osquery_perf: Windows MDM push

[getvictor]

Related issue: Resolves #46567

Note: Hide whitespace for better review

Testing

• QA'd all new/changed functionality manually

Summary by CodeRabbit

• New Features
  • Server-triggered on-demand Windows MDM check-ins for immediate device syncs
  • Dynamic adjustment of the device polling interval based on server directives
  • Enhanced metrics: tracking and reporting of on-demand MDM synchronization sessions

[getvictor]

@coderabbitai full review

[getvictor]

/agentic_review

[coderabbitai]

✅ Action performed

Full review finished.

[qodo-free-for-open-source-projects]

Code Review by Qodo

Looking for bugs?

Check back in a few minutes. An AI review agent is analyzing this pull request.

[Copilot]

Pull request overview

Updates osquery-perf’s Windows MDM simulation to exercise the new “server requests on-demand sync” wake path (instead of relying only on a fixed poll interval), and adds a metric to track how many Windows MDM sessions were triggered by that wake signal.

Changes:

• Add mdmOnDemandSyncs stats counter and include it in periodic stats logging.
• Add a buffered wake channel for Windows MDM agents, advertise CapabilityWindowsMDMSync, and trigger on-demand OMA-DM sessions when WindowsMDMSyncRequest is set in orbit config.
• Refactor the Windows MDM loop to support variable poll intervals (honoring DMClient poll Replace commands) and wake-triggered sessions.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
cmd/osquery-perf/osquery_perf/stats.go	Adds an on-demand sync counter and logs it alongside existing MDM session stats.
cmd/osquery-perf/agent.go	Implements Windows MDM wake signaling, capability advertisement, and a refactored Windows MDM loop that supports on-demand sessions and poll schedule updates.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

❌ Patch coverage is 46.88645% with 145 lines in your changes missing coverage. Please review.
✅ Project coverage is 66.90%. Comparing base (9f5d31f) to head (c938ae9).
⚠️ Report is 30 commits behind head on main.

Files with missing lines	Patch %	Lines
cmd/osquery-perf/agent.go	0.00%	79 Missing ⚠️
server/datastore/mysql/microsoft_mdm.go	62.50%	18 Missing and 15 partials ⚠️
server/service/microsoft_mdm.go	72.41%	4 Missing and 4 partials ⚠️
cmd/osquery-perf/osquery_perf/stats.go	0.00%	6 Missing ⚠️
...0_AddPollScheduleRelaxedToMDMWindowsEnrollments.go	72.72%	4 Missing and 2 partials ⚠️
orbit/pkg/update/notifications.go	82.60%	3 Missing and 1 partial ⚠️
orbit/cmd/orbit/orbit.go	0.00%	2 Missing ⚠️
orbit/pkg/update/execwinapi_stub.go	0.00%	2 Missing ⚠️
server/fleet/capabilities.go	0.00%	1 Missing and 1 partial ⚠️
server/service/orbit.go	86.66%	1 Missing and 1 partial ⚠️
... and 1 more

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #46777      +/-   ##
==========================================
- Coverage   66.91%   66.90%   -0.01%     
==========================================
  Files        2833     2834       +1     
  Lines      224964   225171     +207     
  Branches    11620    11620              
==========================================
+ Hits       150526   150647     +121     
- Misses      60781    60845      +64     
- Partials    13657    13679      +22     

Flag	Coverage Δ
backend	68.61% <46.88%> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: af550ec0-616f-4dc4-9a45-e7139d6c1d6e

📥 Commits

Reviewing files that changed from the base of the PR and between 5dd50ba and c938ae9.

📒 Files selected for processing (1)

• cmd/osquery-perf/agent.go

🚧 Files skipped from review as they are similar to previous changes (1)

• cmd/osquery-perf/agent.go

---

Walkthrough

This change adds client-side on-demand Windows MDM check-in support to the osquery-perf simulator. The agent now advertises fleet.CapabilityWindowsMDMSync capability to the server and implements a buffered wake channel that triggers immediate OMA-DM sessions when the server sends WindowsMDMSyncRequest. The MDM polling loop was refactored to select between periodic tickers and on-demand wake signals, with support for dynamic poll interval adjustments from server-sent Replace commands. A new doWindowsMDMCheckIn function centralizes management session logic: SCEP certificate install handling, command ACKing, and SyncML response dispatch. Stats tracking was extended with mdmOnDemandSyncs counter and logging support.

Possibly related issues

• #46567: Windows MDM push (device wake) via fleetd – This PR implements the client-side on-demand MDM wake capability described in the issue: the agent advertises fleet.CapabilityWindowsMDMSync, responds to server-initiated WindowsMDMSyncRequest signals by triggering immediate OMA-DM sessions, and tracks on-demand sync activity, directly fulfilling the "Client-side (orbit/fleetd) behavior" requirements for on-demand MDM wake support.

🚥 Pre-merge checks | ✅ 2 | ❌ 3

❌ Failed checks (2 warnings, 1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The PR description includes the related issue (#46567) and testing notes, but is missing several required checklist items like changes file, security validation, and testing sections.	Complete the PR description checklist: add changes file entry, confirm security/SQL injection prevention, add details about automated tests added, and fill out database migration section if applicable.
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Linked Issues check	❓ Inconclusive	The changes partially implement #46567 requirements by adding Windows MDM on-demand wake capability and stats tracking in osquery-perf, but the full implementation (server notification field, capability headers, DB columns, throttling, and compatibility testing) appears incomplete.	Clarify whether this PR implements only the osquery-perf agent side or the full end-to-end solution; verify that corresponding server-side changes for OrbitConfigNotifications, capability handling, and DB columns are in place or planned separately.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'osquery_perf: Windows MDM push' accurately reflects the main change - adding Windows MDM push/on-demand sync capability to the osquery-perf agent.
Out of Scope Changes check	✅ Passed	The changes are narrowly focused on osquery-perf agent MDM wake functionality and stats tracking, directly aligned with implementing on-demand OMA-DM session support required by #46567.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 43773-osquery-perf

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[qodo-free-for-open-source-projects]

CI Feedback 🧐

A test triggered by this PR failed. Here is an AI-generated analysis of the failure:

Action: aggregate-result

Failed stage: Check for failures [❌]

Failed test name: vuln-mysql8.0.44, main-mysql8.0.44

Failure summary: The action failed in the failed_tests aggregation step because one or more test job status artifacts contained fail. - ./vuln-mysql8.0.44-status/status had status content fail → marked vuln-mysql8.0.44 as failed. - ./main-mysql8.0.44-status/status had status content fail → marked main-mysql8.0.44 as failed. The script then exited with code 1 at the check if [[ -n "$failed_tests" ]]; then ... exit 1, causing the workflow to fail.

Relevant error logs: 1: ##[group]Runner Image Provisioner 2: Hosted Compute Agent ... 119: Artifact download completed successfully. 120: Extracting artifact entry: /home/runner/work/fleet/fleet/vuln-mysql8.0.44-status/status 121: Artifact download completed successfully. 122: Extracting artifact entry: /home/runner/work/fleet/fleet/integration-core-mysql8.0.44-status/status 123: Artifact download completed successfully. 124: Extracting artifact entry: /home/runner/work/fleet/fleet/integration-mdm-mysql8.0.44-status/status 125: Artifact download completed successfully. 126: Extracting artifact entry: /home/runner/work/fleet/fleet/scripts-status/status 127: Artifact download completed successfully. 128: Extracting artifact entry: /home/runner/work/fleet/fleet/mysql-mysql8.0.44-status/status 129: Artifact download completed successfully. 130: Extracting artifact entry: /home/runner/work/fleet/fleet/main-mysql8.0.44-status/status 131: Artifact download completed successfully. 132: Total of 10 artifact(s) downloaded 133: Download artifact has finished successfully 134: ##[group]Run failed_tests="" 135: �[36;1mfailed_tests=""�[0m 136: �[36;1mstatus_count=0�[0m 137: �[36;1m# Find all status files (they are in directories like 'fleetctl-mysql8.0.44-status/status')�[0m 138: �[36;1mfor status_file in $(find ./ -type f -name 'status'); do�[0m 139: �[36;1m status_count=$((status_count + 1))�[0m 140: �[36;1m # Extract test name from parent directory (e.g., 'fleetctl-mysql8.0.44-status')�[0m 141: �[36;1m test_dir=$(basename $(dirname "$status_file"))�[0m 142: �[36;1m # Remove '-status' suffix to get the test name�[0m 143: �[36;1m test_name="${test_dir%-status}"�[0m 144: �[36;1m status_content=$(cat "$status_file")�[0m 145: �[36;1m echo "Processing: $status_file (Test: $test_name) with status content: $status_content"�[0m 146: �[36;1m if grep -q "fail" "$status_file"; then�[0m 147: �[36;1m echo " ❌ Test failed: $test_name"�[0m 148: �[36;1m failed_tests="${failed_tests}${test_name}, "�[0m 149: �[36;1m else�[0m 150: �[36;1m echo " ✅ Test passed: $test_name"�[0m 151: �[36;1m fi�[0m 152: �[36;1mdone�[0m 153: �[36;1mif [[ $status_count -eq 0 ]]; then�[0m 154: �[36;1m echo "❌ ERROR: No status files found! This indicates a workflow issue."�[0m 155: �[36;1m exit 1�[0m 156: �[36;1mfi�[0m 157: �[36;1mif [[ -n "$failed_tests" ]]; then�[0m 158: �[36;1m echo "❌ One or more test jobs failed: ${failed_tests%, }"�[0m 159: �[36;1m exit 1�[0m 160: �[36;1mfi�[0m 161: �[36;1mecho "✅ All test jobs succeeded."�[0m 162: shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0} 163: ##[endgroup] 164: Processing: ./integration-core-mysql8.0.44-status/status (Test: integration-core-mysql8.0.44) with status content: success 165: ✅ Test passed: integration-core-mysql8.0.44 166: Processing: ./vuln-mysql8.0.44-status/status (Test: vuln-mysql8.0.44) with status content: fail 167: ❌ Test failed: vuln-mysql8.0.44 168: Processing: ./service-mysql8.0.44-status/status (Test: service-mysql8.0.44) with status content: success 169: ✅ Test passed: service-mysql8.0.44 170: Processing: ./main-mysql8.0.44-status/status (Test: main-mysql8.0.44) with status content: fail 171: ❌ Test failed: main-mysql8.0.44 172: Processing: ./fleetctl-mysql8.0.44-status/status (Test: fleetctl-mysql8.0.44) with status content: success 173: ✅ Test passed: fleetctl-mysql8.0.44 174: Processing: ./integration-enterprise-mysql8.0.44-status/status (Test: integration-enterprise-mysql8.0.44) with status content: success 175: ✅ Test passed: integration-enterprise-mysql8.0.44 176: Processing: ./fast-status/status (Test: fast) with status content: success 177: ✅ Test passed: fast 178: Processing: ./mysql-mysql8.0.44-status/status (Test: mysql-mysql8.0.44) with status content: success 179: ✅ Test passed: mysql-mysql8.0.44 180: Processing: ./integration-mdm-mysql8.0.44-status/status (Test: integration-mdm-mysql8.0.44) with status content: success 181: ✅ Test passed: integration-mdm-mysql8.0.44 182: Processing: ./scripts-status/status (Test: scripts) with status content: success 183: ✅ Test passed: scripts 184: ❌ One or more test jobs failed: vuln-mysql8.0.44, main-mysql8.0.44 185: ##[error]Process completed with exit code 1. 186: Post job cleanup.

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}