Surface SCEP failures openspec

[getvictor]

Related issue: Resolves #45550

Checklist for submitter

If some of the following don't apply, delete the relevant line.

• Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
  See Changes files for more information.

• Input data is properly validated, SELECT * is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters.

• Timeouts are implemented and retries are limited to avoid infinite loops

• If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes

Testing

• Added/updated automated tests

• Where appropriate, automated tests simulate multiple hosts and test for host isolation (updates to one hosts's records do not affect another)

• QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

• Confirmed that the fix is not expected to adversely impact load test results
• Alerted the release DRI if additional load testing is needed

Database migrations

• Checked schema for all modified table for columns that will auto-update timestamps during migration.
• Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects.
• Ensured the correct collation is explicitly set for character columns (COLLATE utf8mb4_unicode_ci).

New Fleet configuration settings

• Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for GitOps-enabled settings:

• Verified that the setting is exported via fleetctl generate-gitops
• Verified the setting is documented in a separate PR to the GitOps documentation
• Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional)
• Verified that any relevant UI is disabled when GitOps mode is enabled

fleetd/orbit/Fleet Desktop

• Verified compatibility with the latest released version of Fleet (see Must rule)
• If the change applies to only one platform, confirmed that runtime.GOOS is used as needed to isolate changes
• Verified that fleetd runs on macOS, Linux and Windows
• Verified auto-update works from the released version of component to the new version (see tools/tuf/test)

Summary by CodeRabbit

• Chores
  • Updated project metadata to mark the change set as spec-driven and added a creation date.

[getvictor]

@coderabbitai full review

[getvictor]

/agentic_review

[coderabbitai]

✅ Action performed

Full review finished.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 608b8b00-6951-4e3f-9525-8acce177777f

📥 Commits

Reviewing files that changed from the base of the PR and between 3aff550 and 49e3e69.

⛔ Files ignored due to path filters (4)

• openspec/changes/windows-scep-proxy-verification/design.md is excluded by !**/*.md
• openspec/changes/windows-scep-proxy-verification/proposal.md is excluded by !**/*.md
• openspec/changes/windows-scep-proxy-verification/specs/windows-scep-cert-verification/spec.md is excluded by !**/*.md
• openspec/changes/windows-scep-proxy-verification/tasks.md is excluded by !**/*.md

📒 Files selected for processing (1)

• openspec/changes/windows-scep-proxy-verification/.openspec.yaml

---

Walkthrough

A new metadata file, .openspec.yaml, is added under the openspec/changes/windows-scep-proxy-verification/ directory. It specifies a schema field set to spec-driven and a created date field set to 2026-07-07. No other content or code changes are included.

Changes

File	Summary
openspec/changes/windows-scep-proxy-verification/.openspec.yaml	New file adding schema: spec-driven and created: 2026-07-07 metadata fields.

Sequence Diagram(s)

Not applicable — this change adds static metadata only, with no observable runtime flow.

Related issues: #45550 (Surface SCEP failures that are proxied by Fleet on Windows)

Suggested labels: documentation, low-risk

Suggested reviewers: None identified from the provided information

🐰 A tiny yaml, spec-driven and new,
Marks the start of what's soon to accrue,
A date stamped fresh, July the seventh bright,
Windows SCEP proxies come into sight.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Linked Issues check	❓ Inconclusive	The substantive spec files are excluded by the markdown filter, so the #45550 requirements can't be verified from the visible changes.	Include the reviewed spec/design files or provide a summary of the implementation so the failure-handling requirements can be checked.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and points to the SCEP failure surfacing change, matching the PR's stated focus.
Description check	✅ Passed	The description follows the required template and includes the related issue plus checklist and testing sections.
Out of Scope Changes check	✅ Passed	No unrelated code changes are visible; the only reviewed change is .openspec.yaml metadata for the SCEP spec change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch victor/45550-openspec

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

[Copilot]

Pull request overview

This PR adds OpenSpec artifacts (proposal, design, tasks, and a specification) for implementing improved status reporting of proxied Windows SCEP certificate profiles, including a verifying state and surfacing proxy-observed upstream SCEP failures as failed with meaningful detail.

Changes:

• Adds an OpenSpec proposal describing the problem (2xx ACK ≠ successful cert issuance) and the intended behavioral changes.
• Adds a design document and implementation task breakdown for wiring cert observation + proxy-observed failures into host_mdm_windows_profiles.status/detail.
• Adds an initial spec capturing requirements and scenarios for verifying → verified via certificate observation and proxy-observed failures → failed.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
openspec/changes/windows-scep-proxy-verification/tasks.md	Task plan for detecting proxied SCEP profiles, mapping ACKs to verifying, flipping to verified on cert ingestion, and persisting proxy-observed upstream errors.
openspec/changes/windows-scep-proxy-verification/specs/windows-scep-cert-verification/spec.md	Requirements/spec scenarios for Windows proxied SCEP verification and failure surfacing.
openspec/changes/windows-scep-proxy-verification/proposal.md	High-level motivation and intended behavior changes for Windows SCEP proxy verification.
openspec/changes/windows-scep-proxy-verification/design.md	Detailed design decisions, constraints, and trade-offs for implementing the behavior.
openspec/changes/windows-scep-proxy-verification/.openspec.yaml	Declares the OpenSpec schema and creation date for the change.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.