rcourtman 6f97d2a0bc docs: describe the token authority rules that now ship ...

Follows the token authority fixes. The API reference now says:
- agent uninstall is a collector's own-token removal, or an admin session;
- AI narration of reports needs ai:execute from API-token callers, for
  single and fleet reports, and otherwise falls back to the deterministic
  summary;
- API-token callers manage only the tokens in their own organizations,
  and only an instance-wide token can create, edit, rotate or delete
  another instance-wide token;
- quick setup that would change credentials needs an instance-wide
  token from API-token callers.

Adds the missing entry for POST /api/security/tokens/<id>/rotate, which
the regenerate entry already points scoped tokens to.

test_api_reference_routes.py pins each statement to the code that
enforces it, so the reference and the gates cannot drift apart. Each pin
fails when the code or the reference is reverted.

Contract-Neutral: Customer docs corrected to match shipped behaviour; no runtime, API or contract change.

2026-10-11 20:33:40 +01:00

..

integration

…

run.sh

Run complete script smoke checks in two isolated CI shards

2026-10-10 01:51:21 +01:00

test_admin_docs.py

Keep organisation API read recipes private and bounded

2026-10-09 19:06:13 +01:00

test_agent_auth_docs.py

Clarify Docker-only tokens in host authentication triage

2026-10-11 05:03:08 +01:00

test_agent_docs.py

docs: correct customer docs that drifted from the source

2026-10-11 13:59:56 +01:00

test_agent_log_docs.py

Bound copied log diagnostics by bytes as well as records

2026-10-11 02:24:14 +01:00

test_agent_profile_docs.py

docs: correct customer docs that drifted from the source

2026-10-11 13:59:56 +01:00

test_agent_storage_docs.py

Keep constrained NAS install guidance private and non-destructive

2026-10-05 07:25:14 +01:00

test_agent_uninstall_docs.py

Clarify destructive agent removal and runner-only revocation

2026-10-10 07:12:44 +01:00

test_api_auth_docs.py

Keep node configuration API recipes scoped, private and trust-aware

2026-10-10 04:56:35 +01:00

test_api_failure_index.py

Retain bounded API shard skip observations

2026-10-07 08:08:02 +01:00

test_api_reference_routes.py

docs: describe the token authority rules that now ship

2026-10-11 20:33:40 +01:00

test_audit_recovery_docs.py

Make audit webhook guidance match delivery and trust boundaries

2026-10-08 07:00:59 +01:00

test_authentication_diagnostic_docs.py

Align AI uncertainty wording check with the revised guide

2026-10-09 20:07:13 +01:00

test_auto_update_service_state.py

Keep updater collector failures and final installer evidence

2026-10-10 17:15:39 +01:00

test_auto_update_systemd.py

Repair native updater signer setup and platform-specific controls

2026-10-11 10:09:34 +01:00

test_benchmark_workflow_contract.py

ci: retain exact benchmark collection provenance

2026-09-06 11:12:42 +01:00

test_cloud_migration_docs.py

Keep Cloud migration within configuration-transfer limits

2026-10-09 22:21:03 +01:00

test_configuration_auth_docs.py

Keep installation quick starts on bootstrap authentication

2026-10-03 08:43:25 +01:00

test_contribution_report_safety.py

Keep offered patches as evidence and preserve contributor follow-through

2026-10-09 15:05:12 +01:00

test_dependabot_config.py

Keep Vitest major upgrades coordinated

2026-09-27 10:10:45 +01:00

test_dependency_advisory_watch.py

Audit main without directing dependency repairs to retired lines

2026-10-10 23:43:37 +01:00

test_deployment_update_docs.py

Keep installation update help on state-preserving procedures

2026-10-07 09:24:32 +01:00

test_dev_prepush_frontend.py

Correct pre-push receipt fixtures to compare admitted content

2026-10-06 12:07:58 +01:00

test_docker_troubleshooting_docs.py

Bound passive agent log collection across help entry points

2026-10-07 18:06:37 +01:00

test_docs_mirror.py

Stop background git from racing test_docs_mirror temp cleanup

2026-09-02 09:55:47 +01:00

test_e2e_container_logs.py

Retain E2E container diagnostics without flooding Actions logs

2026-10-10 19:00:17 +01:00

test_e2e_test_images.py

Fail shared E2E fixture admission before repeating browser setup

2026-10-10 05:48:35 +01:00

test_e2e_workflow_contract.py

Shard internal/api race tests and drop probation E2E from PRs

2026-09-29 11:43:57 +01:00

test_external_agent_docs.py

Check credential boundaries independently of sentence capitalisation

2026-10-09 23:29:26 +01:00

test_failed_upgrade_intake_docs.py

Separate failed-upgrade attempts from observed recovery in issue intake

2026-10-10 11:39:23 +01:00

test_faq_deployment_docs.py

Preserve existing deployments in FAQ configuration help

2026-10-07 08:12:01 +01:00

test_frontend_real_embed.py

Retain checkout-read failure before real-embed compilation

2026-10-10 14:01:13 +01:00

test_frontend_workflow_order.py

Assert required frontend steps before comparing their order

2026-10-07 00:07:24 +01:00

test_gitleaks_ignore.py

security: narrow historical secret scan allowlist

2026-08-08 03:17:57 +01:00

test_go_mod_download.py

Keep a kill backstop on the bounded module download

2026-10-07 15:46:01 +01:00

test_go_package_shards.py

Start slow non-API test packages before the small-package tail

2026-10-10 01:08:54 +01:00

test_go_test_compilation.py

Reject incompatible Go test fixtures before backend CI fan-out

2026-10-06 19:54:22 +01:00

test_guest_disk_reading_docs.py

Keep guest reading guidance separate from coverage and routing

2026-10-09 14:14:13 +01:00

test_guest_network_troubleshooting_docs.py

Keep guest reading guidance separate from coverage and routing

2026-10-09 14:14:13 +01:00

test_icmp_privilege_docs.py

Keep ICMP permission recovery scoped to the observation host

2026-10-10 05:49:51 +01:00

test_localized_public_docs.py

Keep Docker setup credentials private across help languages

2026-10-03 07:41:56 +01:00

test_login_troubleshooting_docs.py

Distinguish login failures by credential source and request path

2026-10-06 13:26:49 +01:00

test_memory_troubleshooting_docs.py

Distinguish memory baseline regressions from growth in support guidance

2026-10-11 10:56:42 +01:00

test_native_installer_contract_runner.py

Keep installer runner fixtures aligned with all three bounded groups

2026-10-09 23:05:15 +01:00

test_navigation_help_docs.py

Point monitoring help at the current platform navigation

2026-10-03 02:32:05 +01:00

test_node_api_docs.py

Create node API documentation fixtures privately from the start

2026-10-10 06:24:36 +01:00

test_notification_runtime.py

Respect deployment telemetry lock in notification CI journey

2026-10-11 05:18:21 +01:00

test_notification_troubleshooting_docs.py

Bound copied log diagnostics by bytes as well as records

2026-10-11 02:24:14 +01:00

test_npm_audit_retry.py

Require successful npm audit completion before a clean verdict

2026-10-06 05:44:41 +01:00

test_oidc_session_docs.py

Explain OIDC session and access-removal limits truthfully

2026-10-07 22:51:30 +01:00

test_password_recovery_docs.py

Recover local logins without deleting authentication state

2026-10-03 09:25:52 +01:00

test_patrol_rule_help.py

Lead Patrol rule removal help with the existing UI

2026-10-05 21:51:17 +01:00

test_pbs_docs.py

Align PBS source guidance with current backup table labels

2026-10-08 06:54:22 +01:00

test_performance_troubleshooting_docs.py

Require observed reader termination within the existing deadline budget

2026-10-09 23:39:25 +01:00

test_playwright_acquisition.py

Fit complete WebKit dependency acquisition inside bounded E2E setup

2026-10-09 21:38:36 +01:00

test_pmg_docs.py

Align PMG collection guidance with saved-scope repair

2026-10-08 07:53:14 +01:00

test_production_rollout_docs.py

Keep Operational Trust upgrade checks read-only

2026-10-09 21:37:45 +01:00

test_public_docs_claims.py

Align TrueNAS guidance with JSON-RPC runtime

2026-09-01 18:32:39 +01:00

test_public_docs_workflow.py

Run complete documentation safety suites on docs-only changes

2026-10-09 19:10:29 +01:00

test_public_report_containment_docs.py

Explain safe containment after an accidental public disclosure

2026-10-10 09:54:36 +01:00

test_pve_backup_troubleshooting_docs.py

Keep guest disk permission guidance inside the intended access scope

2026-10-09 11:53:32 +01:00

test_release_browser_packet.py

Bind release browser qualification to the narrow CI identity

2026-10-04 04:57:17 +01:00

test_release_browser_tailnet.py

Bind release browser qualification to the narrow CI identity

2026-10-04 04:57:17 +01:00

test_release_lifecycle_rehearsal.py

Keep late browser refusal terminal during context cleanup

2026-10-04 03:55:53 +01:00

test_release_train_ci_contract.py

fix(ci): include release trains in build and E2E triggers

2026-09-06 00:58:57 +01:00

test_repo_docs_link_drift.py

Integrate reviewed bounded private RBAC administrative guidance

2026-10-09 18:51:01 +01:00

test_require_safe_gh_attestation.py

Bind release activation to trusted provenance

2026-08-30 01:51:58 +01:00

test_root_pair_diagnostic.py

fix(ci): archive durable root-pair candidate

2026-09-10 19:13:29 +01:00

test_scheduler_polling_docs.py

Keep scheduler diagnostics private and failure-aware

2026-10-03 13:13:21 +01:00

test_security_docs.py

State credential encryption and log-disclosure limits accurately

2026-10-09 15:59:57 +01:00

test_server_installer_stop.py

Stage source-built server binaries before atomic replacement

2026-10-07 12:44:56 +01:00

test_server_installer_temporary_inputs.py

Keep server installer inputs private and authenticated

2026-10-09 10:17:47 +01:00

test_server_release_selection.py

Select only published server releases in the installer

2026-10-09 08:29:32 +01:00

test_server_service_discovery.py

Refuse unattended recovery on uncertain systemd service state

2026-10-10 12:06:24 +01:00

test_server_update_containment_docs.py

Explain timer-only containment after uncertain server updates

2026-10-10 12:25:47 +01:00

test_server_update_menu.py

Bind unattended installer updates to exact menu targets

2026-10-09 09:20:16 +01:00

test_server_update_repair.py

Exercise half-removed server updates instead of matching bare calls

2026-10-10 13:12:42 +01:00

test_server_update_timer.py

Confine asset-repair entry-point validation to fixture unit inventory

2026-10-09 12:52:09 +01:00

test_setup_access_docs.py

Keep history diagnostics private and match current query types

2026-10-05 06:47:09 +01:00

test_signed_installer_docs.py

Preserve alert lifecycle truth and safe pinned updates

2026-09-24 17:43:50 +01:00

test_smoke_runner.py

Run complete script smoke checks in two isolated CI shards

2026-10-10 01:51:21 +01:00

test_smoke_workflow.py

Run complete script smoke checks in two isolated CI shards

2026-10-10 01:51:21 +01:00

test_sync_chart_release_metadata.py

fix(deploy): pin docs links to release refs

2026-03-28 21:32:11 +00:00

test_telemetry_adoption_report.py

Keep telemetry timing guard free of per-row mock bookkeeping

2026-10-09 17:28:20 +01:00

test_telemetry_schema_parity.py

Add privacy-safe telemetry lifecycle and outcome signals

2026-07-23 01:10:38 +01:00

test_transparency_docs.py

Preserve upstream release guidance in the integrated disclosure

2026-10-06 12:49:16 +01:00

test_troubleshooting_logs.py

Bound copied log diagnostics by bytes as well as records

2026-10-11 02:24:14 +01:00

test_truenas_docs.py

docs: correct customer docs that drifted from the source

2026-10-11 13:59:56 +01:00

test_update_recovery_docs.py

Keep manual update help from running an unknown helper

2026-10-09 08:00:25 +01:00

test_upgrade_v5_docs.py

Keep historical upgrade recovery non-destructive

2026-10-07 02:25:19 +01:00

test_uuid_layout_diagnostic.py

ci: add fixed UUID layout diagnostic without release gate waiver

2026-09-06 22:11:03 +01:00

test_validate_published_release.py

test(release): reject signatures outside the configured trust boundary

2026-09-05 17:17:54 +01:00

test_vm_disk_diagnostics.py

Align composed smoke safety checks with reviewed source

2026-10-09 16:58:38 +01:00

test_webhook_verification_docs.py

Clarify the existing webhook correlation contract

2026-10-04 08:44:50 +01:00

test_workflow_trust.py

Keep browser release qualification on the governed Node line

2026-10-04 07:06:02 +01:00

test_write_github_output.py

Close runner output alias bypasses

2026-09-01 16:54:07 +01:00

test-ci-benchmarks.sh

Keep paired PR benchmarks inside their time budget

2026-10-05 22:39:51 +01:00

test-cloud-public-signup-smoke.sh

Add Pulse Cloud public signup smoke

2026-04-23 23:09:10 +01:00

test-common-lib.sh

…

test-e2e-fixture-admission.sh

Make fixture admission executable through script smoke

2026-10-10 06:01:33 +01:00

test-e2e-runner-cleanup.sh

Tear down failed E2E setup without clearing another run's handoff

2026-10-10 05:08:02 +01:00

test-hot-dev-auth.sh

Stabilize script smoke checks

2026-05-28 12:55:33 +01:00

test-hot-dev-bg.sh

Merge commit '7606b72a8b85e70696e8bfa52a0792fbb146a34d'

2026-10-08 11:03:49 +01:00

test-hot-dev-runtime.sh

build(deps): qualify the go-minor-patch dependency group

2026-09-23 06:49:52 +01:00

test-install-ps1-parser.sh

Tighten unified agent hardening proof

2026-04-23 23:37:25 +01:00

test-install-update-resilience.sh

Refuse server replacement until Pulse is confirmed stopped

2026-10-07 08:41:36 +01:00

test-npm-audit-retry.sh

Require successful npm audit completion before a clean verdict

2026-10-06 05:44:41 +01:00

test-pulse-auto-update.sh

Refuse unattended recovery on uncertain systemd service state

2026-10-10 12:06:24 +01:00

test-reclaim-closed-pr-capacity.sh

Reclaim CI capacity when pull requests close

2026-09-02 11:03:53 +01:00

test-retired-trial-acquisition-docs.sh

Rename retired trial acquisition proof assets

2026-04-28 18:38:10 +01:00

test-script-reference-integrity.sh

Switch script-reference integrity test from rg to git grep for portable CI

2026-05-12 00:30:43 +01:00

test-toggle-mock.sh

Scale large-estate workload and Proxmox demo performance

2026-08-23 15:09:32 +01:00