refactor(server): remove AMT support entirely (VS-64) #85

Merged

David merged 1 commit from feat/VS-64-remove-amt into main

2026-06-27 21:31:39 +02:00

Claude-Run commented

2026-06-27 20:46:10 +02:00

Member

Deleted crates (workspace members and [workspace.dependencies]): vervain-amt, vervain-amt-redirect, vervain-amt-wsman, vervain-mps, vervain-ipkvm.

vervain-web: dropped AmtManager from AppState (and its construction in vervain/src/main.rs); deleted the AMT .ashx routes (ipkvm / commander / apf / amtimport / oneclickrecovery) and their handlers; removed the AMT WSMAN power path (actiontype 3xx) from power_action while keeping the generic agent power action; removed the AMT control actions and helpers (addamtdevice, scanamtdevice, groupamtpolicy, amtbootorder, amteventlog, amtversion, amt, importamtdevices, oneclickrecovery, amtsetupbin, satellite) plus their ControlIn/ControlOut variants, the AmtImportEntry struct, and the satellite-flags plumbing in user_session_registry. Removed the now-dead BIT_AMT_CIRA/BIT_AMT_DIRECT connectivity bits and the NO_AMT right (its bit value is kept reserved so a future right does not collide with what legacy clients may still send).

vervain-relay: deleted the dead AMT-redirection HTTP interceptor (http_intercept.rs), which nothing else used. vervain-pki: stopped issuing the MPS (AMT CIRA) leaf cert. vervain-ctrl: dropped the AMT command and group-type help text.

Scope boundary: the clone_safe_group / clone_safe_node secret redaction in groups.rs is left intact. It strips secrets (ssh/rdp/pmt as well as legacy amt/intelamt blobs) before sending docs to a browser; since the storage shapes mirror MeshCentral, a migrated database can still hold legacy intelamt.pass, so removing the redaction would leak it in cleartext. This is generic secret hygiene, not AMT subsystem wiring.

ROADMAP: removed the VS-15 (AMT redirection client) and VS-16 (ACS keypair for amtsetupbin) rows, both superseded by this removal.

#VS-64

Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com

Remove Intel AMT (Active Management Technology) support from the server: the five AMT crates and all their wiring, leaving no AMT routes, state, power actions, scanner, provisioning, MPS listener, or redirection scaffold. AMT was incomplete and unused, with no AMT deployment in the customer base. Deleted crates (workspace members and `[workspace.dependencies]`): `vervain-amt`, `vervain-amt-redirect`, `vervain-amt-wsman`, `vervain-mps`, `vervain-ipkvm`. vervain-web: dropped `AmtManager` from `AppState` (and its construction in `vervain/src/main.rs`); deleted the AMT `.ashx` routes (`ipkvm` / `commander` / `apf` / `amtimport` / `oneclickrecovery`) and their handlers; removed the AMT WSMAN power path (actiontype 3xx) from `power_action` while keeping the generic agent power action; removed the AMT control actions and helpers (`addamtdevice`, `scanamtdevice`, `groupamtpolicy`, `amtbootorder`, `amteventlog`, `amtversion`, `amt`, `importamtdevices`, `oneclickrecovery`, `amtsetupbin`, `satellite`) plus their `ControlIn`/`ControlOut` variants, the `AmtImportEntry` struct, and the satellite-flags plumbing in `user_session_registry`. Removed the now-dead `BIT_AMT_CIRA`/`BIT_AMT_DIRECT` connectivity bits and the `NO_AMT` right (its bit value is kept reserved so a future right does not collide with what legacy clients may still send). vervain-relay: deleted the dead AMT-redirection HTTP interceptor (`http_intercept.rs`), which nothing else used. vervain-pki: stopped issuing the MPS (AMT CIRA) leaf cert. vervain-ctrl: dropped the AMT command and group-type help text. Scope boundary: the `clone_safe_group` / `clone_safe_node` secret redaction in `groups.rs` is left intact. It strips secrets (ssh/rdp/pmt as well as legacy `amt`/`intelamt` blobs) before sending docs to a browser; since the storage shapes mirror MeshCentral, a migrated database can still hold legacy `intelamt.pass`, so removing the redaction would leak it in cleartext. This is generic secret hygiene, not AMT subsystem wiring. ROADMAP: removed the VS-15 (AMT redirection client) and VS-16 (ACS keypair for amtsetupbin) rows, both superseded by this removal. #VS-64 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Claude-Run added 1 commit

2026-06-27 20:46:10 +02:00

refactor(server): remove AMT support entirely (VS-64)

Check / fmt + clippy + build + tests (pull_request) Successful in 1m13s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

4fe9825eaa

Remove Intel AMT (Active Management Technology) support from the server: the five AMT crates and all their wiring, leaving no AMT routes, state, power actions, scanner, provisioning, MPS listener, or redirection scaffold. AMT was incomplete and unused, with no AMT deployment in the customer base.

Deleted crates (workspace members and `[workspace.dependencies]`): `vervain-amt`, `vervain-amt-redirect`, `vervain-amt-wsman`, `vervain-mps`, `vervain-ipkvm`.

vervain-web: dropped `AmtManager` from `AppState` (and its construction in `vervain/src/main.rs`); deleted the AMT `.ashx` routes (`ipkvm` / `commander` / `apf` / `amtimport` / `oneclickrecovery`) and their handlers; removed the AMT WSMAN power path (actiontype 3xx) from `power_action` while keeping the generic agent power action; removed the AMT control actions and helpers (`addamtdevice`, `scanamtdevice`, `groupamtpolicy`, `amtbootorder`, `amteventlog`, `amtversion`, `amt`, `importamtdevices`, `oneclickrecovery`, `amtsetupbin`, `satellite`) plus their `ControlIn`/`ControlOut` variants, the `AmtImportEntry` struct, and the satellite-flags plumbing in `user_session_registry`. Removed the now-dead `BIT_AMT_CIRA`/`BIT_AMT_DIRECT` connectivity bits and the `NO_AMT` right (its bit value is kept reserved so a future right does not collide with what legacy clients may still send).

vervain-relay: deleted the dead AMT-redirection HTTP interceptor (`http_intercept.rs`), which nothing else used. vervain-pki: stopped issuing the MPS (AMT CIRA) leaf cert. vervain-ctrl: dropped the AMT command and group-type help text.

Scope boundary: the `clone_safe_group` / `clone_safe_node` secret redaction in `groups.rs` is left intact. It strips secrets (ssh/rdp/pmt as well as legacy `amt`/`intelamt` blobs) before sending docs to a browser; since the storage shapes mirror MeshCentral, a migrated database can still hold legacy `intelamt.pass`, so removing the redaction would leak it in cleartext. This is generic secret hygiene, not AMT subsystem wiring.

ROADMAP: removed the VS-15 (AMT redirection client) and VS-16 (ACS keypair for amtsetupbin) rows, both superseded by this removal.

#VS-64

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>