macOS 27: update_new_hosts doesn’t require update during ADE (no matching asset found) #58730

Fleet versions

• Discovered: 4.94.1
• Reproduced: Not yet reproduced outside the customer's environment

Web browser and operating system: N/A (server-side, during ADE Setup Assistant). Affected hosts run macOS 27.0, 27.2 and 27.2.1. Seen on Mac17,6, 17,7, 17,12 and 17,13.

💥 Actual behavior

On macOS 27, ADE Macs in a Fleet with macos_updates.update_new_hosts: true and no minimum_version aren't required to update during Setup Assistant. Fleet logs getting apple software update required err="no matching asset found for device Mac17,x" and continues to end-user authentication.

🛠️ Expected behavior

When GDMF offers a newer macOS version for the Mac's board ID, Fleet requires the update during Setup Assistant, as it does for Macs on macOS 26.x.

🧑‍💻 Steps to reproduce

These steps:

• Have been confirmed to consistently lead to reproduction in multiple Fleet instances.
• Describe the workflow that led to the error, but have not yet been reproduced in multiple Fleet instances.

1. On Fleet 4.94.1, set macos_updates.update_new_hosts: true with no minimum_version on a Fleet with end-user authentication enabled.
2. Assign an ADE Mac running macOS 27.x to that Fleet and start Setup Assistant.
3. Check the server logs for no matching asset found for device ..., and confirm the Mac isn't asked to update.

🕯️ More info (optional)

• Same Mac, different OS: a Mac17,7 was checked with no error on macOS 26.5.1. The same Mac errored after it was on 27.2.1.
• Correct board IDs are stored and cached: the affected hosts' host_mdm_apple_os_updates.software_update_device_id hold valid board IDs (K116sAP, J714cAP), and both are in the cached GDMF assets. The GDMF cache refreshed after the 27.2.1 posting, and a manual apple_mdm_os_updates trigger didn't help.
• Suspected cause: gdmf.GetLatestOSVersion matches on PRODUCT or SOFTWARE_UPDATE_DEVICE_ID from MachineInfo. If macOS 27 leaves out SOFTWARE_UPDATE_DEVICE_ID in the Setup Assistant MachineInfo, Fleet compares Mac17,x against board IDs and never matches. The correct stored value may come later from osquery.
• Logging gap: the error only prints PRODUCT. It would help to also log SOFTWARE_UPDATE_DEVICE_ID.
• Related: update_new_hosts fails silently when the GDMF asset cache has no row for the device model #53262 (empty cache, same error, different cause).
• Internal Pylon Issue #2877