Compose the exact observed upstream additively without rewriting reviewed tip 805ea6d712 or any accepted ancestry. The new Go 1.26.9 and x/net graph need matching final-source evidence before this batch can be proposed.
Change-source: pulse-maintainer
govulncheck on the pinned Go 1.26.8 reports twelve reachable standard
library vulnerabilities in Pulse (net/http, crypto/tls, html/template,
os, net/textproto), published 2026-10-08 and fixed in Go 1.26.9, plus
x/net advisories fixed in v0.60.0. With both bumped, govulncheck v1.1.4
and v1.7.0 report no affecting vulnerabilities.
Pulse's own govulncheck job last ran on 2026-10-05, so nothing flagged
it. The private Enterprise test job did: once the scan finds reachable
advisories it exceeds the 4 GiB CI VM and the guest kernel kills it,
which has failed every Enterprise pair check since 2026-10-08.
All release builders and local toolchain guards move together, as for
1.26.8. Only x/net changes in the module graph; the modules are
deliberately not re-tidied.
Checked on pulse-dev against this exact tree: the readonly dependency
graph and the full build pass, the four installtests that pin the
toolchain digests pass, and the root pair diagnostic tests pass.
Compose the exact observed current upstream additively. Keep starting reviewed tip 805ea6d712 and all accepted identities in history; the workload tap-target paths are disjoint from the local maintenance corrections.
Change-source: pulse-maintainer
At phone width the Workloads name cell shows the backup shield below the
guest name when the Backup column is hidden. Since 02e6a90374 it carried a
44x44 touch target. On phones the whole guest row is the disclosure target
(the expand chevron is screen-reader only), so that box covered the lower
left of every row's tap area: a tap there opened the backup sheet instead of
the guest drawer. It also grew every phone row from 33.5px to 63.5px.
Give the name-cell indicator a 24x24 target (the WCAG 2.2 AA minimum) and
keep the 44px target on the Backup column badge, which owns its own cell.
Measured on a 375px mock stack: rows are 43.5px, a tap beside the shield
opens the drawer, and a tap on the shield still opens the backup sheet. The
guest drawer already shows the last completed backup, so a row tap reaches
the same evidence. Desktop and the 768px layout are unchanged.
govulncheck on the pinned 1.26.8 toolchain reports twelve reachable
standard library vulnerabilities in Pulse (net/http, crypto/tls,
html/template, os, net/textproto), published on 2026-10-08 and fixed in
Go 1.26.9. golang.org/x/net v0.58.0 carries further advisories fixed in
v0.60.0. With 1.26.9 and x/net v0.60.0 the scan reports no affecting
vulnerabilities under both govulncheck v1.1.4 and v1.7.0.
Pulse's own govulncheck job last ran on 2026-10-05, so nothing flagged
this. The private Enterprise build and test job notices it: once the scan
finds reachable advisories it needs more than the 4 GiB CI VM holds, the
guest kernel kills govulncheck, and the job is cancelled. That has failed
every Enterprise pair check since 2026-10-08, including the first
beta's.
Move every release builder and local toolchain guard together, as 1.26.8
did, so no candidate artifact keeps an older compiler: go.mod, the
builder image digests (index digest for 1.26.9-alpine), the release and
dev scripts, the devcontainer, and the root pair diagnostic. Only x/net
is raised in the module graph; go mod tidy is deliberately not run, so
unrelated indirect requirements stay as they were.
Contract-Neutral: Toolchain and indirect dependency patch update that clears reported advisories; no product or runtime contract changed.
Preserve the complete reviewed maintenance tip and upstream release metadata additively before final-source validation and protected publication.
Change-source: pulse-maintainer
Preserve Delivery tip 00680c9c5a exactly in merge ancestry. Resolve the overlapping startup helper to the candidate implementation and retain the canonical diagnostic controls and existing documentation. Frontend test formatting is already present; no runtime UI or workflow changes.
Change-source: pulse-maintainer
Beta cut from main at 413449306f. It carries every change merged since stable v6.5.0.
Contract-Neutral: Release-only v6.6.0-beta.1 version, release notes and distribution metadata; no public install or runtime contract changes.
Change-source: pulse-maintainer
Beta cut from main at 7520daae8e. It carries every change merged since stable v6.5.0.
Contract-Neutral: Release-only v6.6.0-beta.1 version, release notes and distribution metadata; no public install or runtime contract changes.
Change-source: pulse-maintainer
Reconcile the overlapping single and fleet narration documentation with current upstream route assertions, retaining CSV refusal and the actual shared ai:execute guard. Record the incorporated diagnostics token visibility boundary in its dependent contracts without changing runtime authority.
Change-source: pulse-maintainer
Completed PR2825 CI reports Windows Unix-type compilation failures and three Prettier fixture failures. Compile the existing Linux-only MSP daemon fixture only on Linux and format the unchanged frontend assertions. Separate successful CLI stdout from retained stderr diagnostics so Compose warnings cannot corrupt container identities, ports or bootstrap facts; add three executable controls without changing deadlines or acceptance gates.
Change-source: pulse-maintainer
Preserve every accepted maintenance commit while incorporating human-authored diagnostics token visibility. Resolve API guide overlap by retaining the shared ai:execute narration gate, explicit deterministic fallback and CSV refusal in both mirrors.
Change-source: pulse-maintainer
The refreshed proposal compiles the Linux-only control-plane startup fixture during Windows installer tests, failing on Unix-only dependencies before lifecycle assertions run. Exclude the fixture and its controls at compile time outside Linux, check Go file selection, and preserve required native Windows/macOS execution. Format only the three test files rejected by the exact containing CI, with Prettier AST-equivalence checks; no assertion, timeout, production source or workflow gate changes.
Change-source: pulse-maintainer
The discriminating Machines clock test and parent desktop/phone control exposed button remounting when option objects refreshed. Keep the shared primitive keyed by its logical value, update current metadata and preserve distinct numeric/string values. Cover wrapper projection, disabled/removal boundaries and bind the production-page browser receipt to this parent.
Change-source: pulse-maintainer
The exact-head hosted startup check reaches Docker exec with readback taken from CombinedOutput. Separate stdout from successful stderr warnings for identities, endpoints, mount hashes, bootstrap facts and cleanup, while retaining warnings and both failed-command streams. Add real-child-process controls and the matching deployment acceptance contract; hosted Compose acceptance remains required.
Change-source: pulse-maintainer
Follows the token authority fixes. The API reference now says:
- agent uninstall is a collector's own-token removal, or an admin session;
- AI narration of reports needs ai:execute from API-token callers, for
single and fleet reports, and otherwise falls back to the deterministic
summary;
- API-token callers manage only the tokens in their own organizations,
and only an instance-wide token can create, edit, rotate or delete
another instance-wide token;
- quick setup that would change credentials needs an instance-wide
token from API-token callers.
Adds the missing entry for POST /api/security/tokens/<id>/rotate, which
the regenerate entry already points scoped tokens to.
test_api_reference_routes.py pins each statement to the code that
enforces it, so the reference and the gates cannot drift apart. Each pin
fails when the code or the reference is reverted.
Contract-Neutral: Customer docs corrected to match shipped behaviour; no runtime, API or contract change.
Compose the three retained monitoring repairs and finish the existing health surface: counts, selected results and accessible status labels follow the row classifier on the shared clock, without changing observations. Preserve search, page-owned filter state and offline/unknown handling. Reuse complete-guide test fixtures with isolated clones instead of repeated sanitisation; keep all advice assertions and deadlines.
Change-source: pulse-maintainer
Preserve the published shared ai:execute gate while integrating the reviewed report help. Correct only source-shape assertions and the internal contract description; report behaviour and browser-verified guide contents remain unchanged.
Change-source: pulse-maintainer
A host-report 401 cannot diagnose lost upgrade credentials, and a 403 does not require disabling host monitoring or granting command execution. Direct operators to the existing instance, record and access policy instead of another installation. Preserve rejection buffers, throttles, identities and monitoring-only ceilings; prove ordinary same-credential recovery for primary and observer reporting. This diagnostic repair does not establish Discussion #2769's cause or native recovery.
Change-source: pulse-maintainer
Preserve the exact PI candidate and its retained renderer and desktop/phone help proof. Existing help only; no alert or Patrol runtime change and no installed relief claim.
Change-source: pulse-maintainer
Retain exact Core commits and scoped normal/race/vet/ARMv7 and trusted-HTTPS process evidence. This independent repair does not establish the Pi reporter cause or installed recovery.
Change-source: pulse-maintainer
The native Unix inventory tests the root installer, unattended updater and their Python service/readback fixtures, but the workflow's event filters omit those inputs. Include each on push and pull_request, preserving all jobs, tools and deadlines. Decode both events in regression controls and reject removal or exclusion of each input.
Contract-Neutral: Native CI admission coverage only; installer/updater behaviour, agent and Windows lifecycle, service authority and recovery contracts are unchanged.
Change-source: pulse-maintainer
Keep generation's read scope distinct from the ai:execute permission needed for single-resource and fleet PDF narration. Preserve the bounded PR2836 runtime guard unchanged, mirror the canonical API/MSP help into shipped assets, and record the actual contract including token-triggered versus server-run schedules. Replace the old unconditional-POST source assertion with both method and spending-scope checks, and cross GET with all five caller types. The production Docs browser fixture checks the public guidance on desktop and touch phone without API requests or mutations.
Change-source: pulse-maintainer
The FAQ promised every metric could be disabled globally or per resource with -1. Clarify supported editor controls, overriding thresholds, unchanged collection, queued notifications and the existing Patrol fallback. Keep ordinary notification help reachable without generating new alerts.
Contract-Neutral: Existing help and its source/rendering/browser checks only; no alert, notification, Patrol, settings or API behaviour changes.
Change-source: pulse-maintainer
Accept existing-help maintenance with retained exact-source documentation controls, frontend type-check/docs tests/build and desktop/phone renderer proof. This does not establish installed Pi authentication or reporting recovery.
Change-source: pulse-maintainer
Incorporate the upstream frontier present at coordination start without re-parenting reviewed source; later upstream reconciliation remains with the publication gate.
Change-source: pulse-maintainer
The real host agent sends gzip reports. Decode only the fixture observer copy, leaving the request bytes and headers unchanged for canonical router authentication and decompression. Document selected-file startup errors and retained enrolment restart semantics.
Change-source: pulse-maintainer
Preserve the exact Delivery candidate and its parent-bound source proof. The repaired acceptance oracle requires stable managed process identity and independent authenticated executable hashes; portable validation does not establish native or customer recovery.
Change-source: pulse-maintainer
Keep PULSE_TOKEN out of the direct-token flag default. Refuse an unreadable or empty selected file instead of silently borrowing other credentials, while preserving enrolled runtime-token restarts and implicit token-optional startup.
Cover actual flag loading and a synthetic host issuer, private installer-writer, compiled agent and trusted HTTPS lookup/report journey. This repairs an independent source-selection defect; it does not establish the cause or recovery of Discussion #2769.
Change-source: pulse-maintainer
Keep bare, quoted, prefixed and unknown file forms distinct from credential selection and successful reporting. Link the existing private-file installation to non-destructive guidance, and verify its source alignment, rendered table and keyboard navigation.
Contract-Neutral: Help and regression controls only; no token parsing, authentication, permission, installer or runtime contract change.
Change-source: pulse-maintainer
Subscribe Machines status to the shared clock, classify attention sort inputs once per call, and reactively read Debug source status across independently arriving records. Preserve canonical observations, newer guest safeguards, focus and disclosure ownership. Exact-parent and repaired desktop/phone browser matrices cover the final source bytes; source acceptance and PR disposition remain distinct from native recovery or release availability.
Change-source: pulse-maintainer
Several Off toggles on the Thresholds page did nothing or did the
opposite, because each layer read 0, -1 and "missing" differently:
- PMG and Docker restart/memory-limit defaults: the toggle sends -1
and NormalizePMGDefaults/NormalizeDockerDefaults turned anything <= 0
back into the factory value, so Off reverted on save. The Docker
restart-loop and memory-limit checks also had no Off at all.
- Backup and snapshot critical age: the editor sanitizers and the save
payload raised a 0 critical to the warning age, so turning critical
off made backups go critical at the warning age.
- A Docker container override saved for CPU alone carried
DisableConnectivity=false and re-enabled that container's state
alerts over a disabled Docker default.
- Per-server PMG cells, PMG bulk edit and per-container restart and
memory-limit cells wrote fields ThresholdConfig does not have, so
the backend dropped them on save.
0 is now Off for these counts; negative values (the toggle's -1) are
stored as 0. Keys an older alerts.json or an import omits decode as
ThresholdCountUnset and take the factory value, so existing installs
keep their alerts; persistence resolves the marker before writing. A
PMG quarantine growth level with one half Off turns that level off
instead of invalidating the spec and skipping the whole check. Docker
container overrides re-enable state alerts only with their own
severity, as applyThresholdOverride does elsewhere. The frontend keeps
a 0 critical age Off, the group header says "Restart loop off", and
rows only offer metrics an override can store.
AI Patrol's threshold adapter still maps an Off alert threshold to its
factory value; that is a Patrol product decision and is left as is.
The current native acceptance oracle can return success without a manager observation after comparing running executable bytes. Bracket the comparison with stable active process identity and compare both executables independently to the authenticated fixture, so a changing PID or equally wrong destinations cannot pass. Add required portable drift/refusal controls without changing installer authority or hosted admission.
Change-source: pulse-maintainer
Use the same Compose configuration before and after best-effort evaluation issuance. Preserve two-client unsigned evaluation, signed renewal restarts, explicit invalid-file refusal and the Pulse-hosted licence requirement.
Add real release-daemon restart/readback controls and secret-free hosted Compose acceptance for the actual placeholder and licensed mounts.
Change-source: pulse-maintainer
Incorporate the exact upstream frontier observed during publication while preserving every reviewed local commit. The upstream correction separates attention lifecycle mutation admission from reads and action planning; combined final-source validation remains required.
Change-source: pulse-maintainer
Follows the token scope fixes. POST /api/security/regenerate-token now
needs an instance-wide full-access token from API-token callers and
replaces every stored token; the reference says so and points scoped
tokens at the per-token rotate route. POST /api/resources/{id}/link,
/unlink and /report-merge need monitoring:write.
test_api_reference_routes.py pins each of these to the code that
enforces it, so the reference and the gates cannot drift apart again.
Each pin fails when the code or the reference is reverted.
Contract-Neutral: Customer docs corrected to match shipped behaviour; no runtime, API or contract change.
The API reference marked the Patrol stream, manual run, acknowledge,
snooze, suppress, suppressions and dismissed routes "(Pro)" and promised
a 402 when unlicensed. None of them is licence-gated: Patrol and
managing its findings are free (ai_patrol is a free feature, and the
frontend offers these controls on every plan). Only governed fixes need
Pro. The routes now show the scope they actually require and the
reference says what Community gets, including the one-full-run-per-hour
cap on manual runs.
Also corrects the findings routes: reinvestigate is Pro and needs the
ai_autofix entitlement and a Patrol mode above Watch only, and
reapprove is retired and always answers 410.
scripts/tests/test_api_reference_routes.py gains checks that a Patrol
route documented without a paid label has no licence wrapper in its
registration, and that reapprove is documented as retired. Each fails
when its claim is reverted.
Contract-Neutral: Customer docs corrected to match shipped behaviour; no runtime, API or contract change.
Incorporate the exact upstream head observed during publication without rewriting accepted integrations or the additive safety-help test correction.
Change-source: pulse-maintainer
Audited every HTTP route the server registers against docs/API.md.
Where a documented route and the code disagreed, or an integrator-facing
route was missing, the reference now matches the code.
- Auth and scope labels: notifications, SSO providers, license
activate/clear, security reset-lockout, availability targets, agent
profiles (every method needs settings:write for tokens), relay settings
and the resource metadata routes (no admin requirement).
- Behaviour: POST /api/notifications/test targets one channel per request,
the storage detail route is GET /api/storage/{storageId} (not a list at /api/storage/), token
rename-only updates are accepted, validate-token moved out of the Audit
Log (Pro) section because it has no licence gate, and the setup script
is public.
- Retired routes: /api/ai/remediation/execute and /rollback always answer
410 Gone, as approve already documented.
- Newly documented: GET /api/ai/patrol/runs/{id}, POST
/api/availability-history, POST /api/agents/agent/{id}/allow-reenroll,
PUT /api/truenas/connections/{id} and its /test route.
scripts/tests/test_api_reference_routes.py pins the corrections to the
router so later drift fails a test: every scope named on a route line must
exist in pkg/auth/scopes.go, the newly documented routes must exist in the
router, and the retired routes must say 410. It fails on the previous
reference and passes on this one.
Each doc is mirrored under frontend-modern/public/docs and updated in
both places. Labels where the docs and the code disagree about licence
gating are left alone; that needs a product decision, not a doc edit.
Contract-Neutral: Customer docs corrected to match shipped behaviour; no runtime, API or contract change.
Use the supplied Doctor wording to separate collector privilege, credential scope and runner posture. Preserve both supported command paths and working monitoring; make profile choice deliberate rather than a connection diagnostic.
Contract-Neutral: Documentation and rendered-guide checks only; no command authority, credential issuance, admission, dispatch or recovery contract changes.
Change-source: pulse-maintainer
Accept exact Delivery commits with retained source-z6bm51cn installer, race, vet and real-embed proof. Active forward and restored service acceptance now require stable MainPID and matching process bytes; uncertainty retains the backup without a new restart or rollback grant. Native containing-source follow-through remains separate.
Change-source: pulse-maintainer
Incorporate the upstream frontier recorded at the start of this coordination batch; retain reviewed local history and independent proof bindings.
Change-source: pulse-maintainer
pulse-triage[bot]