refactor: CU-17tkuw5tebe retire Fleet osquery schema endpoint

.github/workflows/changes.yaml

@@ -37,7 +37,7 @@ jobs:
             {
               "id": "server",
               "name": "fleet",
-              "paths": ["./server/**", "./cmd/**", "./pkg/**", "./schema/**", "./ee/**", "./tools/**", "./Dockerfile", "./.goreleaser.yml"]
+              "paths": ["./server/**", "./cmd/**", "./pkg/**", "./ee/**", "./tools/**", "./Dockerfile", "./.goreleaser.yml"]
             }
           ]'
 

.github/workflows/test.yml

@@ -166,8 +166,8 @@ jobs:
         with:
           install-only: true
 
-      - name: Test OpenFrame osquery schema search and refresh
-        run: go test -race ./schema ./server/config ./server/service ./cmd/fleet -run 'Test(SearchOsquery|RefreshOsquery|RankOsquery|RunOsquery|OpenframeConfig|OsquerySchema)' -count=1
+      - name: Test OpenFrame configuration and schema endpoint retirement
+        run: go test -race ./server/config ./server/service ./cmd/fleet -run 'Test(OpenframeConfig|OpenframeOsquerySchemaRoute)' -count=1
 
       - name: Build with GoReleaser
         env:

charts/fleet/values.yaml

@@ -448,11 +448,6 @@ environments:
   # you store this private key in a secret and use envsFrom to reference the secret below.
   # For more information, check out the docs: https://fleetdm.com/docs/configuration/fleet-server-configuration#server-private-key
   FLEET_SERVER_PRIVATE_KEY: ""
-  # >>> OPENFRAME(osquery-schema-search): keep the query-generation schema current in OpenFrame deployments
-  FLEET_OSQUERY_SCHEMA_REFRESH_ENABLED: "false"
-  FLEET_OSQUERY_SCHEMA_REFRESH_INTERVAL: "24h"
-  FLEET_OSQUERY_SCHEMA_REFRESH_URL: "https://raw.githubusercontent.com/flamingo-stack/fleetmdm/main/schema/osquery_fleet_schema.json"
-  # <<< OPENFRAME(osquery-schema-search)
 
 ## Section: Environment Variables from Secrets/CMs
 # envsFrom:

cmd/fleet/serve.go

@@ -430,9 +430,6 @@ func runServeCmd(cmd *cobra.Command, configManager configpkg.Manager, debug, dev
 	baseCtx := licensectx.NewContext(context.Background(), license)
 	ctx, cancelFunc := context.WithCancel(baseCtx)
 	defer cancelFunc()
-	// >>> OPENFRAME(osquery-schema-search): start per-replica schema auto-refresh — openframe/docs/api-osquery-schema-search.md
-	startOsquerySchemaRefresh(ctx, config.Osquery, logger)
-	// <<< OPENFRAME(osquery-schema-search)
 
 	// Channel used to trigger graceful shutdown on fatal DB errors (e.g. Aurora failover).
 	dbFatalCh := make(chan error, 1)

openframe/docs/README.md

@@ -41,7 +41,6 @@ The agent has its own switch, `--openframe-mode` / `ORBIT_OPENFRAME_MODE`.
 | [api-host-assignments.md](api-host-assignments.md) | REST API for the above (add/remove/replace/list hosts). |
 | [managed-policies.md](managed-policies.md) | `policies.openframe_managed` — platform-owned policies omitted from the policy list/count endpoints (and from GitOps deletion) while still running on hosts and reporting results. |
 | [managed-queries.md](managed-queries.md) | `queries.openframe_managed` — the queries twin: platform-owned queries omitted from the query listing and its count. |
-| [api-osquery-schema-search.md](api-osquery-schema-search.md) | Authenticated read-only search over Fleet's vendored canonical osquery schema for AI query generation. |
 | [api-expose-osquery-host-id.md](api-expose-osquery-host-id.md) | Exposes `osquery_host_id` in the host JSON so the OpenFrame control plane can match agents. |
 | [query-results-ttl-cleanup.md](query-results-ttl-cleanup.md) | Time-based cleanup of `query_results` (keeps the Debezium CDC pipeline alive without unbounded growth). Gated by OpenFrame mode **and** a positive TTL. |
 | [redis-key-prefix.md](redis-key-prefix.md) | Per-tenant Redis key/channel prefix (`FLEET_REDIS_KEY_PREFIX`) so tenants can share one Redis. |

openframe/docs/fork-file-manifest.md

@@ -108,7 +108,6 @@ never had was relocated into this directory):
 README.md                       agent-openframe-mode.md
 architecture-host-assignments.md  api-host-assignments.md
 api-expose-osquery-host-id.md   query-results-ttl-cleanup.md
-api-osquery-schema-search.md
 redis-key-prefix.md             migrations.md
 helm-chart.md                   ci-cd-release-pipeline.md
 node-key-management.md          local-setup.md
@@ -131,7 +130,6 @@ and the heaviest standing rebase cost.
 | Area | Files |
 |------|-------|
 | Host assignments | `server/fleet/{policies,queries,hosts,datastore,service}.go`, `server/datastore/mysql/{policies,queries,hosts}.go`, `server/service/{global_policies,queries,handler,labels_util}.go`, `server/mock/{datastore,datastore_mock}.go`, `server/mock/service/service_mock.go`, `server/datastore/mysql/mysql.go`, `cmd/fleet/prepare.go` |
-| osquery schema search and refresh | `schema/osquery_{search,refresh}.go`, `cmd/fleet/osquery_schema_refresh_openframe.go`, `cmd/fleet/serve.go`, `server/config/config.go`, `server/service/{osquery_schema_openframe,handler}.go`, `server/api_endpoints/api_endpoints.yml`, `charts/fleet/values.yaml` |
 | Managed queries / policies | flag: `server/fleet/{queries,policies}.go`, `server/service/{queries,global_policies,team_policies}.go`, `server/datastore/mysql/{queries,policies}.go`, `schema.sql`; queries listing opt-in (`include_openframe_managed`): `server/fleet/{app,api_queries,service}.go`, `server/service/{global_schedule,team_schedule,queries_test}.go`, `server/mock/service/service_mock.go`; tests: `server/datastore/mysql/{queries,policies}_openframe_managed_test.go` — see [managed-queries.md](managed-queries.md), [managed-policies.md](managed-policies.md) |
 | osquery host id | `server/fleet/hosts.go` |
 | Query-results TTL cleanup | `server/config/config.go`, `server/fleet/{cron_schedules,datastore}.go`, `server/datastore/mysql/query_results.go`, `cmd/fleet/{cron,serve}.go` |
@@ -188,7 +186,7 @@ Computed from the fork working tree vs the upstream baseline
 `server/datastore/mysql/migrations/data/` (the ~473 idempotent upstream migrations —
 see [migrations.md](migrations.md)). Paths are repo-root-relative.
 
-### Added (49)
+### Added (40)
 
 ```
 .github/steps/sign-macos-package/action.yml
@@ -202,13 +200,10 @@ charts/fleet/templates/configmap.yaml
 charts/fleet/templates/secret.yaml
 charts/fleet/templates/vulnprocessing/bind-job.yaml
 charts/fleet/templates/vulnprocessing/pvc.yaml
-cmd/fleet/osquery_schema_refresh_openframe.go
-cmd/fleet/osquery_schema_refresh_openframe_test.go
 openframe/docs/README.md
 openframe/docs/agent-openframe-mode.md
 openframe/docs/api-expose-osquery-host-id.md
 openframe/docs/api-host-assignments.md
-openframe/docs/api-osquery-schema-search.md
 openframe/docs/architecture-host-assignments.md
 openframe/docs/ci-cd-release-pipeline.md
 openframe/docs/fork-file-manifest.md
@@ -230,19 +225,13 @@ server/datastore/mysql/migrations_openframe_test.go
 server/datastore/redis/keyprefix.go
 server/datastore/redis/keyprefix_test.go
 server/fleet/openframe.go
-schema/osquery_search.go
-schema/osquery_search_test.go
-schema/osquery_refresh.go
-schema/osquery_refresh_test.go
-server/service/osquery_schema_openframe.go
-server/service/osquery_schema_openframe_test.go
 server/service/openframe/openframe-encryption-service.go
 server/service/openframe/openframe-token-extractor.go
 server/service/openframe/openframe_authorization_manager.go
 server/service/openframe/openframe_token_refresher.go
 ```
 
-### Modified (52)
+### Modified (53)
 
 ```
 .github/pull_request_template.md
@@ -291,6 +280,7 @@ server/service/base_client.go
 server/service/global_policies.go
 server/service/global_schedule.go
 server/service/handler.go
+server/service/handler_test.go
 server/service/labels_util.go
 server/service/orbit_client.go
 server/service/osquery_utils/queries.go

openframe/scripts/verify.sh

@@ -46,7 +46,7 @@ rm -f vet.err
 # 3. Marker presence: if a merge silently dropped fork code, its OPENFRAME markers
 #    vanish too. A slug dropping to zero is a red flag worth a human look.
 step "OPENFRAME marker presence (dropped-fork-code detector)"
-for slug in host-assignments managed-policies managed-queries redis-key-prefix redis-seed-nodes query-results-ttl osquery-host-id osquery-schema-search agent-openframe-mode agent-json-content-type agent-skip-setup-experience migration-race; do
+for slug in host-assignments managed-policies managed-queries redis-key-prefix redis-seed-nodes query-results-ttl osquery-host-id agent-openframe-mode agent-json-content-type agent-skip-setup-experience migration-race; do
   n=$(grep -rIl "OPENFRAME($slug" --include='*.go' --include='*.yaml' --include='*.tpl' . 2>/dev/null | wc -l | tr -d ' ')
   if [ "$n" -gt 0 ]; then ok "$slug — present in $n file(s)"; else bad "$slug — NO markers found (fork code may have been dropped in the merge)"; fi
 done