service through crafted indexed source maps.
The alert's manifest is
`internal/cloudcp/portal/frontend/package-lock.json`, which still pinned
1.2.1 through `postcss` (it accepts `^1.2.1`). `frontend-modern` already
resolves 1.2.2 behind an override, so this was the only lockfile behind.
The package is development scope: build tooling for the portal frontend,
not shipped code.
- Lockfile only: three lines, the `version`, `resolved` and `integrity`
of the `node_modules/source-map-js` entry. The package set is unchanged.
- The entry was edited by hand instead of regenerated, because npm 10.8
on the build box drops the `libc` fields newer npm writes and would have
rewritten 45 unrelated lines. The new integrity hash is the one
`frontend-modern`'s lockfile already records for 1.2.2.
- The canonical completion guard asked for a `cloud-paid` contract and
proof change because the lockfile sits under the portal path. This is a
contract-neutral dependency bump, so the commit uses the guard's
documented contract-neutral override with that reason. The sensitivity,
governance, status, registry and contract audits still ran.
Supply the registered API-reference synchronization proof for the additive documentation reconciliation. Keep upstream scope descriptions, deterministic fleet fallback and CSV refusal bound to the actual shared narration controls.
Change-source: pulse-maintainer
Reconcile the overlapping single and fleet narration documentation with current upstream route assertions, retaining CSV refusal and the actual shared ai:execute guard. Record the incorporated diagnostics token visibility boundary in its dependent contracts without changing runtime authority.
Change-source: pulse-maintainer
Completed PR2825 CI reports Windows Unix-type compilation failures and three Prettier fixture failures. Compile the existing Linux-only MSP daemon fixture only on Linux and format the unchanged frontend assertions. Separate successful CLI stdout from retained stderr diagnostics so Compose warnings cannot corrupt container identities, ports or bootstrap facts; add three executable controls without changing deadlines or acceptance gates.
Change-source: pulse-maintainer
The release train now cuts a beta every two days before the release
candidate. Its first beta, v6.6.0-beta.1, failed its preparation checks
twice: the governance test that maps VERSION to its release packet only
matched -rc.N, and two tests required the release index to say "current
v6 release candidate packet" while the metadata tool writes "current v6
beta packet" for a beta.
Accept -beta.N where the packet paths are derived and derive the expected
index wording from the version. Release candidates and stable releases
are checked exactly as before.
Contract-Neutral: Release metadata tests only; no runtime, API, install or customer contract change.
Preserve every accepted maintenance commit while incorporating human-authored diagnostics token visibility. Resolve API guide overlap by retaining the shared ai:execute narration gate, explicit deterministic fallback and CSV refusal in both mirrors.
Change-source: pulse-maintainer
`/api/diagnostics` is readable with `settings:read` and lists the whole
token inventory: every token's ID, name, timestamps, key hint and which
agents use it, across organizations. A token bound to one organization
could read other organizations' credential metadata, which the token
management endpoints (#2837) already refuse to show it.
The diagnostics result is computed once per organization scope and
cached for every caller, so the filter runs after the cache. An
API-token caller that is not instance-wide gets an API token section
rebuilt over the tokens `callerTokenMayManage` allows, with counts,
notes and agent usage computed over that view. Instance-wide tokens and
browser sessions get the full section, and the cache still holds the
full result.
Tests cover the builder (tokens, counts, usage) and the handler on the
cached path, including that serving a scoped caller from the cache does
not change what the next caller sees. The record filter, the usage
filter and the post-cache filter each fail their tests when removed. The
49 existing diagnostics tests pass.
Follow-up to the token authority fixes now on `main`. The API reference
now says:
- **Agent uninstall** is a collector's removal of the agent its own
`agent:report` token owns, or an admin session; no other caller can use
it.
- **AI narration of reports** needs `ai:execute` from API-token callers,
for single and fleet reports; otherwise the report falls back to the
deterministic summary.
- **Token management:** API-token callers manage only the tokens in
their own organizations (others answer `404`), and only an instance-wide
token can create, edit, rotate or delete another instance-wide token.
- **Quick setup** that would change credentials (`force: true`) from an
API token needs an instance-wide full-access token.
It also adds the missing entry for `POST
/api/security/tokens/<id>/rotate`, which the regenerate entry already
points scoped tokens to (response shape read from the handler: `{
"token", "record" }`; name, scopes, organization bindings, metadata and
expiry are kept).
`scripts/tests/test_api_reference_routes.py` pins each statement to the
code that enforces it. Six pins were checked by reverting the matching
code or doc line; each fails the guard. Both doc copies change together.
Checked on a full `origin/main` tree: docs mirror check, the Python
doc-pinning suites (no new failures against the earlier failing set) and
a scan for test-pinned phrases this edit removes (none).
The refreshed proposal compiles the Linux-only control-plane startup fixture during Windows installer tests, failing on Unix-only dependencies before lifecycle assertions run. Exclude the fixture and its controls at compile time outside Linux, check Go file selection, and preserve required native Windows/macOS execution. Format only the three test files rejected by the exact containing CI, with Prettier AST-equivalence checks; no assertion, timeout, production source or workflow gate changes.
Change-source: pulse-maintainer
The discriminating Machines clock test and parent desktop/phone control exposed button remounting when option objects refreshed. Keep the shared primitive keyed by its logical value, update current metadata and preserve distinct numeric/string values. Cover wrapper projection, disabled/removal boundaries and bind the production-page browser receipt to this parent.
Change-source: pulse-maintainer
The exact-head hosted startup check reaches Docker exec with readback taken from CombinedOutput. Separate stdout from successful stderr warnings for identities, endpoints, mount hashes, bootstrap facts and cleanup, while retaining warnings and both failed-command streams. Add real-child-process controls and the matching deployment acceptance contract; hosted Compose acceptance remains required.
Change-source: pulse-maintainer
Dependabot alert 160 (high): source-map-js before 1.2.2 allows an
event-loop denial of service through crafted indexed source maps. The
alert's manifest is the Cloud portal frontend lockfile, which still pinned
1.2.1 through postcss (which accepts ^1.2.1). frontend-modern already
resolves 1.2.2 behind an override, so only this lockfile was behind. The
package is development scope, build tooling only.
Lockfile only, three lines. The entry was edited by hand rather than by
running npm because npm 10.8 on the build box drops the libc fields newer
npm writes, which would have rewritten 45 unrelated lines. The new
integrity hash is the one frontend-modern's lockfile already records for
1.2.2.
Contract-Neutral: Dependency lockfile bump for Dependabot alert 160 (source-map-js, development scope); no public-contract delta
Follows the token authority fixes. The API reference now says:
- agent uninstall is a collector's own-token removal, or an admin session;
- AI narration of reports needs ai:execute from API-token callers, for
single and fleet reports, and otherwise falls back to the deterministic
summary;
- API-token callers manage only the tokens in their own organizations,
and only an instance-wide token can create, edit, rotate or delete
another instance-wide token;
- quick setup that would change credentials needs an instance-wide
token from API-token callers.
Adds the missing entry for POST /api/security/tokens/<id>/rotate, which
the regenerate entry already points scoped tokens to.
test_api_reference_routes.py pins each statement to the code that
enforces it, so the reference and the gates cannot drift apart. Each pin
fails when the code or the reference is reverted.
Contract-Neutral: Customer docs corrected to match shipped behaviour; no runtime, API or contract change.
/api/diagnostics is readable with settings:read and lists the whole token
inventory: every token's ID, name, timestamps, key hint and which agents
use it, across organizations. A token bound to one organization could
read the other organizations' credential metadata, which the token
management endpoints already refuse to show it.
The diagnostics result is computed once per organization scope and cached
for every caller, so the filter runs after the cache: an API-token caller
that is not instance-wide gets an API token section rebuilt over the
tokens callerTokenMayManage allows, with counts, notes and agent usage
computed over that view. Instance-wide tokens and browser sessions get the
full section, and the cache itself still holds the full result.
Tests cover the builder (tokens, counts, usage) and the handler on the
cached path, including that a scoped caller served from the cache does
not change what the next caller sees. Each filter fails when removed.
Contract-Neutral: Behavioural fix that applies the token visibility rule to diagnostics; no new API surface or contract.
Compose the three retained monitoring repairs and finish the existing health surface: counts, selected results and accessible status labels follow the row classifier on the shared clock, without changing observations. Preserve search, page-owned filter state and offline/unknown handling. Reuse complete-guide test fixtures with isolated clones instead of repeated sanitisation; keep all advice assertions and deadlines.
Change-source: pulse-maintainer
Preserve the published shared ai:execute gate while integrating the reviewed report help. Correct only source-shape assertions and the internal contract description; report behaviour and browser-verified guide contents remain unchanged.
Change-source: pulse-maintainer
EnableHost belongs to the unified CLI, not hostagent.Config. Keep this host-module fixture enabled by exercising its ordinary delivery path and assert the unchanged agent identity and command ceiling directly. The diagnostic messages and reporting behavior are unchanged.
Change-source: pulse-maintainer
A host-report 401 cannot diagnose lost upgrade credentials, and a 403 does not require disabling host monitoring or granting command execution. Direct operators to the existing instance, record and access policy instead of another installation. Preserve rejection buffers, throttles, identities and monitoring-only ceilings; prove ordinary same-credential recovery for primary and observer reporting. This diagnostic repair does not establish Discussion #2769's cause or native recovery.
Change-source: pulse-maintainer
Reports are readable with `settings:read`, but a `POST` report can
narrate with the tenant's Pulse Assistant, a paid provider call recorded
in the cost ledger. Any token holding `settings:read` could therefore
spend that budget, while every other AI-spending route needs
`ai:execute`.
An API token now needs `ai:execute` for AI narration, on single-resource
reports and on fleet reports. Without it the report is still produced,
with the deterministic summary and a note explaining why. Browser
sessions and scheduled reports are unchanged, and `GET` keeps narrating
deterministically.
`report_ai_narration_scope_test.go` covers a session, a `settings:read`
token, a token with `monitoring:read` as well, an `ai:execute` token and
a full-access token on both handlers, and fails when either handler
ignores the gate (each handler is covered separately). The existing
contract test for the GET/POST rule still passes.
The API token inventory is global, but only token creation recorded an
organization. Listing, reading, renaming, deleting and rotating a token
looked the target up by ID across every organization and checked scopes
only. A token bound to one organization could therefore see another
organization's tokens, and rotate one to obtain its raw credential,
including an instance-wide full-access token.
A token caller may now manage a token only if every organization the
target is bound to is one the caller is bound to. A target outside the
caller's organizations answers `404`, as if it did not exist, and is
left out of the list. Instance-wide full-access tokens (full access,
bound only to the default organization) keep managing everything, and
browser sessions are unchanged.
An instance-wide token is the most powerful credential, so only an
instance-wide caller may rotate, delete or edit one, or mint one in the
default organization (directly, or by editing a scoped token to full
access). A caller bound to several organizations that includes the
default one is not instance-wide, even though its organizations are a
superset of the target's. Callers without full-access scope are still
refused by the existing scope-containment checks, so the pinned `403`
cases are unchanged.
Tests drive each handler as an organization-bound caller. They cover
list, get, rename, delete and rotate across organizations, the
within-organization and instance-wide cases that must keep working, the
multi-organization escalation edges (rotate, mint, promote), and the
rule as a table. Each check fails when it is removed. The two existing
failures in this package when run locally on macOS (`systemd-analyze`
missing, a dev-mode expectation) also fail on `main`.
Not changed here: `quick-setup` with `force`, config import and the
development first-run reset can still replace the whole token inventory
with `settings:write`, and `/api/diagnostics` lists token metadata
globally.
Preserve the exact PI candidate and its retained renderer and desktop/phone help proof. Existing help only; no alert or Patrol runtime change and no installed relief claim.
Change-source: pulse-maintainer
Retain exact Core commits and scoped normal/race/vet/ARMv7 and trusted-HTTPS process evidence. This independent repair does not establish the Pi reporter cause or installed recovery.
Change-source: pulse-maintainer
The native Unix inventory tests the root installer, unattended updater and their Python service/readback fixtures, but the workflow's event filters omit those inputs. Include each on push and pull_request, preserving all jobs, tools and deadlines. Decode both events in regression controls and reject removal or exclusion of each input.
Contract-Neutral: Native CI admission coverage only; installer/updater behaviour, agent and Windows lifecycle, service authority and recovery contracts are unchanged.
Change-source: pulse-maintainer
Exact source-b_1ydtoz stopped at five focused-documentation timeouts, including this new test rendering two whole reference guides. Keep the complete mirror comparison and all permission/fallback/method assertions, but render only the real API/MSP report sections. Do not change timeouts or remove the four pre-existing failing cases; their adverse result remains retained. Public help and runtime scope-gate bytes are unchanged, so the inspected desktop/phone browser evidence remains applicable.
Change-source: pulse-maintainer
pulse-triage[bot]