Prepare v6.1.0-rc.5 release

This commit is contained in:
rcourtman 2026-07-22 11:28:38 +01:00
parent 671b159711
commit d3070ce1cb
13 changed files with 238 additions and 60 deletions

View file

@ -1 +1 @@
6.1.0-rc.4
6.1.0-rc.5

View file

@ -2,9 +2,9 @@ apiVersion: v2
name: pulse
description: Helm chart for deploying the Pulse hub and optional Docker monitoring agent.
type: application
version: 6.1.0-rc.4
appVersion: "6.1.0-rc.4"
icon: https://raw.githubusercontent.com/rcourtman/Pulse/v6.1.0-rc.4/docs/images/pulse-logo.svg
version: 6.1.0-rc.5
appVersion: "6.1.0-rc.5"
icon: https://raw.githubusercontent.com/rcourtman/Pulse/v6.1.0-rc.5/docs/images/pulse-logo.svg
keywords:
- monitoring
- proxmox
@ -32,7 +32,7 @@ annotations:
description: Smoke tests with kind cluster deployment
artifacthub.io/links: |
- name: Documentation
url: https://github.com/rcourtman/Pulse/blob/v6.1.0-rc.4/docs/KUBERNETES.md
url: https://github.com/rcourtman/Pulse/blob/v6.1.0-rc.5/docs/KUBERNETES.md
- name: Support
url: https://github.com/rcourtman/Pulse/discussions
artifacthub.io/maintainers: |

View file

@ -1,6 +1,6 @@
# pulse
![Version: 6.1.0-rc.4](https://img.shields.io/badge/Version-6.1.0--rc.4-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 6.1.0-rc.4](https://img.shields.io/badge/AppVersion-6.1.0--rc.4-informational?style=flat-square)
![Version: 6.1.0-rc.5](https://img.shields.io/badge/Version-6.1.0--rc.5-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 6.1.0-rc.5](https://img.shields.io/badge/AppVersion-6.1.0--rc.5-informational?style=flat-square)
Helm chart for deploying the Pulse hub and optional Docker monitoring agent.

View file

@ -2,7 +2,7 @@ version: '3.8'
services:
pulse:
image: ${PULSE_IMAGE:-rcourtman/pulse:6.1.0-rc.4}
image: ${PULSE_IMAGE:-rcourtman/pulse:6.1.0-rc.5}
container_name: pulse
restart: unless-stopped
logging:

View file

@ -7,10 +7,12 @@ For historical v4 notes that previously lived in this repo, see:
`docs/releases/RELEASE_NOTES_v4.md`
For the current v6 support release candidate packet, see:
- `docs/releases/RELEASE_NOTES_v6.1.0-rc.4.md`
- `docs/releases/V6_CHANGELOG_v6.1.0-rc.4.md`
- `docs/releases/RELEASE_NOTES_v6.1.0-rc.5.md`
- `docs/releases/V6_CHANGELOG_v6.1.0-rc.5.md`
For historical v6 support release candidate packets, see:
- `docs/releases/RELEASE_NOTES_v6.1.0-rc.4.md`
- `docs/releases/V6_CHANGELOG_v6.1.0-rc.4.md`
- `docs/releases/RELEASE_NOTES_v6.1.0-rc.3.md`
- `docs/releases/V6_CHANGELOG_v6.1.0-rc.3.md`
- `docs/releases/RELEASE_NOTES_v6.1.0-rc.2.md`

View file

@ -4,8 +4,8 @@ This guide covers practical upgrade steps for existing Pulse installs moving to
For the current v6 support release candidate packet, see:
- `docs/releases/RELEASE_NOTES_v6.1.0-rc.4.md`
- `docs/releases/V6_CHANGELOG_v6.1.0-rc.4.md`
- `docs/releases/RELEASE_NOTES_v6.1.0-rc.5.md`
- `docs/releases/V6_CHANGELOG_v6.1.0-rc.5.md`
For the current stable v6 packet and rollout references, see:

View file

@ -9064,7 +9064,21 @@
]
}
],
"work_claims": [],
"work_claims": [
{
"id": "release-operator-rc5-release-gate-single-build-release-promotion-path",
"agent_id": "release-operator-rc5",
"summary": "Prepare and publish v6.1.0-rc.5 through the governed exact-SHA promotion workflow",
"target_id": "v6-product-lane-expansion",
"claimed_at": "2026-07-22T08:51:49Z",
"heartbeat_at": "2026-07-22T08:51:49Z",
"expires_at": "2026-07-22T16:51:49Z",
"work_item": {
"kind": "release-gate",
"id": "single-build-release-promotion-path"
}
}
],
"open_decisions": [],
"source_of_truth_file": "docs/release-control/v6/internal/SOURCE_OF_TRUTH.md",
"resolved_decisions": [

View file

@ -1037,9 +1037,9 @@ host-local redirect contract as runtime token minting and exchange. Proof input
must reject absolute, scheme-relative, backslash-authority, encoded-separator,
and control-character targets before constructing the handoff request.
The active support prerelease `v6.1.0-rc.4` cut sets the repo-root `VERSION`,
The active support prerelease `v6.1.0-rc.5` cut sets the repo-root `VERSION`,
repo-root `docker-compose.yml` image default, `scripts/install-docker.sh`
fallback, and Helm chart release metadata to the same `6.1.0-rc.4` release
fallback, and Helm chart release metadata to the same `6.1.0-rc.5` release
version. This support prerelease keeps `rollback_version=v6.0.5`, publishes a
versioned public GitHub prerelease plus versioned Docker and Helm artifacts, and
does not move stable/latest install pointers or stable semver aliases. It puts
@ -1064,12 +1064,16 @@ reliable alert state transitions, report-only Unified Agent observer
destinations with destination-scoped transport policy, and release-candidate
feedback fixes across Assistant, storage, Docker, responsive tables, and
session continuity.
The companion evidence for this cut is Pulse Mobile iOS build 10 and Android
versionCode 8 on TestFlight and Google Play internal testing only, with
candidate-channel runtime-version-1 update group
`9b78b108-2586-4b0f-91d3-afbed19b49b3` built from mobile commit
`fddb091e683e84902de6aac680b08a47862b738b` for both platforms. The release
packet must not describe either candidate as a public store rollout.
The fifth candidate sharpens infrastructure identity and fleet truth, moves
Agent Doctor into a routed, filterable diagnostic workflow with copyable
reports and platform-correct host-local cleanup handoff, adds SAS and SCSI SMART
coverage, restores actionable agent-update controls, fixes Patrol finding and
proposal provenance, improves metrics and audit-store concurrency, and prepares
the stable Windows SignPath signing path while retaining the governed
unsigned-Windows prerelease exception.
The rc.5 server cut is classified `no-mobile-impact`; no companion build upload
is part of this cut. The existing mobile candidate programme remains separate,
and the release packet must not describe a public store rollout.
The same release boundary now provides one canonical in-app release-note
experience. Update checks can preview a curated `Highlights` section, and an
authenticated running-version endpoint lets the update surface show those
@ -1129,8 +1133,8 @@ compose image default, standalone installer fallback constant, and packaged
Helm metadata. A draft release workflow failure caused by stale image or chart
pins is a release-packet blocker until the defaults, tests, and evidence
record are refreshed from the new branch head.
For the active support prerelease `v6.1.0-rc.4` cut, the repo-root compose
default and `scripts/install-docker.sh` fallback must both pin `6.1.0-rc.4`
For the active support prerelease `v6.1.0-rc.5` cut, the repo-root compose
default and `scripts/install-docker.sh` fallback must both pin `6.1.0-rc.5`
until the next governed stable cut moves them forward. The stable promotion
guard remains in force and must reject leftover `-rc.` defaults when the
governed `VERSION` returns to a stable release.

View file

@ -0,0 +1,97 @@
# Pulse v6.1.0-rc.5 Release Notes
`v6.1.0-rc.5` is a release candidate for the next Pulse v6 minor line. It
follows stable `v6.0.5` and supersedes `v6.1.0-rc.4` with more accurate
infrastructure identity, a dedicated Agent Doctor workflow, broader disk-health
coverage, and reliability fixes from continued release-candidate testing.
## Highlights
- Infrastructure now distinguishes real Unified Agents from machines observed
through an integration, while still surfacing workload-only agents where
they are useful.
- Agent Doctor is now a dedicated routed page with status filters, copyable
diagnostic reports, and host-local cleanup handoffs for removed agents.
- Host identity prefers operator-supplied and physical interface addresses over
virtual bridges, reducing duplicate or misleading resource identities.
- Disk monitoring understands SAS transport and SCSI SMART attributes, and
Proxmox disk health uses one canonical vocabulary across runtime and UI.
- Metrics reads no longer queue behind unrelated writes, and retained audit
data is reclaimed incrementally after retention cleanup.
- Agent update controls, TrueNAS connection errors, vCenter membership, and
Patrol finding continuity are more actionable and consistent.
## Added
- `--report-ip` can set the reported host address during Unified Agent install
and becomes the leading host-identity signal.
- SAS devices and SCSI SMART attributes participate in disk-health collection.
- Stable release infrastructure can submit exact-SHA Windows agent artifacts
through the governed SignPath signing and verification path once the external
project is configured.
- Agent Doctor status filters and copyable reports make large fleet diagnostic
sets easier to triage and share.
- Additional branch-level proof covers connection grouping, setup
classification, agent update commands, workload metadata, Unraid merging,
retry handling, and monitoring helpers.
## Improved
- Physical interface addresses sort ahead of virtual bridge addresses when
composing host identity.
- ESXi hosts appear as members of their owning vCenter connection.
- Workload guest metadata follows the canonical metadata event instead of a
legacy event path.
- The infrastructure ledger keeps its manage flow synchronized and shows
actionable TrueNAS TLS failures.
- Removed-agent diagnostics retain the last-known platform so Agent Doctor can
provide the correct host-local uninstall command without granting remote
removal authority.
- Pro updates request their explicit update channel from the dual-channel
broker.
- ICMP failures caused by a missing `CAP_NET_RAW` grant explain the required
runtime permission.
## Fixed
- Integration-monitored machines no longer appear as fabricated agent rows or
false Agent Doctor targets.
- Agent Doctor no longer lives inside a constrained settings modal; direct
navigation and back/forward history preserve the diagnostic workflow.
- Manual agent update commands remain available until an update is actually
applying.
- Patrol assessments recover active findings when an identifier was mangled,
and action origins retain the proposal evidence that led to review.
- High-volume metric reads can proceed concurrently with writes.
- Audit retention uses incremental vacuuming so deleted history does not leave
the database permanently inflated.
## Security
- Patrol action origins preserve proposal evidence alongside the reviewed
action boundary.
- The release pipeline now contains the canonical SignPath submission,
signature verification, signer check, and evidence-recording path required
for stable Windows publication.
## Upgrade Notes
Use the normal v6 install or update flow for `v6.1.0-rc.5` only when you are
comfortable testing an RC. The rollback target is `v6.0.5`.
The exact rollback reinstall command is:
```bash
./scripts/install.sh --version v6.0.5
```
This server candidate has no mobile compatibility change and does not require
a companion build upload. No public mobile-store rollout is part of this RC.
Windows Unified Agent binaries retain checksum and detached-signature
verification, but they are not yet Authenticode-signed and Windows may show an
unknown-publisher warning. Public Windows Authenticode signing remains required
before stable promotion.
Paid Pulse Pro, Relay, and eligible legacy customers should continue to use the
private download page and private runtime image for paid runtime features.

View file

@ -0,0 +1,58 @@
# Pulse v6.1.0-rc.5
_This changelog describes the changes since `v6.1.0-rc.4`.
`v6.1.0-rc.5` remains a prerelease and rolls back to stable `v6.0.5`._
## Added
- Unified Agent `--report-ip` propagation from installer to host identity.
- SAS transport detection and SCSI SMART attribute parsing.
- Routed Agent Doctor page with status filters and copyable diagnostic reports.
- Canonical SignPath request, verification, signer validation, and evidence
plumbing for stable Windows release candidates.
- Branch-level proof for connection, monitoring, workload metadata, setup,
Unraid, retry, and agent-update helper paths.
## Changed
- Physical interface addresses lead virtual bridge addresses in host identity.
- Integration-observed machines are modeled separately from real agents, while
workload-only agents remain visible through their canonical projection.
- Removed-agent records retain their last-known platform for scoped host-local
cleanup handoff.
- ESXi hosts group under their owning vCenter connection.
- Workload guest metadata subscribes to the canonical metadata event.
- Pro updates request an explicit channel from the dual-channel broker.
- Metrics reads can proceed concurrently with writes.
- Audit retention uses incremental vacuum and bounded page reclamation.
## Fixed
- Manual agent update commands remain available unless an update is applying.
- Removed agents receive platform-correct local uninstall guidance without
implying remote uninstall authority.
- TrueNAS TLS failures are surfaced through the infrastructure manage flow.
- Proxmox disk health values normalize to the canonical presentation states.
- Patrol assessment lookup recovers active findings from mangled identifiers.
- Patrol action origins retain proposal evidence.
- ICMP probe failures explain a missing `CAP_NET_RAW` capability.
- Integration-monitored machines no longer create fabricated ledger agent rows
or misleading Agent Doctor entries.
## Security
- Reviewed Patrol actions retain their proposal evidence at the origin
boundary.
- Stable Windows publication has an exact-SHA SignPath signing and verification
path; prerelease Windows binaries continue under the explicit unsigned-RC
exception until that external project is configured.
## Release Metadata
- Version: `v6.1.0-rc.5`
- Previous candidate: `v6.1.0-rc.4`
- Rollback target: `v6.0.5`
- Rollback command: `./scripts/install.sh --version v6.0.5`
- Promotion path: exact-SHA single-build release candidate from `main`
- Mobile decision: `no-mobile-impact`; no companion build upload or public
store rollout is part of this candidate

View file

@ -6,7 +6,7 @@ set -euo pipefail
SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
DOCKER_IMAGE_REPO="${DOCKER_IMAGE_REPO:-rcourtman/pulse}"
CANONICAL_DEFAULT_PULSE_VERSION="6.1.0-rc.4"
CANONICAL_DEFAULT_PULSE_VERSION="6.1.0-rc.5"
resolve_default_pulse_version() {
if [ -n "${PULSE_IMAGE_VERSION:-}" ]; then

View file

@ -338,46 +338,49 @@ func TestCurrentSupportPrereleasePacketTracksInstallMetadata(t *testing.T) {
"`v"+version+"` is a release candidate",
"## Highlights",
"stable `v"+previous+"`",
"supersedes `v6.1.0-rc.3`",
"canonical Operational Trust workflow",
"Patrol attention workbench",
"protection and availability",
"reviewed lifecycle",
"independent verification",
"report-only Unified Agent observer destinations",
"without giving observers command",
"destination has its own identity, token, retry state, health metric",
"plaintext-HTTP policy",
"Mobile chat can propose typed work while keeping approval mandatory",
"Assistant panel can be resized",
"PBS datastores are deduplicated",
"Remember-me browser sessions survive",
"Observer acknowledgements cannot change",
"Pulse Mobile iOS candidate build 10 and Android candidate versionCode 8",
"9b78b108-2586-4b0f-91d3-afbed19b49b3",
"runtime version 1",
"supersedes `v6.1.0-rc.4`",
"distinguishes real Unified Agents from machines observed through an integration",
"Agent Doctor is now a dedicated routed page with status filters",
"copyable diagnostic reports",
"host-local cleanup handoffs for removed agents",
"operator-supplied and physical interface addresses",
"SAS transport and SCSI SMART attributes",
"Metrics reads no longer queue behind unrelated writes",
"retained audit data is reclaimed incrementally",
"`--report-ip` can set the reported host address",
"ESXi hosts appear as members of their owning vCenter connection",
"Workload guest metadata follows the canonical metadata event",
"Pro updates request their explicit update channel",
"Integration-monitored machines no longer appear as fabricated agent rows",
"Removed-agent diagnostics retain the last-known platform",
"correct host-local uninstall command",
"Manual agent update commands remain available",
"action origins retain the proposal evidence",
"no mobile compatibility change",
"No public mobile-store rollout",
"not yet Authenticode-signed",
"rollback target is `v"+previous+"`",
)
assertFileContainsAllNormalized(t, changelogPath,
"Version: `v"+version+"`",
"Rollback target: `v"+previous+"`",
"Previous candidate: `v6.1.0-rc.3`",
"Previous candidate: `v6.1.0-rc.4`",
"Promotion path: exact-SHA single-build release candidate from `main`",
"Canonical Operational Trust lifecycle evidence",
"Protection posture and availability facets",
"Patrol attention workbench",
"Governed Docker restart review",
"Report-only Unified Agent observer destinations",
"Mobile typed-action proposals behind mandatory approval",
"Alert detection, activation, notification, and resolution",
"Assistant width is user-adjustable",
"High-percentage thresholds remain valid",
"PBS datastore identities",
"Stale Docker host records",
"Every non-loopback plaintext observer destination requires explicit",
"Observer acknowledgements cannot replace",
"Mobile companion candidates: iOS build 10 and Android versionCode 8",
"candidate OTA channel at runtime version 1",
"Unified Agent `--report-ip` propagation",
"SAS transport detection and SCSI SMART attribute parsing",
"Routed Agent Doctor page with status filters and copyable diagnostic reports",
"Canonical SignPath request",
"Physical interface addresses lead virtual bridge addresses",
"Integration-observed machines are modeled separately from real agents",
"Removed-agent records retain their last-known platform",
"platform-correct local uninstall guidance",
"ESXi hosts group under their owning vCenter connection",
"Metrics reads can proceed concurrently with writes",
"Audit retention uses incremental vacuum",
"Patrol assessment lookup recovers active findings",
"Patrol action origins retain proposal evidence",
"Mobile decision: `no-mobile-impact`",
"no companion build upload or public store rollout",
)
assertFileContainsAll(t, repoFile("docs", "RELEASE_NOTES.md"),
"docs/releases/RELEASE_NOTES_v"+version+".md",
@ -410,7 +413,7 @@ func TestCurrentSupportPrereleasePacketTracksInstallMetadata(t *testing.T) {
"The active support prerelease `v"+version+"` cut sets the repo-root `VERSION`, repo-root `docker-compose.yml` image default, `scripts/install-docker.sh` fallback, and Helm chart release metadata to the same `"+version+"` release version.",
"This support prerelease keeps `rollback_version=v"+previous+"`, publishes a versioned public GitHub prerelease plus versioned Docker and Helm artifacts, and does not move stable/latest install pointers or stable semver aliases.",
"For the active support prerelease `v"+version+"` cut, the repo-root compose default and `scripts/install-docker.sh` fallback must both pin `"+version+"` until the next governed stable cut moves them forward.",
"The companion evidence for this cut is Pulse Mobile iOS build 10 and Android versionCode 8 on TestFlight and Google Play internal testing only, with candidate-channel runtime-version-1 update group `9b78b108-2586-4b0f-91d3-afbed19b49b3` built from mobile commit `fddb091e683e84902de6aac680b08a47862b738b` for both platforms. The release packet must not describe either candidate as a public store rollout.",
"The rc.5 server cut is classified `no-mobile-impact`; no companion build upload is part of this cut. The existing mobile candidate programme remains separate, and the release packet must not describe a public store rollout.",
)
}

View file

@ -128,7 +128,7 @@ func TestPreviousStableForPrereleaseVersionCrossesMinorBoundaries(t *testing.T)
want string
}{
{version: "6.0.5-rc.4", want: "6.0.4"},
{version: "6.1.0-rc.4", want: "6.0.5"},
{version: "6.1.0-rc.5", want: "6.0.5"},
}
for _, test := range tests {
@ -309,7 +309,7 @@ func TestInstallDockerProofTracksSupportPrereleaseContract(t *testing.T) {
"The active support prerelease `v"+version+"` cut sets the repo-root `VERSION`, repo-root `docker-compose.yml` image default, `scripts/install-docker.sh` fallback, and Helm chart release metadata to the same `"+version+"` release version.",
"This support prerelease keeps `rollback_version=v"+previous+"`, publishes a versioned public GitHub prerelease plus versioned Docker and Helm artifacts, and does not move stable/latest install pointers or stable semver aliases.",
"the expanded Pulse Intelligence action and verification lifecycle, the operator-facing Actions inbox, monitor-first product workflows, governed host and storage operations, native-agent update safety, Windows logged-readiness and recovery proof, OIDC callback recovery, and fail-closed security hardening behind RC validation",
"The companion evidence for this cut is Pulse Mobile iOS build 10 and Android versionCode 8 on TestFlight and Google Play internal testing only, with candidate-channel runtime-version-1 update group `9b78b108-2586-4b0f-91d3-afbed19b49b3` built from mobile commit `fddb091e683e84902de6aac680b08a47862b738b` for both platforms. The release packet must not describe either candidate as a public store rollout.",
"The rc.5 server cut is classified `no-mobile-impact`; no companion build upload is part of this cut. The existing mobile candidate programme remains separate, and the release packet must not describe a public store rollout.",
"For the active support prerelease `v"+version+"` cut, the repo-root compose default and `scripts/install-docker.sh` fallback must both pin `"+version+"` until the next governed stable cut moves them forward.",
)
}