feat(sccm): analyze Software Update Point coverage

[adamgell]

Summary

• adds the issue-scoped Software Update Point/WSUS coverage-only adapter
• preserves canonical intake coverage states without inferring health or outcomes
• scopes bounded recapture requests to declared SUP sources
• binds next_artifact_requests into canonical server-intake authority so post-intake mutation fails closed

Dependency and scope

Targets the SCCM integration branch codex/parser-family-skeleton, not main. The reviewed stack descends directly from integration head 8329522742a4889565fba2c838f832208b7e7443 and contains exactly three commits:

• 4908d12c — SUP coverage-only intake adapter
• 76e2b0b9 — request scoping and conservative coverage wording
• 3cd037b9 — request-authority sealing and deterministic projection

The diff is limited to four parser-crate files under the SCCM server/SUP surface.

Evidence

• focused SUP: 9 passed
• intake/SUP/spine aggregate: 257 passed
• full parser suite: green
• wasm32 check: green
• strict Clippy (-D warnings): green
• changed-file rustfmt and git diff --check: green
• exact-range CodeRabbit: 0 findings
• independent quality gate: ACCEPT, high confidence
• adversarial request mutation, duplication, reordering, and oversize cases fail closed or serialize deterministically

State

• committed/pushed/reviewed: yes at 3cd037b9199e3414f599994e2156d85e0cfb3608
• merged: no
• live Windows validated: no; this is pure-parser coverage logic

Closes #330 only when the integration and acceptance criteria are complete. Part of #317.

Summary by CodeRabbit

• New Features

  • Added Software Update Point/WSUS coverage analysis for SCCM server intake data.
  • Reports captured coverage, missing or incomplete sources, profile eligibility gaps, and relevant follow-up requests.
  • Provides deterministic analysis results and clear diagnostics when intake or topology validation fails.

• Bug Fixes

  • Strengthened intake integrity validation to detect modified, duplicated, or reordered artifact requests.

• Tests

  • Added comprehensive coverage for request integrity, filtering, failure handling, and order-independent output.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 101ed54a-b1fb-42db-be90-34682cc113aa

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The change binds next_artifact_requests to intake integrity and adds a public, coverage-only Software Update Point/WSUS analyzer. The analyzer produces deterministic coverage rows, gaps, and follow-up requests. Tests cover authority validation, filtering, failure states, and serialization determinism.

Changes

Software Update Point analysis

Layer / File(s)	Summary
Bind artifact requests to intake integrity crates/cmtraceopen-parser/src/sccm/server/windows/intake.rs	Intake integrity now records bounded canonical request data. Adapter authority checks validate request count and content. Duplicate and oversized requests are rejected.
Implement coverage-only SUP analysis crates/cmtraceopen-parser/src/sccm/server/windows/software_update_point.rs, crates/cmtraceopen-parser/src/sccm/server/windows/mod.rs	Adds public SUP/WSUS analysis types and exports. The analyzer validates authority, creates deterministic coverage rows and gaps, and filters follow-up requests.
Validate deterministic SUP analysis crates/cmtraceopen-parser/tests/sccm_server_software_update_point.rs	Adds integration coverage for fixture loading, coverage states, request filtering, fail-closed tampering behavior, and stable serialized output.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Intake
  participant SUPAnalyzer
  participant Artifacts
  Intake->>SUPAnalyzer: provide verified canonical intake
  SUPAnalyzer->>Artifacts: select SUP and WSUS sources
  Artifacts-->>SUPAnalyzer: return coverage inputs
  SUPAnalyzer-->>Intake: return rows, gaps, and requests

Loading

Possibly related PRs

• adamgell/cmtraceopen#434: Extends the same intake assessment and canonicalization boundaries.
• adamgell/cmtraceopen#443: Builds on the canonical intake integrity and adapter validation mechanisms.
• adamgell/cmtraceopen#458: Adds a related sealed-intake SCCM Windows source adapter with deterministic coverage.

Suggested labels: test

Suggested reviewers: copilot

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The PR adds coverage analysis but does not implement the issue's required workflow diagnosis, failure distinctions, client corroboration, or required fixtures.	Add SUP/WSUS phase diagnosis, failure-state distinctions, stable-key client corroboration, and the healthy, failure, no-SUP, retry, and incomplete-evidence fixtures.
Docstring Coverage	⚠️ Warning	Docstring coverage is 42.11% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Out of Scope Changes check	✅ Passed	The changes remain within the SUP/WSUS adapter, intake authority, request scoping, and related tests.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding SCCM Software Update Point coverage analysis.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

---

_{Comment @coderabbitai help to get the list of available commands.}

[adamgell]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/cmtraceopen-parser/src/sccm/server/windows/software_update_point.rs`:
- Around line 84-110: Update the coverage-building flow around `coverage_rows`
and `coverage_gaps` to emit one canonical coverage gap when the intake-valid
topology lacks `SccmRole::SoftwareUpdatePoint`, rather than returning empty
output. Preserve the existing row-based gap generation when the SUP role is
present, and add a fixture asserting the no-SUP result.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: bf92130c-8e20-4c73-a4b4-ba3c6b1250b1

📥 Commits

Reviewing files that changed from the base of the PR and between 8329522 and 3cd037b.

📒 Files selected for processing (4)

• crates/cmtraceopen-parser/src/sccm/server/windows/intake.rs
• crates/cmtraceopen-parser/src/sccm/server/windows/mod.rs
• crates/cmtraceopen-parser/src/sccm/server/windows/software_update_point.rs
• crates/cmtraceopen-parser/tests/sccm_server_software_update_point.rs

[Copilot]

Pull request overview

Adds a SCCM Server Software Update Point (SUP) / supplemental WSUS coverage-only analyzer that projects canonical intake coverage and bounded recapture requests without inferring health/outcomes, and strengthens intake integrity so post-intake request mutation fails closed.

Changes:

• Introduces analyze_software_update_point coverage-only projection for SUP/WSUS sources, including deterministic ordering and scoped request projection.
• Seals next_artifact_requests into the canonical server-intake integrity binding (including normalization, duplication rejection, and digesting).
• Adds integration-style tests covering capped/captured/skipped/parseFailed coverage, request scoping, tamper fail-closed behavior, and deterministic serialization under reordering.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
crates/cmtraceopen-parser/tests/sccm_server_software_update_point.rs	New tests for SUP/WSUS coverage-only analysis, request scoping, and fail-closed integrity behavior.
crates/cmtraceopen-parser/src/sccm/server/windows/software_update_point.rs	New SUP/WSUS coverage-only analyzer and deterministic projection logic.
crates/cmtraceopen-parser/src/sccm/server/windows/mod.rs	Wires the new software_update_point module into the SCCM server Windows surface exports.
crates/cmtraceopen-parser/src/sccm/server/windows/intake.rs	Extends intake integrity binding to include next_artifact_requests (counts, structure bounds, normalization, digest).

[adamgell]

Superseded on main. This frozen SUP API was explicitly CoverageOnly; current main has six lifecycle phases, succeeded/failed/deferred/incomplete states, terminal semantics, correlation handoff, and all 10 scenarios through the production analyzer. Superseded by 76deb04 and promoted through PR #490. Closing unmerged.