diff --git a/VERSION b/VERSION index 2de57bb4d5..06e62719af 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -6.1.0-rc.2 +6.1.0-rc.3 diff --git a/deploy/helm/pulse/Chart.yaml b/deploy/helm/pulse/Chart.yaml index 6b075a0859..f4211fb068 100644 --- a/deploy/helm/pulse/Chart.yaml +++ b/deploy/helm/pulse/Chart.yaml @@ -2,9 +2,9 @@ apiVersion: v2 name: pulse description: Helm chart for deploying the Pulse hub and optional Docker monitoring agent. type: application -version: 6.1.0-rc.2 -appVersion: "6.1.0-rc.2" -icon: https://raw.githubusercontent.com/rcourtman/Pulse/v6.1.0-rc.2/docs/images/pulse-logo.svg +version: 6.1.0-rc.3 +appVersion: "6.1.0-rc.3" +icon: https://raw.githubusercontent.com/rcourtman/Pulse/v6.1.0-rc.3/docs/images/pulse-logo.svg keywords: - monitoring - proxmox @@ -32,7 +32,7 @@ annotations: description: Smoke tests with kind cluster deployment artifacthub.io/links: | - name: Documentation - url: https://github.com/rcourtman/Pulse/blob/v6.1.0-rc.2/docs/KUBERNETES.md + url: https://github.com/rcourtman/Pulse/blob/v6.1.0-rc.3/docs/KUBERNETES.md - name: Support url: https://github.com/rcourtman/Pulse/discussions artifacthub.io/maintainers: | diff --git a/deploy/helm/pulse/README.md b/deploy/helm/pulse/README.md index 729a6159b2..f7a0023762 100644 --- a/deploy/helm/pulse/README.md +++ b/deploy/helm/pulse/README.md @@ -1,6 +1,6 @@ # pulse -![Version: 6.1.0-rc.2](https://img.shields.io/badge/Version-6.1.0--rc.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 6.1.0-rc.2](https://img.shields.io/badge/AppVersion-6.1.0--rc.2-informational?style=flat-square) +![Version: 6.1.0-rc.3](https://img.shields.io/badge/Version-6.1.0--rc.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 6.1.0-rc.3](https://img.shields.io/badge/AppVersion-6.1.0--rc.3-informational?style=flat-square) Helm chart for deploying the Pulse hub and optional Docker monitoring agent. diff --git a/docker-compose.yml b/docker-compose.yml index 3c42462688..b7622729ec 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -2,7 +2,7 @@ version: '3.8' services: pulse: - image: ${PULSE_IMAGE:-rcourtman/pulse:6.1.0-rc.2} + image: ${PULSE_IMAGE:-rcourtman/pulse:6.1.0-rc.3} container_name: pulse restart: unless-stopped logging: diff --git a/docs/RELEASE_NOTES.md b/docs/RELEASE_NOTES.md index 32f9971248..6fcb156ce2 100644 --- a/docs/RELEASE_NOTES.md +++ b/docs/RELEASE_NOTES.md @@ -7,10 +7,12 @@ For historical v4 notes that previously lived in this repo, see: `docs/releases/RELEASE_NOTES_v4.md` For the current v6 support release candidate packet, see: -- `docs/releases/RELEASE_NOTES_v6.1.0-rc.2.md` -- `docs/releases/V6_CHANGELOG_v6.1.0-rc.2.md` +- `docs/releases/RELEASE_NOTES_v6.1.0-rc.3.md` +- `docs/releases/V6_CHANGELOG_v6.1.0-rc.3.md` For historical v6 support release candidate packets, see: +- `docs/releases/RELEASE_NOTES_v6.1.0-rc.2.md` +- `docs/releases/V6_CHANGELOG_v6.1.0-rc.2.md` - `docs/releases/RELEASE_NOTES_v6.1.0-rc.1.md` - `docs/releases/V6_CHANGELOG_v6.1.0-rc.1.md` - `docs/releases/RELEASE_NOTES_v6.0.5-rc.4.md` diff --git a/docs/UPGRADE_v6.md b/docs/UPGRADE_v6.md index dc6dc50719..8490aa0fad 100644 --- a/docs/UPGRADE_v6.md +++ b/docs/UPGRADE_v6.md @@ -4,8 +4,8 @@ This guide covers practical upgrade steps for existing Pulse installs moving to For the current v6 support release candidate packet, see: -- `docs/releases/RELEASE_NOTES_v6.1.0-rc.2.md` -- `docs/releases/V6_CHANGELOG_v6.1.0-rc.2.md` +- `docs/releases/RELEASE_NOTES_v6.1.0-rc.3.md` +- `docs/releases/V6_CHANGELOG_v6.1.0-rc.3.md` For the current stable v6 packet and rollout references, see: diff --git a/docs/release-control/v6/internal/status.json b/docs/release-control/v6/internal/status.json index 4b07bedc74..ff69f03921 100644 --- a/docs/release-control/v6/internal/status.json +++ b/docs/release-control/v6/internal/status.json @@ -8870,7 +8870,21 @@ ] } ], - "work_claims": [], + "work_claims": [ + { + "id": "claude-triage-lane-l1", + "agent_id": "claude-triage", + "summary": "Prepare and publish the governed v6.1.0-rc.3 release packet", + "target_id": "v6-product-lane-expansion", + "claimed_at": "2026-07-18T15:52:00Z", + "heartbeat_at": "2026-07-18T15:52:00Z", + "expires_at": "2026-07-18T19:52:00Z", + "work_item": { + "kind": "lane", + "id": "L1" + } + } + ], "open_decisions": [], "source_of_truth_file": "docs/release-control/v6/internal/SOURCE_OF_TRUTH.md", "resolved_decisions": [ diff --git a/docs/release-control/v6/internal/subsystems/deployment-installability.md b/docs/release-control/v6/internal/subsystems/deployment-installability.md index dd9c2480b2..d53a1276fd 100644 --- a/docs/release-control/v6/internal/subsystems/deployment-installability.md +++ b/docs/release-control/v6/internal/subsystems/deployment-installability.md @@ -999,9 +999,9 @@ host-local redirect contract as runtime token minting and exchange. Proof input must reject absolute, scheme-relative, backslash-authority, encoded-separator, and control-character targets before constructing the handoff request. -The active support prerelease `v6.1.0-rc.2` cut sets the repo-root `VERSION`, +The active support prerelease `v6.1.0-rc.3` cut sets the repo-root `VERSION`, repo-root `docker-compose.yml` image default, `scripts/install-docker.sh` -fallback, and Helm chart release metadata to the same `6.1.0-rc.2` release +fallback, and Helm chart release metadata to the same `6.1.0-rc.3` release version. This support prerelease keeps `rollback_version=v6.0.5`, publishes a versioned public GitHub prerelease plus versioned Docker and Helm artifacts, and does not move stable/latest install pointers or stable semver aliases. It puts @@ -1013,7 +1013,13 @@ behind RC validation before the next stable minor release. The second candidate extends that cumulative scope with model-led Patrol qualification, subscription-backed Claude transport, typed Docker update and restart recovery, a governed commercial lifecycle, and additional fail-closed authentication and -installer hardening. +installer hardening. The third candidate +carries release-candidate feedback fixes: host agent install tokens mint the +command-execution scope the operator asks for with first-use command-channel +binding, ZFS pool membership resolves nvme-eui and namespace-suffixed member +references, TrueNAS storage reads the served API shapes, Patrol findings can +notify through alert channels, and in-app updates select releases by highest +version. The companion evidence for this cut is Pulse Mobile iOS build 10 and Android versionCode 8 on TestFlight and Google Play internal testing only. The release packet must not describe either candidate as a public store rollout. @@ -1076,8 +1082,8 @@ compose image default, standalone installer fallback constant, and packaged Helm metadata. A draft release workflow failure caused by stale image or chart pins is a release-packet blocker until the defaults, tests, and evidence record are refreshed from the new branch head. -For the active support prerelease `v6.1.0-rc.2` cut, the repo-root compose -default and `scripts/install-docker.sh` fallback must both pin `6.1.0-rc.2` +For the active support prerelease `v6.1.0-rc.3` cut, the repo-root compose +default and `scripts/install-docker.sh` fallback must both pin `6.1.0-rc.3` until the next governed stable cut moves them forward. The stable promotion guard remains in force and must reject leftover `-rc.` defaults when the governed `VERSION` returns to a stable release. diff --git a/docs/releases/RELEASE_NOTES_v6.1.0-rc.3.md b/docs/releases/RELEASE_NOTES_v6.1.0-rc.3.md new file mode 100644 index 0000000000..14bce0815c --- /dev/null +++ b/docs/releases/RELEASE_NOTES_v6.1.0-rc.3.md @@ -0,0 +1,213 @@ +# Pulse v6.1.0-rc.3 Release Notes + +`v6.1.0-rc.3` is a release candidate for the next Pulse v6 minor line. It +follows stable `v6.0.5`, retains the substantial monitor-first product update, +typed Pulse Intelligence action lifecycle, dedicated Actions workspace, safer +native-agent update and recovery behavior, and broad security and reliability +hardening from the earlier candidates, and supersedes `v6.1.0-rc.2` with fixes +driven directly by release-candidate feedback across agent command enrolment, +Docker update actions, storage identity, TrueNAS accuracy, Patrol reliability, +and update selection. + +## Highlights + +- Patrol findings can now move through one reviewed Actions inbox with clear + approval, execution, and verification state. +- Pulse can safely carry out a wider set of explicitly governed Docker, + Proxmox, host-update, package-maintenance, and storage-cleanup actions. +- Platform pages, connected systems, responsive layouts, and Assistant + conversations are more task-focused and easier to operate day to day. +- Native updates, agent recovery, authentication boundaries, and service + hardening fail closed across more installation and recovery paths. +- Patrol investigations now keep evidence and model-turn budgets bounded, + preserve multiple grounded findings, and separate Watch detection from + model-led investigation. +- Claude subscription-backed models can use schema-bound streaming and native + typed tools without creating a parallel action-execution path. +- Enabling command execution when adding a Pulse Agent now mints an install + token that actually carries the command permission, and the command channel + accepts it on first registration. +- TrueNAS storage surfaces read the API shapes TrueNAS actually serves, and + physical disks resolve their ZFS pool membership for nvme-eui and + namespace-suffixed member references. +- Patrol findings can notify through the same channels as alerts, and manual + Patrol runs no longer report a false timeout while a slow self-hosted model + is still warming up. + +## Added + +- Pulse Intelligence now has explicit detection and investigation profiles, + a typed proposal-to-action lifecycle, and post-action verification for + supported Docker and Kubernetes operations. +- Patrol action state now reconciles from the authoritative action audit and + stays current across investigation history, desktop approval controls, and + Pulse Mobile approve or reject flows. +- Actions provides a dedicated inbox for reviewing proposed work, checking + policy and verification details, and seeing pending approvals without + searching through Assistant history. +- Patrol can authorize low-risk Docker and Podman restarts through explicit + per-resource capability allowlists and optional recurring maintenance + windows, while unsupported, out-of-window, or downgraded-mode actions remain + approval-gated and fail closed. +- Governed host updates, Debian and Ubuntu package maintenance, storage-pressure + cleanup, and supported Proxmox guest lifecycle operations now use reviewed + plans, durable execution receipts, and independent outcome verification. +- Local AI setup includes a guided Ollama quickstart for `qwen3:8b`, with + clearer Provider & Models readiness guidance. +- Cluster members can override their connection addresses when the discovered + address is not the one Pulse should use. +- The Unified Agent Windows service now writes owner-controlled rotating logs, + verifies logged readiness during installation, and carries native lifecycle + proof for install, replacement, recovery, persistence, and uninstall. +- A live Patrol qualification path exercises model-led investigations, finding + quality, remediation planning, typed tool use, and negative controls. +- Claude subscription-backed models support bounded preflight, streaming native + tool calls, retry-safe durable outcomes, and explicit separation from + API-billed provider routes. +- Docker inventory warns when two machines report the same agent identity, and + registry pulls can negotiate bearer tokens from authentication challenges. +- New Patrol findings can be routed to the configured alert notification + channels, with settings exposed in the API and the Patrol settings page. +- The Docker thresholds page exposes the container update-alert delay, + including an off state that fully disables update alerts. +- Relay is discoverable where users configure alerts, the Assistant is + surfaced during first AI setup, and the external-agent (MCP) connector + setup is findable from sidebar search. + +## Improved + +- Platform and connected-system pages lead with monitor-first attention and + task-oriented workflows, with more coherent responsive and mobile layouts. +- Pulse Intelligence settings and daily-use surfaces use one consistent + product vocabulary while keeping Patrol focused on detection and + investigation. +- The provider MSP portal uses the product design system, supports dark mode, + and presents self-service behavior honestly when an email provider is not + configured. +- Update execution now uses one canonical lifecycle with clearer completion, + rollback, and operator feedback. +- Investigation prompts receive the real typed capability catalog, including + approval requirements and parameter constraints, instead of asking the + model to guess which actions are available. +- Assistant conversations can be retried, regenerated, edited and resent, and + steered while a response is running. Long pasted input is collapsed into a + manageable composer attachment, and the last-turn summary reports estimated + model cost when available. +- Patrol handoffs now open the related Actions review directly, background + Patrol work stays out of the Assistant quick-resume list, and the Actions tab + shows its pending-approval count. +- Docker, Kubernetes, TrueNAS, vSphere, and Proxmox node tables preserve + user-controlled column sorting through one shared platform-table model. +- Multi-finding Patrol runs preserve accepted siblings and sequential findings, + while provider retries and replay handling retain durable outcomes without + upgrading incomplete evidence. +- Docker update and restart work stays on reviewed typed plans with durable + receipts and recovery after server or agent reconnection. +- Commercial plan, cadence, entitlement, revocation, and downgrade handling now + shares an installation-scoped lifecycle that preserves customer data. + +## Fixed + +- Add Pulse Agent minted install tokens without the command-execution scope + even when Enable Pulse command execution was ticked, so agents could never + register the command channel. Tokens are now minted server-side with the + scopes the checkbox asks for and the binding the command channel requires, + the token regenerates when the checkbox is toggled, and the rejection + message names the actual recovery step. +- Pool membership resolution missed disks referenced as `nvme-eui.` or + with a trailing namespace suffix in zpool member links, so those disks + showed a generic ZFS label instead of their pool name. +- TrueNAS datasets, disks, and pools no longer show Offline, Attention, or + Unknown when the underlying system is healthy, and per-system storage no + longer swaps names with the system selected in Overview. +- Disabling all Docker container or service alerts now clears already-active + update alerts instead of letting them keep notifying, and the update-alert + delay has an explicit off state. +- The container update button is disabled up front when the server refuses + the update capability, failed update plans surface the refusal reason, and + the agent-too-old refusal explains what to do. +- Manual Patrol runs reported a connection timeout when a slow provider had + not streamed within fifteen seconds even though the run had started; + failure is now only reported once a status refresh confirms no run is in + progress. +- In-app updates select releases by highest version rather than GitHub list + order, and malformed release notes fail closed. +- Webhook delivery and outbound security dialing try every permitted + resolved IP instead of pinning the first. +- Approved-action dispatch survives client disconnects, unavailable reviewed + actions surface their real cause, and the Docker agent bounds its collect + cycle with a watchdog so a hung container daemon cannot stall reporting. +- With no systems connected, the page-header and setup-band calls to action + are now distinctly named, and telemetry pings are suppressed while mock + mode is enabled. +- Native updates self-test the replacement binary before swapping it in, + reject silent edition downgrades, preserve a sanctioned rollback path, and + fail fast when signing configuration is incomplete. +- Native updates fail closed instead of silently falling back to a community + build, preserve writable configuration backups under hardened services, and + publish verification keys in the exact OpenSSH `allowed_signers` form used + by the documented verification command. +- Docker updates now recreate the container instead of attempting a restart + that cannot apply a new image. +- Docker containers retain their grouped-by-host view and open configured web + links consistently after REST resource snapshot hydration. +- Docker and Kubernetes agents tolerate realistic clock skew when evaluating + liveness, and posture alerts no longer ignore the intended guest-suppression + rules. +- Legacy OIDC callbacks recover the initiating provider correctly. +- Provider/runtime failures and proposal-validation failures remain separate, + so a failed investigation cannot be misreported as a completed + needs-attention result. +- First-run, request parsing, storage, cookie, remediation-lock, and remote + deployment boundaries now fail closed across the hardened paths included in + this candidate. +- FreeBSD agent update recovery and Windows service recovery now preserve a + usable runtime across replacement and restart paths. +- Cluster re-registration preserves an operator-selected member address, moved + guests keep their alert ownership aligned with the new node, and unavailable + guest-agent disk data is no longer presented as a real measurement. +- Physical disks no longer disappear on wide node layouts, standby SSDs no + longer report misleading state, shared Docker network namespaces survive + container updates, and SSO administrators retain the expected settings + authority. +- Patrol rejects untrusted prompt instructions, unsupported reconfirmation + shortcuts, and ungrounded health claims; repeated restarts and Docker OOM + events now use authoritative evidence. +- OIDC sessions without refresh tokens remain valid where allowed, mixed-auth + startup avoids deadlock, and Basic-auth identity reaches action authorization. +- Deleted hosts can re-enroll with fresh credentials, agent configuration stays + available from continuity state during reload windows, and Windows version + checks normalize a leading `v`. +- Constrained NAS installs no longer require `od`; recovery-point, TrueNAS, and + `nvme-eui` ZFS disk identity reconciliation retain authoritative sources. +- Availability polling honors its configured interval, alert email times include + their timezone, and no-op Docker update status no longer creates false history. + +## Upgrade Notes + +Use the normal v6 install or update flow for `v6.1.0-rc.3` only when you are +comfortable testing an RC. The rollback target for this release candidate is +`v6.0.5`. + +The exact rollback reinstall command is: + +```bash +./scripts/install.sh --version v6.0.5 +``` + +This candidate changes authentication and native installer/updater boundaries, +so it is intentionally using the governed RC path rather than the direct +stable-patch path. + +Pulse Mobile iOS candidate build 10 and Android candidate versionCode 8 carry +the matching plan-bound action review and approval client. They remain on the +TestFlight and Google Play internal-testing tracks; no public store rollout is +part of this RC. + +Windows Unified Agent binaries in this release candidate retain the same +checksum and detached-signature verification used by `v6.0.5`, but they are +not yet Authenticode-signed and Windows may show an unknown-publisher warning. +Public Windows Authenticode signing remains required before stable promotion. + +Paid Pulse Pro, Relay, and eligible legacy customers should continue to use the +private download page and private runtime image for paid runtime features. diff --git a/docs/releases/V6_CHANGELOG_v6.1.0-rc.3.md b/docs/releases/V6_CHANGELOG_v6.1.0-rc.3.md new file mode 100644 index 0000000000..3ca59c2b2a --- /dev/null +++ b/docs/releases/V6_CHANGELOG_v6.1.0-rc.3.md @@ -0,0 +1,165 @@ +# Pulse v6.1.0-rc.3 + +_This changelog describes the cumulative `v6.1.0-rc.3` release candidate +compared with stable `v6.0.5`. It supersedes `v6.1.0-rc.2`._ + +## Added + +- Pulse Intelligence now exposes explicit detection and investigation + profiles over the canonical typed action lifecycle. +- Patrol can capture typed action proposals and route approved work through + the shared lifecycle instead of command-side execution paths. +- Desktop and Pulse Mobile clients now use the canonical pending-action queue, + decision endpoint, and action identity instead of retired command-shaped + approval endpoints. +- The desktop Actions inbox now provides one review surface for proposed work, + policy provenance, approval state, execution progress, verification detail, + and direct Patrol handoffs. +- Docker and Kubernetes actions verify supported scale and update outcomes + after execution. +- Policy-scoped Patrol autonomy can authorize low-risk Docker and Podman + restarts only for explicitly allowed resources and optional recurring + maintenance windows. +- Host update, Debian and Ubuntu package, storage-pressure cleanup, Docker + restart, and supported Proxmox guest lifecycle plans now share the governed + action, durable receipt, and independent-verification path. +- Local provider setup includes a guided Ollama `qwen3:8b` quickstart. +- Cluster members can override discovered connection addresses. +- The Unified Agent accepts a rotating JSON log path for native service use. +- Live Patrol qualification now exercises model-led investigations, typed tool + use, finding quality, remediation planning, and negative controls. +- Claude subscription-backed models now support schema-bound streaming turns, + native tools, bounded preflight, and retry-safe durable outcomes. +- Docker inventory identifies conflicting shared agent identities, and registry + clients can negotiate bearer tokens from authentication challenges. +- New Patrol findings can route to the configured alert notification channels, + with settings exposed in the API and the Patrol settings page. +- The Docker thresholds page exposes the container update-alert delay with an + explicit off state. +- Relay is discoverable from alert configuration, the Assistant surfaces at + first AI setup, and the external-agent (MCP) connector setup is findable + from sidebar search. + +## Changed + +- Connected systems, platform attention states, and responsive layouts are + task-first and monitor-first across the main product surfaces. +- Assistant and Patrol settings now use the Pulse Intelligence product name + consistently while retaining Patrol as the detection and investigation + engine. +- The provider MSP portal now uses product design tokens and dark mode, and + its no-email-provider behavior is explicit and self-sufficient. +- Native-agent update application now runs through one store action and one + transport-independent lifecycle service. +- Action transitions reconcile investigation outcomes from the authoritative + audit at write time and hydrate missed transitions when investigations are + read later. +- Investigation prompts include the validated capability catalog with approval + floors, parameter schemas, and sensitive/operator-only constraints. +- Assistant supports in-place retry, response regeneration, edit-and-resend, + mid-turn steering, collapsed long-paste attachments, and estimated + last-turn cost summaries. +- Patrol action handoffs open the matching Actions review, background Patrol + sessions stay out of Assistant quick resume, and pending approvals are + visible on the Actions navigation tab. +- Docker, Kubernetes, TrueNAS, vSphere, and Proxmox node tables share one + sortable platform-table model and retain user-controlled column ordering. +- Windows native CI exercises installer parsing, install, version replacement, + logged readiness, forced-process recovery, restart persistence, and cleanup. +- Release automation builds one signed exact-SHA candidate and promotes that + candidate without rebuilding. +- Action dispatch now binds server-authored policy provenance and reviewed plan + identity through durable admission, transport, result, and audit records. +- Patrol separates Watch detection from investigation, bounds evidence and model + turns, preserves multiple accepted findings, and keeps canonical resource + identities through typed tool calls. +- Docker update and restart work remains on reviewed typed plans with durable + receipts and reconnect recovery. +- Commercial plan, cadence, entitlement, revocation, and downgrade handling now + shares an installation-scoped lifecycle that preserves customer data. + +## Fixed + +- Host agent install tokens now carry the command-execution scope the + Add Pulse Agent checkbox asks for, with first-use command-channel binding + and regeneration when the choice changes. +- ZFS pool membership resolves `nvme-eui.` and namespace-suffixed by-id + member references on both the server and host-agent matchers. +- TrueNAS storage reads the API shapes TrueNAS actually serves, so datasets, + disks, and pool details report real state. +- Disable-all Docker alert toggles clear active container update alerts. +- Container update refusals surface their reason up front, including the + agent-too-old case. +- Manual Patrol runs only report a failed start after a status refresh + confirms no run is in progress. +- In-app updates select releases by highest version, not GitHub list order, + and malformed release notes fail closed. +- Webhook and security dialers try every permitted resolved IP. +- Approved-action dispatch survives client disconnects, and the Docker agent + collect cycle is watchdog-bounded. +- The zero-connected Add infrastructure calls to action are distinctly named, + and telemetry pings are suppressed in mock mode. +- Replacement binaries are self-tested before the in-app updater swaps them + into place. +- Edition-aware update checks block silent Pro-to-community downgrades and + preserve an explicit rollback route. +- Docker update guidance recreates the container so the selected image is + actually applied. +- Docker and Kubernetes agent liveness handles clock skew correctly. +- Docker updates preserve containers that share another container's network + namespace. +- Guest suppression is honored for posture alerts. +- Legacy OIDC callback handling recovers the initiating provider. +- Simultaneous provider/runtime and proposal-channel failures preserve both + failure causes across the core and enterprise boundary. +- Terminal action verification now drives honest desktop and mobile completion + or failure state, including canonical push action identities. +- FreeBSD update recovery preserves the native agent lifecycle. +- Windows service installation fails closed when required recovery actions or + non-crash recovery cannot be configured. +- Windows install success now requires both local readiness and a non-empty + durable service log. +- Discovery backfills quiesce during shutdown. +- Cluster members retain an operator-selected connection address when they + re-register through another member. +- Guest alerts move with the guest when its owning node changes, and missing + guest-agent disk data uses an unavailable sentinel instead of a fabricated + measurement. +- Physical disk tables keep wide-node disks visible and avoid reporting + standby SSDs as active failures. +- SSO-backed administrators retain their effective settings privileges. +- Patrol rejects untrusted instructions, invalid reconfirmation shortcuts, and + ungrounded health claims while using authoritative restart and OOM evidence. +- OIDC sessions without refresh tokens remain valid where allowed, mixed-auth + startup avoids deadlock, and Basic-auth identity reaches action authorization. +- Deleted hosts can re-enroll with fresh credentials, continuity state serves + agent configuration during reload windows, and Windows version checks + normalize a leading `v`. +- Constrained NAS installs no longer require `od`; recovery-point, TrueNAS, and + `nvme-eui` disk reconciliation preserve authoritative identity. +- Availability polling cadence, alert timezones, Docker change history, and + stable web-interface links now reflect authoritative values. + +## Security + +- First-run security boundaries now fail closed. +- Autonomous dispatches fail closed when remediation lock state is unknown. +- Request, storage, integer-conversion, allocation, and cookie boundaries have + additional CodeQL-driven hardening. +- macOS native release signing and notarization are required for this RC; + Windows Authenticode remains required for stable promotion and is disclosed + explicitly while the public signing application is pending. +- Demo SSH setup no longer weakens host-key handling for private deploy hosts + or IP targets. +- Update verification documentation and release output use a guarded OpenSSH + `allowed_signers` line, and hardened update services keep configuration + backups on a writable path. + +## Release Metadata + +- Version: `v6.1.0-rc.3` +- Rollback target: `v6.0.5` +- Rollback command: `./scripts/install.sh --version v6.0.5` +- Promotion path: release candidate from `main` +- Mobile companion candidates: iOS build 10 and Android versionCode 8 on the + TestFlight and Google Play internal-testing tracks diff --git a/scripts/install-docker.sh b/scripts/install-docker.sh index 697c1b86dd..b0b582b349 100755 --- a/scripts/install-docker.sh +++ b/scripts/install-docker.sh @@ -6,7 +6,7 @@ set -euo pipefail SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)" DOCKER_IMAGE_REPO="${DOCKER_IMAGE_REPO:-rcourtman/pulse}" -CANONICAL_DEFAULT_PULSE_VERSION="6.1.0-rc.2" +CANONICAL_DEFAULT_PULSE_VERSION="6.1.0-rc.3" resolve_default_pulse_version() { if [ -n "${PULSE_IMAGE_VERSION:-}" ]; then diff --git a/scripts/installtests/build_release_assets_test.go b/scripts/installtests/build_release_assets_test.go index 5e2257eb16..d3152a7db9 100644 --- a/scripts/installtests/build_release_assets_test.go +++ b/scripts/installtests/build_release_assets_test.go @@ -353,7 +353,12 @@ func TestCurrentSupportPrereleasePacketTracksInstallMetadata(t *testing.T) { "Legacy OIDC callbacks", "Windows service recovery", "fail closed", - "supersedes `v6.1.0-rc.1`", + "supersedes `v6.1.0-rc.2`", + "carries the command permission", + "namespace-suffixed member references", + "API shapes TrueNAS actually serves", + "notify through the same channels as alerts", + "select releases by highest version", "Claude subscription-backed models", "Docker inventory warns when two machines report the same agent identity", "Commercial plan, cadence, entitlement, revocation, and downgrade handling", @@ -382,7 +387,12 @@ func TestCurrentSupportPrereleasePacketTracksInstallMetadata(t *testing.T) { "Windows service installation fails closed", "First-run security boundaries now fail closed", "one signed exact-SHA candidate", - "supersedes `v6.1.0-rc.1`", + "supersedes `v6.1.0-rc.2`", + "command-execution scope the", + "namespace-suffixed by-id", + "API shapes TrueNAS actually serves", + "route to the configured alert notification channels", + "select releases by highest version", "Claude subscription-backed models", "Docker inventory identifies conflicting shared agent identities", "Commercial plan, cadence, entitlement, revocation, and downgrade handling", diff --git a/scripts/installtests/install_docker_sh_test.go b/scripts/installtests/install_docker_sh_test.go index 97f5ad3033..ac50393792 100644 --- a/scripts/installtests/install_docker_sh_test.go +++ b/scripts/installtests/install_docker_sh_test.go @@ -128,7 +128,7 @@ func TestPreviousStableForPrereleaseVersionCrossesMinorBoundaries(t *testing.T) want string }{ {version: "6.0.5-rc.4", want: "6.0.4"}, - {version: "6.1.0-rc.2", want: "6.0.5"}, + {version: "6.1.0-rc.3", want: "6.0.5"}, } for _, test := range tests {