Migration 020 created the security_settings table with updated_at /
updated_by but no created_at / created_by columns. Query code
(database/queries/security_settings.go) SELECTs and INSERTs both
create-side fields, causing "failed to initialize default security
settings" at server startup — the dashboard's security panel then
shows hardcoded defaults instead of DB-backed values.
Adds both columns with NOT NULL + DEFAULT NOW() on created_at and a
nullable FK to users on created_by, matching the updated_by shape.
No backfill scaffolding (no live clients per release stance).
Closes AUDIT_TASKS.md §4.
Single-approve at /updates/:id/approve has always run the OSV.dev
ecosystem check for npm/PyPI packages, but the bulk endpoint
/updates/approve called BulkApproveUpdates directly — a single DB
write with no vulnerability lookup. So selecting N items in the UI
silently bypassed a check the README advertises.
ApproveUpdates now mirrors the single-approve loop: GetUpdateByID,
NeedsSupplyChainCheck, CheckOSVVulnerabilities, then
ApproveUpdateWithVulns when the OSV query returns CVEs (preserving
supply_chain_vulns / supply_chain_checked_at in metadata) or plain
ApproveUpdate when clean. Per-package warnings are aggregated and
returned to the caller. Fail-open semantics from the single-approve
path carry through — OSV unreachable does not block approval.
Also removed server/internal/api/handlers/update_handler.go.
UnifiedUpdateHandler was a parallel implementation of every
UpdateHandler method but NewUnifiedUpdateHandler was never called
from main.go or anywhere else. The file was confusing on grep and
masked which approve path was actually wired.
The legacy "updates" virtual subsystem was deprecated (scheduler.go:159
skips it), but five paths kept re-creating the row in agent_subsystems:
- agent migration detection flagged missing "updates" subsystem as a
missing security feature, prompting the executor to re-add it to the
local config on every startup migration
- server install-config template, scanner-timeout list, and intervals
map all kept "updates" alive in the config artifact sent to agents
Removed at all five sites. Scheduler skip logic, per-scanner mapping
helper (subsystems.go:236), and update-report data path remain — they
are not subsystem-row creators.
Historical migration 024_disable_updates_subsystem left intact.
Registration retries hit the (agent_id, subsystem) unique constraint,
which errored out the INSERT and poisoned the entire transaction. The
handler treated this as non-fatal, but PostgreSQL doesn't allow any
further statements in an aborted tx.
Adds ON CONFLICT DO NOTHING + treats sql.ErrNoRows as success.
Migration 033 adds the 'received' status to agent_commands so the server can
distinguish "agent confirmed receipt" from "sent but may be lost in flight."
Stuck-command re-issuance now excludes received commands — the TimeoutService
handles the longer timeout for those (default 30m) vs the per-poll re-issuer
(sent/pending at 5m).
The agent side: disk-persists executed command IDs to survive restart (closes
the in-memory-only dedup gap), reports received_command_ids on each check-in so
the server transitions sent→received before issuing new work, and authenticates
binary downloads with JWT+X-Machine-ID (was unauthenticated http.Get — would
401 in production).
TimeoutService extended with reconcileAgentUpdates: clears is_updating when
current_version matches updating_to_version (success), or after a 15m threshold
(timeout, with system_event) so the dashboard never shows "updating" forever.
isVersionUpgrade replaced with utils.IsNewerVersion (no panic on 2-part
versions, no false-reject on 4-part).
MarkCommand* failures elevated from [WARNING] to [ERROR] + should_retry
response hint so agents know to re-deliver results (silent drops were ETHOS #1
violations).
Fixes: build broken on public since eac8a012 (command.go accidentally emptied).
