Try both loopback families for IPv6 wildcard listeners without changing explicit or IPv4-only binds. Reserve each family a share of the API deadline, keep all later checks on the responding address, and retry a failed observation once with a fresh bounded budget in the telemetry background runner.
Keep genuine API, UI and asset failures visible and report only a closed timeout category, never transport details. Cover both real listener families, startup recovery, failure and privacy boundaries; synchronise the disclosure and subsystem contract.
Change-source: pulse-maintainer
Use TrueNAS default summaries for reporting queries so SCALE 25.04 can validate its History responses. Preserve raw samples, time windows, CORE live telemetry and existing error boundaries.
Refs #2346
Change-source: pulse-maintainer
The executable audit fixtures pass, but the release-asset check still pins the superseded total-only parser. Preserve the no-threshold and required-workflow checks while asserting positive package/count precedence and a complete typed clean verdict.
Change-source: pulse-maintainer
A missing or zero total must not erase package or severity findings. Require a complete typed zero verdict, retain bounded outage handling for unknown reports, and keep raw metadata out of workflow annotations. Add executable regression coverage and update the installability contract.
Change-source: pulse-maintainer
Batch WebSocket identity decoding from the encoded arrays and retain decoder-owned entry buffers. Keep canonical metadata refresh on every resource clone while replacing membership maps with small scope slices and a single sensitivity-tag scan. Preserve delta identity, scope ordering, policy precedence and clone isolation with reference/fuzz and transition tests.
Adapt the remaining performance work proposed in Pulse PR #2342 for issue #2199. The contributor's first-ID check cannot verify a stale tail; this candidate uses standard JSON decoding for every encoded identity instead. Keep the imported contributor history and branch unchanged.
Co-authored-by: Andy Prosser <andy.prosser@icloud.com>
Based-on: https://github.com/rcourtman/Pulse/pull/2342
Original-Commit: 0cbfa43186
Change-source: pulse-maintainer
Use a private header file and an authenticated read-only summary rather than passing tokens in argv to a public health check. Exercise both header formats, file permissions, preserved content and failing HTTP auth errors with synthetic local fixtures.
Contract-Neutral: API authentication, routes, scopes and CSRF enforcement are unchanged; this updates existing usage guidance and executable documentation checks.
Change-source: pulse-maintainer
Preserve the exact reviewed Product intelligence candidate and its deployment-specific, credential-safe help. No runtime or new product surface changes.
Change-source: pulse-maintainer
Remove the full service-environment dump, which can expose authentication and integration credentials. Explain listener precedence, the separate agent port, systemd reloads, and Docker port recreation without changing the image or deleting persistent data. Keep the shipped guide identical and protect these boundaries with documentation tests.
Contract-Neutral: Guidance and verification for existing port configuration only; no runtime, authentication, schema or frontend behaviour changes.
Change-source: pulse-maintainer
Render escaped, allowlisted details from the captured audit response instead of making a second registry call outside the wall-clock watchdog. Preserve every advisory failure and outage policy; executable fixtures pin single-request diagnostics, missing detail, transport-error precedence and annotation-safe output.
Change-source: pulse-maintainer
A fixed ten-entry history made accepted higher thresholds unreachable and silently disabled storm suppression. Bound retained observations to the configured threshold while preserving the existing diagnostic allowance, expiry and one-shot cooldown. Verify normal config updates, callback admission, delivery diagnosis, window expiry, rearming and threshold changes, and register the focused proof owner.
Change-source: pulse-maintainer
PR #2341 Core E2E run 36660586289 fails its desktop and phone PBS target assertions because the old fixture supplies only labels and a non-contract pbs.hostname. The reviewed identity repair requires reported pbs.nodeName or an explicit Agent link. Supply nodeName and retain the expected guest/standalone History targets and wrong-target rejection. No runtime behavior changes.
Contract-Neutral: Integration-fixture machine identity only; existing History assertions and runtime contracts are unchanged.
Change-source: pulse-maintainer
Preserve the exact reviewed candidate tip; its PBS identity repair is already integrated, so this merge changes no source content.
Change-source: pulse-maintainer
Pulse PR #2341 run 36658394047 failed the locked Prettier check for docsLinks.test.ts. Format that test without changing its assertions or product behavior, preserving every reviewed commit.
Contract-Neutral: Test-only locked Prettier formatting; no runtime or contract delta.
Change-source: pulse-maintainer
Keep the existing guest deduplication and refresh-omission assertions, supplying a reported node name or unchanged backend Agent link instead of the obsolete endpoint-name guess. Runtime and its parent-bound browser proof are unchanged.
Change-source: pulse-maintainer
Preserve the exact reviewed documentation candidate and its focused proof while retaining the current canonical frontier.
Change-source: pulse-maintainer
Reject editable labels and endpoint token guesses, preserve current backend links and fresh exact reported machine names, and revoke ambiguous retention. Isolate each reconciled PBS row from reusable service/Agent DTOs so a join cannot corrupt its later service target. Desktop and phone browser proof covers three PBS services, nine Agents and present colliding guests after link withdrawal.
Contract-Neutral: No API, schema, route or canonical ownership delta; PBS presentation requires corroborated machine identity and isolates reconciled rows from source snapshots.
Change-source: pulse-maintainer
The agent prefers its saved identity before deriving one from the OS. The old live machine-ID deletion recipe could disrupt unrelated services while leaving a Pulse collision unchanged. Explain managed overrides, precedence, private evidence and distinct-host verification in both shipped guides; cover the safe path with documentation and real-browser checks.
Contract-Neutral: Guidance and verification for existing agent identity options only; no runtime, authentication, schema or frontend behaviour changes.
Change-source: pulse-maintainer
Add adverse History and host-disk fixtures for editable labels, endpoint guesses and a present guest after backend link withdrawal. The following repair completes this regression-first candidate.
Change-source: pulse-maintainer
Compose the retained PBS identity repair with current reviewed source without rewriting its history. The continuation requires terminal exact-source race validation before this candidate is complete.
Change-source: pulse-maintainer
Preserve both exact Product intelligence commits. Replace the obsolete recovery-token recipe with the existing deployment-specific reset path and client-bound recovery facts, and guide users to bounded sanitized evidence with privacy review rather than dangerous retries.
Change-source: pulse-maintainer
Preserve the exact Web candidate and its parent-bound browser receipt. This bounded maintenance fix drops a retained host target when the backend link changes or disappears; it does not establish full PBS History or installed relief.
Change-source: pulse-maintainer
## What changed and why
Docker update rows now remain pending until the governed action has a
recorded outcome, and reopen the same action with GET-only receipt
review instead of inferring success from a cleared registry badge,
elapsed time or a legacy command. This addresses the uncertain update
state reported in #1891 without blindly retrying an operation.
PBS host association now accepts a unique, fresh running PVE guest at
the PBS endpoint IP and its linked Agent as corroboration.
Operator-chosen connection labels no longer count as Agent identity,
preventing another server's History or SMART disks from being attached
by a same-name collision. This is a bounded source repair for the #1723
topology; it does not establish VirtualBox coverage or installed
acceptance.
## Included source
Pulse main range
`ad9c2d9d3e03b76cb88dad1d56065a262d7c948e..e726ccee9feae16206e173f18aa3dd592ea31e29`.
- Web candidate `dcb9399cecc1ece8e366305afc9084a979b7e7a0`, integrated
as `3ab4183d8225f2e27d869b4f1adf4f1778d99fb5`.
- Core guest-correlation candidate
`43634935976f4b184c87e333b21b1bf201bd4958`, integrated as
`c3e8b6dd6dff36b5396ba2eb147d4e58d23001a6`.
- Core identity correction `2ad36fe4d17e802434bad1af8583418cf3f2e0ca`.
- Additive upstream merge `e726ccee9feae16206e173f18aa3dd592ea31e29`
preserves all reviewed identities and incorporates published #2338; it
changes ancestry, not the reviewed tip's tree.
## Validation
- Web committed-source offline VM receipt `source-hffp4sc_`: exact-lock
offline install, 1,195 test files / 21,504 tests, lint, type-check and
production build passed (one file / three tests skipped).
- Mock-backed production-component browser proof: Chromium desktop 1365
and phone 390, pending/review/completed states, GET-only reads, no page
errors or horizontal overflow; six screenshots inspected by the source
owner. Frontend source is unchanged since that proof.
- Core committed-source offline VM receipt `source-m6uckql7` at
`2ad36fe4d1`: full unifiedresources suite passed in 49.309s, with
label-collision and disk-membership regressions. Available Go 1.26.7 was
used; the repository requests 1.26.8. Final proposed tree equals that
tested source tree.
- Gate checks passed: per-commit completion guards, final-range browser
receipt guard, Pulse-scoped contract and registry audits, provenance and
whitespace checks.
Exact-head GitHub checks and independent source review remain required.
These source/browser proofs do not resolve the reporter's old action
receipt, establish installed PBS behaviour, or approve a release. The
separate Backups frontend identity fallback remains with its source
owner.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Direct PBS host correlation could lend Agent History and SMART ownership through loopback, Docker-local or stale address evidence, and a stale Agent could block its fresh replacement. Reuse the provider address filter and the five-minute observation boundary, preserve IPv6 URL hosts, and cover unsafe evidence, private management controls, link replacement and the three-PBS/nine-Agent topology.
Change-source: pulse-maintainer
Resolve Tailwind's relative config from the frontend module before starting Vite, as the existing Docs fixture runner does. Keep the initial overflow failure in the lane receipts and expose the privacy-review step in the phone screenshot.
Contract-Neutral: Browser verification harness only; no product, API, schema or runtime change.
Change-source: pulse-maintainer
Remove the obsolete inline recovery-token curl recipe: recovery sessions are client-bound, so it neither unlocks a separate browser nor needs a credential copied into command history. Point to deployment-specific bootstrap recovery and give symptom-specific, reviewed and sanitized incident reporting steps without requiring dangerous repeats.
Contract-Neutral: Documentation and verification only; clarifies existing browser-bound recovery and sanitized diagnostics without changing authentication, API, schema or runtime behaviour.
Change-source: pulse-maintainer
Retain the Agent target only while the corroborated PBS link remains unchanged. Cover three concurrent PBS guests and fail closed when that link disappears during a host-row refresh gap.
Contract-Neutral: No canonical API or schema delta; this only invalidates a stale frontend correlation when its backend evidence is withdrawn.
Change-source: pulse-maintainer
## What changed
A successful Proxmox Backup Server node-status poll now records observed
CPU and memory into that server's existing service History series.
Failed polls do not fabricate samples. The recovery regression test
checks the changed observed value within the store's second-resolution
bucket.
## Why
Pulse #1723 reports Backup Server drawers stuck at “Collecting History”
on the published RC even while current CPU and memory values appear. The
service target previously received no node-status samples. This source
fix addresses that gap; it does not establish the reporter's installed
result or resolve separate Agent association and disk/network/I/O
history questions.
## Source in this proposal
Reviewed candidate
`5e57a077801e044331965a6926f3cfe2259cba3c..463482f67d15ee27d353625fc06684ae9848ae88`
on main, plus additive merge `ec13932c963494acf77feb17898d95f557813b8a`
of upstream `fef914d5da2e6352ea59f74fae96750574119a5c`. No accepted
commit was rewritten. The newer PBS/PVE Agent association candidate is
not included and remains for separate review.
## Validation and limits
The lane's exact-source offline focused proof `source-b2f8_pk0` passed
three PBS polling/history tests, including persistence and failed-poll
recovery. Combined-head exact-source offline race proof
`source-zja4vzo0` passed focused monitoring/PBS History and incident
tests at `ec13932c963494acf77feb17898d95f557813b8a`. `git diff --check`
and publication provenance passed. This is source validation, not
installed acceptance, release qualification, or a claim that the
published RC contains the fix. Required exact-head CI and independent
review remain before merge.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
A user-chosen PBS label could attach an unrelated Agent before the exact guest-IP/Agent link was evaluated, putting host History and SMART ownership on the wrong server. Use reported node and endpoint evidence instead, and cover both the collision and label-only cases.
Change-source: pulse-maintainer
When a PBS API token cannot report nodeName and the in-guest Agent omits interface addresses, use a unique running PVE VM at the exact PBS endpoint IP plus its state-owned Agent link. Reject stale or ambiguous observations instead of guessing from display names. This restores the source-native host target for corroborated PBS VMs while preserving the separate PBS service target.
Change-source: pulse-maintainer
## What changed and why
This batch makes Actions review ownership safer when responses arrive
out of order, restores continuing-symptom notification handling after an
incident's primary recovery, and keeps the provider control-plane and
integration mock on the same pinned Go 1.26.8 builder. The first two
address unsafe update-review state and missed alert follow-through; the
builder pin follows the reviewed #2275 dependency update without
changing the prebuilt release runtime.
## Included source
Pulse `main` after `30bb963b6cbd9f0575e1b9ac86c88c3cd45a512a` through
`91d8822d76c5a7214995c0e370be637b6e6336e3`: reviewed Actions commits
`ba298b29e264f671f917b49139cf9031678b87da` and
`e57bb692ae79c75c2df1fa4c91d90b84d5aa0fb4`, notification commit
`fd9e836ca458e34f5b6736b456375de51a625b18`, builder pin
`91d8822d76c5a7214995c0e370be637b6e6336e3`, and additive
upstream/integration merges `d50b902797f9989eb3d786b502adc385a9a8fe37`
and `75d72f586881ba2356263dd0e664735b6baae4e9`.
## Verification and limits
The reviewed Actions candidate included focused component/browser
coverage; the alert candidate added focused incident-synthesis tests;
the builder candidate's exact-source install-test proof passed
(`source-ow_zygny`). Publication provenance and range diff checks pass
at this tip. A new combined-tip source-proof request could not start
because all executor slots were occupied; it is not a passing result.
Exact-head PR checks and independent review remain required before
landing. The builder image still needs the required exact Docker
qualification in its disposable executor; this PR does not establish
that the digest can be pulled or built, release qualification, or
installed behaviour.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Do not infer success from a registry badge clearing while a receipt is pending. Keep the action review reachable from the row, preserve inconclusive outcomes, and show completion only from the recorded audit. Add focused state tests and desktop/phone browser proof.
Change-source: pulse-maintainer
The metrics store retains second-resolution samples. Verify a changed observed memory value after recovery, rather than requiring a second row when polls share a bucket.
Change-source: pulse-maintainer
Persist measured PBS CPU and memory on the service metrics target when node status succeeds. Keep host-agent history separate and avoid false samples on unavailable status. Cover service reads, denial and recovery.
Change-source: pulse-maintainer
Advance the provider control-plane source builder and integration mock builder
on Pulse PR #2275's reviewed 1.26.8 Alpine digest. Keep their exact compiler
image locked by an installability proof and record what this does not qualify.
The published prebuilt runtime path is unchanged.
Change-source: pulse-maintainer
## What changed
- Keep monitor-only alerts visible without escalation or quiet-hours
replay, and keep symptoms already owned by a verified infrastructure
alert from generating duplicate escalation, queued callbacks, or replay.
Independent uncorroborated alerts remain eligible.
- Let operators re-read the status of a pending update/action receipt
without dispatching the action again; retain the unknown-outcome warning
and existing administrative closure gate. This addresses the unsafe
retry uncertainty reported in Pulse #1891.
- Improve pre-release issue intake so screenshots render normally and
version/image questions distinguish a running container from a failed or
non-container installation.
- Clarify the official signed Proxmox server-install route after Pulse
#2327: it does not ask for a GitHub PAT or use Helm-chart assets, and
operators should check for a partly created LXC before retrying.
## Included source
`pulse` main after `b020a1cde7077418802f98a2f83a3da1b27c2998` through
`90556cc1fc87d82289c4a63ad8b7715a8721fcfe` (12 commits, preserving the
upstream merge). Reviewed candidates include `dc75bd6e3b`, `82cdcd8f61`,
`a1b7e9d5d8`, `b54b8981ed`, and `38b66ad000`; the remaining commits are
integration and alert-test attribution commits.
## Verification
The combined committed head passed offline Go alert-package tests,
offline frontend type-check and 21 ActionReviewDialog tests, plus `git
diff --check`. The review includes targeted alert delivery/replay
coverage and action receipt interaction tests. Exact-head CI, including
broader backend/frontend and security checks, must pass before landing.
This source PR is not release qualification or installed acceptance.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
A supported endpoint failure may outlive its primary host incident. When synthesis removes the supported cause, dispatch its first independent notification without reopening the occurrence or duplicating a symptom previously notified before grouping.
Change-source: pulse-maintainer
The supported-cause escalation and queued callback tests live in incident_synthesis_test.go, not escalation_policy_change_test.go. Keep the verification contract aligned with the actual test file.
Change-source: pulse-maintainer
pulse-triage[bot]