refactor: CU-17tkuw5tebe retire Fleet osquery schema endpoint

[yevhenii-flamingo]

Ticket: https://app.clickup.com/t/9013925967/17tkuw5tebe
Change-Set: feat-remove-osquery-schema-refresh
Depends-On: https://github.com/flamingo-stack/openframe-saas-tenant/pull/3650

Summary

• Remove the custom Fleet osquery schema search route, implementation and fork-specific schema search catalog logic.
• Remove startup/periodic remote schema refresh and its command/config/chart settings.
• Preserve the upstream bundled schema used by other Fleet code and preserve device, query/report and policy routes.
• Add a route-retirement regression and update fork documentation and CI coverage.

Compatibility

• GET /api/{v}/fleet/osquery/schema/search is intentionally removed. Tenant schema-search consumers must migrate to osquery release assets before this Fleet deployment.
• Removed refresh CLI options are no longer supported. No changes to Fleet device registration, SQL execution, query reports, tenant isolation, persisted data, events or frontend code.
• The separate Fleet MCP binary and the upstream schema generators/catalog are not removed.

Release risks

• Rollout order: verify, merge and release osquery #104 with schema assets; deploy and E2E-test tenant Update product handbook fleetdm/fleet#3650 in each target environment; only then deploy this Fleet retirement and shared gateway cleanup Learn-how-to-use-Fleet.md - fixed line-break on enroll device command fleetdm/fleet#2393.
• No database migration or library release is required; a new Fleet server/chart deployment delivers the endpoint removal.
• Exact pushed commit passed release-tag server build, vet and affected config/API/routes/key-prefix tests (62 top-level tests, 808 pass events; four existing self-skips).
• Full cmd/fleet suite still fails TestInitLicense/dev_license because the built-in development license expired on 2026-06-30. The same failure was independently reproduced on current main.
• make openframe-verify still reports 18 pre-existing unmarked lines in five unchanged files; current main reports the same findings. The user explicitly authorized push based on the successful affected suite and release build with both baseline failures disclosed.
• Related PRs: https://github.com/flamingo-stack/openframe-saas-tenant/pull/3650 and https://github.com/flamingo-stack/openframe-saas-shared/pull/2393

Change set flamingo-stack/osquery#104: these pull requests are one change, reviewed together.

• flamingo-stack/osquery#104: feat(codegen): CU-17tkuw5tebe publish release-bound osquery schemas · landed
• flamingo-stack/fleetmdm#221 (this pull request): refactor: CU-17tkuw5tebe retire Fleet osquery schema endpoint · open
• …and 2 pull requests not visible

Linked work

• CU-17tkuw5tebe Validate Mingo SQL Against the Target Device Platform and osquery Version · working

Linked by the Depends-On / Change-Set lines in these descriptions; this block is maintained by the hub.

[github-actions]

🦩 Flamingo Code Review

No findings on the current head.

Mode: advisory

---

Need another pass? Commits pushed after this review are not reviewed automatically.

• Review the new commits — the commits added since this review
• Review the whole diff again — ignoring what was already reviewed

Prefer typing? Comment @flamingo-review, or @flamingo-review full. To review every push on this pull request, add the flamingo-review-always label.

React 👍/👎 on inline comments to teach the reviewer.

Started 2026-10-02 14:14 UTC · updated 2026-10-02 14:16 UTC · workflow run