Compose the exact observed upstream additively without rewriting reviewed tip 805ea6d712 or any accepted ancestry. The new Go 1.26.9 and x/net graph need matching final-source evidence before this batch can be proposed.
Change-source: pulse-maintainer
govulncheck on the pinned 1.26.8 toolchain reports twelve reachable
standard library vulnerabilities in Pulse (net/http, crypto/tls,
html/template, os, net/textproto), published on 2026-10-08 and fixed in
Go 1.26.9. golang.org/x/net v0.58.0 carries further advisories fixed in
v0.60.0. With 1.26.9 and x/net v0.60.0 the scan reports no affecting
vulnerabilities under both govulncheck v1.1.4 and v1.7.0.
Pulse's own govulncheck job last ran on 2026-10-05, so nothing flagged
this. The private Enterprise build and test job notices it: once the scan
finds reachable advisories it needs more than the 4 GiB CI VM holds, the
guest kernel kills govulncheck, and the job is cancelled. That has failed
every Enterprise pair check since 2026-10-08, including the first
beta's.
Move every release builder and local toolchain guard together, as 1.26.8
did, so no candidate artifact keeps an older compiler: go.mod, the
builder image digests (index digest for 1.26.9-alpine), the release and
dev scripts, the devcontainer, and the root pair diagnostic. Only x/net
is raised in the module graph; go mod tidy is deliberately not run, so
unrelated indirect requirements stay as they were.
Contract-Neutral: Toolchain and indirect dependency patch update that clears reported advisories; no product or runtime contract changed.
Preserve Delivery tip 00680c9c5a exactly in merge ancestry. Resolve the overlapping startup helper to the candidate implementation and retain the canonical diagnostic controls and existing documentation. Frontend test formatting is already present; no runtime UI or workflow changes.
Change-source: pulse-maintainer
Beta cut from main at 7520daae8e. It carries every change merged since stable v6.5.0.
Contract-Neutral: Release-only v6.6.0-beta.1 version, release notes and distribution metadata; no public install or runtime contract changes.
Change-source: pulse-maintainer
Use the existing exact-completion validator for de5f541553 and bf2742cce6. The validator still requires ancestry, substantive contracts and the registry-selected proof; preserve all original commits and enforced checks.
Change-source: pulse-maintainer
Completed PR2825 CI reports Windows Unix-type compilation failures and three Prettier fixture failures. Compile the existing Linux-only MSP daemon fixture only on Linux and format the unchanged frontend assertions. Separate successful CLI stdout from retained stderr diagnostics so Compose warnings cannot corrupt container identities, ports or bootstrap facts; add three executable controls without changing deadlines or acceptance gates.
Change-source: pulse-maintainer
The release train now cuts a beta every two days before the release
candidate. Its first beta, v6.6.0-beta.1, failed its preparation checks
twice: the governance test that maps VERSION to its release packet only
matched -rc.N, and two tests required the release index to say "current
v6 release candidate packet" while the metadata tool writes "current v6
beta packet" for a beta.
Accept -beta.N where the packet paths are derived and derive the expected
index wording from the version. Release candidates and stable releases
are checked exactly as before.
Contract-Neutral: Release metadata tests only; no runtime, API, install or customer contract change.
Preserve every accepted maintenance commit while incorporating human-authored diagnostics token visibility. Resolve API guide overlap by retaining the shared ai:execute narration gate, explicit deterministic fallback and CSV refusal in both mirrors.
Change-source: pulse-maintainer
The refreshed proposal compiles the Linux-only control-plane startup fixture during Windows installer tests, failing on Unix-only dependencies before lifecycle assertions run. Exclude the fixture and its controls at compile time outside Linux, check Go file selection, and preserve required native Windows/macOS execution. Format only the three test files rejected by the exact containing CI, with Prettier AST-equivalence checks; no assertion, timeout, production source or workflow gate changes.
Change-source: pulse-maintainer
The exact-head hosted startup check reaches Docker exec with readback taken from CombinedOutput. Separate stdout from successful stderr warnings for identities, endpoints, mount hashes, bootstrap facts and cleanup, while retaining warnings and both failed-command streams. Add real-child-process controls and the matching deployment acceptance contract; hosted Compose acceptance remains required.
Change-source: pulse-maintainer
Follows the token authority fixes. The API reference now says:
- agent uninstall is a collector's own-token removal, or an admin session;
- AI narration of reports needs ai:execute from API-token callers, for
single and fleet reports, and otherwise falls back to the deterministic
summary;
- API-token callers manage only the tokens in their own organizations,
and only an instance-wide token can create, edit, rotate or delete
another instance-wide token;
- quick setup that would change credentials needs an instance-wide
token from API-token callers.
Adds the missing entry for POST /api/security/tokens/<id>/rotate, which
the regenerate entry already points scoped tokens to.
test_api_reference_routes.py pins each statement to the code that
enforces it, so the reference and the gates cannot drift apart. Each pin
fails when the code or the reference is reverted.
Contract-Neutral: Customer docs corrected to match shipped behaviour; no runtime, API or contract change.
Preserve the exact PI candidate and its retained renderer and desktop/phone help proof. Existing help only; no alert or Patrol runtime change and no installed relief claim.
Change-source: pulse-maintainer
The native Unix inventory tests the root installer, unattended updater and their Python service/readback fixtures, but the workflow's event filters omit those inputs. Include each on push and pull_request, preserving all jobs, tools and deadlines. Decode both events in regression controls and reject removal or exclusion of each input.
Contract-Neutral: Native CI admission coverage only; installer/updater behaviour, agent and Windows lifecycle, service authority and recovery contracts are unchanged.
Change-source: pulse-maintainer
Preserve exact Delivery commits 5ef1729292 and cd1d162e30. Retained installer/vet and final smoke proofs cover unchanged fixture scopes; production verification, deadlines and recovery matrix are unchanged.
Change-source: pulse-maintainer
The FAQ promised every metric could be disabled globally or per resource with -1. Clarify supported editor controls, overriding thresholds, unchanged collection, queued notifications and the existing Patrol fallback. Keep ordinary notification help reachable without generating new alerts.
Contract-Neutral: Existing help and its source/rendering/browser checks only; no alert, notification, Patrol, settings or API behaviour changes.
Change-source: pulse-maintainer
Accept existing-help maintenance with retained exact-source documentation controls, frontend type-check/docs tests/build and desktop/phone renderer proof. This does not establish installed Pi authentication or reporting recovery.
Change-source: pulse-maintainer
The RETURN-trap smoke fixture has a simulated manager and script binary, not a real managed Linux process. Provide its exact-service/new-version comparator and require exactly one success-path invocation, with none on prerelease refusal. Keep actual process-identity refusals in the independent source/native controls; do not relax production verification.
Change-source: pulse-maintainer
Contract-Neutral: Legacy shell smoke fixture correction only; production updater and its running-executable, signing, restoration and deadline contracts are unchanged.
Use a counted-NUL shell logger double instead of starting Python for every installer line. Keep production log(), complete pipe draining, all eight first/later/final-error recovery cases and the existing 45-second bound. Require exact argument-frame and failure-sequence controls in the Go acceptance wrapper.
Change-source: pulse-maintainer
Contract-Neutral: Confined installer test fixture optimisation only; production updater, signing, native oracle, recovery matrix and safety deadlines are unchanged.
Preserve the exact Delivery candidate and its parent-bound source proof. The repaired acceptance oracle requires stable managed process identity and independent authenticated executable hashes; portable validation does not establish native or customer recovery.
Change-source: pulse-maintainer
Keep bare, quoted, prefixed and unknown file forms distinct from credential selection and successful reporting. Link the existing private-file installation to non-destructive guidance, and verify its source alignment, rendered table and keyboard navigation.
Contract-Neutral: Help and regression controls only; no token parsing, authentication, permission, installer or runtime contract change.
Change-source: pulse-maintainer
The current native acceptance oracle can return success without a manager observation after comparing running executable bytes. Bracket the comparison with stable active process identity and compare both executables independently to the authenticated fixture, so a changing PID or equally wrong destinations cannot pass. Add required portable drift/refusal controls without changing installer authority or hosted admission.
Change-source: pulse-maintainer
The sourced installer deliberately uses newline/tab IFS. Assert the three Docker arguments separately rather than joining them with the installer's separator. Runtime source and refusal bounds remain unchanged.
Contract-Neutral: Test-only argument-vector assertion repair; no runtime or operator contract changes.
Change-source: pulse-maintainer
Use the same Compose configuration before and after best-effort evaluation issuance. Preserve two-client unsigned evaluation, signed renewal restarts, explicit invalid-file refusal and the Pulse-hosted licence requirement.
Add real release-daemon restart/readback controls and secret-free hosted Compose acceptance for the actual placeholder and licensed mounts.
Change-source: pulse-maintainer
Incorporate the exact upstream frontier observed during publication while preserving every reviewed local commit. The upstream correction separates attention lifecycle mutation admission from reads and action planning; combined final-source validation remains required.
Change-source: pulse-maintainer
Follows the token scope fixes. POST /api/security/regenerate-token now
needs an instance-wide full-access token from API-token callers and
replaces every stored token; the reference says so and points scoped
tokens at the per-token rotate route. POST /api/resources/{id}/link,
/unlink and /report-merge need monitoring:write.
test_api_reference_routes.py pins each of these to the code that
enforces it, so the reference and the gates cannot drift apart again.
Each pin fails when the code or the reference is reverted.
Contract-Neutral: Customer docs corrected to match shipped behaviour; no runtime, API or contract change.
The API reference marked the Patrol stream, manual run, acknowledge,
snooze, suppress, suppressions and dismissed routes "(Pro)" and promised
a 402 when unlicensed. None of them is licence-gated: Patrol and
managing its findings are free (ai_patrol is a free feature, and the
frontend offers these controls on every plan). Only governed fixes need
Pro. The routes now show the scope they actually require and the
reference says what Community gets, including the one-full-run-per-hour
cap on manual runs.
Also corrects the findings routes: reinvestigate is Pro and needs the
ai_autofix entitlement and a Patrol mode above Watch only, and
reapprove is retired and always answers 410.
scripts/tests/test_api_reference_routes.py gains checks that a Patrol
route documented without a paid label has no licence wrapper in its
registration, and that reapprove is documented as retired. Each fails
when its claim is reverted.
Contract-Neutral: Customer docs corrected to match shipped behaviour; no runtime, API or contract change.
Incorporate the exact upstream head observed during publication without rewriting accepted integrations or the additive safety-help test correction.
Change-source: pulse-maintainer
Audited every HTTP route the server registers against docs/API.md.
Where a documented route and the code disagreed, or an integrator-facing
route was missing, the reference now matches the code.
- Auth and scope labels: notifications, SSO providers, license
activate/clear, security reset-lockout, availability targets, agent
profiles (every method needs settings:write for tokens), relay settings
and the resource metadata routes (no admin requirement).
- Behaviour: POST /api/notifications/test targets one channel per request,
the storage detail route is GET /api/storage/{storageId} (not a list at /api/storage/), token
rename-only updates are accepted, validate-token moved out of the Audit
Log (Pro) section because it has no licence gate, and the setup script
is public.
- Retired routes: /api/ai/remediation/execute and /rollback always answer
410 Gone, as approve already documented.
- Newly documented: GET /api/ai/patrol/runs/{id}, POST
/api/availability-history, POST /api/agents/agent/{id}/allow-reenroll,
PUT /api/truenas/connections/{id} and its /test route.
scripts/tests/test_api_reference_routes.py pins the corrections to the
router so later drift fails a test: every scope named on a route line must
exist in pkg/auth/scopes.go, the newly documented routes must exist in the
router, and the retired routes must say 410. It fails on the previous
reference and passes on this one.
Each doc is mirrored under frontend-modern/public/docs and updated in
both places. Labels where the docs and the code disagree about licence
gating are left alone; that needs a product decision, not a doc edit.
Contract-Neutral: Customer docs corrected to match shipped behaviour; no runtime, API or contract change.
Use the supplied Doctor wording to separate collector privilege, credential scope and runner posture. Preserve both supported command paths and working monitoring; make profile choice deliberate rather than a connection diagnostic.
Contract-Neutral: Documentation and rendered-guide checks only; no command authority, credential issuance, admission, dispatch or recovery contract changes.
Change-source: pulse-maintainer
Accept exact Delivery commits with retained source-z6bm51cn installer, race, vet and real-embed proof. Active forward and restored service acceptance now require stable MainPID and matching process bytes; uncertainty retains the backup without a new restart or rollback grant. Native containing-source follow-through remains separate.
Change-source: pulse-maintainer
Incorporate the upstream frontier recorded at the start of this coordination batch; retain reviewed local history and independent proof bindings.
Change-source: pulse-maintainer
Audited the customer-facing docs against the code: about 5,200 concrete
claims (env vars, endpoints, flags, defaults, ports, UI labels), plus every
environment variable the code reads. Each discrepancy was re-verified
against the source before editing, and every edit was reviewed again.
What users would have hit following the old text:
- UI paths and labels that no longer exist (Settings > Relay, Platform
connections, Access Control, SSO Providers, Create Organization) and
Patrol mode names (now Ask first, Safe auto-fix, Autopilot).
- Wrong values and behaviour: LOG_MAX_AGE=0 does not disable cleanup,
Patrol evidence budget is 10 calls and 12 turns, ALLOW_UNPROTECTED_EXPORT
covers private networks too, PULSE_AUDIT_ASYNC defaults on.
- Agent install: install.sh ignores PULSE_ENABLE_KUBERNETES and
PULSE_ENABLE_PROXMOX, rejects --disable-auto-update, and the token
fallback lives in the state directory.
- API: audit endpoints answer 402 on Community, onboarding QR is GET,
type=container is rejected, several routes need admin plus a scope.
- HTTP_REDIRECT_PORT was not documented anywhere.
Docs are mirrored under frontend-modern/public/docs, so each change is
applied to both copies. The tests that pinned the old wording (including
three that asserted claims the code contradicts) are updated alongside.
Contract-Neutral: Customer docs corrected to match shipped behaviour; no runtime, API or contract change.
Keep simulated process acceptance explicit in portable discovery and URL controls. Require the running-executable callback to receive the same selected service; refused and prior-inactive URL cases must not invoke it. Actual owned process identity remains covered independently.
Change-source: pulse-maintainer
Contract-Neutral: Portable fixture adapters and assertions only; no change to production acceptance or deployment contract.
Use the existing planning error and Agent Doctor authority wording before workload inspection. Keep an earlier sent action and missing receipt unresolved, and route command-capable hosts to connection/admission help without retries or wider grants. Check rendered links, stage ordering and the implementation evidence.
Contract-Neutral: Existing workload-update help and documentation checks only; no action, authentication, command-admission or recovery contract changes.
Change-source: pulse-maintainer
Supply the connected manager double's fixed comparator and keep its simulated process readback explicit. Separate mandatory real-sink controls from service-state deadlines without removing cases or extending either 45-second bound.
Change-source: pulse-maintainer
Contract-Neutral: Test fixture correction only; the running-executable acceptance contract added by the parent is unchanged.
An installed target version and active service can conceal an old managed executable. Compare the actual process bytes between complete bounded MainPID observations before accepting an update or restored active service. Retain the backup and current service on uncertainty without an automatic restart or rollback grant. Register real owned-process and conditional transaction controls; keep synthetic/native and customer acceptance distinct.
Change-source: pulse-maintainer
A reporter reply of any kind interrupts the silence condition, and another human's continuing failure after day fourteen must still prevent timeout closure. Make those standing conditions explicit in the public explanation and its renderer/doc checks; do not limit the evidence window to the first fourteen days.
Contract-Neutral: Refines documentation of the existing retest-timeout conditions only; no runtime or wire contract changes.
Change-source: pulse-maintainer
The standing triage-link destination explains source and release availability but omits what a retest-timeout close means. Document every-symptom resolution, the stable-release contact clock and exclusions, and returning to the original issue with safe existing evidence. Keep timeout separate from confirmed recovery, with shipped-mirror and production-renderer coverage.
Contract-Neutral: Documents existing issue resolution and stable retest-timeout policy only; no runtime or wire contract changes.
Change-source: pulse-maintainer
Preserve the exact Delivery candidate and its retained normal, race, parent-control and embedded-build evidence. This repairs hidden logger failures, not the reported LXC stop cause.
Change-source: pulse-maintainer
Accept the exact Product intelligence candidate as existing-flow guidance maintenance. Preserve passive collection and uncertainty; guidance does not establish runtime memory recovery.
Change-source: pulse-maintainer
Conditional Bash callers hid a failed logger write behind successful stdout. Attempt both sinks, return the first failed sink, and exercise the unchanged draining collector and recovery path with the real log primitive and confined external logger. Preserve the distinction between observed pipeline completion and native or customer recovery.
Change-source: pulse-maintainer
The latest memory report is about a higher steady baseline, not a leak. Keep steady regressions actionable, separate unlike process ages and CPU savings from RSS recovery, and preserve existing evidence without another restart, downgrade or profile. Keep the shipped guides, optional intake and regression controls aligned.
Contract-Neutral: Clarifies interpretation of existing memory reports and documentation only; no runtime, API, route, collection recipe, label synchronizer or subsystem contract changes.
Change-source: pulse-maintainer
The exact-source installer suite exposed a result-reader defect: successful unittest methods emit phase markers before their final ok verdict. Retain complete unique method results across that output, reject missing/duplicate/mismatched identities, and keep the required Linux and portable-control verdicts unchanged.
Contract-Neutral: Test-result parsing only; no native fixture, platform admission, signing, installer, updater, recovery or customer contract delta.
Change-source: pulse-maintainer
The source-bound hosted receipt stops before any native phase because its new ephemeral signer is mode 0644. Establish owned regular-file and verified 0600 mode before signing, without adopting existing keys or relaxing OpenSSH. Keep Linux ELF execution in both native Linux jobs; macOS still runs the portable signer/admission/recovery controls, and the bridge requires the exact platform verdict instead of staging Mach-O as Linux.
Change-source: pulse-maintainer
The current macOS CI drops its already provisioned GNU tools inside the connected updater fixture and reaches incompatible BSD tar. Capture only the needed supplied executables and require end-to-end tool use; keep the production harness environment scrubbed. Retain non-secret stage, file metadata and closed diagnostic markers for the actual hosted signer failure, without publishing signer output or inferring its cause.
Contract-Neutral: Confined native CI tool selection and additive non-secret failure observations only; no public installer, updater, signing, service, permission or customer contract changes.
Change-source: pulse-maintainer
Retain exact Delivery candidate 8cb66ef0f7. Allocate disposable native-CI scratch before child observation, preserving exclusive refusal and cleanup ownership. Related canonical fixture HOME correction is retained; no product, frontend or infrastructure change.
Change-source: pulse-maintainer
pulse-triage[bot]