fix: Remove internal configs

Co-Authored-By: Claude <noreply@anthropic.com>

Author: mvicknr

.fleetControl/schemaGeneration/generate-schema.py

@@ -306,9 +306,15 @@ def status_code_array_or_range(default=None):
     # Other server-set / non-Settings-class objects on the tree.
     "entity_guid",  # server-assigned at connect
     "attribute_filter",  # AttributeFilter instance, not a config value
+    # Internal-only QA / debug toggles. Surfacing these as customer-tunable
+    # would let an end user disable TLS validation, suppress harvests, swap
+    # logging payloads, etc. -- all of which are support / development
+    # affordances, not configuration.
+    "developer_mode",
     # Subtree exclusions (use `.*` suffix).
     "cross_application_tracer.*",  # legacy, replaced by distributed tracing
     "process_host.*",  # platform-derived (ip_address, display_name, etc.)
+    "debug.*",  # internal QA toggles (cert-validation off-switch, verbose log dumps, etc.)
 }
 
 
@@ -609,10 +615,29 @@ def generate_schema(settings, descriptions, exclude_keys=None, enum_overrides=No
 
 # ---------------------------------------------------------------------------
 # Schema merge -- deep-merges a freshly generated schema into the existing
-# one so the published schema only ever grows.
+# one so the published schema only ever grows for forward-compatibility
+# purposes.
+#
+# Caveat: the "only ever grows" promise does NOT extend to keys that the
+# current generator deliberately excludes via EXCLUDE_KEYS. Filtering those
+# out of the old schema before merge guarantees that newly-added exclusions
+# actually take effect on the next regeneration, instead of being silently
+# resurrected from the prior on-disk schema.
 # ---------------------------------------------------------------------------
 
 
+def filter_excluded(schema, exclude_keys):
+    """Return a copy of `schema` with any properties whose dotted path
+    matches `exclude_keys` removed. Operates on flat top-level property
+    paths only -- mirrors how is_excluded is used in build_properties.
+    """
+    if not schema or "properties" not in schema:
+        return schema
+    filtered = dict(schema)
+    filtered["properties"] = {k: v for k, v in schema["properties"].items() if not is_excluded(k, exclude_keys)}
+    return filtered
+
+
 def merge_schemas(old_s, new_s):
     if not old_s:
         return new_s
@@ -714,7 +739,12 @@ def main(argv=None):
     generated = generate_schema(settings, descriptions)
 
     old_schema = {} if args.force else load_existing(SCHEMA_PATH)
-    new_schema = merge_schemas(old_schema, generated)
+    # Drop excluded paths from the prior schema before merging so newly-added
+    # entries in EXCLUDE_KEYS take effect instead of being preserved by the
+    # "schema only ever grows" merge. Keep the original around so the diff
+    # classifier can still surface those removals to reviewers.
+    filtered_old_schema = filter_excluded(old_schema, EXCLUDE_KEYS)
+    new_schema = merge_schemas(filtered_old_schema, generated)
 
     validate_meta_schema(new_schema)
 

.fleetControl/schemas/config.json

@@ -339,100 +339,6 @@
       "type": "boolean",
       "default": true
     },
-    "debug.connect_span_stream_in_developer_mode": {
-      "type": "boolean",
-      "default": false
-    },
-    "debug.disable_api_supportability_metrics": {
-      "type": "boolean",
-      "default": false
-    },
-    "debug.disable_certificate_validation": {
-      "type": "boolean",
-      "default": false
-    },
-    "debug.disable_harvest_until_shutdown": {
-      "type": "boolean",
-      "default": false
-    },
-    "debug.enable_coroutine_profiling": {
-      "type": "boolean",
-      "default": false
-    },
-    "debug.explain_plan_obfuscation": {
-      "type": "string",
-      "default": "simple"
-    },
-    "debug.ignore_all_server_settings": {
-      "type": "boolean",
-      "default": false
-    },
-    "debug.local_settings_overrides": {
-      "type": "array",
-      "items": {
-        "type": "string"
-      },
-      "default": []
-    },
-    "debug.log_agent_initialization": {
-      "type": "boolean",
-      "default": false
-    },
-    "debug.log_autorum_middleware": {
-      "type": "boolean",
-      "default": false
-    },
-    "debug.log_data_collector_calls": {
-      "type": "boolean",
-      "default": false
-    },
-    "debug.log_data_collector_payloads": {
-      "type": "boolean",
-      "default": false
-    },
-    "debug.log_explain_plan_queries": {
-      "type": "boolean",
-      "default": false
-    },
-    "debug.log_malformed_json_data": {
-      "type": "boolean",
-      "default": false
-    },
-    "debug.log_normalization_rules": {
-      "type": "boolean",
-      "default": false
-    },
-    "debug.log_normalized_metric_data": {
-      "type": "boolean",
-      "default": false
-    },
-    "debug.log_raw_metric_data": {
-      "type": "boolean",
-      "default": false
-    },
-    "debug.log_thread_profile_payload": {
-      "type": "boolean",
-      "default": false
-    },
-    "debug.log_transaction_trace_payload": {
-      "type": "boolean",
-      "default": false
-    },
-    "debug.log_untrusted_distributed_trace_keys": {
-      "type": "boolean",
-      "default": false
-    },
-    "debug.otlp_content_encoding": {
-      "type": "string"
-    },
-    "debug.record_transaction_failure": {
-      "type": "boolean",
-      "default": false
-    },
-    "developer_mode": {
-      "type": "boolean",
-      "default": false
-    },
     "distributed_tracing.enabled": {
       "type": "boolean",
       "default": true,