$ modules / patching

Patching.

Campaigns. Stage rings. Rollback. Per-client compliance reports.

windowsmacosnative · OS update APIsga

// in 60 seconds

→Canary → test → production ring rollout. Per-client policies.
→Automatic rollback on failure KPIs.
→Client-facing compliance PDFs, auto-generated.

Core capabilities.

Stage rings

Canary (pilot fleet) → test → production. Ring promotion gated on KPIs.

Windows Update API

Uses native Windows Update Agent (WUA) on Windows hosts.

macOS softwareupdate

Uses `softwareupdate` + MDM-style install on macOS.

Rollback on regression

KPI-gated (blue-screen, reboot loop, disk failure). Auto-rollback.

Compliance reports

PDF per-client: patch status, SLA, exceptions.

CVE cross-reference

Software inventory × CVE feed. Prioritize CVE-critical patches.

Third-party apps

Chocolatey (Windows) + Homebrew (macOS). Custom via Scripts Marketplace.

Reboot coordination

Reboot windows per-client. Deferred notifications to end-user.

Offline catch-up

Agent resumes pending patches on reconnect.

// architecture

RMM agent driven. Patch catalog synced from OS vendor feeds + CVE feed. State machine per patch per host.

FAQ.

What if a patch causes a boot loop?+

Auto-rollback on second failed reboot. Ticket created with host in rollback state.

Related modules.

RMM & Agents

Cross-platform agents. ClickHouse telemetry. Zero-trust enrollment.

Scripts Marketplace

Signed scripts. Approval workflow. Scheduled. Audited with output.

SLA Management

Policies, overrides, pausable clocks, auto-escalation.