<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** NA
The Fleet UI now displays a policy's targeted platform, so repeating it
in the policy name is redundant. This strips the leading `macOS - ` /
`Windows - ` / `Linux - ` from all 84 prefixed policies in
`it-and-security`.
## Collisions
GitOps rejects duplicate policy names within a fleet
([`pkg/spec/gitops.go`](https://github.com/fleetdm/fleet/blob/main/pkg/spec/gitops.go#L2020)),
and the Workstations fleet includes macOS, Windows, and Linux policies
together. 14 stripped names would collide, so for those the platform
moves to a trailing suffix instead of being dropped:
| Before | After |
|---|---|
| `macOS - Gatekeeper enabled` | `Gatekeeper enabled` |
| `Windows - Secure Boot enabled` | `Secure Boot enabled` |
| `Linux - Removable storage is read-only` | `Removable storage is
read-only` |
| `macOS - Disk encryption enabled` | `Disk encryption enabled (macOS)`
|
| `Windows - Disk encryption enabled` | `Disk encryption enabled
(Windows)` |
| `Linux - Disk encryption enabled` | `Disk encryption enabled (Linux)`
|
49 policies lose the platform entirely; 35 keep it as a suffix. The 14
suffixed names are: Disk encryption enabled, Sufficient disk space
available, User .npmrc min-release-age at least 0.5 days, 1Password
installed, Battery healthy, and the 9 patch policies that exist for both
macOS and Windows (1Password, Google Chrome, Firefox, Slack, Zoom,
Visual Studio Code, Okta Verify, Claude, Adobe Acrobat Reader).
Also updates the descriptions of `macos-screen-lock-exclusions` and
`windows-screen-lock-exclusions`, which quote policy names.
## Notes for the reviewer
- **This is destructive on apply.** GitOps matches policies by name, so
applying this deletes the 84 existing policies and creates new ones.
Policy pass/fail history and host results reset. Automations defined in
the policy YAML (calendar events, install/script triggers) carry over,
but anything referencing these names outside the repo — saved filters,
dashboards, Slack workflows — needs updating separately.
- `tools/fleet-slackbot/system-prompt.js:338` still documents the
`<Platform> - <Description>` convention, and the `fleetctl new` macOS
template still ships a prefixed name. Both left alone intentionally —
out of scope for dogfood config.
- Four policy files appear unused by any fleet and were renamed only for
consistency: `lib/{macos,windows}/policies/update-claude.yml` and
`update-slack.yml`. Their names duplicate entries already in
`patch-fleet-maintained-apps.yml` for the same platform. Worth deleting
in a follow-up.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
N/A — dogfood GitOps config only, no product code changes.
## Testing
- [x] QA'd all new/changed functionality manually
Verified locally:
- No `macOS - ` / `Windows - ` / `Linux - ` strings remain anywhere
under `it-and-security/`.
- Every fleet passes the same uniqueness rule GitOps enforces —
Workstations resolves to 78 policies with 0 duplicate names; all other
fleets unchanged.
- All 73 touched/related YAML files parse.
- The diff touches only `- name:` lines plus the two label descriptions.
Allen Houchins
cc9f8e4891