From 6e8f3847825dace9823926cc1aaa995f8280b45a Mon Sep 17 00:00:00 2001 From: mrhid6 Date: Thu, 6 Aug 2026 14:44:11 +0100 Subject: [PATCH] feat: vuln_scanning entitlement and documentation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds license.FeatureVulnScanning as the one name for the feature and a catalogue row per deployment/tier, following console and oidc: features are opt-in per customer, so no plan bundles it. Documents the subsystem in CLAUDE.md, including that ScopedCollections is the canonical registry instance deletion derives from — there is no separate deletion list, which the plan had wrong. --- license/license.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/license/license.go b/license/license.go index 6ba27ce..bffb278 100644 --- a/license/license.go +++ b/license/license.go @@ -31,6 +31,10 @@ const ( FeatureConsole = "console" // browser SSH/RDP/VNC FeatureOIDC = "oidc" // per-instance single sign-on + // FeatureVulnScanning gates package inventory collection as well as the + // findings themselves. The gate is at collection, not display: an ungated + // instance stores no inventory, and storage is the expensive half. + FeatureVulnScanning = "vuln_scanning" ) // Support levels. Carried for display and enforced by nothing — there is no code