A patch that breaks something breaks it everywhere, at once, if that's how it went out. Akku sends patches through rings you define, checks each machine is fit to receive one, and halts the rollout if failures start stacking up.

A patch is defined once and applies fleet-wide: a third-party installer, an operating system update, or a script you write yourself. Windows Update and Ubuntu apt upgrades are driven natively from the console rather than left to each machine, and application patches go to Windows, Ubuntu and macOS alike. They come from Akku's platform catalogue, a maintained library with verified download sources, installer hashes and silent-install commands, and you can add your own entries beside it. Every installer is verified against its SHA-256 hash before it runs, and a mismatch is never executed. Where you're adding an entry yourself, point the console at the download URL and it captures the hash for you.

Deployments move through rings you define, a pilot group first, then wider, then the fleet. Set a success threshold and a ring promotes itself when it clears it. Set a failure limit and the rollout halts on its own, before the next ring gets it. If you'd rather rehearse first, a dry run downloads and verifies every installer without installing anything.

Jobs dispatch only inside the maintenance window you set, in your own timezone. Before installing, the agent checks the machine: low on disk, running on battery, waiting on a reboot, or already mid-install, and it skips and retries rather than forcing it. Reboots are confined to a window you choose, and the user gets a notice and a snooze rather than losing what they were doing.

Every deployment is tracked per device, pending, running, succeeded, failed or skipped, with the output captured. A rollout can be revoked mid-flight, and published work is snapshotted, so editing a catalogue entry afterwards doesn't change a deployment already in progress.
