Vantage/vantage-app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: implementation plan for scheduled patching; align spec audit names, alert payload and run source

Browse Source
This commit is contained in:
mrhid6
2026-09-14 15:32:47 +00:00
parent 48116bf737
commit e63e773cda
2 changed files with 5925 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/superpowers/plans/2026-09-14-scheduled-patching.md
+5912
View File
File diff suppressed because it is too large Load Diff
docs/superpowers/specs/2026-09-14-scheduled-patching-design.md
+13 -7
View File
@@ -132,7 +132,9 @@ type PatchRun struct {
RunID string `bson:"run_id" json:"run_id"`
PolicyID string `bson:"policy_id,omitempty" json:"policy_id,omitempty"` // empty for manual
PolicyName string `bson:"policy_name,omitempty" json:"policy_name,omitempty"`
TriggeredBy string `bson:"triggered_by" json:"triggered_by"` // "schedule" | actor | "vulnerability:<cve>"
TriggeredBy string `bson:"triggered_by" json:"triggered_by"` // "schedule" | actor
Source string `bson:"source" json:"source"` // schedule | server | vulnerabilities | mcp | run_now
CancelledAt *time.Time `bson:"cancelled_at,omitempty" json:"cancelled_at,omitempty"`
Scope string `bson:"scope" json:"scope"` // snapshot
Reboot string `bson:"reboot" json:"reboot"` // snapshot
MaxConcurrent int `bson:"max_concurrent" json:"max_concurrent"` // snapshot
@@ -375,7 +377,8 @@ qualifies.
`POST /servers/:id/apply-updates` and the vulnerability page's Apply updates
create a one-server `patch_run` (`scope: all`, `reboot: never`, no window,
`TriggeredBy` the actor or `vulnerability:<cve>`) and dispatch immediately in
`TriggeredBy` the actor, `Source` one of `server`, `vulnerabilities` or `mcp`)
and dispatch immediately in
the handler rather than waiting for the next tick. A dispatch failure still
answers 503, and the run is recorded as `failed` so the attempt is not lost.
Timeouts and finalisation go through the same tick.
@@ -391,10 +394,11 @@ flight, in which case immediately.
### Notifications
When a run finalises as `partial` or `failed`, one summary goes to each channel
in `NotifyChannelIDs` through the existing `notify` dispatch: `[Vantage] Patch
policy "Sunday prod" partial: 38 succeeded, 2 failed, 1 missed offline`. The
webhook payload carries the counts as fields and the run ID. A clean run sends
nothing.
in `NotifyChannelIDs` through the existing `notify` dispatch, as a new event
type `patch`: `[Vantage] Patch policy "Sunday prod" partial: 38 succeeded,
2 failed, 1 missed offline (run 3f2a...)`. The webhook payload is the existing
event shape with that summary as its message; no new payload fields. A clean
run sends nothing.
## REST API
@@ -430,7 +434,9 @@ or run, `409 window_in_use`, `503` agent offline on apply-updates.
## Audit
`maintenance_window.created|updated|deleted`, `patch_policy.created|updated|deleted|disabled`,
Every event uses the `patch.` prefix so the audit page groups them under one
category: `patch.window_created|window_updated|window_deleted`,
`patch.policy_created|policy_updated|policy_deleted|policy_disabled`,
`patch.run_started`, `patch.run_finished`, `patch.skipped`, `patch.cancelled`,
`patch.reboot` (one per server Vantage reboots, naming the policy),
and the existing `updates.applied` for manual runs, now carrying the run ID.