[Fleet] Mark agent as offline when last_checkin_status is disconnected

[michel-laterman]

Summary

Adds a disconnected check to the agent status runtime field Painless script so that agents are marked offline immediately when fleet-server reports last_checkin_status: disconnected, rather than waiting for the time-based offline threshold.

Related fleet-server change: elastic/fleet-server#6792
Related issue: elastic/fleet-server#6784

[elasticmachine]

Pinging @elastic/fleet (Team:Fleet)

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR changes runtime behavior by adding a new 'disconnected' status value and modifying agent status computation to mark disconnected agents as 'offline'. Since this affects how agents are classified in production and the author doesn't own any of the modified Fleet files (owned by @elastic/fleet), human review by the code owners is appropriate.

^{You can customize Macroscope's approvability policy. Learn more.}

[juliaElastic]

The change looks good, it would be good to add integration tests in fleet_api_integration to verify that the ES query works correctly with test agent documents. Claude can help generate it.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 003b9d02-0683-4e9e-a9a9-e2a4524d4d7d

📥 Commits

Reviewing files that changed from the base of the PR and between d1ec64f and c763735.

📒 Files selected for processing (9)

• oas_docs/output/kibana.serverless.yaml
• oas_docs/output/kibana.yaml
• x-pack/platform/plugins/shared/fleet/common/types/models/agent.ts
• x-pack/platform/plugins/shared/fleet/server/services/agents/build_status_runtime_field.test.ts
• x-pack/platform/plugins/shared/fleet/server/services/agents/build_status_runtime_field.ts
• x-pack/platform/plugins/shared/fleet/server/types/rest_spec/agent.ts
• x-pack/platform/plugins/shared/fleet/server/types/so_attributes.ts
• x-pack/platform/test/fleet_api_integration/apis/agents/status.ts
• x-pack/platform/test/fleet_api_integration/helpers.ts

---

📝 Walkthrough

Walkthrough

This change extends agent status handling throughout the Fleet system by introducing 'disconnected' as a new allowed value for agent check-in status fields. The 'disconnected' status is added to TypeScript type definitions (AgentBase, FleetServerAgent, AgentSOAttributes), OpenAPI schemas, REST response schemas, and runtime field logic. The runtime field processor now treats agents with 'disconnected' status as offline. Integration tests and test helpers were updated to validate the new status handling with test data and assertions.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

• 🛠️ Update Documentation: Commit on current branch
• 🛠️ Update Documentation: Create PR

Warning

Tools execution failed with the following error:

Failed to run tools: 13 INTERNAL: Received RST_STREAM with code 2 (Internal server error)

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[michel-laterman]

@elastic/ski-docs, can I please get a review?

[kibanamachine]

Starting backport for target branches: 9.4

https://github.com/elastic/kibana/actions/runs/24526885341

[elasticmachine]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: beacdc1

Failed CI Steps

• FTR Configs #138

Metrics [docs]

✅ unchanged

History

• 💛 Build #427512 was flaky c763735
• 💔 Build #427487 failed dc05c1d
• 💛 Build #426819 was flaky 73a2954
• 💔 Build #425386 failed ca2fd7f

[kibanamachine]

💚 All backports created successfully

Status	Branch	Result
✅	9.4

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation