Stage 1 step 1: read-only collectors, evidence schema, catalog and synthetic data

.gitignore

@@ -0,0 +1,7 @@
+# Generated synthetic data (regenerate with synthetic/generate_evidence.py)
+synthetic/out/
+# Real audit output is personal data: never commit it
+audit-*.json
+audit-*.txt
+__pycache__/
+.DS_Store

README.md

@@ -1,10 +1,126 @@
 ---
 title: Endpoint Auditor
-emoji: 📊
-colorFrom: yellow
-colorTo: red
+emoji: 🛡️
+colorFrom: red
+colorTo: indigo
 sdk: static
 pinned: false
+short_description: Read-only endpoint audit for ISO 27001, GDPR, EU AI Act
 ---
 
-Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference
+# Devseis Endpoint Auditor — stage 1, step 1
+
+A **read-only** audit of a Windows, Linux or macOS endpoint against a security baseline, GDPR technical
+controls, EU AI Act controls and organisational controls. It produces:
+
+- a **text report** in the Devseis format (one line per check, then its status), and
+- a **JSON evidence file** in one shared format, the input for the Devseis auditor model (later steps).
+
+This repository is **step 1** of the MVP: the collectors, the evidence format, the check catalog and a
+**synthetic evidence generator**, so the model can be built before real customer data exists.
+
+> Not a certification. ISO 27001 certification needs an accredited auditor, and much of GDPR and AI Act
+> compliance is organisational. The tool collects evidence and flags gaps.
+
+## What it checks
+
+| Section | Checks | Examples |
+|---|---|---|
+| `COMPLIANCE RESULTS` | Security baseline (33 on Windows, 26 on Linux/macOS) | Password and lockout policy, antivirus, firewall, screen lock, USB storage, administrators, disk encryption |
+| `GDPR TECHNICAL CONTROLS` | 12 | Automatic updates, supported OS, security logging, time sync, backup, removable media encryption, guest account, remote access, diagnostic data, personal data discovery (opt-in, later stage) |
+| `EU AI ACT CONTROLS` | 5 | AI software inventory, unapproved AI tools (shadow AI), risk classification (by the model), Windows Recall / Apple Intelligence, AI log retention |
+| `ORGANISATIONAL CONTROLS` | 8 | RoPA, DPIA, breach procedure, processor agreements, AI register, AI literacy, human oversight, AI transparency |
+
+Every check, with its ISO 27001:2022 Annex A, GDPR and AI Act references, is in
+[`catalog/checks.json`](catalog/checks.json). Control titles are referenced; the ISO standard text is not
+reproduced (it is copyrighted).
+
+Statuses: `Compliant`, `Non-Compliant`, `NotApplicable`, `Pending` (needs the model or an organisational
+answer) and `Error` (value not readable, usually because the collector was not run as administrator/root).
+
+## Repository layout
+
+```
+baseline.conf                     required values (password length, lockout, USB, approved admins, AI tools…)
+organisational.conf               answers to the organisational questions (yes / no / partial / n/a)
+catalog/checks.json               every check: id, section, name per OS, rule, control references
+schema/evidence.schema.json       JSON Schema of the evidence file
+collectors/windows/audit.ps1      Windows collector (Windows PowerShell 5.1 or PowerShell 7)
+collectors/linux/audit.sh         Linux collector (Ubuntu/Debian, RHEL family)
+collectors/macos/audit.sh         macOS collector (bash 3.2 as shipped with macOS)
+synthetic/generate_evidence.py    synthetic evidence in the same format, using the same rules
+synthetic/samples/                three example synthetic records (one per OS)
+tools/validate_evidence.py        checks evidence against the schema rules and the catalog
+tools/render_report.py            turns evidence back into the text report
+```
+
+## Running an audit
+
+The collectors only **read** settings. The only files they write are the report and evidence
+(plus short-lived exports from `secedit`/`auditpol` in TEMP on Windows, deleted straight away).
+
+```powershell
+# Windows (elevated PowerShell). Output: C:\ProgramData\Devseis\EndpointAudit\
+powershell -ExecutionPolicy Bypass -File .\collectors\windows\audit.ps1
+```
+
+```bash
+# Linux. Output: /var/log/devseis-endpoint-audit/
+sudo ./collectors/linux/audit.sh
+
+# macOS. Output: /Library/Logs/Devseis/EndpointAudit/
+sudo ./collectors/macos/audit.sh
+```
+
+Options: `--baseline FILE`, `--org FILE`, `--output DIR` (Windows: `-Baseline`, `-Organisational`, `-Output`).
+Exit code: `0` all compliant, `1` at least one Non-Compliant, `2` could not run or write output.
+
+Without administrator/root rights the audit still runs; checks that need those rights report `Error`.
+
+## Configuring the baseline
+
+Edit [`baseline.conf`](baseline.conf). Important values to set per organisation:
+
+- `APPROVED_ADMINS` — the IT administrator accounts allowed to be administrators.
+- `APPROVED_AI_TOOLS` — AI tools allowed on endpoints, as named in the AI inventory.
+- `APPROVED_REMOTE_SERVICES` — remote access allowed (e.g. `ssh`, `rdp`).
+- `USB_READ` / `USB_WRITE` — `allow` or `deny`.
+
+Answer the eight questions in [`organisational.conf`](organisational.conf) once; they appear in every report.
+
+## Synthetic data
+
+```bash
+python3 synthetic/generate_evidence.py --count 600 --seed 7 --out synthetic/out/evidence.jsonl
+python3 tools/validate_evidence.py synthetic/out/evidence.jsonl
+python3 tools/render_report.py synthetic/out/evidence.jsonl --index 0
+```
+
+Records follow the collectors' check order, names and pass/fail rules, across three device profiles
+(`hardened`, `typical`, `neglected`), current and unsupported OS versions, runs without admin rights,
+third-party antivirus, and AI tool inventories. Host names, serial numbers and accounts are invented.
+The same seed always gives the same data.
+
+## Test status (collector version 0.1.0)
+
+| Collector | How it was tested |
+|---|---|
+| macOS | Run on a real Mac (macOS 26, Intel) without root: evidence valid; report identical to the rendered evidence apart from the time-zone label. |
+| Linux | Run in an Ubuntu 24.04 container as root and as a normal user: evidence valid, results checked by hand. Still to test on a full desktop install (GNOME, LUKS, ufw). |
+| Windows | Parsed with PowerShell 7 (0 errors) and checked with PSScriptAnalyzer (no errors). **Still to run on a real Windows 11 machine.** |
+| Synthetic | 600 records, all valid against the schema and catalog; reproducible from the seed. |
+
+## Privacy
+
+Real evidence contains the host name, serial number, user account names and file paths: it is personal
+data under GDPR. Keep it on the device or in the organisation's own storage. Only synthetic data belongs
+in this repository.
+
+## Roadmap
+
+1. **Collectors, evidence format, catalog, synthetic data** ← this repository
+2. Control library in Devseis's own wording, for retrieval by the model
+3. Training data: evidence → auditor findings (explanation, risk, recommendation, references), reviewed by an ISO 27001 / GDPR expert
+4. Fine-tune a small open-weight model (LoRA/QLoRA) to run locally
+5. Evaluate on held-out data (correct references, no invented values) and publish the scores
+6. Package: one installer per OS that detects the OS, runs the collector and writes the report locally

baseline.conf

@@ -0,0 +1,56 @@
+# Devseis endpoint audit baseline
+# KEY=VALUE lines only. The collectors parse this file; they never execute it.
+# Lists are comma-separated. Name matching ignores case; "*" works as a wildcard.
+
+# --- Passwords -------------------------------------------------------------
+PASSWORD_MIN_LENGTH=14
+PASSWORD_HISTORY=24
+# Passwords must expire within this many days. 0 = expiry not required (NIST SP 800-63B style).
+PASSWORD_MAX_AGE_DAYS=365
+PASSWORD_MIN_AGE_DAYS=1
+PASSWORD_COMPLEXITY=1
+
+# --- Account lockout -------------------------------------------------------
+LOCKOUT_THRESHOLD_MAX=5
+LOCKOUT_DURATION_MIN_MINUTES=15
+LOCKOUT_OBSERVATION_MIN_MINUTES=15
+
+# --- Malware protection ----------------------------------------------------
+SIGNATURE_MAX_AGE_DAYS=3
+# Apple ships XProtect data less often than daily signature feeds.
+MACOS_XPROTECT_MAX_AGE_DAYS=30
+
+# --- Firewall --------------------------------------------------------------
+# Expected default outbound policy: allow | deny
+FIREWALL_OUTBOUND=allow
+
+# --- Screen lock -----------------------------------------------------------
+SCREEN_LOCK_MAX_SECONDS=900
+
+# --- USB storage (allow | deny) --------------------------------------------
+USB_READ=allow
+USB_WRITE=deny
+
+# --- Administrators --------------------------------------------------------
+# Accounts allowed to be administrators: user names, DOMAIN\name, or Windows SIDs.
+APPROVED_ADMINS=itadmin
+# Windows: a disabled built-in Administrator (RID 500) is not counted as unauthorized.
+ALLOW_DISABLED_BUILTIN_ADMIN=1
+
+# --- GDPR technical controls ----------------------------------------------
+UPDATES_MAX_AGE_DAYS=30
+BACKUP_MAX_AGE_DAYS=7
+# Remote access services that may be enabled: rdp, ssh, smb, winrm, vnc, screensharing, filesharing, remotemanagement
+APPROVED_REMOTE_SERVICES=
+# Lowest OS versions that still receive security updates.
+WINDOWS_MIN_BUILD=22631
+MACOS_MIN_MAJOR=14
+UBUNTU_MIN_VERSION=22.04
+DEBIAN_MIN_VERSION=12
+RHEL_MIN_VERSION=9
+# Opt-in personal data discovery scan (0 = off). Not implemented in stage 1.
+PERSONAL_DATA_SCAN=0
+
+# --- EU AI Act -------------------------------------------------------------
+# AI tools allowed on endpoints, as named in the AI software inventory (e.g. Microsoft Copilot,ChatGPT).
+APPROVED_AI_TOOLS=

catalog/checks.json

@@ -0,0 +1,147 @@
+{
+  "catalog_version": "0.1.0",
+  "statuses": ["Compliant", "Non-Compliant", "NotApplicable", "Pending", "Error"],
+  "status_meaning": {
+    "Compliant": "The device meets the baseline value.",
+    "Non-Compliant": "The device does not meet the baseline value.",
+    "NotApplicable": "The check does not apply to this device or OS, or an opt-in check is switched off.",
+    "Pending": "Needs a later step: classification by the auditor model, or an unanswered organisational question.",
+    "Error": "The value could not be read (for example the collector was not run as administrator/root)."
+  },
+  "sections": [
+    { "id": "baseline", "title": "COMPLIANCE RESULTS" },
+    { "id": "gdpr", "title": "GDPR TECHNICAL CONTROLS" },
+    { "id": "aiact", "title": "EU AI ACT CONTROLS" },
+    { "id": "org", "title": "ORGANISATIONAL CONTROLS" }
+  ],
+  "references": {
+    "iso27001": {
+      "A.5.9": "Inventory of information and other associated assets",
+      "A.5.12": "Classification of information",
+      "A.5.15": "Access control",
+      "A.5.16": "Identity management",
+      "A.5.17": "Authentication information",
+      "A.5.18": "Access rights",
+      "A.5.20": "Addressing information security within supplier agreements",
+      "A.5.24": "Information security incident management planning and preparation",
+      "A.5.26": "Response to information security incidents",
+      "A.5.34": "Privacy and protection of PII",
+      "A.6.3": "Information security awareness, education and training",
+      "A.6.7": "Remote working",
+      "A.7.7": "Clear desk and clear screen",
+      "A.7.10": "Storage media",
+      "A.8.1": "User endpoint devices",
+      "A.8.2": "Privileged access rights",
+      "A.8.5": "Secure authentication",
+      "A.8.7": "Protection against malware",
+      "A.8.8": "Management of technical vulnerabilities",
+      "A.8.12": "Data leakage prevention",
+      "A.8.13": "Information backup",
+      "A.8.15": "Logging",
+      "A.8.17": "Clock synchronization",
+      "A.8.19": "Installation of software on operational systems",
+      "A.8.20": "Networks security",
+      "A.8.24": "Use of cryptography"
+    },
+    "gdpr": {
+      "Art. 5(1)(c)": "Data minimisation",
+      "Art. 5(1)(e)": "Storage limitation",
+      "Art. 5(1)(f)": "Integrity and confidentiality",
+      "Art. 25": "Data protection by design and by default",
+      "Art. 28": "Processor",
+      "Art. 30": "Records of processing activities",
+      "Art. 32(1)(a)": "Security of processing: pseudonymisation and encryption",
+      "Art. 32(1)(b)": "Security of processing: confidentiality, integrity, availability and resilience",
+      "Art. 32(1)(c)": "Security of processing: restore availability and access after an incident",
+      "Art. 32(1)(d)": "Security of processing: regular testing and evaluation",
+      "Art. 33": "Notification of a personal data breach to the supervisory authority",
+      "Art. 34": "Communication of a personal data breach to the data subject",
+      "Art. 35": "Data protection impact assessment",
+      "Art. 44": "General principle for transfers"
+    },
+    "ai_act": {
+      "Art. 4": "AI literacy",
+      "Art. 5": "Prohibited AI practices",
+      "Art. 6": "Classification rules for high-risk AI systems",
+      "Art. 14": "Human oversight",
+      "Art. 26": "Obligations of deployers of high-risk AI systems",
+      "Art. 26(6)": "Deployers: keep automatically generated logs for at least six months",
+      "Art. 50": "Transparency obligations for providers and deployers of certain AI systems",
+      "Annex III": "High-risk AI systems referred to in Article 6(2)"
+    }
+  },
+  "checks": [
+    { "id": "password.min_length", "section": "baseline", "name": "Minimum password length", "os": ["windows", "linux", "macos"], "baseline_keys": ["PASSWORD_MIN_LENGTH"], "rule": "Configured minimum length >= PASSWORD_MIN_LENGTH.", "controls": { "iso27001": ["A.5.17", "A.8.5"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+    { "id": "password.history", "section": "baseline", "name": "Password history", "os": ["windows", "linux", "macos"], "baseline_keys": ["PASSWORD_HISTORY"], "rule": "Remembered passwords >= PASSWORD_HISTORY.", "controls": { "iso27001": ["A.5.17", "A.8.5"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+    { "id": "password.expiration", "section": "baseline", "name": "Password expiration", "os": ["windows", "linux", "macos"], "baseline_keys": ["PASSWORD_MAX_AGE_DAYS"], "rule": "Passwords expire after 1..PASSWORD_MAX_AGE_DAYS days (0 in the baseline = expiry not required).", "controls": { "iso27001": ["A.5.17"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+    { "id": "password.min_age", "section": "baseline", "name": "Minimum password age", "os": ["windows", "linux", "macos"], "baseline_keys": ["PASSWORD_MIN_AGE_DAYS"], "rule": "Minimum age >= PASSWORD_MIN_AGE_DAYS days. macOS has no such setting (NotApplicable).", "controls": { "iso27001": ["A.5.17"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+    { "id": "password.complexity", "section": "baseline", "name": "Password complexity", "os": ["windows", "linux", "macos"], "baseline_keys": ["PASSWORD_COMPLEXITY"], "rule": "Complexity enforced (mixed character classes).", "controls": { "iso27001": ["A.5.17", "A.8.5"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+    { "id": "lockout.threshold", "section": "baseline", "name": "Account lockout threshold", "os": ["windows", "linux", "macos"], "baseline_keys": ["LOCKOUT_THRESHOLD_MAX"], "rule": "Lockout after 1..LOCKOUT_THRESHOLD_MAX failed attempts (0 = never locks).", "controls": { "iso27001": ["A.8.5"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+    { "id": "lockout.duration", "section": "baseline", "name": "Account lockout duration", "os": ["windows", "linux", "macos"], "baseline_keys": ["LOCKOUT_DURATION_MIN_MINUTES"], "rule": "Locked for >= LOCKOUT_DURATION_MIN_MINUTES minutes, or until an administrator unlocks.", "controls": { "iso27001": ["A.8.5"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+    { "id": "lockout.observation", "section": "baseline", "name": "Lockout observation period", "os": ["windows", "linux", "macos"], "baseline_keys": ["LOCKOUT_OBSERVATION_MIN_MINUTES"], "rule": "Failed-attempt counter kept for >= LOCKOUT_OBSERVATION_MIN_MINUTES minutes.", "controls": { "iso27001": ["A.8.5"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+
+    { "id": "malware.antivirus", "section": "baseline", "name": "Antivirus", "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "An enabled, up-to-date antivirus product is present.", "controls": { "iso27001": ["A.8.7"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+    { "id": "malware.service", "section": "baseline", "name": "Malware protection service", "names": { "windows": "Microsoft Defender Antimalware", "linux": "ClamAV malware protection service", "macos": "Apple malware protection service" }, "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "The platform malware protection service is running.", "controls": { "iso27001": ["A.8.7"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+    { "id": "malware.realtime", "section": "baseline", "name": "Real-time protection", "os": ["windows"], "baseline_keys": [], "rule": "Defender real-time protection is on.", "controls": { "iso27001": ["A.8.7"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+    { "id": "malware.on_access", "section": "baseline", "name": "On-access malware protection", "names": { "windows": "On-access protection" }, "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "Files are scanned when opened. macOS: NotApplicable unless a third-party scanner provides it.", "controls": { "iso27001": ["A.8.7"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+    { "id": "malware.tamper", "section": "baseline", "name": "Tamper protection", "os": ["windows"], "baseline_keys": [], "rule": "Defender tamper protection is on.", "controls": { "iso27001": ["A.8.7"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+    { "id": "malware.signatures", "section": "baseline", "name": "Malware signatures", "names": { "windows": "Security intelligence", "macos": "Malware protection signatures" }, "os": ["windows", "linux", "macos"], "baseline_keys": ["SIGNATURE_MAX_AGE_DAYS", "MACOS_XPROTECT_MAX_AGE_DAYS"], "rule": "Signatures no older than SIGNATURE_MAX_AGE_DAYS (macOS XProtect: MACOS_XPROTECT_MAX_AGE_DAYS).", "controls": { "iso27001": ["A.8.7", "A.8.8"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+    { "id": "malware.signature_updates", "section": "baseline", "name": "Malware signature updates", "names": { "macos": "Malware security updates" }, "os": ["linux", "macos"], "baseline_keys": [], "rule": "Automatic signature/security-data updates are enabled.", "controls": { "iso27001": ["A.8.7", "A.8.8"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+
+    { "id": "firewall.enabled", "section": "baseline", "name": "Firewall", "os": ["linux", "macos"], "baseline_keys": [], "rule": "A host firewall is active.", "controls": { "iso27001": ["A.8.20", "A.8.1"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+    { "id": "firewall.inbound", "section": "baseline", "name": "Firewall inbound policy", "os": ["linux", "macos"], "baseline_keys": [], "rule": "Unsolicited inbound traffic is blocked by default (macOS: firewall on with stealth mode).", "controls": { "iso27001": ["A.8.20"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+    { "id": "firewall.outbound", "section": "baseline", "name": "Firewall outbound policy", "os": ["linux", "macos"], "baseline_keys": ["FIREWALL_OUTBOUND"], "rule": "Default outbound policy equals FIREWALL_OUTBOUND.", "controls": { "iso27001": ["A.8.20"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+    { "id": "firewall.domain.enabled", "section": "baseline", "name": "Domain firewall", "os": ["windows"], "baseline_keys": [], "rule": "Domain profile enabled.", "controls": { "iso27001": ["A.8.20", "A.8.1"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+    { "id": "firewall.domain.inbound", "section": "baseline", "name": "Domain inbound", "os": ["windows"], "baseline_keys": [], "rule": "Domain profile default inbound action is Block.", "controls": { "iso27001": ["A.8.20"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+    { "id": "firewall.domain.outbound", "section": "baseline", "name": "Domain outbound", "os": ["windows"], "baseline_keys": ["FIREWALL_OUTBOUND"], "rule": "Domain profile default outbound action equals FIREWALL_OUTBOUND.", "controls": { "iso27001": ["A.8.20"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+    { "id": "firewall.private.enabled", "section": "baseline", "name": "Private firewall", "os": ["windows"], "baseline_keys": [], "rule": "Private profile enabled.", "controls": { "iso27001": ["A.8.20", "A.8.1"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+    { "id": "firewall.private.inbound", "section": "baseline", "name": "Private inbound", "os": ["windows"], "baseline_keys": [], "rule": "Private profile default inbound action is Block.", "controls": { "iso27001": ["A.8.20"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+    { "id": "firewall.private.outbound", "section": "baseline", "name": "Private outbound", "os": ["windows"], "baseline_keys": ["FIREWALL_OUTBOUND"], "rule": "Private profile default outbound action equals FIREWALL_OUTBOUND.", "controls": { "iso27001": ["A.8.20"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+    { "id": "firewall.public.enabled", "section": "baseline", "name": "Public firewall", "os": ["windows"], "baseline_keys": [], "rule": "Public profile enabled.", "controls": { "iso27001": ["A.8.20", "A.8.1"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+    { "id": "firewall.public.inbound", "section": "baseline", "name": "Public inbound", "os": ["windows"], "baseline_keys": [], "rule": "Public profile default inbound action is Block.", "controls": { "iso27001": ["A.8.20"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+    { "id": "firewall.public.outbound", "section": "baseline", "name": "Public outbound", "os": ["windows"], "baseline_keys": ["FIREWALL_OUTBOUND"], "rule": "Public profile default outbound action equals FIREWALL_OUTBOUND.", "controls": { "iso27001": ["A.8.20"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+
+    { "id": "screen_lock.enabled", "section": "baseline", "name": "Screen lock", "os": ["linux", "macos"], "baseline_keys": [], "rule": "The screen locks when idle.", "controls": { "iso27001": ["A.8.1", "A.7.7"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+    { "id": "screen_lock.timeout", "section": "baseline", "name": "Screen lock timeout", "os": ["windows", "linux", "macos"], "baseline_keys": ["SCREEN_LOCK_MAX_SECONDS"], "rule": "Idle time before lock (including any grace delay) is 1..SCREEN_LOCK_MAX_SECONDS seconds.", "controls": { "iso27001": ["A.8.1", "A.7.7"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+    { "id": "screen_lock.password", "section": "baseline", "name": "Screen lock password requirement", "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "A password is required to unlock (macOS: within 5 seconds of the screen locking).", "controls": { "iso27001": ["A.8.1", "A.7.7", "A.8.5"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+
+    { "id": "usb.read", "section": "baseline", "name": "USB storage read", "os": ["windows", "linux", "macos"], "baseline_keys": ["USB_READ"], "rule": "Effective USB storage read access equals USB_READ (allow/deny).", "controls": { "iso27001": ["A.7.10", "A.8.12"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+    { "id": "usb.write", "section": "baseline", "name": "USB storage write", "os": ["windows", "linux", "macos"], "baseline_keys": ["USB_WRITE"], "rule": "Effective USB storage write access equals USB_WRITE (allow/deny).", "controls": { "iso27001": ["A.7.10", "A.8.12"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+
+    { "id": "admin.approved", "section": "baseline", "name": "Approved IT administrator", "os": ["windows", "linux", "macos"], "baseline_keys": ["APPROVED_ADMINS"], "rule": "At least one account listed in APPROVED_ADMINS is an enabled administrator.", "controls": { "iso27001": ["A.8.2", "A.5.15"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+    { "id": "admin.unauthorized", "section": "baseline", "name": "Unauthorized employee administrator accounts", "names": { "windows": "Unauthorized employee local administrator accounts" }, "os": ["windows", "linux", "macos"], "baseline_keys": ["APPROVED_ADMINS", "ALLOW_DISABLED_BUILTIN_ADMIN"], "rule": "No administrator accounts other than APPROVED_ADMINS (and the disabled built-in Administrator on Windows).", "controls": { "iso27001": ["A.8.2", "A.5.18"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+
+    { "id": "encryption.feature", "section": "baseline", "name": "BitLocker", "os": ["windows"], "baseline_keys": [], "rule": "BitLocker is turned on for the system drive.", "controls": { "iso27001": ["A.8.24", "A.8.1"], "gdpr": ["Art. 32(1)(a)"], "ai_act": [] } },
+    { "id": "encryption.enabled", "section": "baseline", "name": "Encryption", "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "The system disk is fully encrypted (BitLocker / LUKS / FileVault).", "controls": { "iso27001": ["A.8.24", "A.8.1"], "gdpr": ["Art. 32(1)(a)"], "ai_act": [] } },
+    { "id": "encryption.protection", "section": "baseline", "name": "Disk encryption protection", "names": { "windows": "BitLocker protection" }, "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "Encryption protection is active (not suspended or in progress) with a strong cipher.", "controls": { "iso27001": ["A.8.24"], "gdpr": ["Art. 32(1)(a)"], "ai_act": [] } },
+    { "id": "encryption.recovery", "section": "baseline", "name": "Disk encryption recovery", "names": { "windows": "BitLocker recovery" }, "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "A recovery key or second unlock method exists.", "controls": { "iso27001": ["A.8.24", "A.8.13"], "gdpr": ["Art. 32(1)(a)", "Art. 32(1)(c)"], "ai_act": [] } },
+
+    { "id": "gdpr.auto_updates", "section": "gdpr", "name": "Automatic security updates", "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "Security updates are downloaded and installed automatically.", "controls": { "iso27001": ["A.8.8"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+    { "id": "gdpr.updates_recent", "section": "gdpr", "name": "Security updates installed recently", "os": ["windows", "linux", "macos"], "baseline_keys": ["UPDATES_MAX_AGE_DAYS"], "rule": "Last successful update/package change within UPDATES_MAX_AGE_DAYS days.", "controls": { "iso27001": ["A.8.8"], "gdpr": ["Art. 32(1)(b)", "Art. 32(1)(d)"], "ai_act": [] } },
+    { "id": "gdpr.os_supported", "section": "gdpr", "name": "Supported operating system version", "os": ["windows", "linux", "macos"], "baseline_keys": ["WINDOWS_MIN_BUILD", "MACOS_MIN_MAJOR", "UBUNTU_MIN_VERSION", "DEBIAN_MIN_VERSION", "RHEL_MIN_VERSION"], "rule": "The OS version still receives security updates (minimums in the baseline).", "controls": { "iso27001": ["A.8.8"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+    { "id": "gdpr.security_logging", "section": "gdpr", "name": "Security event logging", "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "Logon and account-change events are recorded (Windows audit policy, Linux auditd, macOS unified log).", "controls": { "iso27001": ["A.8.15"], "gdpr": ["Art. 32(1)(d)", "Art. 33"], "ai_act": [] } },
+    { "id": "gdpr.time_sync", "section": "gdpr", "name": "Time synchronisation", "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "The clock is synchronised from a time server.", "controls": { "iso27001": ["A.8.17"], "gdpr": ["Art. 33"], "ai_act": [] } },
+    { "id": "gdpr.backup_configured", "section": "gdpr", "name": "Backup configured", "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "A backup solution is configured for user data.", "controls": { "iso27001": ["A.8.13"], "gdpr": ["Art. 32(1)(c)"], "ai_act": [] } },
+    { "id": "gdpr.backup_recent", "section": "gdpr", "name": "Recent backup", "os": ["windows", "linux", "macos"], "baseline_keys": ["BACKUP_MAX_AGE_DAYS"], "rule": "Last backup within BACKUP_MAX_AGE_DAYS days (Pending when the date cannot be read).", "controls": { "iso27001": ["A.8.13"], "gdpr": ["Art. 32(1)(c)"], "ai_act": [] } },
+    { "id": "gdpr.removable_encryption", "section": "gdpr", "name": "Removable media encryption", "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "Data cannot be written to unencrypted removable drives.", "controls": { "iso27001": ["A.7.10", "A.8.24"], "gdpr": ["Art. 32(1)(a)", "Art. 34"], "ai_act": [] } },
+    { "id": "gdpr.guest_account", "section": "gdpr", "name": "Guest account disabled", "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "No enabled guest login.", "controls": { "iso27001": ["A.5.16", "A.8.5"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+    { "id": "gdpr.remote_access", "section": "gdpr", "name": "Remote access services restricted", "os": ["windows", "linux", "macos"], "baseline_keys": ["APPROVED_REMOTE_SERVICES"], "rule": "Only remote access services listed in APPROVED_REMOTE_SERVICES are enabled.", "controls": { "iso27001": ["A.8.20", "A.6.7"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
+    { "id": "gdpr.telemetry", "section": "gdpr", "name": "Diagnostic data minimised", "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "OS diagnostic/usage data sharing is at the minimum level.", "controls": { "iso27001": ["A.5.34"], "gdpr": ["Art. 5(1)(c)", "Art. 25"], "ai_act": [] } },
+    { "id": "gdpr.personal_data_discovery", "section": "gdpr", "name": "Personal data discovery", "os": ["windows", "linux", "macos"], "baseline_keys": ["PERSONAL_DATA_SCAN"], "rule": "Opt-in scan of user folders for personal data patterns (counts and paths only). Not implemented in stage 1: NotApplicable.", "controls": { "iso27001": ["A.5.34", "A.5.12"], "gdpr": ["Art. 5(1)(c)", "Art. 5(1)(e)", "Art. 30"], "ai_act": [] } },
+
+    { "id": "aiact.inventory", "section": "aiact", "name": "AI software inventory", "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "AI apps, local AI services and local model folders are listed (Compliant = inventory taken).", "controls": { "iso27001": ["A.5.9"], "gdpr": ["Art. 30"], "ai_act": ["Art. 26"] } },
+    { "id": "aiact.unapproved", "section": "aiact", "name": "Unapproved AI tools (shadow AI)", "os": ["windows", "linux", "macos"], "baseline_keys": ["APPROVED_AI_TOOLS"], "rule": "Every AI tool found is listed in APPROVED_AI_TOOLS.", "controls": { "iso27001": ["A.5.9", "A.8.19"], "gdpr": ["Art. 28", "Art. 44"], "ai_act": ["Art. 26"] } },
+    { "id": "aiact.risk_classification", "section": "aiact", "name": "AI system risk classification", "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "Each AI tool found is classified (prohibited / high-risk / limited / minimal). Done by the auditor model: Pending in the collector output, NotApplicable when no AI tool is found.", "controls": { "iso27001": ["A.5.9"], "gdpr": [], "ai_act": ["Art. 5", "Art. 6", "Annex III"] } },
+    { "id": "aiact.os_ai_features", "section": "aiact", "name": "Operating system AI features restricted", "names": { "windows": "Windows Recall / Copilot data analysis disabled", "macos": "Apple Intelligence external integrations restricted" }, "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "OS-level AI features that capture or send user data are disabled by policy. NotApplicable where the OS has none.", "controls": { "iso27001": ["A.5.34"], "gdpr": ["Art. 5(1)(c)", "Art. 25"], "ai_act": ["Art. 26"] } },
+    { "id": "aiact.log_retention", "section": "aiact", "name": "AI usage log retention", "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "Logs kept >= 6 months if a high-risk AI system is used. Pending until classification; NotApplicable when no AI tool is found.", "controls": { "iso27001": ["A.8.15"], "gdpr": [], "ai_act": ["Art. 26(6)"] } },
+
+    { "id": "org.ropa", "section": "org", "name": "Record of processing activities", "os": ["windows", "linux", "macos"], "answer_key": "ORG_ROPA", "question": "Is there a current record of processing activities (RoPA)?", "baseline_keys": [], "rule": "Answer yes = Compliant, no/partial = Non-Compliant, n/a = NotApplicable, unanswered = Pending.", "controls": { "iso27001": ["A.5.34"], "gdpr": ["Art. 30"], "ai_act": [] } },
+    { "id": "org.dpia", "section": "org", "name": "Data protection impact assessment", "os": ["windows", "linux", "macos"], "answer_key": "ORG_DPIA", "question": "Has a DPIA been done for every high-risk processing activity?", "baseline_keys": [], "rule": "As above.", "controls": { "iso27001": ["A.5.34"], "gdpr": ["Art. 35"], "ai_act": [] } },
+    { "id": "org.breach_procedure", "section": "org", "name": "Breach response procedure", "os": ["windows", "linux", "macos"], "answer_key": "ORG_BREACH_PROCEDURE", "question": "Is there a tested procedure to report a personal data breach within 72 hours?", "baseline_keys": [], "rule": "As above.", "controls": { "iso27001": ["A.5.24", "A.5.26"], "gdpr": ["Art. 33", "Art. 34"], "ai_act": [] } },
+    { "id": "org.processor_agreements", "section": "org", "name": "Data processing agreements", "os": ["windows", "linux", "macos"], "answer_key": "ORG_PROCESSOR_AGREEMENTS", "question": "Are data processing agreements signed with all processors, including AI providers?", "baseline_keys": [], "rule": "As above.", "controls": { "iso27001": ["A.5.20"], "gdpr": ["Art. 28"], "ai_act": [] } },
+    { "id": "org.ai_register", "section": "org", "name": "AI register", "os": ["windows", "linux", "macos"], "answer_key": "ORG_AI_REGISTER", "question": "Is there a register of the AI systems the organisation uses?", "baseline_keys": [], "rule": "As above.", "controls": { "iso27001": ["A.5.9"], "gdpr": [], "ai_act": ["Art. 26"] } },
+    { "id": "org.ai_literacy", "section": "org", "name": "AI literacy training", "os": ["windows", "linux", "macos"], "answer_key": "ORG_AI_LITERACY", "question": "Have staff who use AI received AI literacy training?", "baseline_keys": [], "rule": "As above.", "controls": { "iso27001": ["A.6.3"], "gdpr": [], "ai_act": ["Art. 4"] } },
+    { "id": "org.human_oversight", "section": "org", "name": "Human oversight for high-risk AI", "os": ["windows", "linux", "macos"], "answer_key": "ORG_HUMAN_OVERSIGHT", "question": "Is a trained person assigned to oversee each high-risk AI system?", "baseline_keys": [], "rule": "As above.", "controls": { "iso27001": [], "gdpr": [], "ai_act": ["Art. 14", "Art. 26"] } },
+    { "id": "org.ai_transparency", "section": "org", "name": "AI transparency to users", "os": ["windows", "linux", "macos"], "answer_key": "ORG_AI_TRANSPARENCY", "question": "Are people told when they interact with AI or receive AI-generated content?", "baseline_keys": [], "rule": "As above.", "controls": { "iso27001": [], "gdpr": [], "ai_act": ["Art. 50"] } }
+  ]
+}

collectors/linux/audit.sh

@@ -0,0 +1,688 @@
+#!/bin/bash
+# Devseis endpoint audit - Linux collector (Ubuntu/Debian and RHEL family)
+#
+# READ-ONLY: this script only reads settings. It never changes the system.
+# The only files it writes are the report (.txt) and evidence (.json) in the output folder.
+#
+# Run as root for complete results:   sudo ./audit.sh
+# Options: --baseline FILE  --org FILE  --output DIR  --help
+
+set -u
+
+COLLECTOR_VERSION="0.1.0"
+CATALOG_VERSION="0.1.0"
+
+SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
+ROOT_DIR=$(cd "$SCRIPT_DIR/../.." && pwd)
+BASELINE_FILE="$ROOT_DIR/baseline.conf"
+ORG_FILE="$ROOT_DIR/organisational.conf"
+OUTPUT_DIR="/var/log/devseis-endpoint-audit"
+
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --baseline) BASELINE_FILE="$2"; shift 2 ;;
+        --org) ORG_FILE="$2"; shift 2 ;;
+        --output) OUTPUT_DIR="$2"; shift 2 ;;
+        -h|--help) sed -n '2,9p' "$0"; exit 0 ;;
+        *) echo "Unknown option: $1" >&2; exit 2 ;;
+    esac
+done
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+# Read KEY=VALUE from a config file without executing it. Usage: conf_get FILE KEY DEFAULT
+conf_get() {
+    local value=""
+    if [ -r "$1" ]; then
+        value=$(awk -v key="$2" '
+            /^[[:space:]]*#/ { next }
+            index($0, "=") { k = substr($0, 1, index($0, "=") - 1); gsub(/[[:space:]]/, "", k)
+                             if (k == key) { v = substr($0, index($0, "=") + 1) } }
+            END { print v }' "$1")
+        value=$(printf '%s' "$value" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//' -e 's/^"\(.*\)"$/\1/')
+    fi
+    if [ -n "$value" ]; then printf '%s' "$value"; else printf '%s' "$3"; fi
+}
+
+BASELINE_KEYS="PASSWORD_MIN_LENGTH PASSWORD_HISTORY PASSWORD_MAX_AGE_DAYS PASSWORD_MIN_AGE_DAYS PASSWORD_COMPLEXITY LOCKOUT_THRESHOLD_MAX LOCKOUT_DURATION_MIN_MINUTES LOCKOUT_OBSERVATION_MIN_MINUTES SIGNATURE_MAX_AGE_DAYS MACOS_XPROTECT_MAX_AGE_DAYS FIREWALL_OUTBOUND SCREEN_LOCK_MAX_SECONDS USB_READ USB_WRITE APPROVED_ADMINS ALLOW_DISABLED_BUILTIN_ADMIN UPDATES_MAX_AGE_DAYS BACKUP_MAX_AGE_DAYS APPROVED_REMOTE_SERVICES WINDOWS_MIN_BUILD MACOS_MIN_MAJOR UBUNTU_MIN_VERSION DEBIAN_MIN_VERSION RHEL_MIN_VERSION PERSONAL_DATA_SCAN APPROVED_AI_TOOLS"
+declare -A B
+B[PASSWORD_MIN_LENGTH]=14; B[PASSWORD_HISTORY]=24; B[PASSWORD_MAX_AGE_DAYS]=365; B[PASSWORD_MIN_AGE_DAYS]=1
+B[PASSWORD_COMPLEXITY]=1; B[LOCKOUT_THRESHOLD_MAX]=5; B[LOCKOUT_DURATION_MIN_MINUTES]=15; B[LOCKOUT_OBSERVATION_MIN_MINUTES]=15
+B[SIGNATURE_MAX_AGE_DAYS]=3; B[MACOS_XPROTECT_MAX_AGE_DAYS]=30; B[FIREWALL_OUTBOUND]=allow; B[SCREEN_LOCK_MAX_SECONDS]=900
+B[USB_READ]=allow; B[USB_WRITE]=deny; B[APPROVED_ADMINS]=""; B[ALLOW_DISABLED_BUILTIN_ADMIN]=1
+B[UPDATES_MAX_AGE_DAYS]=30; B[BACKUP_MAX_AGE_DAYS]=7; B[APPROVED_REMOTE_SERVICES]=""; B[WINDOWS_MIN_BUILD]=22631
+B[MACOS_MIN_MAJOR]=14; B[UBUNTU_MIN_VERSION]=22.04; B[DEBIAN_MIN_VERSION]=12; B[RHEL_MIN_VERSION]=9
+B[PERSONAL_DATA_SCAN]=0; B[APPROVED_AI_TOOLS]=""
+for key in $BASELINE_KEYS; do B[$key]=$(conf_get "$BASELINE_FILE" "$key" "${B[$key]}"); done
+
+is_root() { [ "$(id -u)" -eq 0 ]; }
+is_int() { case "$1" in ''|*[!0-9-]*) return 1 ;; *) return 0 ;; esac; }
+lower() { printf '%s' "$1" | tr '[:upper:]' '[:lower:]'; }
+have() { command -v "$1" >/dev/null 2>&1; }
+days_since() { echo $(( ( $(date +%s) - $1 ) / 86400 )); }
+active() { have systemctl && systemctl is-active --quiet "$1" 2>/dev/null; }
+enabled() { have systemctl && systemctl is-enabled --quiet "$1" 2>/dev/null; }
+version_ge() { [ "$(printf '%s\n%s\n' "$2" "$1" | sort -V | head -1)" = "$2" ]; }
+
+# Is VALUE in a comma-separated LIST? Case-insensitive, "*" wildcards allowed.
+in_list() {
+    local value item found=1
+    value=$(lower "$1")
+    set -f
+    local IFS=,
+    for item in $2; do
+        item=$(lower "$(printf '%s' "$item" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')")
+        [ -z "$item" ] && continue
+        # shellcheck disable=SC2254
+        case "$value" in $item) found=0; break ;; esac
+    done
+    set +f
+    return $found
+}
+
+json_escape() {
+    printf '%s' "$1" | sed -e 's/\\/\\\\/g' -e 's/"/\\"/g' -e 's/\t/\\t/g' | awk 'NR > 1 { printf "\\n" } { printf "%s", $0 }' | tr -d '\000-\010\013\014\016-\037'
+}
+
+R_ID=(); R_SECTION=(); R_NAME=(); R_STATUS=(); R_ACTUAL=(); R_EXPECTED=(); R_DETAIL=()
+add() { # id section name status actual expected [detail]
+    R_ID+=("$1"); R_SECTION+=("$2"); R_NAME+=("$3"); R_STATUS+=("$4")
+    R_ACTUAL+=("$5"); R_EXPECTED+=("$6"); R_DETAIL+=("${7:-}")
+}
+needs_root() { add "$1" "$2" "$3" "Error" "not read" "$4" "Requires root: run the collector with sudo."; }
+pass_fail() { # condition-result(0/1) id section name actual expected [detail]
+    local ok=$1; shift
+    if [ "$ok" -eq 0 ]; then add "$1" "$2" "$3" Compliant "$4" "$5" "${6:-}"; else add "$1" "$2" "$3" Non-Compliant "$4" "$5" "${6:-}"; fi
+}
+
+# Human accounts: UID >= UID_MIN, a real login shell and a home directory.
+UID_MIN=$(awk '$1 == "UID_MIN" { print $2 }' /etc/login.defs 2>/dev/null); UID_MIN=${UID_MIN:-1000}
+HUMAN_USERS=$(awk -F: -v min="$UID_MIN" '$3 >= min && $3 < 60000 && $7 !~ /(nologin|false)$/ { print $1 ":" $3 ":" $6 }' /etc/passwd)
+
+# Run a read-only command as another user (for per-user desktop settings).
+as_user() { # user uid home command...
+    local user=$1 uid=$2 home=$3; shift 3
+    if is_root; then
+        runuser -u "$user" -- env HOME="$home" XDG_RUNTIME_DIR="/run/user/$uid" DBUS_SESSION_BUS_ADDRESS="unix:path=/run/user/$uid/bus" "$@" 2>/dev/null
+    elif [ "$(id -un)" = "$user" ]; then
+        "$@" 2>/dev/null
+    fi
+}
+
+# ---------------------------------------------------------------------------
+# Host information
+# ---------------------------------------------------------------------------
+# shellcheck disable=SC1091
+OS_ID=$(. /etc/os-release 2>/dev/null; echo "${ID:-linux}")
+OS_LIKE=$(. /etc/os-release 2>/dev/null; echo "${ID_LIKE:-}")
+OS_PRETTY=$(. /etc/os-release 2>/dev/null; echo "${PRETTY_NAME:-Linux}")
+OS_VERSION=$(. /etc/os-release 2>/dev/null; echo "${VERSION_ID:-unknown}")
+KERNEL=$(uname -r)
+ARCH=$(uname -m)
+HOSTNAME_VALUE=$(hostname 2>/dev/null || cat /etc/hostname)
+SERIAL=$(cat /sys/class/dmi/id/product_serial 2>/dev/null); SERIAL=${SERIAL:-unknown}
+EXEC_USER=$(id -un)
+AUDIT_DATE=$(date '+%Y-%m-%d %H:%M:%S %Z')
+STARTED_AT=$(date '+%Y-%m-%dT%H:%M:%S%:z')
+IS_ADMIN=false; is_root && IS_ADMIN=true
+
+case " $OS_ID $OS_LIKE " in
+    *" debian "*|*" ubuntu "*) FAMILY=debian; PAM_PASSWORD="/etc/pam.d/common-password"; PAM_AUTH="/etc/pam.d/common-auth" ;;
+    *" rhel "*|*" fedora "*|*" centos "*) FAMILY=rhel; PAM_PASSWORD="/etc/pam.d/system-auth /etc/pam.d/password-auth"; PAM_AUTH="/etc/pam.d/system-auth /etc/pam.d/password-auth" ;;
+    *) FAMILY=other; PAM_PASSWORD="/etc/pam.d/common-password /etc/pam.d/system-auth"; PAM_AUTH="/etc/pam.d/common-auth /etc/pam.d/system-auth" ;;
+esac
+
+# ---------------------------------------------------------------------------
+# 1. Security baseline
+# ---------------------------------------------------------------------------
+S=baseline
+
+# PAM module line (non-comment) for a module in the given files.
+pam_line() { # module files...
+    local module=$1; shift
+    # shellcheck disable=SC2086
+    grep -hE "^[[:space:]]*[a-z-]+[[:space:]].*$module" $@ 2>/dev/null | head -1
+}
+pam_arg() { printf '%s' "$1" | grep -oE "(^|[[:space:]])$2=[^[:space:]]+" | head -1 | cut -d= -f2; }
+conf_value() { # key files... -> last "key = value" in the files
+    local key=$1; shift
+    # shellcheck disable=SC2068
+    cat $@ 2>/dev/null | awk -v k="$key" '/^[[:space:]]*#/ { next } { line = $0; gsub(/[[:space:]]/, "", line) } index(line, k "=") == 1 { v = substr(line, length(k) + 2) } END { print v }'
+}
+
+PWQ_LINE=$(pam_line pam_pwquality.so $PAM_PASSWORD)
+PWQ_CONF="/etc/security/pwquality.conf $(ls /etc/security/pwquality.conf.d/*.conf 2>/dev/null | tr '\n' ' ')"
+pwq() { # key default -> value from the PAM arguments, else pwquality.conf, else default
+    local v
+    v=$(pam_arg "$PWQ_LINE" "$1")
+    # shellcheck disable=SC2086
+    [ -z "$v" ] && v=$(conf_value "$1" $PWQ_CONF)
+    printf '%s' "${v:-$2}"
+}
+UNIX_LINE=$(pam_line pam_unix.so $PAM_PASSWORD)
+
+if [ -n "$PWQ_LINE" ]; then
+    min_len=$(pwq minlen 8)
+    detail="pam_pwquality"
+else
+    min_len=$(pam_arg "$UNIX_LINE" minlen); min_len=${min_len:-6}
+    detail="pam_pwquality not enabled; pam_unix minimum"
+fi
+[ "$min_len" -ge "${B[PASSWORD_MIN_LENGTH]}" ] 2>/dev/null; pass_fail $? password.min_length $S "Minimum password length" "$min_len" ">= ${B[PASSWORD_MIN_LENGTH]}" "$detail"
+
+PWH_LINE=$(pam_line pam_pwhistory.so $PAM_PASSWORD)
+if [ -n "$PWH_LINE" ]; then
+    remember=$(pam_arg "$PWH_LINE" remember); [ -z "$remember" ] && remember=$(conf_value remember /etc/security/pwhistory.conf)
+    remember=${remember:-10}
+else
+    remember=$(pam_arg "$UNIX_LINE" remember); remember=${remember:-0}
+fi
+[ "$remember" -ge "${B[PASSWORD_HISTORY]}" ] 2>/dev/null; pass_fail $? password.history $S "Password history" "$remember" ">= ${B[PASSWORD_HISTORY]}"
+
+defs() { awk -v k="$1" '$1 == k { print $2 }' /etc/login.defs 2>/dev/null | tail -1; }
+max_days=$(defs PASS_MAX_DAYS); min_days=$(defs PASS_MIN_DAYS)
+# Existing human accounts with a password: their own max/min age (needs /etc/shadow).
+shadow_out=""; shadow_min_out=""
+if is_root; then
+    for entry in $HUMAN_USERS; do
+        u=${entry%%:*}
+        line=$(grep "^$u:" /etc/shadow)
+        hash=$(echo "$line" | cut -d: -f2); umin=$(echo "$line" | cut -d: -f4); umax=$(echo "$line" | cut -d: -f5)
+        case "$hash" in '!'*|'*'*|'') continue ;; esac
+        if [ "${B[PASSWORD_MAX_AGE_DAYS]}" -gt 0 ] && { ! is_int "$umax" || [ "$umax" -lt 1 ] || [ "$umax" -gt "${B[PASSWORD_MAX_AGE_DAYS]}" ]; }; then
+            shadow_out="${shadow_out:+$shadow_out, }$u (${umax:-never})"
+        fi
+        if ! is_int "$umin" || [ "$umin" -lt "${B[PASSWORD_MIN_AGE_DAYS]}" ]; then
+            shadow_min_out="${shadow_min_out:+$shadow_min_out, }$u (${umin:-0})"
+        fi
+    done
+fi
+if [ "${B[PASSWORD_MAX_AGE_DAYS]}" -eq 0 ]; then
+    add password.expiration $S "Password expiration" Compliant "PASS_MAX_DAYS ${max_days:-unset}" "not required" "Baseline does not require expiry."
+elif is_int "$max_days" && [ "$max_days" -ge 1 ] && [ "$max_days" -le "${B[PASSWORD_MAX_AGE_DAYS]}" ] && [ -z "$shadow_out" ]; then
+    add password.expiration $S "Password expiration" Compliant "$max_days days" "1-${B[PASSWORD_MAX_AGE_DAYS]} days" "$(is_root || echo 'Existing accounts not checked (needs root).')"
+else
+    add password.expiration $S "Password expiration" Non-Compliant "PASS_MAX_DAYS ${max_days:-unset}${shadow_out:+; accounts: $shadow_out}" "1-${B[PASSWORD_MAX_AGE_DAYS]} days"
+fi
+if is_int "$min_days" && [ "$min_days" -ge "${B[PASSWORD_MIN_AGE_DAYS]}" ] && [ -z "$shadow_min_out" ]; then
+    add password.min_age $S "Minimum password age" Compliant "$min_days days" ">= ${B[PASSWORD_MIN_AGE_DAYS]} days"
+else
+    add password.min_age $S "Minimum password age" Non-Compliant "PASS_MIN_DAYS ${min_days:-unset}${shadow_min_out:+; accounts: $shadow_min_out}" ">= ${B[PASSWORD_MIN_AGE_DAYS]} days"
+fi
+
+if [ -n "$PWQ_LINE" ]; then
+    minclass=$(pwq minclass 0); negatives=0
+    for credit in dcredit ucredit lcredit ocredit; do
+        c=$(pwq "$credit" 0); [ "${c:-0}" -lt 0 ] 2>/dev/null && negatives=$((negatives + 1))
+    done
+    { [ "$minclass" -ge 3 ] 2>/dev/null || [ "$negatives" -ge 3 ]; }
+    pass_fail $? password.complexity $S "Password complexity" "minclass=$minclass, required classes=$negatives" "3 or more character classes"
+else
+    add password.complexity $S "Password complexity" Non-Compliant "pam_pwquality not enabled" "3 or more character classes"
+fi
+
+FL_LINE=$(pam_line pam_faillock.so $PAM_AUTH)
+fl() { local v; v=$(pam_arg "$FL_LINE" "$1"); [ -z "$v" ] && v=$(conf_value "$1" /etc/security/faillock.conf); printf '%s' "${v:-$2}"; }
+if [ -n "$FL_LINE" ]; then
+    deny=$(fl deny 3); unlock=$(fl unlock_time 600); interval=$(fl fail_interval 900)
+    { [ "$deny" -ge 1 ] && [ "$deny" -le "${B[LOCKOUT_THRESHOLD_MAX]}" ]; } 2>/dev/null
+    pass_fail $? lockout.threshold $S "Account lockout threshold" "$deny" "1-${B[LOCKOUT_THRESHOLD_MAX]}" "pam_faillock"
+    if [ "$unlock" = "0" ] || [ "$unlock" = "never" ]; then
+        add lockout.duration $S "Account lockout duration" Compliant "until an administrator unlocks" ">= ${B[LOCKOUT_DURATION_MIN_MINUTES]} minutes"
+    else
+        [ "$unlock" -ge $(( B[LOCKOUT_DURATION_MIN_MINUTES] * 60 )) ] 2>/dev/null
+        pass_fail $? lockout.duration $S "Account lockout duration" "$(( unlock / 60 )) minutes" ">= ${B[LOCKOUT_DURATION_MIN_MINUTES]} minutes"
+    fi
+    [ "$interval" -ge $(( B[LOCKOUT_OBSERVATION_MIN_MINUTES] * 60 )) ] 2>/dev/null
+    pass_fail $? lockout.observation $S "Lockout observation period" "$(( interval / 60 )) minutes" ">= ${B[LOCKOUT_OBSERVATION_MIN_MINUTES]} minutes"
+else
+    add lockout.threshold $S "Account lockout threshold" Non-Compliant "pam_faillock not enabled" "1-${B[LOCKOUT_THRESHOLD_MAX]}"
+    add lockout.duration $S "Account lockout duration" Non-Compliant "no lockout" ">= ${B[LOCKOUT_DURATION_MIN_MINUTES]} minutes"
+    add lockout.observation $S "Lockout observation period" Non-Compliant "no lockout" ">= ${B[LOCKOUT_OBSERVATION_MIN_MINUTES]} minutes"
+fi
+
+# Malware protection: ClamAV, or another endpoint protection product.
+other_av=""
+active mdatp && other_av="${other_av:+$other_av, }Microsoft Defender for Endpoint"
+active falcon-sensor && other_av="${other_av:+$other_av, }CrowdStrike Falcon"
+active sentinelone && other_av="${other_av:+$other_av, }SentinelOne"
+active sophos-spl && other_av="${other_av:+$other_av, }Sophos"
+active esets && other_av="${other_av:+$other_av, }ESET"
+clamd=""; for svc in clamav-daemon clamd@scan clamd; do active "$svc" && clamd=$svc && break; done
+freshclam=""; for svc in clamav-freshclam freshclam clamav-freshclam.timer; do active "$svc" && freshclam=$svc && break; done
+clamonacc=0; { active clamav-clamonacc || pgrep -x clamonacc >/dev/null 2>&1; } && clamonacc=1
+
+if [ -n "$clamd" ] || [ -n "$other_av" ]; then
+    add malware.antivirus $S "Antivirus" Compliant "${clamd:+ClamAV ($clamd)}${clamd:+${other_av:+, }}$other_av" "antivirus running"
+else
+    add malware.antivirus $S "Antivirus" Non-Compliant "none running" "antivirus running"
+fi
+if [ -n "$other_av" ] && [ -z "$clamd" ]; then
+    na="Another endpoint protection product is used: $other_av"
+    add malware.service $S "ClamAV malware protection service" NotApplicable "not used" "running" "$na"
+    add malware.signature_updates $S "Malware signature updates" NotApplicable "not used" "automatic" "$na"
+    add malware.signatures $S "Malware signatures" NotApplicable "not used" "<= ${B[SIGNATURE_MAX_AGE_DAYS]} days old" "$na"
+    add malware.on_access $S "On-access malware protection" Compliant "$other_av" "on-access scanning" "Provided by $other_av."
+else
+    [ -n "$clamd" ]; pass_fail $? malware.service $S "ClamAV malware protection service" "${clamd:-not running}" "running"
+    [ -n "$freshclam" ]; pass_fail $? malware.signature_updates $S "Malware signature updates" "${freshclam:-freshclam not running}" "automatic"
+    db=$(ls -t /var/lib/clamav/daily.c[lv]d /var/lib/clamav/daily.cld /var/lib/clamav/daily.cvd 2>/dev/null | head -1)
+    if [ -n "$db" ]; then
+        age=$(days_since "$(stat -c %Y "$db")")
+        [ "$age" -le "${B[SIGNATURE_MAX_AGE_DAYS]}" ]; pass_fail $? malware.signatures $S "Malware signatures" "$age days old" "<= ${B[SIGNATURE_MAX_AGE_DAYS]} days old" "$db"
+    else
+        add malware.signatures $S "Malware signatures" Non-Compliant "no signature database" "<= ${B[SIGNATURE_MAX_AGE_DAYS]} days old"
+    fi
+    [ "$clamonacc" -eq 1 ]; pass_fail $? malware.on_access $S "On-access malware protection" "$( [ "$clamonacc" -eq 1 ] && echo "clamonacc running" || echo "not running")" "on-access scanning"
+fi
+
+# Firewall: ufw, firewalld, nftables or iptables.
+fw_name=""; fw_in=""; fw_out=""; fw_detail=""
+if have ufw && is_root; then
+    ufw_out=$(ufw status verbose 2>/dev/null)
+    if printf '%s' "$ufw_out" | grep -q "Status: active"; then
+        fw_name=ufw
+        defaults=$(printf '%s' "$ufw_out" | sed -n 's/^Default: //p')
+        fw_in=$(printf '%s' "$defaults" | grep -oE '(deny|reject|allow) \(incoming\)' | cut -d' ' -f1)
+        fw_out=$(printf '%s' "$defaults" | grep -oE '(deny|reject|allow) \(outgoing\)' | cut -d' ' -f1)
+    fi
+fi
+if [ -z "$fw_name" ] && active firewalld; then
+    fw_name=firewalld
+    zone=$(firewall-cmd --get-default-zone 2>/dev/null)
+    target=$(firewall-cmd --permanent --zone="$zone" --get-target 2>/dev/null)
+    case "$target" in ACCEPT) fw_in=allow ;; *) fw_in=deny ;; esac
+    fw_out=allow; fw_detail="default zone $zone, target ${target:-default}"
+fi
+if [ -z "$fw_name" ] && have nft && is_root; then
+    ruleset=$(nft list ruleset 2>/dev/null)
+    if printf '%s' "$ruleset" | grep -q "hook input"; then
+        fw_name=nftables
+        printf '%s' "$ruleset" | grep -E "hook input.*policy drop" >/dev/null && fw_in=deny || fw_in=allow
+        printf '%s' "$ruleset" | grep -E "hook output.*policy drop" >/dev/null && fw_out=deny || fw_out=allow
+    fi
+fi
+if [ -z "$fw_name" ] && have iptables && is_root; then
+    if iptables -S INPUT 2>/dev/null | grep -q "^-P INPUT DROP"; then
+        fw_name=iptables; fw_in=deny
+        iptables -S OUTPUT 2>/dev/null | grep -q "^-P OUTPUT DROP" && fw_out=deny || fw_out=allow
+    fi
+fi
+if [ -z "$fw_name" ] && ! is_root; then
+    needs_root firewall.enabled $S "Firewall" "active"
+    needs_root firewall.inbound $S "Firewall inbound policy" "deny"
+    needs_root firewall.outbound $S "Firewall outbound policy" "${B[FIREWALL_OUTBOUND]}"
+elif [ -z "$fw_name" ]; then
+    add firewall.enabled $S "Firewall" Non-Compliant "no active firewall" "active"
+    add firewall.inbound $S "Firewall inbound policy" Non-Compliant "allow (no firewall)" "deny"
+    add firewall.outbound $S "Firewall outbound policy" Non-Compliant "no firewall" "${B[FIREWALL_OUTBOUND]}"
+else
+    add firewall.enabled $S "Firewall" Compliant "$fw_name active" "active" "$fw_detail"
+    case "$fw_in" in deny|reject) pass_fail 0 firewall.inbound $S "Firewall inbound policy" "$fw_in" "deny" ;; *) pass_fail 1 firewall.inbound $S "Firewall inbound policy" "${fw_in:-unknown}" "deny" ;; esac
+    out_expected=$(lower "${B[FIREWALL_OUTBOUND]}")
+    case "$fw_out" in reject) fw_out_norm=deny ;; *) fw_out_norm=$fw_out ;; esac
+    [ "$fw_out_norm" = "$out_expected" ]; pass_fail $? firewall.outbound $S "Firewall outbound policy" "${fw_out:-unknown}" "$out_expected"
+fi
+
+# Screen lock (GNOME settings, per user).
+if ! have gsettings || ! gsettings list-schemas 2>/dev/null | grep -q '^org.gnome.desktop.screensaver$'; then
+    for pair in "screen_lock.enabled:Screen lock:on" "screen_lock.timeout:Screen lock timeout:<= ${B[SCREEN_LOCK_MAX_SECONDS]} seconds" "screen_lock.password:Screen lock password requirement:password required"; do
+        IFS=: read -r cid cname cexp <<< "$pair"
+        add "$cid" $S "$cname" NotApplicable "no GNOME desktop" "$cexp" "No graphical desktop settings found."
+    done
+else
+    lock_bad=""; timeout_bad=""; pass_bad=""; checked=""
+    for entry in $HUMAN_USERS; do
+        IFS=: read -r u uid home <<< "$entry"
+        enabled_v=$(as_user "$u" "$uid" "$home" gsettings get org.gnome.desktop.screensaver lock-enabled)
+        [ -z "$enabled_v" ] && continue
+        checked="${checked:+$checked, }$u"
+        idle=$(as_user "$u" "$uid" "$home" gsettings get org.gnome.desktop.session idle-delay | awk '{ print $NF }')
+        delay=$(as_user "$u" "$uid" "$home" gsettings get org.gnome.desktop.screensaver lock-delay | awk '{ print $NF }')
+        no_lock=$(as_user "$u" "$uid" "$home" gsettings get org.gnome.desktop.lockdown disable-lock-screen)
+        { [ "$enabled_v" = "true" ] && [ "${idle:-0}" -gt 0 ]; } || lock_bad="${lock_bad:+$lock_bad, }$u"
+        { [ "${idle:-0}" -gt 0 ] && [ $(( idle + ${delay:-0} )) -le "${B[SCREEN_LOCK_MAX_SECONDS]}" ]; } || timeout_bad="${timeout_bad:+$timeout_bad, }$u ($(( ${idle:-0} + ${delay:-0} ))s)"
+        { [ "$enabled_v" = "true" ] && [ "$no_lock" != "true" ]; } || pass_bad="${pass_bad:+$pass_bad, }$u"
+    done
+    if [ -z "$checked" ]; then
+        for pair in "screen_lock.enabled:Screen lock:on" "screen_lock.timeout:Screen lock timeout:<= ${B[SCREEN_LOCK_MAX_SECONDS]} seconds" "screen_lock.password:Screen lock password requirement:password required"; do
+            IFS=: read -r cid cname cexp <<< "$pair"
+            if is_root; then add "$cid" $S "$cname" NotApplicable "no desktop users" "$cexp"; else needs_root "$cid" $S "$cname" "$cexp"; fi
+        done
+    else
+        [ -z "$lock_bad" ]; pass_fail $? screen_lock.enabled $S "Screen lock" "${lock_bad:+off for: }${lock_bad:-on}" "on" "Users checked: $checked"
+        [ -z "$timeout_bad" ]; pass_fail $? screen_lock.timeout $S "Screen lock timeout" "${timeout_bad:+too long for: }${timeout_bad:-within limit}" "<= ${B[SCREEN_LOCK_MAX_SECONDS]} seconds" "Users checked: $checked"
+        [ -z "$pass_bad" ]; pass_fail $? screen_lock.password $S "Screen lock password requirement" "${pass_bad:+not required for: }${pass_bad:-required}" "password required" "Users checked: $checked"
+    fi
+fi
+
+# USB storage
+usb_read=allow; usb_write=allow; usb_detail=""
+if modprobe -n -v usb-storage 2>/dev/null | grep -qE "install[[:space:]]+/bin/(true|false)"; then
+    usb_read=deny; usb_write=deny; usb_detail="usb-storage module disabled"
+elif grep -rqsE '^[[:space:]]*blacklist[[:space:]]+usb[-_]storage' /etc/modprobe.d && ! lsmod 2>/dev/null | grep -q '^usb_storage'; then
+    usb_read=deny; usb_write=deny; usb_detail="usb-storage module blacklisted"
+elif active usbguard && grep -qsE '^ImplicitPolicyTarget=(block|reject)' /etc/usbguard/usbguard-daemon.conf; then
+    usb_read=deny; usb_write=deny; usb_detail="USBGuard blocks unknown devices"
+elif grep -rqsE 'usb.*(ATTR\{ro\}="1"|blockdev --setro)' /etc/udev/rules.d; then
+    usb_write=deny; usb_detail="udev rule makes USB storage read-only"
+fi
+[ "$usb_read" = "$(lower "${B[USB_READ]}")" ]; pass_fail $? usb.read $S "USB storage read" "$usb_read" "${B[USB_READ]}" "$usb_detail"
+[ "$usb_write" = "$(lower "${B[USB_WRITE]}")" ]; pass_fail $? usb.write $S "USB storage write" "$usb_write" "${B[USB_WRITE]}" "$usb_detail"
+
+# Administrators: sudo/admin/wheel groups, extra UID 0 accounts, sudoers entries.
+admins=""
+for group in sudo admin wheel; do
+    members=$(getent group "$group" 2>/dev/null | cut -d: -f4 | tr ',' ' ')
+    for m in $members; do admins="$admins $m"; done
+done
+for m in $(awk -F: '$3 == 0 && $1 != "root" { print $1 }' /etc/passwd); do admins="$admins $m"; done
+if is_root; then
+    for m in $(grep -hsE '^[a-zA-Z0-9_.-]+[[:space:]]+ALL[[:space:]]*=' /etc/sudoers /etc/sudoers.d/* | awk '{ print $1 }'); do
+        [ "$m" = "root" ] || admins="$admins $m"
+    done
+fi
+admins=$(printf '%s\n' $admins | sort -u | tr '\n' ' ')
+approved_found=""; unauthorized=""
+for user in $admins; do
+    if in_list "$user" "${B[APPROVED_ADMINS]}"; then approved_found="${approved_found:+$approved_found, }$user"
+    else unauthorized="${unauthorized:+$unauthorized, }$user"; fi
+done
+[ -n "$approved_found" ]; pass_fail $? admin.approved $S "Approved IT administrator" "${approved_found:-none of the approved accounts is an administrator}" "${B[APPROVED_ADMINS]:-none configured}"
+[ -z "$unauthorized" ]; pass_fail $? admin.unauthorized $S "Unauthorized employee administrator accounts" "${unauthorized:-none}" "none" "$(is_root || echo 'sudoers files not read (needs root).')"
+
+# Disk encryption (LUKS under the root filesystem)
+root_src=$(findmnt -no SOURCE / 2>/dev/null)
+# Btrfs subvolumes appear as /dev/mapper/x[/@]: keep the device part only.
+root_src=${root_src%%[*}
+crypt_name=$(lsblk -nslo NAME,TYPE "$root_src" 2>/dev/null | awk '$2 == "crypt" { print $1; exit }')
+if [ -n "$crypt_name" ]; then
+    add encryption.enabled $S "Encryption" Compliant "root filesystem on LUKS ($crypt_name)" "system disk encrypted"
+    if is_root; then
+        status=$(cryptsetup status "$crypt_name" 2>/dev/null)
+        ctype=$(printf '%s' "$status" | awk '/type:/ { print $2 }'); cipher=$(printf '%s' "$status" | awk '/cipher:/ { print $2 }')
+        keysize=$(printf '%s' "$status" | awk '/keysize:/ { print $2 }')
+        { printf '%s' "$status" | grep -q "is active" && ! printf '%s' "$status" | grep -qi suspended && [ "${keysize:-0}" -ge 256 ]; }
+        pass_fail $? encryption.protection $S "Disk encryption protection" "$ctype $cipher ${keysize:-?}-bit key" "active, strong cipher"
+        parent=$(lsblk -no PKNAME "/dev/mapper/$crypt_name" 2>/dev/null | head -1)
+        dump=$(cryptsetup luksDump "/dev/$parent" 2>/dev/null)
+        slots=$(printf '%s' "$dump" | awk '/^Keyslots:/ { k = 1; next } /^[A-Za-z]/ { k = 0 } k && /^[[:space:]]+[0-9]+: luks2/ { n++ } /^Key Slot [0-9]+: ENABLED/ { n++ } END { print n + 0 }')
+        tokens=$(printf '%s' "$dump" | grep -cE 'systemd-(tpm2|fido2|recovery)')
+        { [ "$slots" -ge 2 ] || [ "$tokens" -ge 1 ]; }
+        pass_fail $? encryption.recovery $S "Disk encryption recovery" "$slots key slots, $tokens unlock tokens" "recovery key or second unlock method"
+    else
+        needs_root encryption.protection $S "Disk encryption protection" "active, strong cipher"
+        needs_root encryption.recovery $S "Disk encryption recovery" "recovery key or second unlock method"
+    fi
+else
+    add encryption.enabled $S "Encryption" Non-Compliant "root filesystem not encrypted" "system disk encrypted"
+    add encryption.protection $S "Disk encryption protection" Non-Compliant "not encrypted" "active, strong cipher"
+    add encryption.recovery $S "Disk encryption recovery" Non-Compliant "not encrypted" "recovery key or second unlock method"
+fi
+
+# ---------------------------------------------------------------------------
+# 2. GDPR technical controls
+# ---------------------------------------------------------------------------
+S=gdpr
+
+if [ "$FAMILY" = "debian" ]; then
+    uu=$(apt-config dump 2>/dev/null | awk -F'"' '/^APT::Periodic::Unattended-Upgrade /{ print $2 }')
+    dpkg-query -W -f='${Status}' unattended-upgrades 2>/dev/null | grep -q "install ok installed" && uu_pkg=1 || uu_pkg=0
+    { [ "$uu" = "1" ] && [ "$uu_pkg" -eq 1 ]; }
+    pass_fail $? gdpr.auto_updates $S "Automatic security updates" "unattended-upgrades installed=$uu_pkg, enabled=${uu:-0}" "automatic"
+elif [ "$FAMILY" = "rhel" ]; then
+    apply=$(conf_value apply_updates /etc/dnf/automatic.conf)
+    { { enabled dnf-automatic-install.timer || { enabled dnf-automatic.timer && [ "$apply" = "yes" ]; }; }; }
+    pass_fail $? gdpr.auto_updates $S "Automatic security updates" "dnf-automatic timer $(enabled dnf-automatic.timer && echo on || echo off), apply_updates=${apply:-no}" "automatic"
+else
+    add gdpr.auto_updates $S "Automatic security updates" Pending "unknown distribution" "automatic" "Check the vendor's update mechanism."
+fi
+
+last_update=""
+if [ "$FAMILY" = "debian" ]; then
+    last_update=$(zcat -f /var/log/apt/history.log* 2>/dev/null | awk '/^Start-Date:/ { d = $2 " " $3 } /^Upgrade:/ { if (d > last) last = d } END { print last }')
+    [ -z "$last_update" ] && [ -f /var/lib/dpkg/status ] && last_update=$(date -d "@$(stat -c %Y /var/lib/dpkg/status)" '+%Y-%m-%d %H:%M:%S')
+elif have rpm; then
+    last_update=$(rpm -qa --last 2>/dev/null | head -1 | sed -E 's/^[^ ]+ +//')
+fi
+if [ -n "$last_update" ] && lu_epoch=$(date -d "$last_update" +%s 2>/dev/null); then
+    age=$(days_since "$lu_epoch")
+    [ "$age" -le "${B[UPDATES_MAX_AGE_DAYS]}" ]; pass_fail $? gdpr.updates_recent $S "Security updates installed recently" "$age days ago" "<= ${B[UPDATES_MAX_AGE_DAYS]} days ago" "Last package upgrade: $last_update"
+else
+    add gdpr.updates_recent $S "Security updates installed recently" Error "not read" "<= ${B[UPDATES_MAX_AGE_DAYS]} days ago" "No package upgrade history found."
+fi
+
+case "$OS_ID" in
+    ubuntu) version_ge "$OS_VERSION" "${B[UBUNTU_MIN_VERSION]}"; pass_fail $? gdpr.os_supported $S "Supported operating system version" "$OS_PRETTY" "Ubuntu ${B[UBUNTU_MIN_VERSION]} or later" ;;
+    debian) version_ge "${OS_VERSION%%.*}" "${B[DEBIAN_MIN_VERSION]}"; pass_fail $? gdpr.os_supported $S "Supported operating system version" "$OS_PRETTY" "Debian ${B[DEBIAN_MIN_VERSION]} or later" ;;
+    rhel|rocky|almalinux|centos) version_ge "${OS_VERSION%%.*}" "${B[RHEL_MIN_VERSION]}"; pass_fail $? gdpr.os_supported $S "Supported operating system version" "$OS_PRETTY" "RHEL ${B[RHEL_MIN_VERSION]} or later" ;;
+    *) add gdpr.os_supported $S "Supported operating system version" Pending "$OS_PRETTY" "vendor-supported release" "Unknown distribution: check the vendor's support dates." ;;
+esac
+
+journal="volatile"; [ -d /var/log/journal ] && journal="persistent"
+active auditd; pass_fail $? gdpr.security_logging $S "Security event logging" "auditd $(active auditd && echo running || echo 'not running'), journal $journal" "auditd running"
+
+ntp_sync=$(timedatectl show -p NTPSynchronized --value 2>/dev/null); ntp_on=$(timedatectl show -p NTP --value 2>/dev/null)
+{ [ "$ntp_on" = "yes" ] || active chronyd || active chrony || active ntpd || active ntp; }
+pass_fail $? gdpr.time_sync $S "Time synchronisation" "NTP service ${ntp_on:-unknown}, synchronised ${ntp_sync:-unknown}" "time synchronised"
+
+backup_tool=""; backup_date=""
+if [ -f /etc/timeshift/timeshift.json ] && grep -qE '"schedule_[a-z]+"[[:space:]]*:[[:space:]]*"true"' /etc/timeshift/timeshift.json; then
+    backup_tool="Timeshift"
+    snap=$(ls -1d /timeshift/snapshots/* /run/timeshift/*/backup/timeshift*/snapshots/* 2>/dev/null | grep -oE '[0-9]{4}-[0-9]{2}-[0-9]{2}_[0-9]{2}-[0-9]{2}-[0-9]{2}' | sort | tail -1)
+    [ -n "$snap" ] && backup_date=$(echo "$snap" | sed -E 's/_/ /; s/-([0-9]{2})-([0-9]{2})$/:\1:\2/')
+fi
+if have gsettings; then
+    for entry in $HUMAN_USERS; do
+        IFS=: read -r u uid home <<< "$entry"
+        if [ "$(as_user "$u" "$uid" "$home" gsettings get org.gnome.DejaDup periodic)" = "true" ]; then
+            backup_tool="${backup_tool:+$backup_tool, }Deja Dup ($u)"
+            last=$(as_user "$u" "$uid" "$home" gsettings get org.gnome.DejaDup last-backup | tr -d "'")
+            [ -n "$last" ] && { [ -z "$backup_date" ] || [[ "$last" > "$backup_date" ]]; } && backup_date=$last
+        fi
+    done
+fi
+timers=$(systemctl list-timers --all --no-legend 2>/dev/null | grep -oiE '[a-z0-9@_.-]*(restic|borg|backup)[a-z0-9@_.-]*\.timer' | sort -u | tr '\n' ' ')
+[ -n "$timers" ] && backup_tool="${backup_tool:+$backup_tool, }$timers"
+if [ -n "$backup_tool" ]; then
+    add gdpr.backup_configured $S "Backup configured" Compliant "$backup_tool" "backup configured"
+    if [ -n "$backup_date" ] && b_epoch=$(date -d "$backup_date" +%s 2>/dev/null); then
+        age=$(days_since "$b_epoch")
+        [ "$age" -le "${B[BACKUP_MAX_AGE_DAYS]}" ]; pass_fail $? gdpr.backup_recent $S "Recent backup" "$age days ago" "<= ${B[BACKUP_MAX_AGE_DAYS]} days ago"
+    else
+        add gdpr.backup_recent $S "Recent backup" Pending "date not readable" "<= ${B[BACKUP_MAX_AGE_DAYS]} days ago" "Confirm the last backup date in: $backup_tool"
+    fi
+else
+    add gdpr.backup_configured $S "Backup configured" Non-Compliant "none" "backup configured"
+    add gdpr.backup_recent $S "Recent backup" Non-Compliant "no backup" "<= ${B[BACKUP_MAX_AGE_DAYS]} days ago"
+fi
+
+[ "$usb_write" = "deny" ]; pass_fail $? gdpr.removable_encryption $S "Removable media encryption" "$( [ "$usb_write" = "deny" ] && echo "writing to USB storage blocked" || echo "USB storage writable without enforced encryption")" "no unencrypted writes"
+
+guest_issue=""
+grep -rqsiE '^[[:space:]]*allow-guest[[:space:]]*=[[:space:]]*true' /etc/lightdm && guest_issue="LightDM guest session allowed"
+awk -F: '$1 == "guest" && $7 !~ /(nologin|false)$/' /etc/passwd | grep -q . && guest_issue="${guest_issue:+$guest_issue; }guest account with login shell"
+[ -z "$guest_issue" ]; pass_fail $? gdpr.guest_account $S "Guest account disabled" "${guest_issue:-no guest login}" "no guest login"
+
+remote=""
+{ active ssh || active sshd || active ssh.socket; } && remote="${remote:+$remote, }ssh"
+active xrdp && remote="${remote:+$remote, }rdp"
+{ active gnome-remote-desktop || pgrep -x gnome-remote-de >/dev/null 2>&1; } && remote="${remote:+$remote, }rdp"
+pgrep -x -f '.*(x11vnc|Xvnc|vncserver).*' >/dev/null 2>&1 && remote="${remote:+$remote, }vnc"
+{ active smbd || active smb; } && remote="${remote:+$remote, }smb"
+active teamviewerd && remote="${remote:+$remote, }teamviewer"
+active anydesk && remote="${remote:+$remote, }anydesk"
+pgrep -f chrome-remote-desktop >/dev/null 2>&1 && remote="${remote:+$remote, }chromeremotedesktop"
+remote=$(printf '%s' "$remote" | tr ',' '\n' | sed 's/^ *//' | sort -u | paste -sd, - | sed 's/,/, /g')
+unapproved_remote=""
+IFS=, read -ra svcs <<< "$remote"
+for svc in "${svcs[@]}"; do
+    svc=$(printf '%s' "$svc" | sed 's/^ *//'); [ -z "$svc" ] && continue
+    in_list "$svc" "${B[APPROVED_REMOTE_SERVICES]}" || unapproved_remote="${unapproved_remote:+$unapproved_remote, }$svc"
+done
+[ -z "$unapproved_remote" ]; pass_fail $? gdpr.remote_access $S "Remote access services restricted" "${unapproved_remote:-${remote:-none enabled}}" "only: ${B[APPROVED_REMOTE_SERVICES]:-none}"
+
+telemetry=""
+grep -qsE '^PARTICIPATE="?yes' /etc/popularity-contest.conf && telemetry="popularity-contest on"
+active whoopsie && telemetry="${telemetry:+$telemetry, }whoopsie error reporting on"
+[ -z "$telemetry" ]; pass_fail $? gdpr.telemetry $S "Diagnostic data minimised" "${telemetry:-usage reporting off}" "usage reporting off"
+
+add gdpr.personal_data_discovery $S "Personal data discovery" NotApplicable "not run" "opt-in scan" "Opt-in scan (PERSONAL_DATA_SCAN=${B[PERSONAL_DATA_SCAN]}) is planned for a later stage."
+
+# ---------------------------------------------------------------------------
+# 3. EU AI Act controls
+# ---------------------------------------------------------------------------
+S=aiact
+
+ai_tools=""; ai_detail=""
+add_tool() { case ",$ai_tools," in *",$1,"*) ;; *) ai_tools="${ai_tools:+$ai_tools,}$1" ;; esac; }
+homes=$(printf '%s\n' "$HUMAN_USERS" | cut -d: -f3)
+for cli in "ollama:Ollama" "lms:LM Studio" "gpt4all:GPT4All" "jan:Jan" "claude:Claude Code"; do
+    name=${cli%%:*}
+    found=0; have "$name" && found=1
+    for h in $homes; do [ -x "$h/.local/bin/$name" ] && found=1; done
+    [ "$found" -eq 1 ] && add_tool "${cli##*:}"
+done
+if have snap; then
+    for s in $(snap list 2>/dev/null | awk 'NR > 1 { print $1 }'); do
+        case "$s" in *ollama*) add_tool Ollama ;; *gpt4all*) add_tool GPT4All ;; *chatgpt*) add_tool ChatGPT ;; *claude*) add_tool Claude ;; *lm-studio*|*lmstudio*) add_tool "LM Studio" ;; esac
+    done
+fi
+if have flatpak; then
+    for f in $(flatpak list --app --columns=application 2>/dev/null); do
+        case "$(lower "$f")" in *gpt4all*) add_tool GPT4All ;; *jan*) add_tool Jan ;; *alpaca*) add_tool "Alpaca (Ollama client)" ;; *chatgpt*) add_tool ChatGPT ;; esac
+    done
+fi
+for d in /opt/LM-Studio /opt/lm-studio /opt/Jan /opt/gpt4all; do [ -d "$d" ] && add_tool "$(basename "$d")"; done
+if ss -ltn 2>/dev/null | grep -q ':11434 '; then add_tool Ollama; ai_detail="${ai_detail}Local AI service listening on port 11434. "; fi
+for h in $homes /usr/share/ollama; do
+    for pair in ".ollama/models:Ollama" ".cache/lm-studio/models:LM Studio" ".lmstudio/models:LM Studio" ".local/share/nomic.ai/GPT4All:GPT4All" ".cache/huggingface/hub:Hugging Face models"; do
+        path="$h/${pair%%:*}"
+        if [ -d "$path" ] && [ -n "$(ls -A "$path" 2>/dev/null)" ]; then
+            add_tool "${pair##*:}"; ai_detail="${ai_detail}Local models: $path ($(du -sh "$path" 2>/dev/null | awk '{ print $1 }')). "
+        fi
+    done
+done
+ai_list=$(printf '%s' "$ai_tools" | sed 's/,/, /g')
+add aiact.inventory $S "AI software inventory" Compliant "${ai_list:-no AI tools found}" "inventory taken" "$ai_detail"
+
+unapproved_ai=""
+IFS=, read -ra tools <<< "$ai_tools"
+for tool in "${tools[@]}"; do
+    [ -z "$tool" ] && continue
+    in_list "$tool" "${B[APPROVED_AI_TOOLS]}" || unapproved_ai="${unapproved_ai:+$unapproved_ai, }$tool"
+done
+[ -z "$unapproved_ai" ]; pass_fail $? aiact.unapproved $S "Unapproved AI tools (shadow AI)" "${unapproved_ai:-none}" "only: ${B[APPROVED_AI_TOOLS]:-none}"
+
+if [ -n "$ai_tools" ]; then
+    add aiact.risk_classification $S "AI system risk classification" Pending "$ai_list" "every AI tool classified" "Classified by the auditor model (Caveat classifier) in a later step."
+    add aiact.os_ai_features $S "Operating system AI features restricted" NotApplicable "none built in" "restricted by policy" "Linux distributions ship no built-in AI assistant."
+    add aiact.log_retention $S "AI usage log retention" Pending "depends on classification" ">= 6 months for high-risk AI" "Required only if a tool is classified high-risk."
+else
+    add aiact.risk_classification $S "AI system risk classification" NotApplicable "no AI tools found" "every AI tool classified"
+    add aiact.os_ai_features $S "Operating system AI features restricted" NotApplicable "none built in" "restricted by policy" "Linux distributions ship no built-in AI assistant."
+    add aiact.log_retention $S "AI usage log retention" NotApplicable "no AI tools found" ">= 6 months for high-risk AI"
+fi
+
+# ---------------------------------------------------------------------------
+# 4. Organisational controls (answers from organisational.conf)
+# ---------------------------------------------------------------------------
+S=org
+org() { # id key name
+    local answer
+    answer=$(lower "$(conf_get "$ORG_FILE" "$2" "")")
+    case "$answer" in
+        yes) add "$1" $S "$3" Compliant "yes" "yes" ;;
+        no) add "$1" $S "$3" Non-Compliant "no" "yes" ;;
+        partial) add "$1" $S "$3" Non-Compliant "partial" "yes" ;;
+        n/a|na) add "$1" $S "$3" NotApplicable "n/a" "yes" ;;
+        *) add "$1" $S "$3" Pending "not answered" "yes" "Answer $2 in organisational.conf." ;;
+    esac
+}
+org org.ropa ORG_ROPA "Record of processing activities"
+org org.dpia ORG_DPIA "Data protection impact assessment"
+org org.breach_procedure ORG_BREACH_PROCEDURE "Breach response procedure"
+org org.processor_agreements ORG_PROCESSOR_AGREEMENTS "Data processing agreements"
+org org.ai_register ORG_AI_REGISTER "AI register"
+org org.ai_literacy ORG_AI_LITERACY "AI literacy training"
+org org.human_oversight ORG_HUMAN_OVERSIGHT "Human oversight for high-risk AI"
+org org.ai_transparency ORG_AI_TRANSPARENCY "AI transparency to users"
+
+# ---------------------------------------------------------------------------
+# Report
+# ---------------------------------------------------------------------------
+LINE="============================================================"
+print_section() { # section-id title
+    local i
+    echo "$LINE"; echo " $2"; echo "$LINE"
+    for i in "${!R_ID[@]}"; do
+        if [ "${R_SECTION[$i]}" = "$1" ]; then echo "${R_NAME[$i]}"; echo "${R_STATUS[$i]}"; fi
+    done
+}
+report() {
+    echo "$LINE"
+    echo " LINUX ENDPOINT SECURITY BASELINE - AUDIT"
+    echo "$LINE"
+    echo "Hostname        : $HOSTNAME_VALUE"
+    echo "Operating System: $OS_PRETTY"
+    echo "OS Version      : $OS_VERSION"
+    echo "Kernel          : $KERNEL"
+    echo "Serial Number   : $SERIAL"
+    echo "Execution User  : $EXEC_USER"
+    echo "Audit Date      : $AUDIT_DATE"
+    echo "Audit Mode      : READ-ONLY"
+    echo "$LINE"
+    print_section baseline "LINUX ENDPOINT SECURITY BASELINE - RESULTS"
+    print_section gdpr "GDPR TECHNICAL CONTROLS"
+    print_section aiact "EU AI ACT CONTROLS"
+    print_section org "ORGANISATIONAL CONTROLS"
+    echo "$LINE"
+    echo " END OF LINUX ENDPOINT SECURITY BASELINE AUDIT"
+    echo "$LINE"
+}
+
+count() { local i n=0; for i in "${!R_STATUS[@]}"; do [ "${R_STATUS[$i]}" = "$1" ] && n=$((n + 1)); done; echo $n; }
+
+evidence_json() {
+    local i key first=1
+    printf '{\n  "schema_version": "1.0",\n  "catalog_version": "%s",\n' "$CATALOG_VERSION"
+    printf '  "source": { "kind": "collector", "collector": "linux", "collector_version": "%s" },\n' "$COLLECTOR_VERSION"
+    printf '  "audit": { "mode": "READ-ONLY", "started_at": "%s", "execution_user": "%s", "is_admin": %s },\n' "$STARTED_AT" "$(json_escape "$EXEC_USER")" "$IS_ADMIN"
+    printf '  "host": { "hostname": "%s", "os_family": "linux", "os_name": "%s", "os_version": "%s", "kernel": "%s", "architecture": "%s", "serial_number": "%s" },\n' \
+        "$(json_escape "$HOSTNAME_VALUE")" "$(json_escape "$OS_PRETTY")" "$(json_escape "$OS_VERSION")" "$(json_escape "$KERNEL")" "$ARCH" "$(json_escape "$SERIAL")"
+    printf '  "baseline": {'
+    for key in $BASELINE_KEYS; do
+        [ $first -eq 1 ] && first=0 || printf ','
+        printf ' "%s": "%s"' "$key" "$(json_escape "${B[$key]}")"
+    done
+    printf ' },\n  "results": [\n'
+    for i in "${!R_ID[@]}"; do
+        [ "$i" -gt 0 ] && printf ',\n'
+        printf '    { "id": "%s", "section": "%s", "name": "%s", "status": "%s", "actual": "%s", "expected": "%s"' \
+            "${R_ID[$i]}" "${R_SECTION[$i]}" "$(json_escape "${R_NAME[$i]}")" "${R_STATUS[$i]}" "$(json_escape "${R_ACTUAL[$i]}")" "$(json_escape "${R_EXPECTED[$i]}")"
+        [ -n "${R_DETAIL[$i]}" ] && printf ', "detail": "%s"' "$(json_escape "${R_DETAIL[$i]}")"
+        printf ' }'
+    done
+    printf '\n  ],\n  "summary": { "Compliant": %s, "Non-Compliant": %s, "NotApplicable": %s, "Pending": %s, "Error": %s }\n}\n' \
+        "$(count Compliant)" "$(count Non-Compliant)" "$(count NotApplicable)" "$(count Pending)" "$(count Error)"
+}
+
+is_root || echo "Warning: not running as root. Some checks will report Error. Run: sudo $0" >&2
+
+STAMP=$(date '+%Y%m%d-%H%M%S')
+BASENAME="audit-linux-$HOSTNAME_VALUE-$STAMP"
+if mkdir -p "$OUTPUT_DIR" 2>/dev/null && [ -w "$OUTPUT_DIR" ]; then
+    report | tee "$OUTPUT_DIR/$BASENAME.txt"
+    evidence_json > "$OUTPUT_DIR/$BASENAME.json"
+    echo "Report:   $OUTPUT_DIR/$BASENAME.txt" >&2
+    echo "Evidence: $OUTPUT_DIR/$BASENAME.json" >&2
+else
+    report
+    echo "Could not write to $OUTPUT_DIR (use --output DIR). Evidence not saved." >&2
+    exit 2
+fi
+
+[ "$(count Non-Compliant)" -gt 0 ] && exit 1
+exit 0

collectors/macos/audit.sh

@@ -0,0 +1,713 @@
+#!/bin/bash
+# Devseis endpoint audit - macOS collector
+#
+# READ-ONLY: this script only reads settings. It never changes the system.
+# The only files it writes are the report (.txt) and evidence (.json) in the output folder.
+#
+# Run as root for complete results:   sudo ./audit.sh
+# Options: --baseline FILE  --org FILE  --output DIR  --help
+#
+# Compatible with the bash 3.2 that ships with macOS.
+
+set -u
+
+COLLECTOR_VERSION="0.1.0"
+CATALOG_VERSION="0.1.0"
+
+SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
+ROOT_DIR=$(cd "$SCRIPT_DIR/../.." && pwd)
+BASELINE_FILE="$ROOT_DIR/baseline.conf"
+ORG_FILE="$ROOT_DIR/organisational.conf"
+OUTPUT_DIR="/Library/Logs/Devseis/EndpointAudit"
+
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --baseline) BASELINE_FILE="$2"; shift 2 ;;
+        --org) ORG_FILE="$2"; shift 2 ;;
+        --output) OUTPUT_DIR="$2"; shift 2 ;;
+        -h|--help) sed -n '2,12p' "$0"; exit 0 ;;
+        *) echo "Unknown option: $1" >&2; exit 2 ;;
+    esac
+done
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+# Read KEY=VALUE from a config file without executing it. Usage: conf_get FILE KEY DEFAULT
+conf_get() {
+    local value=""
+    if [ -r "$1" ]; then
+        value=$(awk -v key="$2" '
+            /^[[:space:]]*#/ { next }
+            index($0, "=") { k = substr($0, 1, index($0, "=") - 1); gsub(/[[:space:]]/, "", k)
+                             if (k == key) { v = substr($0, index($0, "=") + 1) } }
+            END { print v }' "$1")
+        value=$(printf '%s' "$value" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//' -e 's/^"\(.*\)"$/\1/')
+    fi
+    if [ -n "$value" ]; then printf '%s' "$value"; else printf '%s' "$3"; fi
+}
+
+BASELINE_KEYS="PASSWORD_MIN_LENGTH PASSWORD_HISTORY PASSWORD_MAX_AGE_DAYS PASSWORD_MIN_AGE_DAYS PASSWORD_COMPLEXITY LOCKOUT_THRESHOLD_MAX LOCKOUT_DURATION_MIN_MINUTES LOCKOUT_OBSERVATION_MIN_MINUTES SIGNATURE_MAX_AGE_DAYS MACOS_XPROTECT_MAX_AGE_DAYS FIREWALL_OUTBOUND SCREEN_LOCK_MAX_SECONDS USB_READ USB_WRITE APPROVED_ADMINS ALLOW_DISABLED_BUILTIN_ADMIN UPDATES_MAX_AGE_DAYS BACKUP_MAX_AGE_DAYS APPROVED_REMOTE_SERVICES WINDOWS_MIN_BUILD MACOS_MIN_MAJOR UBUNTU_MIN_VERSION DEBIAN_MIN_VERSION RHEL_MIN_VERSION PERSONAL_DATA_SCAN APPROVED_AI_TOOLS"
+
+B_PASSWORD_MIN_LENGTH=$(conf_get "$BASELINE_FILE" PASSWORD_MIN_LENGTH 14)
+B_PASSWORD_HISTORY=$(conf_get "$BASELINE_FILE" PASSWORD_HISTORY 24)
+B_PASSWORD_MAX_AGE_DAYS=$(conf_get "$BASELINE_FILE" PASSWORD_MAX_AGE_DAYS 365)
+B_PASSWORD_MIN_AGE_DAYS=$(conf_get "$BASELINE_FILE" PASSWORD_MIN_AGE_DAYS 1)
+B_PASSWORD_COMPLEXITY=$(conf_get "$BASELINE_FILE" PASSWORD_COMPLEXITY 1)
+B_LOCKOUT_THRESHOLD_MAX=$(conf_get "$BASELINE_FILE" LOCKOUT_THRESHOLD_MAX 5)
+B_LOCKOUT_DURATION_MIN_MINUTES=$(conf_get "$BASELINE_FILE" LOCKOUT_DURATION_MIN_MINUTES 15)
+B_LOCKOUT_OBSERVATION_MIN_MINUTES=$(conf_get "$BASELINE_FILE" LOCKOUT_OBSERVATION_MIN_MINUTES 15)
+B_SIGNATURE_MAX_AGE_DAYS=$(conf_get "$BASELINE_FILE" SIGNATURE_MAX_AGE_DAYS 3)
+B_MACOS_XPROTECT_MAX_AGE_DAYS=$(conf_get "$BASELINE_FILE" MACOS_XPROTECT_MAX_AGE_DAYS 30)
+B_FIREWALL_OUTBOUND=$(conf_get "$BASELINE_FILE" FIREWALL_OUTBOUND allow)
+B_SCREEN_LOCK_MAX_SECONDS=$(conf_get "$BASELINE_FILE" SCREEN_LOCK_MAX_SECONDS 900)
+B_USB_READ=$(conf_get "$BASELINE_FILE" USB_READ allow)
+B_USB_WRITE=$(conf_get "$BASELINE_FILE" USB_WRITE deny)
+B_APPROVED_ADMINS=$(conf_get "$BASELINE_FILE" APPROVED_ADMINS "")
+B_ALLOW_DISABLED_BUILTIN_ADMIN=$(conf_get "$BASELINE_FILE" ALLOW_DISABLED_BUILTIN_ADMIN 1)
+B_UPDATES_MAX_AGE_DAYS=$(conf_get "$BASELINE_FILE" UPDATES_MAX_AGE_DAYS 30)
+B_BACKUP_MAX_AGE_DAYS=$(conf_get "$BASELINE_FILE" BACKUP_MAX_AGE_DAYS 7)
+B_APPROVED_REMOTE_SERVICES=$(conf_get "$BASELINE_FILE" APPROVED_REMOTE_SERVICES "")
+B_WINDOWS_MIN_BUILD=$(conf_get "$BASELINE_FILE" WINDOWS_MIN_BUILD 22631)
+B_MACOS_MIN_MAJOR=$(conf_get "$BASELINE_FILE" MACOS_MIN_MAJOR 14)
+B_UBUNTU_MIN_VERSION=$(conf_get "$BASELINE_FILE" UBUNTU_MIN_VERSION 22.04)
+B_DEBIAN_MIN_VERSION=$(conf_get "$BASELINE_FILE" DEBIAN_MIN_VERSION 12)
+B_RHEL_MIN_VERSION=$(conf_get "$BASELINE_FILE" RHEL_MIN_VERSION 9)
+B_PERSONAL_DATA_SCAN=$(conf_get "$BASELINE_FILE" PERSONAL_DATA_SCAN 0)
+B_APPROVED_AI_TOOLS=$(conf_get "$BASELINE_FILE" APPROVED_AI_TOOLS "")
+
+is_root() { [ "$(id -u)" -eq 0 ]; }
+is_int() { case "$1" in ''|*[!0-9-]*) return 1 ;; *) return 0 ;; esac; }
+lower() { printf '%s' "$1" | tr '[:upper:]' '[:lower:]'; }
+now_epoch() { date +%s; }
+days_since() { echo $(( ( $(now_epoch) - $1 ) / 86400 )); }
+
+# Is VALUE in a comma-separated LIST? Case-insensitive, "*" wildcards allowed.
+in_list() {
+    local value item old_ifs="$IFS" found=1
+    value=$(lower "$1")
+    set -f
+    IFS=,
+    for item in $2; do
+        item=$(lower "$(printf '%s' "$item" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')")
+        [ -z "$item" ] && continue
+        # shellcheck disable=SC2254
+        case "$value" in $item) found=0; break ;; esac
+    done
+    IFS="$old_ifs"
+    set +f
+    return $found
+}
+
+json_escape() {
+    printf '%s' "$1" | sed -e 's/\\/\\\\/g' -e 's/"/\\"/g' -e 's/	/\\t/g' | awk 'NR > 1 { printf "\\n" } { printf "%s", $0 }' | tr -d '\000-\010\013\014\016-\037'
+}
+
+# Results are kept in parallel arrays (bash 3.2 has no associative arrays).
+R_ID=(); R_SECTION=(); R_NAME=(); R_STATUS=(); R_ACTUAL=(); R_EXPECTED=(); R_DETAIL=()
+add() { # id section name status actual expected [detail]
+    R_ID+=("$1"); R_SECTION+=("$2"); R_NAME+=("$3"); R_STATUS+=("$4")
+    R_ACTUAL+=("$5"); R_EXPECTED+=("$6"); R_DETAIL+=("${7:-}")
+}
+needs_root() { # id section name expected
+    add "$1" "$2" "$3" "Error" "not read" "$4" "Requires root: run the collector with sudo."
+}
+
+CONSOLE_USER=$(stat -f %Su /dev/console 2>/dev/null)
+[ "$CONSOLE_USER" = "root" ] && CONSOLE_USER=""
+# Run a read-only command as the signed-in user (their preferences live in their own domain).
+as_console_user() {
+    if is_root && [ -n "$CONSOLE_USER" ]; then sudo -u "$CONSOLE_USER" "$@"; else "$@"; fi
+}
+
+MANAGED="/Library/Managed Preferences"
+managed_read() { # domain key -> value from a configuration profile, if any
+    [ -f "$MANAGED/$1.plist" ] && defaults read "$MANAGED/$1" "$2" 2>/dev/null
+}
+
+# ---------------------------------------------------------------------------
+# Host information
+# ---------------------------------------------------------------------------
+HOSTNAME_VALUE=$(scutil --get LocalHostName 2>/dev/null || hostname -s)
+OS_NAME=$(sw_vers -productName 2>/dev/null)
+OS_VERSION=$(sw_vers -productVersion 2>/dev/null)
+OS_BUILD=$(sw_vers -buildVersion 2>/dev/null)
+ARCH=$(uname -m)
+SERIAL=$(ioreg -rd1 -c IOPlatformExpertDevice 2>/dev/null | awk -F'"' '/IOPlatformSerialNumber/ { print $4 }')
+EXEC_USER=$(id -un)
+AUDIT_DATE=$(date '+%Y-%m-%d %H:%M:%S %Z')
+STARTED_AT=$(date '+%Y-%m-%dT%H:%M:%S%z' | sed -E 's/([0-9]{2})([0-9]{2})$/\1:\2/')
+IS_ADMIN=false; is_root && IS_ADMIN=true
+
+# ---------------------------------------------------------------------------
+# 1. Security baseline
+# ---------------------------------------------------------------------------
+S=baseline
+
+# Global account policy (pwpolicy works without root).
+PW_XML=$(pwpolicy -getaccountpolicies 2>/dev/null | sed '1{/^Getting/d;}')
+pw_int() { # first <integer> directly after <key>NAME</key>, for each NAME given
+    local key value
+    for key in "$@"; do
+        value=$(printf '%s\n' "$PW_XML" | awk -v k="<key>$key</key>" '
+            found { if ($0 ~ /<integer>/) { gsub(/.*<integer>|<\/integer>.*/, ""); print } exit }
+            index($0, k) { found = 1 }')
+        if [ -n "$value" ]; then printf '%s' "$value"; return; fi
+    done
+}
+pw_has() { printf '%s' "$PW_XML" | grep -qiE "$1"; }
+
+min_len=$(pw_int minimumLength minLength policyAttributeMinimumLength)
+[ -z "$min_len" ] && min_len=$(printf '%s' "$PW_XML" | grep -oE '\.\{[0-9]+,' | head -1 | tr -dc '0-9')
+if is_int "$min_len" && [ "$min_len" -ge "$B_PASSWORD_MIN_LENGTH" ]; then
+    add password.min_length $S "Minimum password length" Compliant "$min_len" ">= $B_PASSWORD_MIN_LENGTH" "pwpolicy global account policy"
+else
+    add password.min_length $S "Minimum password length" Non-Compliant "${min_len:-not set}" ">= $B_PASSWORD_MIN_LENGTH" "pwpolicy global account policy"
+fi
+
+history=$(pw_int policyAttributePasswordHistoryDepth pinHistory)
+if is_int "$history" && [ "$history" -ge "$B_PASSWORD_HISTORY" ]; then
+    add password.history $S "Password history" Compliant "$history" ">= $B_PASSWORD_HISTORY"
+else
+    add password.history $S "Password history" Non-Compliant "${history:-not set}" ">= $B_PASSWORD_HISTORY"
+fi
+
+max_age=$(pw_int policyAttributeExpiresEveryNDays maxPINAgeInDays policyAttributeDaysUntilExpiration)
+if [ "$B_PASSWORD_MAX_AGE_DAYS" -eq 0 ]; then
+    add password.expiration $S "Password expiration" Compliant "${max_age:-never}" "not required" "Baseline does not require expiry."
+elif is_int "$max_age" && [ "$max_age" -ge 1 ] && [ "$max_age" -le "$B_PASSWORD_MAX_AGE_DAYS" ]; then
+    add password.expiration $S "Password expiration" Compliant "$max_age days" "1-$B_PASSWORD_MAX_AGE_DAYS days"
+else
+    add password.expiration $S "Password expiration" Non-Compliant "${max_age:-never}" "1-$B_PASSWORD_MAX_AGE_DAYS days"
+fi
+
+add password.min_age $S "Minimum password age" NotApplicable "no such setting" ">= $B_PASSWORD_MIN_AGE_DAYS days" "macOS account policies have no minimum password age."
+
+if pw_has 'requiresAlpha|requireAlphanumeric|\[a-z|\[A-Z|policyAttributeAlpha' && pw_has 'requiresNumeric|requireAlphanumeric|\[0-9\]|policyAttributeNumeric'; then
+    add password.complexity $S "Password complexity" Compliant "letters and numbers required" "enforced"
+else
+    add password.complexity $S "Password complexity" Non-Compliant "not enforced" "enforced"
+fi
+
+threshold=$(pw_int policyAttributeMaximumFailedAuthentications maxFailedAttempts)
+if is_int "$threshold" && [ "$threshold" -ge 1 ] && [ "$threshold" -le "$B_LOCKOUT_THRESHOLD_MAX" ]; then
+    add lockout.threshold $S "Account lockout threshold" Compliant "$threshold" "1-$B_LOCKOUT_THRESHOLD_MAX"
+else
+    add lockout.threshold $S "Account lockout threshold" Non-Compliant "${threshold:-not set}" "1-$B_LOCKOUT_THRESHOLD_MAX"
+fi
+
+lock_seconds=$(pw_int autoEnableInSeconds)
+if [ -z "$lock_seconds" ]; then
+    lock_minutes=$(pw_int minutesUntilFailedLoginReset)
+    is_int "$lock_minutes" && lock_seconds=$(( lock_minutes * 60 ))
+fi
+lock_text="not set"; is_int "$lock_seconds" && lock_text="$(( lock_seconds / 60 )) minutes"
+min_lock=$(( B_LOCKOUT_DURATION_MIN_MINUTES * 60 ))
+if is_int "$lock_seconds" && [ "$lock_seconds" -ge "$min_lock" ]; then
+    add lockout.duration $S "Account lockout duration" Compliant "$(( lock_seconds / 60 )) minutes" ">= $B_LOCKOUT_DURATION_MIN_MINUTES minutes"
+else
+    add lockout.duration $S "Account lockout duration" Non-Compliant "$lock_text" ">= $B_LOCKOUT_DURATION_MIN_MINUTES minutes"
+fi
+min_obs=$(( B_LOCKOUT_OBSERVATION_MIN_MINUTES * 60 ))
+if is_int "$lock_seconds" && [ "$lock_seconds" -ge "$min_obs" ]; then
+    add lockout.observation $S "Lockout observation period" Compliant "$(( lock_seconds / 60 )) minutes" ">= $B_LOCKOUT_OBSERVATION_MIN_MINUTES minutes" "macOS resets the failed-attempt count when the lockout ends."
+else
+    add lockout.observation $S "Lockout observation period" Non-Compliant "$lock_text" ">= $B_LOCKOUT_OBSERVATION_MIN_MINUTES minutes" "macOS resets the failed-attempt count when the lockout ends."
+fi
+
+# Malware protection
+XPROTECT_BUNDLE="/Library/Apple/System/Library/CoreServices/XProtect.bundle"
+xp_version=$(xprotect version 2>/dev/null | sed -n 's/^Version: \([0-9]*\).*/\1/p')
+[ -z "$xp_version" ] && xp_version=$(defaults read "$XPROTECT_BUNDLE/Contents/Info" CFBundleShortVersionString 2>/dev/null)
+third_party_av=""
+for proc in wdavdaemon falcond SentinelAgent SophosScanD esets_daemon BDLDaemon RTProtectionDaemon; do
+    pgrep -x "$proc" >/dev/null 2>&1 && third_party_av="${third_party_av:+$third_party_av, }$proc"
+done
+if [ -n "$xp_version" ] || [ -n "$third_party_av" ]; then
+    add malware.antivirus $S "Antivirus" Compliant "XProtect ${xp_version:-not found}${third_party_av:+; third-party: $third_party_av}" "antivirus present"
+else
+    add malware.antivirus $S "Antivirus" Non-Compliant "none found" "antivirus present"
+fi
+
+xp_status=$(xprotect status 2>/dev/null)
+gatekeeper=$(spctl --status 2>/dev/null)
+if [ -n "$xp_status" ]; then
+    xp_on=1; printf '%s' "$xp_status" | grep -qi "launch scans: enabled" || xp_on=0
+else
+    xp_on=0; launchctl print system/com.apple.XProtect.daemon.scan >/dev/null 2>&1 && xp_on=1
+fi
+if [ "$xp_on" -eq 1 ] && printf '%s' "$gatekeeper" | grep -q "assessments enabled"; then
+    add malware.service $S "Apple malware protection service" Compliant "XProtect scanning on; Gatekeeper on" "XProtect and Gatekeeper on"
+else
+    add malware.service $S "Apple malware protection service" Non-Compliant "XProtect scanning $( [ "$xp_on" -eq 1 ] && echo on || echo off ); Gatekeeper ${gatekeeper:-unknown}" "XProtect and Gatekeeper on"
+fi
+
+xp_installed=$(xprotect version 2>/dev/null | sed -n 's/.*Installed: \([0-9-]* [0-9:]* [+-][0-9]*\).*/\1/p')
+if [ -n "$xp_installed" ]; then
+    xp_epoch=$(date -j -f "%Y-%m-%d %H:%M:%S %z" "$xp_installed" +%s 2>/dev/null)
+else
+    xp_epoch=$(stat -f %m "$XPROTECT_BUNDLE/Contents/Resources/XProtect.meta.plist" 2>/dev/null)
+fi
+if is_int "$xp_epoch"; then
+    xp_age=$(days_since "$xp_epoch")
+    if [ "$xp_age" -le "$B_MACOS_XPROTECT_MAX_AGE_DAYS" ]; then
+        add malware.signatures $S "Malware protection signatures" Compliant "XProtect $xp_version, $xp_age days old" "<= $B_MACOS_XPROTECT_MAX_AGE_DAYS days old"
+    else
+        add malware.signatures $S "Malware protection signatures" Non-Compliant "XProtect $xp_version, $xp_age days old" "<= $B_MACOS_XPROTECT_MAX_AGE_DAYS days old"
+    fi
+else
+    add malware.signatures $S "Malware protection signatures" Error "not read" "<= $B_MACOS_XPROTECT_MAX_AGE_DAYS days old" "XProtect install date not found."
+fi
+
+sw_pref() { # key default -> managed profile value, else system preference, else default
+    local v
+    v=$(managed_read com.apple.SoftwareUpdate "$1")
+    [ -z "$v" ] && v=$(defaults read /Library/Preferences/com.apple.SoftwareUpdate "$1" 2>/dev/null)
+    printf '%s' "${v:-$2}"
+}
+config_data=$(sw_pref ConfigDataInstall 1)
+critical=$(sw_pref CriticalUpdateInstall 1)
+if [ "$config_data" = "1" ] && [ "$critical" = "1" ]; then
+    add malware.signature_updates $S "Malware security updates" Compliant "security responses and system data files install automatically" "automatic"
+else
+    add malware.signature_updates $S "Malware security updates" Non-Compliant "ConfigDataInstall=$config_data, CriticalUpdateInstall=$critical" "automatic"
+fi
+
+if [ -n "$third_party_av" ]; then
+    add malware.on_access $S "On-access malware protection" Compliant "third-party scanner: $third_party_av" "on-access scanning"
+else
+    add malware.on_access $S "On-access malware protection" NotApplicable "XProtect only" "on-access scanning" "XProtect scans at launch and download; macOS has no built-in on-access scanning."
+fi
+
+# Firewall (application firewall)
+FW=/usr/libexec/ApplicationFirewall/socketfilterfw
+fw_state=$("$FW" --getglobalstate 2>/dev/null)
+fw_stealth=$("$FW" --getstealthmode 2>/dev/null)
+fw_on=0; printf '%s' "$fw_state" | grep -qiE "enabled|State = [12]" && fw_on=1
+stealth_on=0; printf '%s' "$fw_stealth" | grep -qiE "stealth mode is on|stealth mode enabled" && stealth_on=1
+if [ "$fw_on" -eq 1 ]; then
+    add firewall.enabled $S "Firewall" Compliant "on" "on"
+else
+    add firewall.enabled $S "Firewall" Non-Compliant "off" "on"
+fi
+if [ "$fw_on" -eq 1 ] && [ "$stealth_on" -eq 1 ]; then
+    add firewall.inbound $S "Firewall inbound policy" Compliant "block (firewall on, stealth mode on)" "block"
+else
+    add firewall.inbound $S "Firewall inbound policy" Non-Compliant "firewall $( [ "$fw_on" -eq 1 ] && echo on || echo off ), stealth mode $( [ "$stealth_on" -eq 1 ] && echo on || echo off )" "block"
+fi
+if [ "$(lower "$B_FIREWALL_OUTBOUND")" = "allow" ]; then
+    add firewall.outbound $S "Firewall outbound policy" Compliant "allow" "allow" "The macOS application firewall filters inbound connections only."
+else
+    add firewall.outbound $S "Firewall outbound policy" Non-Compliant "allow" "$B_FIREWALL_OUTBOUND" "The macOS application firewall cannot block outbound traffic."
+fi
+
+# Screen lock
+idle=$(managed_read com.apple.screensaver idleTime)
+[ -z "$idle" ] && idle=$(as_console_user defaults -currentHost read com.apple.screensaver idleTime 2>/dev/null)
+display_min=$(pmset -g 2>/dev/null | awk '$1 == "displaysleep" { print $2 }')
+effective_idle=""
+is_int "$idle" && [ "$idle" -gt 0 ] && effective_idle=$idle
+if is_int "$display_min" && [ "$display_min" -gt 0 ]; then
+    d=$(( display_min * 60 ))
+    if [ -z "$effective_idle" ] || [ "$d" -lt "$effective_idle" ]; then effective_idle=$d; fi
+fi
+ask=$(managed_read com.apple.screensaver askForPassword)
+ask_delay=$(managed_read com.apple.screensaver askForPasswordDelay)
+if [ -n "$ask" ]; then
+    if [ "$ask" = "1" ]; then lock_delay=${ask_delay:-0}; else lock_delay="off"; fi
+else
+    lock_status=$(as_console_user sysadminctl -screenLock status 2>&1)
+    case "$lock_status" in
+        *"is off"*) lock_delay="off" ;;
+        *immediate*) lock_delay=0 ;;
+        *"delay is"*) lock_delay=$(printf '%s' "$lock_status" | sed -n 's/.*delay is \([0-9]*\) seconds.*/\1/p') ;;
+        *) lock_delay="" ;;
+    esac
+fi
+
+if [ -z "$lock_delay" ]; then
+    add screen_lock.timeout $S "Screen lock timeout" Error "not read" "<= $B_SCREEN_LOCK_MAX_SECONDS seconds" "Could not read the screen lock setting."
+    add screen_lock.enabled $S "Screen lock" Error "not read" "on"
+    add screen_lock.password $S "Screen lock password requirement" Error "not read" "password within 5 seconds"
+else
+    if [ "$lock_delay" != "off" ] && [ -n "$effective_idle" ] && [ $(( effective_idle + lock_delay )) -le "$B_SCREEN_LOCK_MAX_SECONDS" ]; then
+        add screen_lock.timeout $S "Screen lock timeout" Compliant "$(( effective_idle + lock_delay )) seconds" "<= $B_SCREEN_LOCK_MAX_SECONDS seconds" "Idle ${effective_idle}s (screen saver/display sleep) + ${lock_delay}s password delay."
+    else
+        add screen_lock.timeout $S "Screen lock timeout" Non-Compliant "${effective_idle:-never} idle, password delay $lock_delay" "<= $B_SCREEN_LOCK_MAX_SECONDS seconds"
+    fi
+    if [ "$lock_delay" != "off" ] && [ -n "$effective_idle" ]; then
+        add screen_lock.enabled $S "Screen lock" Compliant "on" "on"
+    else
+        add screen_lock.enabled $S "Screen lock" Non-Compliant "off" "on"
+    fi
+    if [ "$lock_delay" != "off" ] && [ "$lock_delay" -le 5 ]; then
+        add screen_lock.password $S "Screen lock password requirement" Compliant "password after $lock_delay seconds" "password within 5 seconds"
+    else
+        add screen_lock.password $S "Screen lock password requirement" Non-Compliant "password after $lock_delay seconds" "password within 5 seconds"
+    fi
+fi
+
+# USB storage (configuration profile mount-controls)
+usb_rule=""
+if [ -f "$MANAGED/com.apple.systemuiserver.plist" ]; then
+    usb_rule=$(plutil -extract "mount-controls.harddisk-external" json -o - "$MANAGED/com.apple.systemuiserver.plist" 2>/dev/null)
+fi
+usb_read=allow; usb_write=allow
+case "$usb_rule" in *deny*) usb_read=deny; usb_write=deny ;; *read-only*) usb_write=deny ;; esac
+if [ "$usb_read" = "$(lower "$B_USB_READ")" ]; then
+    add usb.read $S "USB storage read" Compliant "$usb_read" "$B_USB_READ"
+else
+    add usb.read $S "USB storage read" Non-Compliant "$usb_read" "$B_USB_READ"
+fi
+if [ "$usb_write" = "$(lower "$B_USB_WRITE")" ]; then
+    add usb.write $S "USB storage write" Compliant "$usb_write" "$B_USB_WRITE"
+else
+    add usb.write $S "USB storage write" Non-Compliant "$usb_write" "$B_USB_WRITE" "No configuration profile restricts external drives."
+fi
+
+# Administrators
+admins=$(dscl . -read /Groups/admin GroupMembership 2>/dev/null | sed 's/^GroupMembership://')
+approved_found=""; unauthorized=""
+for user in $admins; do
+    [ "$user" = "root" ] && continue
+    if in_list "$user" "$B_APPROVED_ADMINS"; then
+        approved_found="${approved_found:+$approved_found, }$user"
+    else
+        unauthorized="${unauthorized:+$unauthorized, }$user"
+    fi
+done
+if [ -n "$approved_found" ]; then
+    add admin.approved $S "Approved IT administrator" Compliant "$approved_found" "${B_APPROVED_ADMINS:-none configured}"
+else
+    add admin.approved $S "Approved IT administrator" Non-Compliant "none of the approved accounts is an administrator" "${B_APPROVED_ADMINS:-none configured}"
+fi
+if [ -z "$unauthorized" ]; then
+    add admin.unauthorized $S "Unauthorized employee administrator accounts" Compliant "none" "none"
+else
+    add admin.unauthorized $S "Unauthorized employee administrator accounts" Non-Compliant "$unauthorized" "none"
+fi
+
+# FileVault
+fv=$(fdesetup status 2>/dev/null)
+if printf '%s' "$fv" | grep -q "FileVault is On"; then
+    add encryption.enabled $S "Encryption" Compliant "FileVault on" "FileVault on"
+    if printf '%s' "$fv" | grep -qi "in progress"; then
+        add encryption.protection $S "Disk encryption protection" Non-Compliant "$(printf '%s' "$fv" | tr '\n' ' ')" "fully encrypted"
+    else
+        add encryption.protection $S "Disk encryption protection" Compliant "fully encrypted" "fully encrypted"
+    fi
+    if is_root; then
+        prk=$(fdesetup haspersonalrecoverykey 2>/dev/null); irk=$(fdesetup hasinstitutionalrecoverykey 2>/dev/null)
+        if [ "$prk" = "true" ] || [ "$irk" = "true" ]; then
+            add encryption.recovery $S "Disk encryption recovery" Compliant "recovery key present (personal: $prk, institutional: $irk)" "recovery key present"
+        else
+            add encryption.recovery $S "Disk encryption recovery" Non-Compliant "no recovery key" "recovery key present"
+        fi
+    else
+        needs_root encryption.recovery $S "Disk encryption recovery" "recovery key present"
+    fi
+else
+    add encryption.enabled $S "Encryption" Non-Compliant "FileVault off" "FileVault on"
+    add encryption.protection $S "Disk encryption protection" Non-Compliant "not encrypted" "fully encrypted"
+    add encryption.recovery $S "Disk encryption recovery" Non-Compliant "no FileVault" "recovery key present"
+fi
+
+# ---------------------------------------------------------------------------
+# 2. GDPR technical controls
+# ---------------------------------------------------------------------------
+S=gdpr
+
+auto_check=$(sw_pref AutomaticCheckEnabled 1)
+auto_download=$(sw_pref AutomaticDownload 1)
+auto_macos=$(sw_pref AutomaticallyInstallMacOSUpdates 0)
+if [ "$auto_check" = "1" ] && [ "$auto_download" = "1" ] && [ "$critical" = "1" ] && [ "$auto_macos" = "1" ]; then
+    add gdpr.auto_updates $S "Automatic security updates" Compliant "check, download and install automatic" "automatic"
+else
+    add gdpr.auto_updates $S "Automatic security updates" Non-Compliant "check=$auto_check download=$auto_download security=$critical macOS-install=$auto_macos" "automatic"
+fi
+
+# Last macOS/software update from the install history (config-data such as XProtect is ignored).
+last_update=$(plutil -p /Library/Receipts/InstallHistory.plist 2>/dev/null | awk '
+    /"contentType" =>/ { ctype = $0 }
+    /"date" =>/ { d = $3 " " $4 " " $5 }
+    /"processName" =>/ { if ($0 ~ /softwareupdated/ && ctype !~ /config-data/ && d > last) last = d; ctype = "" }
+    END { print last }')
+if [ -n "$last_update" ]; then
+    lu_epoch=$(date -j -f "%Y-%m-%d %H:%M:%S %z" "$last_update" +%s 2>/dev/null)
+    lu_age=$(days_since "$lu_epoch")
+    if [ "$lu_age" -le "$B_UPDATES_MAX_AGE_DAYS" ]; then
+        add gdpr.updates_recent $S "Security updates installed recently" Compliant "$lu_age days ago" "<= $B_UPDATES_MAX_AGE_DAYS days ago" "Last software update: $last_update"
+    else
+        add gdpr.updates_recent $S "Security updates installed recently" Non-Compliant "$lu_age days ago" "<= $B_UPDATES_MAX_AGE_DAYS days ago" "Last software update: $last_update"
+    fi
+else
+    add gdpr.updates_recent $S "Security updates installed recently" Error "not read" "<= $B_UPDATES_MAX_AGE_DAYS days ago" "No software update found in the install history."
+fi
+
+major=${OS_VERSION%%.*}
+if is_int "$major" && [ "$major" -ge "$B_MACOS_MIN_MAJOR" ]; then
+    add gdpr.os_supported $S "Supported operating system version" Compliant "macOS $OS_VERSION" "macOS $B_MACOS_MIN_MAJOR or later"
+else
+    add gdpr.os_supported $S "Supported operating system version" Non-Compliant "macOS $OS_VERSION" "macOS $B_MACOS_MIN_MAJOR or later"
+fi
+
+if launchctl print system/com.apple.logd >/dev/null 2>&1; then
+    add gdpr.security_logging $S "Security event logging" Compliant "unified logging active" "security events logged" "macOS unified log records authentication events; retention is managed by the OS."
+else
+    add gdpr.security_logging $S "Security event logging" Non-Compliant "logd not running" "security events logged"
+fi
+
+if is_root; then
+    nt=$(/usr/sbin/systemsetup -getusingnetworktime 2>/dev/null)
+    if printf '%s' "$nt" | grep -qi ": On"; then
+        add gdpr.time_sync $S "Time synchronisation" Compliant "network time on" "network time on"
+    else
+        add gdpr.time_sync $S "Time synchronisation" Non-Compliant "${nt:-unknown}" "network time on"
+    fi
+else
+    needs_root gdpr.time_sync $S "Time synchronisation" "network time on"
+fi
+
+tm_dest=$(tmutil destinationinfo 2>&1)
+backup_tool=""
+printf '%s' "$tm_dest" | grep -q "No destinations" || backup_tool="Time Machine"
+for proc in bzserv CrashPlanService ArqAgent; do
+    pgrep -x "$proc" >/dev/null 2>&1 && backup_tool="${backup_tool:+$backup_tool, }$proc"
+done
+if [ -n "$backup_tool" ]; then
+    add gdpr.backup_configured $S "Backup configured" Compliant "$backup_tool" "backup configured"
+    tm_latest=$(tmutil latestbackup 2>/dev/null | grep -oE '[0-9]{4}-[0-9]{2}-[0-9]{2}-[0-9]{6}' | tail -1)
+    if [ -n "$tm_latest" ]; then
+        tm_epoch=$(date -j -f "%Y-%m-%d-%H%M%S" "$tm_latest" +%s 2>/dev/null)
+        tm_age=$(days_since "$tm_epoch")
+        if [ "$tm_age" -le "$B_BACKUP_MAX_AGE_DAYS" ]; then
+            add gdpr.backup_recent $S "Recent backup" Compliant "$tm_age days ago" "<= $B_BACKUP_MAX_AGE_DAYS days ago"
+        else
+            add gdpr.backup_recent $S "Recent backup" Non-Compliant "$tm_age days ago" "<= $B_BACKUP_MAX_AGE_DAYS days ago"
+        fi
+    else
+        add gdpr.backup_recent $S "Recent backup" Pending "date not readable" "<= $B_BACKUP_MAX_AGE_DAYS days ago" "Confirm the last backup date in $backup_tool."
+    fi
+else
+    add gdpr.backup_configured $S "Backup configured" Non-Compliant "none" "backup configured"
+    add gdpr.backup_recent $S "Recent backup" Non-Compliant "no backup" "<= $B_BACKUP_MAX_AGE_DAYS days ago"
+fi
+
+if [ "$usb_write" = "deny" ]; then
+    add gdpr.removable_encryption $S "Removable media encryption" Compliant "writing to external drives blocked" "no unencrypted writes"
+else
+    add gdpr.removable_encryption $S "Removable media encryption" Non-Compliant "external drives writable without enforced encryption" "no unencrypted writes"
+fi
+
+guest=$(defaults read /Library/Preferences/com.apple.loginwindow GuestEnabled 2>/dev/null)
+smb_guest=$(defaults read /Library/Preferences/SystemConfiguration/com.apple.smb.server AllowGuestAccess 2>/dev/null)
+if [ "${guest:-0}" != "1" ] && [ "${smb_guest:-0}" != "1" ]; then
+    add gdpr.guest_account $S "Guest account disabled" Compliant "guest login off" "guest login off"
+else
+    add gdpr.guest_account $S "Guest account disabled" Non-Compliant "guest login ${guest:-0}, guest file sharing ${smb_guest:-0}" "guest login off"
+fi
+
+disabled_list=$(launchctl print-disabled system 2>/dev/null)
+svc_enabled() { printf '%s' "$disabled_list" | grep -qE "\"$1[^\"]*\" => (enabled|false)"; }
+remote=""
+svc_enabled com.openssh.sshd && remote="${remote:+$remote, }ssh"
+svc_enabled com.apple.screensharing && remote="${remote:+$remote, }screensharing"
+svc_enabled com.apple.smbd && remote="${remote:+$remote, }filesharing"
+pgrep -x ARDAgent >/dev/null 2>&1 && remote="${remote:+$remote, }remotemanagement"
+svc_enabled org.chromium.chromoting && remote="${remote:+$remote, }chromeremotedesktop"
+pgrep -f "TeamViewer" >/dev/null 2>&1 && remote="${remote:+$remote, }teamviewer"
+pgrep -x AnyDesk >/dev/null 2>&1 && remote="${remote:+$remote, }anydesk"
+unapproved_remote=""
+old_ifs="$IFS"; IFS=,
+for svc in $remote; do
+    svc=$(printf '%s' "$svc" | sed 's/^ *//')
+    in_list "$svc" "$B_APPROVED_REMOTE_SERVICES" || unapproved_remote="${unapproved_remote:+$unapproved_remote, }$svc"
+done
+IFS="$old_ifs"
+if [ -z "$unapproved_remote" ]; then
+    add gdpr.remote_access $S "Remote access services restricted" Compliant "${remote:-none enabled}" "only: ${B_APPROVED_REMOTE_SERVICES:-none}"
+else
+    add gdpr.remote_access $S "Remote access services restricted" Non-Compliant "$unapproved_remote" "only: ${B_APPROVED_REMOTE_SERVICES:-none}"
+fi
+
+DIAG="/Library/Application Support/CrashReporter/DiagnosticMessagesHistory.plist"
+auto_submit=$(defaults read "${DIAG%.plist}" AutoSubmit 2>/dev/null)
+third_party=$(defaults read "${DIAG%.plist}" ThirdPartyDataSubmit 2>/dev/null)
+if [ "${auto_submit:-0}" != "1" ] && [ "${third_party:-0}" != "1" ]; then
+    add gdpr.telemetry $S "Diagnostic data minimised" Compliant "analytics sharing off" "analytics sharing off"
+else
+    add gdpr.telemetry $S "Diagnostic data minimised" Non-Compliant "share Mac analytics=${auto_submit:-0}, share with app developers=${third_party:-0}" "analytics sharing off"
+fi
+
+add gdpr.personal_data_discovery $S "Personal data discovery" NotApplicable "not run" "opt-in scan" "Opt-in scan (PERSONAL_DATA_SCAN=$B_PERSONAL_DATA_SCAN) is planned for a later stage."
+
+# ---------------------------------------------------------------------------
+# 3. EU AI Act controls
+# ---------------------------------------------------------------------------
+S=aiact
+
+ai_tools=""
+add_tool() { case ",$ai_tools," in *",$1,"*) ;; *) ai_tools="${ai_tools:+$ai_tools,}$1" ;; esac; }
+ai_detail=""
+for app in "ChatGPT" "Claude" "Microsoft Copilot" "Copilot" "Gemini" "Ollama" "LM Studio" "GPT4All" "Jan" "Perplexity" "Msty" "Cursor" "Windsurf"; do
+    for dir in /Applications /Users/*/Applications; do
+        [ -d "$dir/$app.app" ] && add_tool "$app"
+    done
+done
+for cli in ollama claude; do
+    for dir in /usr/local/bin /opt/homebrew/bin /Users/*/.local/bin; do
+        if [ -x "$dir/$cli" ]; then
+            case "$cli" in ollama) add_tool "Ollama" ;; claude) add_tool "Claude Code" ;; esac
+        fi
+    done
+done
+lsof -nP -iTCP:11434 -sTCP:LISTEN >/dev/null 2>&1 && { add_tool "Ollama"; ai_detail="${ai_detail}Local AI service listening on port 11434. "; }
+for home in /Users/*; do
+    [ -d "$home" ] || continue
+    for pair in ".ollama/models:Ollama" ".cache/lm-studio/models:LM Studio" ".lmstudio/models:LM Studio" "Library/Application Support/nomic.ai/GPT4All:GPT4All" ".cache/huggingface/hub:Hugging Face models"; do
+        path="$home/${pair%%:*}"
+        if [ -d "$path" ] && [ -n "$(ls -A "$path" 2>/dev/null)" ]; then
+            add_tool "${pair##*:}"
+            ai_detail="${ai_detail}Local models: $path ($(du -sh "$path" 2>/dev/null | awk '{ print $1 }')). "
+        fi
+    done
+done
+ai_list=$(printf '%s' "$ai_tools" | sed 's/,/, /g')
+add aiact.inventory $S "AI software inventory" Compliant "${ai_list:-no AI tools found}" "inventory taken" "$ai_detail"
+
+unapproved_ai=""
+old_ifs="$IFS"; IFS=,
+for tool in $ai_tools; do
+    in_list "$tool" "$B_APPROVED_AI_TOOLS" || unapproved_ai="${unapproved_ai:+$unapproved_ai, }$tool"
+done
+IFS="$old_ifs"
+if [ -z "$unapproved_ai" ]; then
+    add aiact.unapproved $S "Unapproved AI tools (shadow AI)" Compliant "none" "only: ${B_APPROVED_AI_TOOLS:-none}"
+else
+    add aiact.unapproved $S "Unapproved AI tools (shadow AI)" Non-Compliant "$unapproved_ai" "only: ${B_APPROVED_AI_TOOLS:-none}"
+fi
+
+if [ -n "$ai_tools" ]; then
+    add aiact.risk_classification $S "AI system risk classification" Pending "$ai_list" "every AI tool classified" "Classified by the auditor model (Caveat classifier) in a later step."
+else
+    add aiact.risk_classification $S "AI system risk classification" NotApplicable "no AI tools found" "every AI tool classified"
+fi
+
+if [ "$ARCH" != "arm64" ]; then
+    add aiact.os_ai_features $S "Apple Intelligence external integrations restricted" NotApplicable "Intel Mac" "restricted by profile" "Apple Intelligence needs Apple silicon."
+else
+    ext_ai=$(managed_read com.apple.applicationaccess allowExternalIntelligenceIntegrations)
+    if [ "$ext_ai" = "0" ]; then
+        add aiact.os_ai_features $S "Apple Intelligence external integrations restricted" Compliant "restricted by profile" "restricted by profile"
+    else
+        add aiact.os_ai_features $S "Apple Intelligence external integrations restricted" Non-Compliant "not restricted" "restricted by profile" "No profile sets allowExternalIntelligenceIntegrations to false."
+    fi
+fi
+
+if [ -n "$ai_tools" ]; then
+    add aiact.log_retention $S "AI usage log retention" Pending "depends on classification" ">= 6 months for high-risk AI" "Required only if a tool is classified high-risk."
+else
+    add aiact.log_retention $S "AI usage log retention" NotApplicable "no AI tools found" ">= 6 months for high-risk AI"
+fi
+
+# ---------------------------------------------------------------------------
+# 4. Organisational controls (answers from organisational.conf)
+# ---------------------------------------------------------------------------
+S=org
+org() { # id key name
+    local answer
+    answer=$(lower "$(conf_get "$ORG_FILE" "$2" "")")
+    case "$answer" in
+        yes) add "$1" $S "$3" Compliant "yes" "yes" ;;
+        no) add "$1" $S "$3" Non-Compliant "no" "yes" ;;
+        partial) add "$1" $S "$3" Non-Compliant "partial" "yes" ;;
+        n/a|na) add "$1" $S "$3" NotApplicable "n/a" "yes" ;;
+        *) add "$1" $S "$3" Pending "not answered" "yes" "Answer $2 in organisational.conf." ;;
+    esac
+}
+org org.ropa ORG_ROPA "Record of processing activities"
+org org.dpia ORG_DPIA "Data protection impact assessment"
+org org.breach_procedure ORG_BREACH_PROCEDURE "Breach response procedure"
+org org.processor_agreements ORG_PROCESSOR_AGREEMENTS "Data processing agreements"
+org org.ai_register ORG_AI_REGISTER "AI register"
+org org.ai_literacy ORG_AI_LITERACY "AI literacy training"
+org org.human_oversight ORG_HUMAN_OVERSIGHT "Human oversight for high-risk AI"
+org org.ai_transparency ORG_AI_TRANSPARENCY "AI transparency to users"
+
+# ---------------------------------------------------------------------------
+# Report
+# ---------------------------------------------------------------------------
+LINE="============================================================"
+print_section() { # section-id title
+    local i
+    echo "$LINE"; echo " $2"; echo "$LINE"
+    for i in "${!R_ID[@]}"; do
+        if [ "${R_SECTION[$i]}" = "$1" ]; then echo "${R_NAME[$i]}"; echo "${R_STATUS[$i]}"; fi
+    done
+}
+report() {
+    echo "$LINE"
+    echo " macOS ENDPOINT SECURITY BASELINE - AUDIT"
+    echo "$LINE"
+    echo "Hostname        : $HOSTNAME_VALUE"
+    echo "Operating System: $OS_NAME"
+    echo "OS Version      : $OS_VERSION"
+    echo "Build           : $OS_BUILD"
+    echo "Serial Number   : $SERIAL"
+    echo "Execution User  : $EXEC_USER"
+    echo "Audit Date      : $AUDIT_DATE"
+    echo "Audit Mode      : READ-ONLY"
+    echo "$LINE"
+    print_section baseline "COMPLIANCE RESULTS"
+    print_section gdpr "GDPR TECHNICAL CONTROLS"
+    print_section aiact "EU AI ACT CONTROLS"
+    print_section org "ORGANISATIONAL CONTROLS"
+    echo "$LINE"
+    echo " END OF AUDIT"
+    echo "$LINE"
+}
+
+count() { local i n=0; for i in "${!R_STATUS[@]}"; do [ "${R_STATUS[$i]}" = "$1" ] && n=$((n + 1)); done; echo $n; }
+
+evidence_json() {
+    local i key first=1
+    printf '{\n  "schema_version": "1.0",\n  "catalog_version": "%s",\n' "$CATALOG_VERSION"
+    printf '  "source": { "kind": "collector", "collector": "macos", "collector_version": "%s" },\n' "$COLLECTOR_VERSION"
+    printf '  "audit": { "mode": "READ-ONLY", "started_at": "%s", "execution_user": "%s", "is_admin": %s },\n' "$STARTED_AT" "$(json_escape "$EXEC_USER")" "$IS_ADMIN"
+    printf '  "host": { "hostname": "%s", "os_family": "macos", "os_name": "%s", "os_version": "%s", "build": "%s", "architecture": "%s", "serial_number": "%s" },\n' \
+        "$(json_escape "$HOSTNAME_VALUE")" "$(json_escape "$OS_NAME")" "$(json_escape "$OS_VERSION")" "$(json_escape "$OS_BUILD")" "$ARCH" "$(json_escape "$SERIAL")"
+    printf '  "baseline": {'
+    for key in $BASELINE_KEYS; do
+        [ $first -eq 1 ] && first=0 || printf ','
+        eval "printf ' \"%s\": \"%s\"' \"\$key\" \"\$(json_escape \"\$B_$key\")\""
+    done
+    printf ' },\n  "results": [\n'
+    for i in "${!R_ID[@]}"; do
+        [ "$i" -gt 0 ] && printf ',\n'
+        printf '    { "id": "%s", "section": "%s", "name": "%s", "status": "%s", "actual": "%s", "expected": "%s"' \
+            "${R_ID[$i]}" "${R_SECTION[$i]}" "$(json_escape "${R_NAME[$i]}")" "${R_STATUS[$i]}" "$(json_escape "${R_ACTUAL[$i]}")" "$(json_escape "${R_EXPECTED[$i]}")"
+        [ -n "${R_DETAIL[$i]}" ] && printf ', "detail": "%s"' "$(json_escape "${R_DETAIL[$i]}")"
+        printf ' }'
+    done
+    printf '\n  ],\n  "summary": { "Compliant": %s, "Non-Compliant": %s, "NotApplicable": %s, "Pending": %s, "Error": %s }\n}\n' \
+        "$(count Compliant)" "$(count Non-Compliant)" "$(count NotApplicable)" "$(count Pending)" "$(count Error)"
+}
+
+is_root || echo "Warning: not running as root. Some checks will report Error. Run: sudo $0" >&2
+
+STAMP=$(date '+%Y%m%d-%H%M%S')
+BASENAME="audit-macos-$HOSTNAME_VALUE-$STAMP"
+if mkdir -p "$OUTPUT_DIR" 2>/dev/null && [ -w "$OUTPUT_DIR" ]; then
+    report | tee "$OUTPUT_DIR/$BASENAME.txt"
+    evidence_json > "$OUTPUT_DIR/$BASENAME.json"
+    echo "Report:   $OUTPUT_DIR/$BASENAME.txt" >&2
+    echo "Evidence: $OUTPUT_DIR/$BASENAME.json" >&2
+else
+    report
+    echo "Could not write to $OUTPUT_DIR (use --output DIR). Evidence not saved." >&2
+    exit 2
+fi
+
+[ "$(count Non-Compliant)" -gt 0 ] && exit 1
+exit 0

collectors/windows/audit.ps1

@@ -0,0 +1,574 @@
+<#
+.SYNOPSIS
+    Devseis endpoint audit - Windows collector.
+
+.DESCRIPTION
+    READ-ONLY: this script only reads settings. It never changes the system.
+    The only files it writes are the report (.txt) and evidence (.json) in the output folder,
+    plus short-lived exports from secedit/auditpol in the TEMP folder (deleted straight away).
+
+    Run from an elevated PowerShell (or as SYSTEM) for complete results.
+    Works with Windows PowerShell 5.1 (built into Windows 10/11) and PowerShell 7.
+
+.EXAMPLE
+    powershell -ExecutionPolicy Bypass -File .\audit.ps1
+    powershell -ExecutionPolicy Bypass -File .\audit.ps1 -Output C:\Audit
+#>
+[CmdletBinding()]
+param(
+    [string]$Baseline = (Join-Path $PSScriptRoot '..\..\baseline.conf'),
+    [string]$Organisational = (Join-Path $PSScriptRoot '..\..\organisational.conf'),
+    [string]$Output = (Join-Path $env:ProgramData 'Devseis\EndpointAudit')
+)
+
+Set-StrictMode -Version 2.0
+$ErrorActionPreference = 'Stop'
+$CollectorVersion = '0.1.0'
+$CatalogVersion = '0.1.0'
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+# Read KEY=VALUE lines without executing anything.
+function Read-Conf([string]$Path) {
+    $conf = @{}
+    if (Test-Path -LiteralPath $Path) {
+        foreach ($line in Get-Content -LiteralPath $Path) {
+            if ($line -match '^\s*#' -or $line -notmatch '=') { continue }
+            $parts = $line -split '=', 2
+            $conf[$parts[0].Trim()] = $parts[1].Trim().Trim('"')
+        }
+    }
+    return $conf
+}
+
+$Defaults = [ordered]@{
+    PASSWORD_MIN_LENGTH = '14'; PASSWORD_HISTORY = '24'; PASSWORD_MAX_AGE_DAYS = '365'; PASSWORD_MIN_AGE_DAYS = '1'
+    PASSWORD_COMPLEXITY = '1'; LOCKOUT_THRESHOLD_MAX = '5'; LOCKOUT_DURATION_MIN_MINUTES = '15'; LOCKOUT_OBSERVATION_MIN_MINUTES = '15'
+    SIGNATURE_MAX_AGE_DAYS = '3'; MACOS_XPROTECT_MAX_AGE_DAYS = '30'; FIREWALL_OUTBOUND = 'allow'; SCREEN_LOCK_MAX_SECONDS = '900'
+    USB_READ = 'allow'; USB_WRITE = 'deny'; APPROVED_ADMINS = ''; ALLOW_DISABLED_BUILTIN_ADMIN = '1'
+    UPDATES_MAX_AGE_DAYS = '30'; BACKUP_MAX_AGE_DAYS = '7'; APPROVED_REMOTE_SERVICES = ''; WINDOWS_MIN_BUILD = '22631'
+    MACOS_MIN_MAJOR = '14'; UBUNTU_MIN_VERSION = '22.04'; DEBIAN_MIN_VERSION = '12'; RHEL_MIN_VERSION = '9'
+    PERSONAL_DATA_SCAN = '0'; APPROVED_AI_TOOLS = ''
+}
+$conf = Read-Conf $Baseline
+$B = [ordered]@{}
+foreach ($key in $Defaults.Keys) {
+    if ($conf.ContainsKey($key) -and $conf[$key] -ne '') { $B[$key] = $conf[$key] } else { $B[$key] = $Defaults[$key] }
+}
+$OrgAnswers = Read-Conf $Organisational
+
+function Split-List([string]$List) { @($List -split ',' | ForEach-Object { $_.Trim() } | Where-Object { $_ -ne '' }) }
+# Case-insensitive match against a comma-separated list; "*" wildcards allowed.
+function Test-InList([string[]]$Values, [string]$List) {
+    foreach ($pattern in (Split-List $List)) {
+        foreach ($value in $Values) { if ($value -and $value -like $pattern) { return $true } }
+    }
+    return $false
+}
+function Get-RegValue([string]$Path, [string]$Name) {
+    try { return (Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop).$Name } catch { return $null }
+}
+function Get-Prop($Object, [string]$Name) {
+    if ($null -ne $Object -and $Object.PSObject.Properties[$Name]) { return $Object.$Name } else { return $null }
+}
+
+$Results = New-Object System.Collections.Generic.List[object]
+function Add-Result($Id, $Section, $Name, $Status, $Actual, $Expected, $Detail) {
+    $item = [ordered]@{ id = $Id; section = $Section; name = $Name; status = $Status; actual = "$Actual"; expected = "$Expected" }
+    if ($Detail) { $item['detail'] = "$Detail" }
+    $Results.Add($item)
+}
+function Pass([bool]$Ok, $Actual, $Detail) {
+    $status = 'Non-Compliant'; if ($Ok) { $status = 'Compliant' }
+    return @{ Status = $status; Actual = $Actual; Detail = $Detail }
+}
+function State([string]$Status, $Actual, $Detail) { return @{ Status = $Status; Actual = $Actual; Detail = $Detail } }
+# Run one check; any failure to read becomes an Error result instead of stopping the audit.
+function Check($Id, $Section, $Name, $Expected, [scriptblock]$Test) {
+    try {
+        $r = & $Test
+        Add-Result $Id $Section $Name $r.Status $r.Actual $Expected $r.Detail
+    } catch {
+        Add-Result $Id $Section $Name 'Error' 'not read' $Expected $_.Exception.Message
+    }
+}
+
+$Identity = [Security.Principal.WindowsIdentity]::GetCurrent()
+$IsAdmin = (New-Object Security.Principal.WindowsPrincipal($Identity)).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
+function Assert-Admin { if (-not $IsAdmin) { throw 'Requires an elevated (administrator) PowerShell.' } }
+
+# ---------------------------------------------------------------------------
+# Host information
+# ---------------------------------------------------------------------------
+$OsInfo = Get-CimInstance Win32_OperatingSystem
+$Serial = (Get-CimInstance Win32_BIOS).SerialNumber
+$AuditDate = Get-Date -Format 'yyyy-MM-dd HH:mm:ss'
+$StartedAt = (Get-Date).ToString('yyyy-MM-ddTHH:mm:sszzz')
+if (-not $IsAdmin) { Write-Warning 'Not running elevated: several checks will report Error. Run PowerShell as administrator.' }
+
+# Local security policy (password, lockout, legacy audit policy) via secedit export.
+function Get-SecPolicy {
+    $tmp = Join-Path $env:TEMP ("devseis_secpol_{0}.inf" -f [guid]::NewGuid())
+    try {
+        $null = & secedit.exe /export /cfg $tmp /areas SECURITYPOLICY /quiet
+        if (-not (Test-Path -LiteralPath $tmp)) { throw 'secedit export failed' }
+        $policy = @{}
+        foreach ($line in Get-Content -LiteralPath $tmp) {
+            if ($line -match '^\s*([A-Za-z]+)\s*=\s*(.+?)\s*$') { $policy[$Matches[1]] = $Matches[2] }
+        }
+        return $policy
+    } finally { Remove-Item -LiteralPath $tmp -Force -ErrorAction SilentlyContinue }
+}
+$Sec = $null
+if ($IsAdmin) { try { $Sec = Get-SecPolicy } catch { $Sec = $null } }
+function SecInt([string]$Key) {
+    Assert-Admin
+    if ($null -eq $Sec) { throw 'Local security policy could not be exported.' }
+    if ($Sec.ContainsKey($Key)) { return [int]$Sec[$Key] } else { return $null }
+}
+
+# ---------------------------------------------------------------------------
+# 1. Security baseline
+# ---------------------------------------------------------------------------
+$S = 'baseline'
+$minLength = [int]$B.PASSWORD_MIN_LENGTH; $history = [int]$B.PASSWORD_HISTORY; $maxAge = [int]$B.PASSWORD_MAX_AGE_DAYS
+$minAge = [int]$B.PASSWORD_MIN_AGE_DAYS; $lockMax = [int]$B.LOCKOUT_THRESHOLD_MAX
+$lockDur = [int]$B.LOCKOUT_DURATION_MIN_MINUTES; $lockObs = [int]$B.LOCKOUT_OBSERVATION_MIN_MINUTES
+
+Check 'password.min_length' $S 'Minimum password length' ">= $minLength" { $v = SecInt 'MinimumPasswordLength'; Pass ($v -ge $minLength) $v }
+Check 'password.history' $S 'Password history' ">= $history" { $v = SecInt 'PasswordHistorySize'; Pass ($v -ge $history) $v }
+Check 'password.expiration' $S 'Password expiration' "1-$maxAge days" {
+    $v = SecInt 'MaximumPasswordAge'
+    $text = "$v days"; if ($null -eq $v -or $v -le 0) { $text = 'never' }
+    if ($maxAge -eq 0) { State 'Compliant' $text 'Baseline does not require expiry.' }
+    else { Pass ($null -ne $v -and $v -ge 1 -and $v -le $maxAge) $text }
+}
+Check 'password.min_age' $S 'Minimum password age' ">= $minAge days" { $v = SecInt 'MinimumPasswordAge'; Pass ($v -ge $minAge) "$v days" }
+Check 'password.complexity' $S 'Password complexity' 'enabled' { $v = SecInt 'PasswordComplexity'; Pass ($v -eq 1) $(if ($v -eq 1) { 'enabled' } else { 'disabled' }) }
+Check 'lockout.threshold' $S 'Account lockout threshold' "1-$lockMax" { $v = SecInt 'LockoutBadCount'; Pass ($v -ge 1 -and $v -le $lockMax) $v }
+Check 'lockout.duration' $S 'Account lockout duration' ">= $lockDur minutes" {
+    $v = SecInt 'LockoutDuration'
+    if ($null -eq $v) { Pass $false 'no lockout configured' }
+    elseif ($v -eq -1) { Pass $true 'until an administrator unlocks' }
+    else { Pass ($v -ge $lockDur) "$v minutes" }
+}
+Check 'lockout.observation' $S 'Lockout observation period' ">= $lockObs minutes" {
+    $v = SecInt 'ResetLockoutCount'
+    if ($null -eq $v) { Pass $false 'no lockout configured' } else { Pass ($v -ge $lockObs) "$v minutes" }
+}
+
+# Antivirus (Security Center) and Microsoft Defender
+$AvProducts = @()
+try { $AvProducts = @(Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction Stop) } catch { $AvProducts = @() }
+$AvGood = @($AvProducts | Where-Object { (([int]$_.productState -band 0x1000) -ne 0) -and (([int]$_.productState -band 0x10) -eq 0) })
+$ThirdPartyAv = @($AvGood | Where-Object { $_.displayName -notmatch 'Defender' } | ForEach-Object { $_.displayName })
+Check 'malware.antivirus' $S 'Antivirus' 'enabled and up to date' {
+    $names = ($AvProducts | ForEach-Object {
+        $s = [int]$_.productState
+        "{0} ({1}, {2})" -f $_.displayName, $(if (($s -band 0x1000) -ne 0) { 'on' } else { 'off' }), $(if (($s -band 0x10) -eq 0) { 'up to date' } else { 'out of date' })
+    }) -join '; '
+    if (-not $names) { $names = 'none registered' }
+    Pass ($AvGood.Count -gt 0) $names
+}
+
+$Mp = $null; $MpError = $null
+try { $Mp = Get-MpComputerStatus -ErrorAction Stop } catch { $MpError = $_.Exception.Message }
+$runningMode = Get-Prop $Mp 'AMRunningMode'
+$DefenderPassive = ($null -ne $Mp -and $runningMode -and $runningMode -ne 'Normal') -or ($null -eq $Mp -and $ThirdPartyAv.Count -gt 0)
+function DefenderCheck($Id, $Name, $Expected, [scriptblock]$Test) {
+    if ($DefenderPassive) {
+        Add-Result $Id $S $Name 'NotApplicable' "Defender in $(if ($runningMode) { $runningMode } else { 'passive/off' })" $Expected ("Another antivirus is primary: " + ($ThirdPartyAv -join ', '))
+    } elseif ($null -eq $Mp) {
+        Add-Result $Id $S $Name 'Error' 'not read' $Expected $MpError
+    } else { Check $Id $S $Name $Expected $Test }
+}
+DefenderCheck 'malware.service' 'Microsoft Defender Antimalware' 'running' { Pass ($Mp.AMServiceEnabled -and $Mp.AntivirusEnabled) ("service {0}, antivirus {1}" -f $Mp.AMServiceEnabled, $Mp.AntivirusEnabled) }
+DefenderCheck 'malware.realtime' 'Real-time protection' 'on' { Pass ([bool]$Mp.RealTimeProtectionEnabled) $(if ($Mp.RealTimeProtectionEnabled) { 'on' } else { 'off' }) }
+DefenderCheck 'malware.on_access' 'On-access protection' 'on' { Pass ([bool]$Mp.OnAccessProtectionEnabled) $(if ($Mp.OnAccessProtectionEnabled) { 'on' } else { 'off' }) }
+DefenderCheck 'malware.tamper' 'Tamper protection' 'on' { Pass ([bool]$Mp.IsTamperProtected) $(if ($Mp.IsTamperProtected) { 'on' } else { 'off' }) }
+$sigMax = [int]$B.SIGNATURE_MAX_AGE_DAYS
+DefenderCheck 'malware.signatures' 'Security intelligence' "<= $sigMax days old" {
+    Pass ([int]$Mp.AntivirusSignatureAge -le $sigMax) ("{0} days old (version {1})" -f $Mp.AntivirusSignatureAge, $Mp.AntivirusSignatureVersion) ("Last updated {0}" -f $Mp.AntivirusSignatureLastUpdated)
+}
+
+# Firewall profiles (effective policy)
+$Profiles = @{}
+try { Get-NetFirewallProfile -PolicyStore ActiveStore -ErrorAction Stop | ForEach-Object { $Profiles[$_.Name] = $_ } } catch { }
+$outExpected = $B.FIREWALL_OUTBOUND.ToLower()
+foreach ($profileName in 'Domain', 'Private', 'Public') {
+    $p = $null; if ($Profiles.ContainsKey($profileName)) { $p = $Profiles[$profileName] }
+    $id = "firewall.$($profileName.ToLower())"
+    Check "$id.enabled" $S "$profileName firewall" 'on' {
+        if ($null -eq $p) { throw 'Firewall profile not readable.' }
+        Pass ("$($p.Enabled)" -eq 'True') $(if ("$($p.Enabled)" -eq 'True') { 'on' } else { 'off' })
+    }
+    Check "$id.inbound" $S "$profileName inbound" 'block' {
+        if ($null -eq $p) { throw 'Firewall profile not readable.' }
+        $action = "$($p.DefaultInboundAction)"; $detail = $null
+        if ($action -eq 'NotConfigured') { $action = 'Block'; $detail = 'Not configured: Windows default (Block) applies.' }
+        Pass ($action -eq 'Block' -and "$($p.Enabled)" -eq 'True') $action.ToLower() $detail
+    }
+    Check "$id.outbound" $S "$profileName outbound" $outExpected {
+        if ($null -eq $p) { throw 'Firewall profile not readable.' }
+        $action = "$($p.DefaultOutboundAction)"; $detail = $null
+        if ($action -eq 'NotConfigured') { $action = 'Allow'; $detail = 'Not configured: Windows default (Allow) applies.' }
+        Pass ($action.ToLower() -eq $outExpected -and "$($p.Enabled)" -eq 'True') $action.ToLower() $detail
+    }
+}
+
+# Screen lock: machine inactivity limit, else every loaded user profile's screen saver settings.
+$lockMaxSec = [int]$B.SCREEN_LOCK_MAX_SECONDS
+$MachineInactivity = Get-RegValue 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' 'InactivityTimeoutSecs'
+$LockDisabled = Get-RegValue 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' 'DisableLockWorkstation'
+$UserScreens = @()
+foreach ($hive in Get-ChildItem -Path 'Registry::HKEY_USERS' -ErrorAction SilentlyContinue) {
+    if ($hive.PSChildName -notmatch '^S-1-(5-21|12-1)-[\d-]+$') { continue }
+    $setting = @{}
+    foreach ($key in "Registry::HKEY_USERS\$($hive.PSChildName)\Software\Policies\Microsoft\Windows\Control Panel\Desktop", "Registry::HKEY_USERS\$($hive.PSChildName)\Control Panel\Desktop") {
+        foreach ($name in 'ScreenSaveActive', 'ScreenSaveTimeOut', 'ScreenSaverIsSecure') {
+            if (-not $setting.ContainsKey($name)) { $v = Get-RegValue $key $name; if ($null -ne $v) { $setting[$name] = "$v" } }
+        }
+    }
+    $account = $hive.PSChildName
+    try { $account = (New-Object Security.Principal.SecurityIdentifier($hive.PSChildName)).Translate([Security.Principal.NTAccount]).Value } catch { }
+    $UserScreens += [pscustomobject]@{ User = $account; Active = $setting['ScreenSaveActive']; Timeout = $setting['ScreenSaveTimeOut']; Secure = $setting['ScreenSaverIsSecure'] }
+}
+Check 'screen_lock.timeout' $S 'Screen lock timeout' "<= $lockMaxSec seconds" {
+    if ($null -ne $MachineInactivity -and [int]$MachineInactivity -gt 0) {
+        return Pass ([int]$MachineInactivity -le $lockMaxSec) "$MachineInactivity seconds (machine inactivity limit)"
+    }
+    if ($UserScreens.Count -eq 0) { return Pass $false 'no machine inactivity limit; no signed-in user to check' }
+    $bad = @($UserScreens | Where-Object { $_.Active -ne '1' -or -not $_.Timeout -or [int]$_.Timeout -le 0 -or [int]$_.Timeout -gt $lockMaxSec })
+    if ($bad.Count -eq 0) { Pass $true ('screen saver within limit for: ' + (($UserScreens | ForEach-Object { $_.User }) -join ', ')) }
+    else { Pass $false ('no machine inactivity limit; too long or off for: ' + (($bad | ForEach-Object { "$($_.User) ($($_.Timeout)s, active=$($_.Active))" }) -join ', ')) }
+}
+Check 'screen_lock.password' $S 'Screen lock password requirement' 'sign-in required to unlock' {
+    if ($LockDisabled -eq 1) { return Pass $false 'locking the workstation is disabled by policy' }
+    if ($null -ne $MachineInactivity -and [int]$MachineInactivity -gt 0) { return Pass $true 'machine inactivity limit locks the session' }
+    if ($UserScreens.Count -eq 0) { return Pass $false 'no machine policy; no signed-in user to check' }
+    $bad = @($UserScreens | Where-Object { $_.Secure -ne '1' })
+    if ($bad.Count -eq 0) { Pass $true 'screen saver requires sign-in for all signed-in users' }
+    else { Pass $false ('screen saver does not require sign-in for: ' + (($bad | ForEach-Object { $_.User }) -join ', ')) }
+}
+
+# USB storage
+$RS = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices'
+$RemovableDisk = "$RS\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"
+$UsbStorStart = Get-RegValue 'HKLM:\SYSTEM\CurrentControlSet\Services\USBSTOR' 'Start'
+$UsbRead = 'allow'; $UsbWrite = 'allow'; $UsbDetail = @()
+if ((Get-RegValue $RS 'Deny_All') -eq 1) { $UsbRead = 'deny'; $UsbWrite = 'deny'; $UsbDetail += 'all removable storage denied by policy' }
+if ((Get-RegValue $RemovableDisk 'Deny_Read') -eq 1) { $UsbRead = 'deny'; $UsbDetail += 'removable disk read denied by policy' }
+if ((Get-RegValue $RemovableDisk 'Deny_Write') -eq 1) { $UsbWrite = 'deny'; $UsbDetail += 'removable disk write denied by policy' }
+if ($UsbStorStart -eq 4) { $UsbRead = 'deny'; $UsbWrite = 'deny'; $UsbDetail += 'USB mass storage driver disabled' }
+if ((Get-RegValue 'HKLM:\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies' 'WriteProtect') -eq 1) { $UsbWrite = 'deny'; $UsbDetail += 'storage write protection on' }
+Check 'usb.read' $S 'USB storage read' $B.USB_READ { Pass ($UsbRead -eq $B.USB_READ.ToLower()) $UsbRead ($UsbDetail -join '; ') }
+Check 'usb.write' $S 'USB storage write' $B.USB_WRITE { Pass ($UsbWrite -eq $B.USB_WRITE.ToLower()) $UsbWrite ($UsbDetail -join '; ') }
+
+# Local Administrators group (found by its well-known SID, so it works in any language)
+function Get-AdminMembers {
+    $groupName = (New-Object Security.Principal.SecurityIdentifier('S-1-5-32-544')).Translate([Security.Principal.NTAccount]).Value.Split('\')[-1]
+    $group = [ADSI]"WinNT://$env:COMPUTERNAME/$groupName,group"
+    $machineSid = $null
+    try { $machineSid = (Get-LocalUser -ErrorAction Stop | Select-Object -First 1).SID.AccountDomainSid.Value } catch { }
+    foreach ($member in @($group.Invoke('Members'))) {
+        $sidBytes = $member.GetType().InvokeMember('objectSid', 'GetProperty', $null, $member, $null)
+        $sid = (New-Object Security.Principal.SecurityIdentifier($sidBytes, 0)).Value
+        $name = $sid
+        try { $name = (New-Object Security.Principal.SecurityIdentifier($sid)).Translate([Security.Principal.NTAccount]).Value } catch { }
+        $enabled = $true
+        if ($machineSid -and $sid.StartsWith($machineSid)) {
+            try { $enabled = (Get-LocalUser -SID $sid -ErrorAction Stop).Enabled } catch { }
+        }
+        [pscustomobject]@{ Name = $name; Short = $name.Split('\')[-1]; Sid = $sid; Enabled = $enabled; BuiltIn = $sid -match '-500$' }
+    }
+}
+$Admins = $null; $AdminError = $null
+try { $Admins = @(Get-AdminMembers) } catch { $AdminError = $_.Exception.Message }
+Check 'admin.approved' $S 'Approved IT administrator' $(if ($B.APPROVED_ADMINS) { $B.APPROVED_ADMINS } else { 'none configured' }) {
+    if ($null -eq $Admins) { throw $AdminError }
+    $ok = @($Admins | Where-Object { $_.Enabled -and (Test-InList @($_.Name, $_.Short, $_.Sid) $B.APPROVED_ADMINS) })
+    if ($ok.Count -gt 0) { Pass $true (($ok | ForEach-Object { $_.Name }) -join ', ') }
+    else { Pass $false 'none of the approved accounts is an enabled administrator' }
+}
+Check 'admin.unauthorized' $S 'Unauthorized employee local administrator accounts' 'none' {
+    if ($null -eq $Admins) { throw $AdminError }
+    $bad = @($Admins | Where-Object {
+        -not (Test-InList @($_.Name, $_.Short, $_.Sid) $B.APPROVED_ADMINS) -and
+        -not ($_.BuiltIn -and -not $_.Enabled -and $B.ALLOW_DISABLED_BUILTIN_ADMIN -eq '1')
+    })
+    if ($bad.Count -eq 0) { Pass $true 'none' }
+    else { Pass $false (($bad | ForEach-Object { $_.Name + $(if (-not $_.Enabled) { ' (disabled)' } else { '' }) }) -join ', ') }
+}
+
+# BitLocker on the system drive
+$Bl = $null; $BlError = $null
+try { Assert-Admin; $Bl = Get-BitLockerVolume -MountPoint $env:SystemDrive -ErrorAction Stop } catch { $BlError = $_.Exception.Message }
+function BitLockerCheck($Id, $Name, $Expected, [scriptblock]$Test) {
+    if ($null -eq $Bl) { Add-Result $Id $S $Name 'Error' 'not read' $Expected $BlError } else { Check $Id $S $Name $Expected $Test }
+}
+BitLockerCheck 'encryption.feature' 'BitLocker' 'on' { Pass ("$($Bl.VolumeStatus)" -ne 'FullyDecrypted') $(if ("$($Bl.VolumeStatus)" -ne 'FullyDecrypted') { 'on' } else { 'off' }) }
+BitLockerCheck 'encryption.enabled' 'Encryption' 'fully encrypted' { Pass ("$($Bl.VolumeStatus)" -eq 'FullyEncrypted') ("{0} ({1}%)" -f $Bl.VolumeStatus, $Bl.EncryptionPercentage) }
+BitLockerCheck 'encryption.protection' 'BitLocker protection' 'protection on, AES' {
+    $method = "$($Bl.EncryptionMethod)"
+    Pass ("$($Bl.ProtectionStatus)" -eq 'On' -and $method -match 'Aes') ("protection {0}, {1}" -f $Bl.ProtectionStatus, $method)
+}
+BitLockerCheck 'encryption.recovery' 'BitLocker recovery' 'recovery password present' {
+    $types = @($Bl.KeyProtector | ForEach-Object { "$($_.KeyProtectorType)" })
+    Pass ($types -contains 'RecoveryPassword') ('key protectors: ' + ($types -join ', '))
+}
+
+# ---------------------------------------------------------------------------
+# 2. GDPR technical controls
+# ---------------------------------------------------------------------------
+$S = 'gdpr'
+
+Check 'gdpr.auto_updates' $S 'Automatic security updates' 'automatic' {
+    $au = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU'
+    $noAuto = Get-RegValue $au 'NoAutoUpdate'; $option = Get-RegValue $au 'AUOptions'
+    $svc = Get-Service -Name wuauserv -ErrorAction SilentlyContinue
+    if ($svc -and "$($svc.StartType)" -eq 'Disabled') { return Pass $false 'Windows Update service disabled' }
+    if ($noAuto -eq 1) { return Pass $false 'automatic updates turned off by policy' }
+    if ($null -ne $option) { return Pass ([int]$option -ge 3) "AUOptions=$option" 'AUOptions 3-5 download and install automatically; 2 only notifies.' }
+    Pass $true 'Windows default (automatic)'
+}
+$updMax = [int]$B.UPDATES_MAX_AGE_DAYS
+Check 'gdpr.updates_recent' $S 'Security updates installed recently' "<= $updMax days ago" {
+    $last = $null
+    try {
+        $searcher = (New-Object -ComObject Microsoft.Update.Session).CreateUpdateSearcher()
+        $count = $searcher.GetTotalHistoryCount()
+        if ($count -gt 0) {
+            $last = @($searcher.QueryHistory(0, [Math]::Min($count, 300)) | Where-Object {
+                $_.Operation -eq 1 -and $_.ResultCode -eq 2 -and $_.Title -notmatch 'Security Intelligence|Definition Update|KB2267602'
+            } | Sort-Object Date -Descending | Select-Object -First 1)
+        }
+    } catch { }
+    if ($last -and $last.Count -gt 0) {
+        $age = [int]((Get-Date) - $last[0].Date.ToLocalTime()).TotalDays
+        return Pass ($age -le $updMax) "$age days ago" ("Last update: {0} ({1:yyyy-MM-dd})" -f $last[0].Title, $last[0].Date)
+    }
+    $hotfix = Get-HotFix -ErrorAction Stop | Where-Object { $_.InstalledOn } | Sort-Object InstalledOn -Descending | Select-Object -First 1
+    if (-not $hotfix) { throw 'No update history found.' }
+    $age = [int]((Get-Date) - $hotfix.InstalledOn).TotalDays
+    Pass ($age -le $updMax) "$age days ago" ("Last hotfix: {0}" -f $hotfix.HotFixID)
+}
+Check 'gdpr.os_supported' $S 'Supported operating system version' "build $($B.WINDOWS_MIN_BUILD) or later" {
+    Pass ([int]$OsInfo.BuildNumber -ge [int]$B.WINDOWS_MIN_BUILD) ("{0} build {1}" -f $OsInfo.Caption, $OsInfo.BuildNumber)
+}
+Check 'gdpr.security_logging' $S 'Security event logging' 'logon success+failure and account changes audited' {
+    Assert-Admin
+    $tmp = Join-Path $env:TEMP ("devseis_audit_{0}.csv" -f [guid]::NewGuid())
+    try {
+        $null = & auditpol.exe /backup /file:$tmp
+        $rows = @(Import-Csv -LiteralPath $tmp)
+    } finally { Remove-Item -LiteralPath $tmp -Force -ErrorAction SilentlyContinue }
+    $value = { param($guid) $r = $rows | Where-Object { $_.'Subcategory GUID' -eq $guid } | Select-Object -First 1; if ($r) { [int]$r.'Setting Value' } else { 0 } }
+    $logon = & $value '{0CCE9215-69AE-11D9-BED3-505054503030}'
+    $account = & $value '{0CCE9235-69AE-11D9-BED3-505054503030}'
+    # Fall back to the legacy audit policy when advanced subcategories are not set.
+    if ($logon -eq 0 -and $Sec -and $Sec.ContainsKey('AuditLogonEvents')) { $logon = [int]$Sec['AuditLogonEvents'] }
+    if ($account -eq 0 -and $Sec -and $Sec.ContainsKey('AuditAccountManage')) { $account = [int]$Sec['AuditAccountManage'] }
+    $names = @{ 0 = 'none'; 1 = 'success'; 2 = 'failure'; 3 = 'success+failure' }
+    Pass ($logon -eq 3 -and ($account -band 1) -eq 1) ("logon: {0}; account management: {1}" -f $names[$logon], $names[$account])
+}
+Check 'gdpr.time_sync' $S 'Time synchronisation' 'NTP or domain time' {
+    $type = Get-RegValue 'HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\Parameters' 'Type'
+    $svc = Get-Service -Name W32Time -ErrorAction SilentlyContinue
+    Pass ($type -and $type -ne 'NoSync' -and $svc -and "$($svc.StartType)" -ne 'Disabled') ("type {0}, service {1}" -f $type, $(if ($svc) { "$($svc.Status)/$($svc.StartType)" } else { 'missing' }))
+}
+
+$BackupTools = @()
+if (Get-RegValue 'HKLM:\SOFTWARE\Policies\Microsoft\OneDrive' 'KFMSilentOptIn') { $BackupTools += 'OneDrive folder backup (policy)' }
+foreach ($profileDir in Get-ChildItem -Path (Join-Path $env:SystemDrive 'Users') -Directory -ErrorAction SilentlyContinue) {
+    if (Test-Path -LiteralPath (Join-Path $profileDir.FullName 'AppData\Local\Microsoft\Windows\FileHistory\Configuration\Config1.xml')) { $BackupTools += "File History ($($profileDir.Name))" }
+}
+foreach ($svcName in 'VeeamEndpointBackupSvc', 'AcronisCyberProtectionService', 'MMS', 'CrashPlanService', 'bzserv') {
+    $svc = Get-Service -Name $svcName -ErrorAction SilentlyContinue
+    if ($svc -and "$($svc.Status)" -eq 'Running') { $BackupTools += $svc.DisplayName }
+}
+Check 'gdpr.backup_configured' $S 'Backup configured' 'backup configured' {
+    Pass ($BackupTools.Count -gt 0) $(if ($BackupTools.Count) { $BackupTools -join ', ' } else { 'none found' })
+}
+Check 'gdpr.backup_recent' $S 'Recent backup' "<= $($B.BACKUP_MAX_AGE_DAYS) days ago" {
+    if ($BackupTools.Count -eq 0) { return Pass $false 'no backup' }
+    State 'Pending' 'date not readable' ("Confirm the last backup date in: " + ($BackupTools -join ', '))
+}
+Check 'gdpr.removable_encryption' $S 'Removable media encryption' 'no unencrypted writes' {
+    $btg = Get-RegValue 'HKLM:\SYSTEM\CurrentControlSet\Policies\Microsoft\FVE' 'RDVDenyWriteAccess'
+    if ($btg -eq 1) { return Pass $true 'BitLocker To Go required before writing' }
+    if ($UsbWrite -eq 'deny') { return Pass $true 'writing to USB storage blocked' }
+    Pass $false 'USB drives writable without encryption'
+}
+Check 'gdpr.guest_account' $S 'Guest account disabled' 'disabled' {
+    $guest = Get-LocalUser -ErrorAction Stop | Where-Object { $_.SID.Value -match '-501$' } | Select-Object -First 1
+    if (-not $guest) { return Pass $true 'no guest account' }
+    Pass (-not $guest.Enabled) $(if ($guest.Enabled) { 'enabled' } else { 'disabled' })
+}
+Check 'gdpr.remote_access' $S 'Remote access services restricted' $(if ($B.APPROVED_REMOTE_SERVICES) { "only: $($B.APPROVED_REMOTE_SERVICES)" } else { 'only: none' }) {
+    $on = @()
+    if ((Get-RegValue 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' 'fDenyTSConnections') -eq 0) { $on += 'rdp' }
+    foreach ($pair in @(@('sshd', 'ssh'), @('WinRM', 'winrm'), @('TeamViewer', 'teamviewer'), @('AnyDesk', 'anydesk'), @('chromoting', 'chromeremotedesktop'))) {
+        $svc = Get-Service -Name $pair[0] -ErrorAction SilentlyContinue
+        if ($svc -and "$($svc.Status)" -eq 'Running') { $on += $pair[1] }
+    }
+    try { if (@(Get-SmbShare -ErrorAction Stop | Where-Object { -not $_.Special }).Count -gt 0) { $on += 'smb' } } catch { }
+    $bad = @($on | Where-Object { -not (Test-InList @($_) $B.APPROVED_REMOTE_SERVICES) })
+    if ($bad.Count -eq 0) { Pass $true $(if ($on.Count) { $on -join ', ' } else { 'none enabled' }) } else { Pass $false ($bad -join ', ') }
+}
+Check 'gdpr.telemetry' $S 'Diagnostic data minimised' 'required diagnostic data only (0-1)' {
+    $policy = Get-RegValue 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection' 'AllowTelemetry'
+    $setting = Get-RegValue 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection' 'AllowTelemetry'
+    $level = $policy; $source = 'policy'
+    if ($null -eq $level) { $level = $setting; $source = 'Settings' }
+    if ($null -eq $level) { return Pass $false 'not configured' 'Windows may send optional diagnostic data.' }
+    Pass ([int]$level -le 1) "AllowTelemetry=$level ($source)"
+}
+Add-Result 'gdpr.personal_data_discovery' $S 'Personal data discovery' 'NotApplicable' 'not run' 'opt-in scan' "Opt-in scan (PERSONAL_DATA_SCAN=$($B.PERSONAL_DATA_SCAN)) is planned for a later stage."
+
+# ---------------------------------------------------------------------------
+# 3. EU AI Act controls
+# ---------------------------------------------------------------------------
+$S = 'aiact'
+$AiTools = New-Object System.Collections.Generic.List[string]
+$AiDetail = @()
+function Add-Tool([string]$Name) { if (-not $AiTools.Contains($Name)) { $AiTools.Add($Name) } }
+$KnownApps = [ordered]@{ '^Ollama' = 'Ollama'; '^LM Studio' = 'LM Studio'; '^GPT4All' = 'GPT4All'; '^Jan( |$)' = 'Jan'; 'ChatGPT' = 'ChatGPT'
+    '^Claude' = 'Claude'; '^Cursor' = 'Cursor'; '^Windsurf' = 'Windsurf'; '^Perplexity' = 'Perplexity'; '^Msty' = 'Msty' }
+$uninstallKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*')
+foreach ($hive in Get-ChildItem -Path 'Registry::HKEY_USERS' -ErrorAction SilentlyContinue) {
+    if ($hive.PSChildName -match '^S-1-(5-21|12-1)-[\d-]+$') { $uninstallKeys += "Registry::HKEY_USERS\$($hive.PSChildName)\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" }
+}
+foreach ($key in $uninstallKeys) {
+    foreach ($app in @(Get-ItemProperty -Path $key -ErrorAction SilentlyContinue)) {
+        $display = Get-Prop $app 'DisplayName'
+        if (-not $display) { continue }
+        foreach ($pattern in $KnownApps.Keys) { if ($display -match $pattern) { Add-Tool $KnownApps[$pattern] } }
+    }
+}
+try {
+    $appx = @(Get-AppxPackage -AllUsers -ErrorAction Stop)
+} catch { $appx = @(Get-AppxPackage -ErrorAction SilentlyContinue) }
+foreach ($pkg in $appx) {
+    if ($pkg.Name -eq 'Microsoft.Copilot' -or $pkg.Name -eq 'Microsoft.Windows.Ai.Copilot.Provider') { Add-Tool 'Microsoft Copilot' }
+    elseif ($pkg.Name -match 'ChatGPT') { Add-Tool 'ChatGPT' }
+    elseif ($pkg.Name -match 'Claude') { Add-Tool 'Claude' }
+}
+try { if (Get-NetTCPConnection -LocalPort 11434 -State Listen -ErrorAction Stop) { Add-Tool 'Ollama'; $AiDetail += 'Local AI service listening on port 11434.' } } catch { }
+foreach ($profileDir in Get-ChildItem -Path (Join-Path $env:SystemDrive 'Users') -Directory -ErrorAction SilentlyContinue) {
+    foreach ($cli in '.local\bin\claude.exe', 'AppData\Roaming\npm\claude.cmd') {
+        if (Test-Path -LiteralPath (Join-Path $profileDir.FullName $cli)) { Add-Tool 'Claude Code' }
+    }
+    foreach ($pair in @(@('.ollama\models', 'Ollama'), @('.cache\lm-studio\models', 'LM Studio'), @('.lmstudio\models', 'LM Studio'),
+                        @('AppData\Local\nomic.ai\GPT4All', 'GPT4All'), @('.cache\huggingface\hub', 'Hugging Face models'))) {
+        $path = Join-Path $profileDir.FullName $pair[0]
+        if ((Test-Path -LiteralPath $path) -and (Get-ChildItem -LiteralPath $path -ErrorAction SilentlyContinue | Select-Object -First 1)) {
+            Add-Tool $pair[1]
+            $bytes = (Get-ChildItem -LiteralPath $path -Recurse -File -ErrorAction SilentlyContinue | Measure-Object -Property Length -Sum).Sum
+            $AiDetail += ("Local models: {0} ({1:N1} GB)." -f $path, ($bytes / 1GB))
+        }
+    }
+}
+$AiList = $AiTools -join ', '
+Add-Result 'aiact.inventory' $S 'AI software inventory' 'Compliant' $(if ($AiList) { $AiList } else { 'no AI tools found' }) 'inventory taken' ($AiDetail -join ' ')
+Check 'aiact.unapproved' $S 'Unapproved AI tools (shadow AI)' $(if ($B.APPROVED_AI_TOOLS) { "only: $($B.APPROVED_AI_TOOLS)" } else { 'only: none' }) {
+    $bad = @($AiTools | Where-Object { -not (Test-InList @($_) $B.APPROVED_AI_TOOLS) })
+    if ($bad.Count -eq 0) { Pass $true 'none' } else { Pass $false ($bad -join ', ') }
+}
+if ($AiTools.Count -gt 0) {
+    Add-Result 'aiact.risk_classification' $S 'AI system risk classification' 'Pending' $AiList 'every AI tool classified' 'Classified by the auditor model (Caveat classifier) in a later step.'
+} else {
+    Add-Result 'aiact.risk_classification' $S 'AI system risk classification' 'NotApplicable' 'no AI tools found' 'every AI tool classified' $null
+}
+Check 'aiact.os_ai_features' $S 'Windows Recall / Copilot data analysis disabled' 'disabled by policy' {
+    $ai = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI'
+    $disableAnalysis = Get-RegValue $ai 'DisableAIDataAnalysis'; $allowRecall = Get-RegValue $ai 'AllowRecallEnablement'
+    $copilotOff = Get-RegValue 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot' 'TurnOffWindowsCopilot'
+    $detail = "DisableAIDataAnalysis=$disableAnalysis; AllowRecallEnablement=$allowRecall; TurnOffWindowsCopilot=$copilotOff"
+    if ($disableAnalysis -eq 1 -or $allowRecall -eq 0) { return Pass $true 'Recall disabled by policy' $detail }
+    $recall = $null
+    try { Assert-Admin; $recall = Get-WindowsOptionalFeature -Online -FeatureName Recall -ErrorAction Stop } catch { }
+    if ($null -eq $recall) { return State 'NotApplicable' 'Recall not available on this device' $detail }
+    Pass $false ("Recall feature {0}, not disabled by policy" -f $recall.State) $detail
+}
+if ($AiTools.Count -gt 0) {
+    Add-Result 'aiact.log_retention' $S 'AI usage log retention' 'Pending' 'depends on classification' '>= 6 months for high-risk AI' 'Required only if a tool is classified high-risk.'
+} else {
+    Add-Result 'aiact.log_retention' $S 'AI usage log retention' 'NotApplicable' 'no AI tools found' '>= 6 months for high-risk AI' $null
+}
+
+# ---------------------------------------------------------------------------
+# 4. Organisational controls (answers from organisational.conf)
+# ---------------------------------------------------------------------------
+$S = 'org'
+$OrgItems = [ordered]@{
+    'org.ropa' = @('ORG_ROPA', 'Record of processing activities'); 'org.dpia' = @('ORG_DPIA', 'Data protection impact assessment')
+    'org.breach_procedure' = @('ORG_BREACH_PROCEDURE', 'Breach response procedure'); 'org.processor_agreements' = @('ORG_PROCESSOR_AGREEMENTS', 'Data processing agreements')
+    'org.ai_register' = @('ORG_AI_REGISTER', 'AI register'); 'org.ai_literacy' = @('ORG_AI_LITERACY', 'AI literacy training')
+    'org.human_oversight' = @('ORG_HUMAN_OVERSIGHT', 'Human oversight for high-risk AI'); 'org.ai_transparency' = @('ORG_AI_TRANSPARENCY', 'AI transparency to users')
+}
+foreach ($id in $OrgItems.Keys) {
+    $key = $OrgItems[$id][0]; $name = $OrgItems[$id][1]
+    $answer = ''; if ($OrgAnswers.ContainsKey($key)) { $answer = $OrgAnswers[$key].ToLower() }
+    switch ($answer) {
+        'yes' { Add-Result $id $S $name 'Compliant' 'yes' 'yes' $null }
+        'no' { Add-Result $id $S $name 'Non-Compliant' 'no' 'yes' $null }
+        'partial' { Add-Result $id $S $name 'Non-Compliant' 'partial' 'yes' $null }
+        { $_ -in 'n/a', 'na' } { Add-Result $id $S $name 'NotApplicable' 'n/a' 'yes' $null }
+        default { Add-Result $id $S $name 'Pending' 'not answered' 'yes' "Answer $key in organisational.conf." }
+    }
+}
+
+# ---------------------------------------------------------------------------
+# Report and evidence
+# ---------------------------------------------------------------------------
+$Line = '=' * 60
+$sb = New-Object System.Text.StringBuilder
+function W([string]$Text) { [void]$sb.AppendLine($Text) }
+W $Line; W ' WINDOWS ENDPOINT SECURITY BASELINE - AUDIT'; W $Line
+W "Hostname        : $env:COMPUTERNAME"
+W "Operating System: $($OsInfo.Caption)"
+W "OS Version      : $($OsInfo.Version)"
+W "Build           : $($OsInfo.BuildNumber)"
+W "Serial Number   : $Serial"
+W "Execution User  : $($Identity.Name)"
+W "Audit Date      : $AuditDate"
+W 'Audit Mode      : READ-ONLY'
+W $Line
+foreach ($section in @(@('baseline', 'COMPLIANCE RESULTS'), @('gdpr', 'GDPR TECHNICAL CONTROLS'), @('aiact', 'EU AI ACT CONTROLS'), @('org', 'ORGANISATIONAL CONTROLS'))) {
+    W ''; W $Line; W " $($section[1])"; W $Line
+    foreach ($r in $Results) { if ($r.section -eq $section[0]) { W $r.name; W $r.status } }
+}
+W $Line; W ' END OF READ-ONLY AUDIT'; W $Line
+$ReportText = $sb.ToString()
+
+$Summary = [ordered]@{}
+foreach ($status in 'Compliant', 'Non-Compliant', 'NotApplicable', 'Pending', 'Error') { $Summary[$status] = @($Results | Where-Object { $_.status -eq $status }).Count }
+$Evidence = [ordered]@{
+    schema_version = '1.0'
+    catalog_version = $CatalogVersion
+    source = [ordered]@{ kind = 'collector'; collector = 'windows'; collector_version = $CollectorVersion }
+    audit = [ordered]@{ mode = 'READ-ONLY'; started_at = $StartedAt; execution_user = $Identity.Name; is_admin = [bool]$IsAdmin }
+    host = [ordered]@{ hostname = $env:COMPUTERNAME; os_family = 'windows'; os_name = "$($OsInfo.Caption)"; os_version = "$($OsInfo.Version)"
+                       build = "$($OsInfo.BuildNumber)"; architecture = "$env:PROCESSOR_ARCHITECTURE"; serial_number = "$Serial" }
+    baseline = $B
+    results = $Results
+    summary = $Summary
+}
+
+Write-Output $ReportText
+try {
+    New-Item -ItemType Directory -Path $Output -Force | Out-Null
+    $base = Join-Path $Output ("audit-windows-{0}-{1:yyyyMMdd-HHmmss}" -f $env:COMPUTERNAME, (Get-Date))
+    $utf8 = New-Object System.Text.UTF8Encoding($false)
+    [IO.File]::WriteAllText("$base.txt", $ReportText, $utf8)
+    [IO.File]::WriteAllText("$base.json", ($Evidence | ConvertTo-Json -Depth 6), $utf8)
+    Write-Host "Report:   $base.txt"
+    Write-Host "Evidence: $base.json"
+} catch {
+    Write-Error "Could not write to $Output (use -Output DIR): $($_.Exception.Message)" -ErrorAction Continue
+    exit 2
+}
+if ($Summary['Non-Compliant'] -gt 0) { exit 1 }
+exit 0

index.html

@@ -1,19 +1,155 @@
 <!doctype html>
-<html>
-	<head>
-		<meta charset="utf-8" />
-		<meta name="viewport" content="width=device-width" />
-		<title>My static Space</title>
-		<link rel="stylesheet" href="style.css" />
-	</head>
-	<body>
-		<div class="card">
-			<h1>Welcome to your static Space!</h1>
-			<p>You can modify this app directly by editing <i>index.html</i> in the Files and versions tab.</p>
-			<p>
-				Also don't forget to check the
-				<a href="https://huggingface.co/docs/hub/spaces" target="_blank">Spaces documentation</a>.
-			</p>
-		</div>
-	</body>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Endpoint Auditor — Devseis</title>
+<meta name="description" content="Read-only endpoint audit for ISO 27001, GDPR and the EU AI Act. Stage 1, step 1: collectors, evidence format and synthetic data.">
+<style>
+  :root {
+    --bg: #f7f8fb; --card: #ffffff; --text: #16181d; --muted: #5b6270; --line: #e3e6ec;
+    --red: #ED2939; --blue: #00A1DE; --ok: #1a7f37; --bad: #c4242f; --na: #6e7781; --pending: #9a6700; --err: #8250df;
+    --code-bg: #0f1218; --code-text: #e6edf3;
+  }
+  @media (prefers-color-scheme: dark) {
+    :root:not([data-theme="light"]) {
+      --bg: #0d1117; --card: #161b22; --text: #e6edf3; --muted: #9da7b3; --line: #2b313a;
+      --ok: #3fb950; --bad: #ff6b6b; --na: #8b949e; --pending: #d29922; --err: #b392f0; --code-bg: #0a0d12;
+    }
+  }
+  * { box-sizing: border-box; }
+  body { margin: 0; background: var(--bg); color: var(--text); font: 16px/1.55 system-ui, -apple-system, "Segoe UI", Roboto, sans-serif; }
+  main { max-width: 1040px; margin: 0 auto; padding: 32px 16px 64px; }
+  .tag { display: inline-block; font-size: 12px; font-weight: 600; letter-spacing: .04em; text-transform: uppercase; color: var(--red); border: 1px solid var(--red); border-radius: 999px; padding: 2px 10px; }
+  h1 { font-size: clamp(28px, 5vw, 40px); line-height: 1.15; margin: 14px 0 8px; }
+  h2 { font-size: 20px; margin: 36px 0 12px; }
+  p.lead { color: var(--muted); font-size: 18px; max-width: 760px; margin: 0; }
+  .grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(220px, 1fr)); gap: 12px; margin-top: 20px; }
+  .card { background: var(--card); border: 1px solid var(--line); border-radius: 12px; padding: 16px; }
+  .card b { display: block; font-size: 15px; margin-bottom: 4px; }
+  .card span { color: var(--muted); font-size: 14px; }
+  .tabs { display: flex; gap: 8px; flex-wrap: wrap; margin: 12px 0; }
+  .tabs button { font: inherit; font-size: 14px; padding: 6px 14px; border-radius: 999px; border: 1px solid var(--line); background: var(--card); color: var(--text); cursor: pointer; }
+  .tabs button[aria-selected="true"] { background: var(--blue); border-color: var(--blue); color: #fff; }
+  .counts { display: flex; gap: 8px; flex-wrap: wrap; margin-bottom: 12px; }
+  .pill { font-size: 13px; font-weight: 600; padding: 3px 10px; border-radius: 999px; background: var(--card); border: 1px solid var(--line); }
+  .s-Compliant { color: var(--ok); } .s-Non-Compliant { color: var(--bad); } .s-NotApplicable { color: var(--na); }
+  .s-Pending { color: var(--pending); } .s-Error { color: var(--err); }
+  .split { display: grid; grid-template-columns: minmax(0, 1fr) minmax(0, 1.25fr); gap: 12px; }
+  @media (max-width: 760px) { .split { grid-template-columns: 1fr; } }
+  pre { margin: 0; background: var(--code-bg); color: var(--code-text); border-radius: 12px; padding: 14px; font: 12.5px/1.45 ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; overflow: auto; max-height: 560px; }
+  table { width: 100%; border-collapse: collapse; font-size: 13.5px; }
+  .table-wrap { background: var(--card); border: 1px solid var(--line); border-radius: 12px; overflow: auto; max-height: 560px; }
+  th, td { text-align: left; padding: 7px 10px; border-bottom: 1px solid var(--line); vertical-align: top; }
+  th { position: sticky; top: 0; background: var(--card); font-size: 12px; text-transform: uppercase; letter-spacing: .03em; color: var(--muted); }
+  td.ref { color: var(--muted); font-size: 12.5px; }
+  code { font: 13px ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; background: var(--card); border: 1px solid var(--line); border-radius: 6px; padding: 1px 6px; }
+  .note { border-left: 4px solid var(--red); background: var(--card); padding: 12px 16px; border-radius: 0 12px 12px 0; color: var(--muted); }
+  ol li { margin: 4px 0; }
+  a { color: var(--blue); }
+  footer { margin-top: 48px; color: var(--muted); font-size: 14px; }
+</style>
+</head>
+<body>
+<main>
+  <span class="tag">Experimental · stage 1 · step 1</span>
+  <h1>Devseis Endpoint Auditor</h1>
+  <p class="lead">A read-only audit of Windows, Linux and macOS endpoints against a security baseline, GDPR technical controls, EU AI Act controls and organisational controls — producing a plain report and JSON evidence for a local auditor model.</p>
+
+  <div class="grid">
+    <div class="card"><b>Read-only collectors</b><span>PowerShell, Linux shell and macOS shell scripts. They read settings and never change the system.</span></div>
+    <div class="card"><b>One evidence format</b><span>Same JSON for every OS, joined to a catalog with ISO 27001, GDPR and AI Act references.</span></div>
+    <div class="card"><b>Synthetic data</b><span>Realistic evidence with the same rules, so the auditor model can be built before real data exists.</span></div>
+    <div class="card"><b>Runs locally</b><span>Evidence stays on the device. Nothing is sent anywhere.</span></div>
+  </div>
+
+  <h2>Sample audit (synthetic)</h2>
+  <div class="tabs" role="tablist" id="tabs"></div>
+  <div class="counts" id="counts"></div>
+  <div class="split">
+    <pre id="report" aria-label="Text report">Loading…</pre>
+    <div class="table-wrap">
+      <table>
+        <thead><tr><th>Check</th><th>Status</th><th>Found</th><th>References</th></tr></thead>
+        <tbody id="rows"></tbody>
+      </table>
+    </div>
+  </div>
+
+  <h2>Roadmap</h2>
+  <ol>
+    <li><b>Collectors, evidence format, catalog, synthetic data</b> — this Space</li>
+    <li>Control library in Devseis's own wording, for retrieval by the model</li>
+    <li>Training data: evidence → auditor findings, reviewed by an ISO 27001 / GDPR expert</li>
+    <li>Fine-tune a small open-weight model to run locally</li>
+    <li>Evaluate on held-out data and publish the scores</li>
+    <li>One installer per OS: detect the OS, run the audit, write the report locally</li>
+  </ol>
+
+  <p class="note">Not a certification. ISO 27001 certification needs an accredited auditor, and much of GDPR and AI Act compliance is organisational. The tool collects evidence and flags gaps. See the <a href="README.md">README</a> for how to run the collectors.</p>
+
+  <footer>Devseis · <a href="https://huggingface.co/Devseis">huggingface.co/Devseis</a></footer>
+</main>
+<script>
+const SAMPLES = { windows: 'synthetic/samples/synthetic-windows-42000126.json', linux: 'synthetic/samples/synthetic-linux-42000126.json', macos: 'synthetic/samples/synthetic-macos-42000126.json' };
+const LABELS = { windows: 'Windows', linux: 'Linux', macos: 'macOS' };
+const LAYOUT = {
+  windows: { title: 'WINDOWS ENDPOINT SECURITY BASELINE - AUDIT', results: 'COMPLIANCE RESULTS', end: 'END OF READ-ONLY AUDIT', blank: true, extra: ['Build', 'build'] },
+  linux: { title: 'LINUX ENDPOINT SECURITY BASELINE - AUDIT', results: 'LINUX ENDPOINT SECURITY BASELINE - RESULTS', end: 'END OF LINUX ENDPOINT SECURITY BASELINE AUDIT', blank: false, extra: ['Kernel', 'kernel'] },
+  macos: { title: 'macOS ENDPOINT SECURITY BASELINE - AUDIT', results: 'COMPLIANCE RESULTS', end: 'END OF AUDIT', blank: false, extra: ['Build', 'build'] },
+};
+const SECTIONS = [['baseline', null], ['gdpr', 'GDPR TECHNICAL CONTROLS'], ['aiact', 'EU AI ACT CONTROLS'], ['org', 'ORGANISATIONAL CONTROLS']];
+let catalog = null;
+
+function render(rec) {
+  const L = LAYOUT[rec.host.os_family], line = '='.repeat(60), pad = s => (s + ' '.repeat(16)).slice(0, 16);
+  const out = [line, ' ' + L.title, line,
+    pad('Hostname') + ': ' + rec.host.hostname, pad('Operating System') + ': ' + rec.host.os_name,
+    pad('OS Version') + ': ' + rec.host.os_version, pad(L.extra[0]) + ': ' + (rec.host[L.extra[1]] || ''),
+    pad('Serial Number') + ': ' + (rec.host.serial_number || ''), pad('Execution User') + ': ' + rec.audit.execution_user,
+    pad('Audit Date') + ': ' + rec.audit.started_at.replace('T', ' ').slice(0, 19), pad('Audit Mode') + ': ' + rec.audit.mode, line];
+  for (const [id, title] of SECTIONS) {
+    if (L.blank) out.push('');
+    out.push(line, ' ' + (title || L.results), line);
+    for (const r of rec.results) if (r.section === id) out.push(r.name, r.status);
+  }
+  out.push(line, ' ' + L.end, line);
+  return out.join('\n');
+}
+
+function refs(id) {
+  const c = catalog && catalog.checks.find(x => x.id === id);
+  if (!c) return '';
+  return [...c.controls.iso27001.map(x => 'ISO ' + x), ...c.controls.gdpr.map(x => 'GDPR ' + x), ...c.controls.ai_act.map(x => 'AI Act ' + x)].join(' · ');
+}
+
+function esc(s) { const d = document.createElement('div'); d.textContent = s; return d.innerHTML; }
+
+async function show(os) {
+  document.querySelectorAll('#tabs button').forEach(b => b.setAttribute('aria-selected', String(b.dataset.os === os)));
+  try {
+    const rec = await (await fetch(SAMPLES[os])).json();
+    document.getElementById('report').textContent = render(rec);
+    document.getElementById('counts').innerHTML = Object.entries(rec.summary)
+      .map(([k, v]) => `<span class="pill s-${k}">${v} ${k}</span>`).join('');
+    document.getElementById('rows').innerHTML = rec.results.map(r =>
+      `<tr><td>${esc(r.name)}</td><td class="s-${r.status}"><b>${r.status}</b></td><td>${esc(r.actual)}</td><td class="ref">${esc(refs(r.id))}</td></tr>`).join('');
+  } catch (e) {
+    document.getElementById('report').textContent = 'Could not load the sample: ' + e.message;
+  }
+}
+
+(async () => {
+  try { catalog = await (await fetch('catalog/checks.json')).json(); } catch (e) { catalog = null; }
+  const tabs = document.getElementById('tabs');
+  for (const os of Object.keys(SAMPLES)) {
+    const b = document.createElement('button');
+    b.textContent = LABELS[os]; b.dataset.os = os; b.setAttribute('role', 'tab');
+    b.addEventListener('click', () => show(os));
+    tabs.appendChild(b);
+  }
+  show('windows');
+})();
+</script>
+</body>
 </html>

organisational.conf

@@ -0,0 +1,20 @@
+# Organisational controls: answered once by the organisation, included in every audit report.
+# Answer each with: yes | no | partial | n/a   (leave empty = Pending)
+# yes = Compliant, no/partial = Non-Compliant, n/a = NotApplicable.
+
+# GDPR Art. 30: Is there a current record of processing activities (RoPA)?
+ORG_ROPA=
+# GDPR Art. 35: Has a DPIA been done for every high-risk processing activity?
+ORG_DPIA=
+# GDPR Art. 33-34: Is there a tested procedure to report a personal data breach within 72 hours?
+ORG_BREACH_PROCEDURE=
+# GDPR Art. 28: Are data processing agreements signed with all processors, including AI providers?
+ORG_PROCESSOR_AGREEMENTS=
+# AI Act Art. 26: Is there a register of the AI systems the organisation uses?
+ORG_AI_REGISTER=
+# AI Act Art. 4: Have staff who use AI received AI literacy training?
+ORG_AI_LITERACY=
+# AI Act Art. 14, 26: Is a trained person assigned to oversee each high-risk AI system?
+ORG_HUMAN_OVERSIGHT=
+# AI Act Art. 50: Are people told when they interact with AI or receive AI-generated content?
+ORG_AI_TRANSPARENCY=

schema/evidence.schema.json

@@ -0,0 +1,85 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://huggingface.co/spaces/Devseis/endpoint-auditor/schema/evidence.schema.json",
+  "title": "Devseis endpoint audit evidence",
+  "description": "Output of one read-only audit run (real collector or synthetic generator). Control references are not repeated here: join results[].id with catalog/checks.json.",
+  "type": "object",
+  "required": ["schema_version", "catalog_version", "source", "audit", "host", "baseline", "results", "summary"],
+  "additionalProperties": false,
+  "properties": {
+    "schema_version": { "const": "1.0" },
+    "catalog_version": { "type": "string" },
+    "source": {
+      "type": "object",
+      "required": ["kind", "collector", "collector_version"],
+      "additionalProperties": false,
+      "properties": {
+        "kind": { "enum": ["collector", "synthetic"] },
+        "collector": { "enum": ["windows", "linux", "macos"] },
+        "collector_version": { "type": "string" },
+        "synthetic_seed": { "type": "integer" },
+        "synthetic_profile": { "type": "string" }
+      }
+    },
+    "audit": {
+      "type": "object",
+      "required": ["mode", "started_at", "execution_user", "is_admin"],
+      "additionalProperties": false,
+      "properties": {
+        "mode": { "const": "READ-ONLY" },
+        "started_at": { "type": "string", "description": "ISO 8601 with offset, e.g. 2026-10-06T17:09:54+05:00" },
+        "execution_user": { "type": "string" },
+        "is_admin": { "type": "boolean" }
+      }
+    },
+    "host": {
+      "type": "object",
+      "required": ["hostname", "os_family", "os_name", "os_version"],
+      "additionalProperties": false,
+      "properties": {
+        "hostname": { "type": "string" },
+        "os_family": { "enum": ["windows", "linux", "macos"] },
+        "os_name": { "type": "string" },
+        "os_version": { "type": "string" },
+        "build": { "type": "string" },
+        "kernel": { "type": "string" },
+        "architecture": { "type": "string" },
+        "serial_number": { "type": "string" }
+      }
+    },
+    "baseline": {
+      "type": "object",
+      "description": "The baseline.conf values used for this run (all values as strings).",
+      "additionalProperties": { "type": "string" }
+    },
+    "results": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["id", "section", "name", "status", "actual", "expected"],
+        "additionalProperties": false,
+        "properties": {
+          "id": { "type": "string", "description": "Check id from catalog/checks.json" },
+          "section": { "enum": ["baseline", "gdpr", "aiact", "org"] },
+          "name": { "type": "string", "description": "Report line, as printed for this OS" },
+          "status": { "enum": ["Compliant", "Non-Compliant", "NotApplicable", "Pending", "Error"] },
+          "actual": { "type": "string", "description": "What was found on the device" },
+          "expected": { "type": "string", "description": "What the baseline requires" },
+          "detail": { "type": "string", "description": "How the value was read, or why the status was given" }
+        }
+      }
+    },
+    "summary": {
+      "type": "object",
+      "required": ["Compliant", "Non-Compliant", "NotApplicable", "Pending", "Error"],
+      "additionalProperties": false,
+      "properties": {
+        "Compliant": { "type": "integer" },
+        "Non-Compliant": { "type": "integer" },
+        "NotApplicable": { "type": "integer" },
+        "Pending": { "type": "integer" },
+        "Error": { "type": "integer" }
+      }
+    }
+  }
+}

synthetic/generate_evidence.py

@@ -0,0 +1,801 @@
+#!/usr/bin/env python3
+"""Generate synthetic endpoint audit evidence for the MVP.
+
+Every record has exactly the format of a real collector run (schema/evidence.schema.json):
+same check ids, names, order and pass/fail rules as collectors/*/audit.* with baseline.conf.
+Host names and serial numbers are invented, so the data holds no personal data.
+
+Usage:
+    python3 synthetic/generate_evidence.py --count 500 --seed 7 --out synthetic/out/evidence.jsonl
+    python3 synthetic/generate_evidence.py --count 3 --os macos --files synthetic/out/samples
+
+Standard library only.
+"""
+import argparse
+import json
+import os
+import random
+import string
+from datetime import datetime, timedelta, timezone
+
+ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+GENERATOR_VERSION = "0.1.0"
+
+# Report order per OS, identical to the collectors.
+PASSWORD_LOCKOUT = ["password.min_length", "password.history", "password.expiration", "password.min_age",
+                    "password.complexity", "lockout.threshold", "lockout.duration", "lockout.observation"]
+GDPR = ["gdpr.auto_updates", "gdpr.updates_recent", "gdpr.os_supported", "gdpr.security_logging", "gdpr.time_sync",
+        "gdpr.backup_configured", "gdpr.backup_recent", "gdpr.removable_encryption", "gdpr.guest_account",
+        "gdpr.remote_access", "gdpr.telemetry", "gdpr.personal_data_discovery"]
+AIACT = ["aiact.inventory", "aiact.unapproved", "aiact.risk_classification", "aiact.os_ai_features", "aiact.log_retention"]
+ORG = ["org.ropa", "org.dpia", "org.breach_procedure", "org.processor_agreements", "org.ai_register",
+       "org.ai_literacy", "org.human_oversight", "org.ai_transparency"]
+ORDER = {
+    "windows": PASSWORD_LOCKOUT + [
+        "malware.antivirus", "malware.service", "malware.realtime", "malware.on_access", "malware.tamper", "malware.signatures",
+        "firewall.domain.enabled", "firewall.domain.inbound", "firewall.domain.outbound",
+        "firewall.private.enabled", "firewall.private.inbound", "firewall.private.outbound",
+        "firewall.public.enabled", "firewall.public.inbound", "firewall.public.outbound",
+        "screen_lock.timeout", "screen_lock.password", "usb.read", "usb.write", "admin.approved", "admin.unauthorized",
+        "encryption.feature", "encryption.enabled", "encryption.protection", "encryption.recovery"] + GDPR + AIACT + ORG,
+    "linux": PASSWORD_LOCKOUT + [
+        "malware.antivirus", "malware.service", "malware.signature_updates", "malware.signatures", "malware.on_access",
+        "firewall.enabled", "firewall.inbound", "firewall.outbound",
+        "screen_lock.enabled", "screen_lock.timeout", "screen_lock.password", "usb.read", "usb.write",
+        "admin.approved", "admin.unauthorized", "encryption.enabled", "encryption.protection", "encryption.recovery"] + GDPR + AIACT + ORG,
+    "macos": PASSWORD_LOCKOUT + [
+        "malware.antivirus", "malware.service", "malware.signatures", "malware.signature_updates", "malware.on_access",
+        "firewall.enabled", "firewall.inbound", "firewall.outbound",
+        "screen_lock.timeout", "screen_lock.enabled", "screen_lock.password", "usb.read", "usb.write",
+        "admin.approved", "admin.unauthorized", "encryption.enabled", "encryption.protection", "encryption.recovery"] + GDPR + AIACT + ORG,
+}
+# Checks that report Error when the collector is not run as administrator/root.
+NEEDS_ADMIN = {
+    "windows": set(PASSWORD_LOCKOUT) | {"encryption.feature", "encryption.enabled", "encryption.protection", "encryption.recovery", "gdpr.security_logging"},
+    "linux": {"firewall.enabled", "firewall.inbound", "firewall.outbound", "encryption.protection", "encryption.recovery"},
+    "macos": {"encryption.recovery", "gdpr.time_sync"},
+}
+# Probability that a check meets the baseline, per device profile.
+PROFILES = {"hardened": 0.92, "typical": 0.65, "neglected": 0.3}
+ORG_ANSWERS = {"hardened": [("yes", 8), ("partial", 1), ("", 1)], "typical": [("yes", 4), ("no", 2), ("partial", 2), ("", 3)],
+               "neglected": [("no", 4), ("", 5), ("partial", 1)]}
+
+OS_VERSIONS = {
+    "windows": [("Microsoft Windows 11 Pro", "10.0.26200", "26200"), ("Microsoft Windows 11 Pro", "10.0.26100", "26100"),
+                ("Microsoft Windows 11 Enterprise", "10.0.26100", "26100"), ("Microsoft Windows 11 Pro", "10.0.22631", "22631"),
+                ("Microsoft Windows 11 Pro", "10.0.22621", "22621"), ("Microsoft Windows 10 Pro", "10.0.19045", "19045")],
+    "linux": [("Ubuntu 26.04.1 LTS", "26.04", "ubuntu"), ("Ubuntu 24.04.3 LTS", "24.04", "ubuntu"), ("Ubuntu 22.04.5 LTS", "22.04", "ubuntu"),
+              ("Ubuntu 20.04.6 LTS", "20.04", "ubuntu"), ("Debian GNU/Linux 13 (trixie)", "13", "debian"),
+              ("Debian GNU/Linux 12 (bookworm)", "12", "debian"), ("Red Hat Enterprise Linux 9.6 (Plow)", "9.6", "rhel"),
+              ("Red Hat Enterprise Linux 8.10 (Ootpa)", "8.10", "rhel")],
+    "macos": [("26.5.2", "25F84"), ("26.0.1", "25A362"), ("15.7.2", "24G325"), ("15.6", "24G84"), ("14.7.8", "23H730"), ("13.7.8", "22H730")],
+}
+KERNELS = {"ubuntu": ["7.0.0-34-generic", "6.8.0-85-generic", "5.15.0-151-generic"], "debian": ["6.12.48+deb13-amd64", "6.1.0-40-amd64"],
+           "rhel": ["5.14.0-570.42.1.el9_6.x86_64", "4.18.0-553.el8_10.x86_64"]}
+AI_TOOLS = {
+    "windows": ["Microsoft Copilot", "ChatGPT", "Claude", "Ollama", "LM Studio", "GPT4All", "Cursor", "Claude Code", "Hugging Face models"],
+    "linux": ["Ollama", "LM Studio", "GPT4All", "Jan", "Claude Code", "Hugging Face models", "Alpaca (Ollama client)"],
+    "macos": ["ChatGPT", "Claude", "Ollama", "LM Studio", "Jan", "Cursor", "Claude Code", "Hugging Face models", "Perplexity"],
+}
+REMOTE_SERVICES = {"windows": ["rdp", "winrm", "ssh", "smb", "teamviewer", "anydesk", "chromeremotedesktop"],
+                   "linux": ["ssh", "rdp", "vnc", "smb", "teamviewer", "anydesk", "chromeremotedesktop"],
+                   "macos": ["ssh", "screensharing", "filesharing", "remotemanagement", "chromeremotedesktop", "teamviewer", "anydesk"]}
+EMPLOYEE_ACCOUNTS = ["jdoe", "asmith", "mkhan", "lmuller", "pmartin", "sali", "tnguyen", "rschmit", "akaya", "ewagner"]
+
+
+def read_conf(path):
+    conf = {}
+    if os.path.exists(path):
+        with open(path, encoding="utf-8") as handle:
+            for line in handle:
+                if line.lstrip().startswith("#") or "=" not in line:
+                    continue
+                key, value = line.split("=", 1)
+                conf[key.strip()] = value.strip().strip('"')
+    return conf
+
+
+def load_catalog():
+    with open(os.path.join(ROOT, "catalog", "checks.json"), encoding="utf-8") as handle:
+        catalog = json.load(handle)
+    return catalog, {c["id"]: c for c in catalog["checks"]}
+
+
+def check_name(check, os_family):
+    return check.get("names", {}).get(os_family, check["name"])
+
+
+class Device:
+    """One synthetic endpoint: draws a value for each check and applies the baseline rule."""
+
+    def __init__(self, rng, os_family, profile, baseline):
+        self.rng, self.os, self.profile, self.B = rng, os_family, profile, baseline
+        self.p_good = PROFILES[profile]
+        self.is_admin = rng.random() > 0.06
+        self.third_party_av = rng.random() < (0.25 if os_family == "windows" else 0.12)
+        self.av_name = rng.choice(["CrowdStrike Falcon", "SentinelOne", "Sophos Endpoint", "ESET Endpoint Security", "Bitdefender Endpoint Security"])
+        self.usb_write = None
+        self.ai_tools = []
+        self.backup_tool = None
+
+    def good(self, bias=0.0):
+        return self.rng.random() < min(max(self.p_good + bias, 0.02), 0.98)
+
+    def b(self, key):
+        return self.B[key]
+
+    def n(self, key):
+        return int(self.B[key])
+
+    def pick(self, choices):
+        return self.rng.choice(choices)
+
+    # Each method returns (status, actual, expected, detail).
+    def value(self, check_id):
+        method = getattr(self, "c_" + check_id.replace(".", "_"), None)
+        if method is None:
+            raise KeyError(check_id)
+        return method()
+
+    @staticmethod
+    def result(ok, actual, expected, detail=""):
+        return ("Compliant" if ok else "Non-Compliant", str(actual), expected, detail)
+
+    # --- passwords and lockout ---------------------------------------------
+    def c_password_min_length(self):
+        need = self.n("PASSWORD_MIN_LENGTH")
+        if self.good():
+            return self.result(True, self.pick([need, need, need + 2, 16]), f">= {need}", self._pw_source())
+        if self.os == "macos":
+            return self.result(False, self.pick(["not set", 8, 10, 12]), f">= {need}", "pwpolicy global account policy")
+        if self.os == "linux" and self.rng.random() < 0.5:
+            return self.result(False, 6, f">= {need}", "pam_pwquality not enabled; pam_unix minimum")
+        return self.result(False, self.pick([0, 6, 8, 10, 12]), f">= {need}", self._pw_source())
+
+    def _pw_source(self):
+        return {"windows": "", "linux": "pam_pwquality", "macos": "pwpolicy global account policy"}[self.os]
+
+    def c_password_history(self):
+        need = self.n("PASSWORD_HISTORY")
+        if self.good():
+            return self.result(True, self.pick([need, need, 24]), f">= {need}")
+        return self.result(False, self.pick(["not set", 0, 5, 10]) if self.os == "macos" else self.pick([0, 5, 10, 12]), f">= {need}")
+
+    def c_password_expiration(self):
+        limit = self.n("PASSWORD_MAX_AGE_DAYS")
+        if limit == 0:
+            return ("Compliant", "never", "not required", "Baseline does not require expiry.")
+        if self.good():
+            days = self.pick([60, 90, 180, 365])
+            return self.result(True, f"{days} days" if self.os != "linux" else f"{days} days", f"1-{limit} days")
+        if self.os == "linux":
+            return self.result(False, self.pick(["PASS_MAX_DAYS 99999", "PASS_MAX_DAYS 90; accounts: jdoe (99999)"]), f"1-{limit} days")
+        return self.result(False, "never", f"1-{limit} days")
+
+    def c_password_min_age(self):
+        need = self.n("PASSWORD_MIN_AGE_DAYS")
+        if self.os == "macos":
+            return ("NotApplicable", "no such setting", f">= {need} days", "macOS account policies have no minimum password age.")
+        if self.good():
+            return self.result(True, f"{self.pick([1, 1, 2])} days", f">= {need} days")
+        return self.result(False, "0 days" if self.os == "windows" else "PASS_MIN_DAYS 0", f">= {need} days")
+
+    def c_password_complexity(self):
+        if self.os == "windows":
+            ok = self.good()
+            return self.result(ok, "enabled" if ok else "disabled", "enabled")
+        if self.os == "linux":
+            if self.good():
+                return self.result(True, self.pick(["minclass=4, required classes=0", "minclass=3, required classes=0", "minclass=0, required classes=4"]), "3 or more character classes")
+            return self.result(False, self.pick(["pam_pwquality not enabled", "minclass=0, required classes=0", "minclass=2, required classes=1"]), "3 or more character classes")
+        ok = self.good()
+        return self.result(ok, "letters and numbers required" if ok else "not enforced", "enforced")
+
+    def c_lockout_threshold(self):
+        limit = self.n("LOCKOUT_THRESHOLD_MAX")
+        if self.good():
+            return self.result(True, self.pick(list(range(3, limit + 1))), f"1-{limit}", "pam_faillock" if self.os == "linux" else "")
+        if self.os == "linux":
+            return self.result(False, self.pick(["pam_faillock not enabled", 10]), f"1-{limit}")
+        return self.result(False, self.pick([0, 10, 20]) if self.os == "windows" else self.pick(["not set", 10]), f"1-{limit}")
+
+    def c_lockout_duration(self):
+        need = self.n("LOCKOUT_DURATION_MIN_MINUTES")
+        if self.good():
+            actual = self.pick([f"{need} minutes", "30 minutes", "until an administrator unlocks"])
+            return self.result(True, actual, f">= {need} minutes")
+        return self.result(False, self.pick(["no lockout configured", "5 minutes", "10 minutes"]) if self.os == "windows"
+                           else self.pick(["no lockout", "10 minutes", "not set"]), f">= {need} minutes")
+
+    def c_lockout_observation(self):
+        need = self.n("LOCKOUT_OBSERVATION_MIN_MINUTES")
+        detail = "macOS resets the failed-attempt count when the lockout ends." if self.os == "macos" else ""
+        if self.good():
+            return self.result(True, self.pick([f"{need} minutes", "30 minutes"]), f">= {need} minutes", detail)
+        return self.result(False, self.pick(["no lockout configured", "5 minutes"]) if self.os == "windows"
+                           else self.pick(["no lockout", "10 minutes", "not set"]), f">= {need} minutes", detail)
+
+    # --- malware protection -------------------------------------------------
+    def c_malware_antivirus(self):
+        if self.os == "windows":
+            if self.third_party_av:
+                return self.result(True, f"{self.av_name} (on, up to date); Windows Defender (off, up to date)", "enabled and up to date")
+            ok = self.good(0.2)
+            return self.result(ok, "Windows Defender (on, up to date)" if ok else "Windows Defender (off, out of date)", "enabled and up to date")
+        if self.os == "linux":
+            if self.third_party_av:
+                return self.result(True, self.av_name, "antivirus running")
+            ok = self.good(-0.15)
+            return self.result(ok, "ClamAV (clamav-daemon)" if ok else "none running", "antivirus running")
+        if self.third_party_av:
+            return self.result(True, f"XProtect {self.rng.randint(5200, 5400)}; third-party: {self.av_name}", "antivirus present")
+        return self.result(True, f"XProtect {self.rng.randint(5200, 5400)}", "antivirus present")
+
+    def _defender_na(self, expected):
+        return ("NotApplicable", "Defender in Passive Mode", expected, f"Another antivirus is primary: {self.av_name}")
+
+    def _linux_other_av_na(self, expected):
+        return ("NotApplicable", "not used", expected, f"Another endpoint protection product is used: {self.av_name}")
+
+    def c_malware_service(self):
+        if self.os == "windows":
+            if self.third_party_av:
+                return self._defender_na("running")
+            ok = self.good(0.2)
+            return self.result(ok, "service True, antivirus True" if ok else "service True, antivirus False", "running")
+        if self.os == "linux":
+            if self.third_party_av:
+                return self._linux_other_av_na("running")
+            ok = self.good(-0.15)
+            return self.result(ok, "clamav-daemon" if ok else "not running", "running")
+        ok = self.good(0.25)
+        return self.result(ok, "XProtect scanning on; Gatekeeper on" if ok else "XProtect scanning on; Gatekeeper assessments disabled", "XProtect and Gatekeeper on")
+
+    def c_malware_realtime(self):
+        if self.third_party_av:
+            return self._defender_na("on")
+        ok = self.good(0.15)
+        return self.result(ok, "on" if ok else "off", "on")
+
+    def c_malware_on_access(self):
+        if self.os == "windows":
+            if self.third_party_av:
+                return self._defender_na("on")
+            ok = self.good(0.15)
+            return self.result(ok, "on" if ok else "off", "on")
+        if self.os == "linux":
+            if self.third_party_av:
+                return ("Compliant", self.av_name, "on-access scanning", f"Provided by {self.av_name}.")
+            ok = self.good(-0.3)
+            return self.result(ok, "clamonacc running" if ok else "not running", "on-access scanning")
+        if self.third_party_av:
+            return ("Compliant", f"third-party scanner: {self.av_name}", "on-access scanning", "")
+        return ("NotApplicable", "XProtect only", "on-access scanning", "XProtect scans at launch and download; macOS has no built-in on-access scanning.")
+
+    def c_malware_tamper(self):
+        if self.third_party_av:
+            return self._defender_na("on")
+        ok = self.good()
+        return self.result(ok, "on" if ok else "off", "on")
+
+    def c_malware_signatures(self):
+        if self.os == "windows":
+            limit = self.n("SIGNATURE_MAX_AGE_DAYS")
+            if self.third_party_av:
+                return self._defender_na(f"<= {limit} days old")
+            age = self.rng.randint(0, limit) if self.good(0.1) else self.rng.randint(limit + 1, 60)
+            version = f"1.{self.rng.randint(430, 450)}.{self.rng.randint(0, 999)}.0"
+            return self.result(age <= limit, f"{age} days old (version {version})", f"<= {limit} days old")
+        if self.os == "linux":
+            limit = self.n("SIGNATURE_MAX_AGE_DAYS")
+            if self.third_party_av:
+                return self._linux_other_av_na(f"<= {limit} days old")
+            if not self.good(-0.15):
+                if self.rng.random() < 0.5:
+                    return self.result(False, "no signature database", f"<= {limit} days old")
+                age = self.rng.randint(limit + 1, 90)
+            else:
+                age = self.rng.randint(0, limit)
+            return self.result(age <= limit, f"{age} days old", f"<= {limit} days old", "/var/lib/clamav/daily.cld")
+        limit = self.n("MACOS_XPROTECT_MAX_AGE_DAYS")
+        age = self.rng.randint(0, limit) if self.good(0.2) else self.rng.randint(limit + 1, 120)
+        return self.result(age <= limit, f"XProtect {self.rng.randint(5200, 5400)}, {age} days old", f"<= {limit} days old")
+
+    def c_malware_signature_updates(self):
+        if self.os == "linux":
+            if self.third_party_av:
+                return self._linux_other_av_na("automatic")
+            ok = self.good(-0.15)
+            return self.result(ok, "clamav-freshclam" if ok else "freshclam not running", "automatic")
+        ok = self.good(0.2)
+        return self.result(ok, "security responses and system data files install automatically" if ok
+                           else "ConfigDataInstall=0, CriticalUpdateInstall=1", "automatic")
+
+    # --- firewall -------------------------------------------------------------
+    def _fw_profile(self, kind):
+        expected_out = self.b("FIREWALL_OUTBOUND").lower()
+        if kind == "enabled":
+            ok = self.good(0.15)
+            self._fw_on = ok
+            return self.result(ok, "on" if ok else "off", "on")
+        if kind == "inbound":
+            ok = self._fw_on and self.good(0.2)
+            action = "block" if ok else "allow"
+            detail = "Not configured: Windows default (Block) applies." if ok and self.rng.random() < 0.5 else ""
+            return self.result(ok and self._fw_on, action, "block", detail)
+        action = expected_out if self.good(0.2) else ("block" if expected_out == "allow" else "allow")
+        detail = "Not configured: Windows default (Allow) applies." if action == "allow" and self.rng.random() < 0.5 else ""
+        return self.result(action == expected_out and self._fw_on, action, expected_out, detail)
+
+    def c_firewall_domain_enabled(self): return self._fw_profile("enabled")
+    def c_firewall_domain_inbound(self): return self._fw_profile("inbound")
+    def c_firewall_domain_outbound(self): return self._fw_profile("outbound")
+    def c_firewall_private_enabled(self): return self._fw_profile("enabled")
+    def c_firewall_private_inbound(self): return self._fw_profile("inbound")
+    def c_firewall_private_outbound(self): return self._fw_profile("outbound")
+    def c_firewall_public_enabled(self): return self._fw_profile("enabled")
+    def c_firewall_public_inbound(self): return self._fw_profile("inbound")
+    def c_firewall_public_outbound(self): return self._fw_profile("outbound")
+
+    def c_firewall_enabled(self):
+        if self.os == "linux":
+            self._fw_name = self.pick(["ufw", "ufw", "firewalld", "nftables"]) if self.good(-0.1) else None
+            if self._fw_name:
+                return ("Compliant", f"{self._fw_name} active", "active", "")
+            return ("Non-Compliant", "no active firewall", "active", "")
+        self._fw_name = "application firewall" if self.good() else None
+        return self.result(bool(self._fw_name), "on" if self._fw_name else "off", "on")
+
+    def c_firewall_inbound(self):
+        if self.os == "linux":
+            if not self._fw_name:
+                return ("Non-Compliant", "allow (no firewall)", "deny", "")
+            ok = self.good(0.25)
+            return self.result(ok, "deny" if ok else "allow", "deny")
+        stealth = self.good(-0.1)
+        if self._fw_name and stealth:
+            return ("Compliant", "block (firewall on, stealth mode on)", "block", "")
+        return ("Non-Compliant", f"firewall {'on' if self._fw_name else 'off'}, stealth mode {'on' if stealth else 'off'}", "block", "")
+
+    def c_firewall_outbound(self):
+        expected = self.b("FIREWALL_OUTBOUND").lower()
+        if self.os == "macos":
+            ok = expected == "allow"
+            return self.result(ok, "allow", expected, "The macOS application firewall filters inbound connections only.")
+        if not self._fw_name:
+            return ("Non-Compliant", "no firewall", expected, "")
+        actual = expected if self.good(0.25) else ("deny" if expected == "allow" else "allow")
+        return self.result(actual == expected, actual, expected)
+
+    # --- screen lock ------------------------------------------------------------
+    def c_screen_lock_enabled(self):
+        if self.os == "linux" and self.rng.random() < 0.12:
+            return ("NotApplicable", "no GNOME desktop", "on", "No graphical desktop settings found.")
+        self._lock_on = self.good(0.15)
+        users = self._desktop_users()
+        if self.os == "linux":
+            return self.result(self._lock_on, "on" if self._lock_on else f"off for: {users}", "on", f"Users checked: {users}")
+        return self.result(self._lock_on, "on" if self._lock_on else "off", "on")
+
+    def _desktop_users(self):
+        if not hasattr(self, "_users"):
+            self._users = ", ".join(self.rng.sample(EMPLOYEE_ACCOUNTS, self.rng.choice([1, 1, 2])))
+        return self._users
+
+    def c_screen_lock_timeout(self):
+        limit = self.n("SCREEN_LOCK_MAX_SECONDS")
+        expected = f"<= {limit} seconds"
+        if self.os == "linux" and not hasattr(self, "_lock_on"):
+            return ("NotApplicable", "no GNOME desktop", expected, "No graphical desktop settings found.")
+        if self.os == "windows":
+            if self.good():
+                if self.rng.random() < 0.5:
+                    secs = self.pick([300, 600, 900])
+                    return self.result(True, f"{secs} seconds (machine inactivity limit)", expected)
+                return self.result(True, f"screen saver within limit for: {self._win_user()}", expected)
+            return self.result(False, self.pick(["no machine inactivity limit; no signed-in user to check",
+                                                 f"no machine inactivity limit; too long or off for: {self._win_user()} (1200s, active=1)",
+                                                 f"no machine inactivity limit; too long or off for: {self._win_user()} (600s, active=0)"]), expected)
+        if self.os == "linux":
+            users = self._desktop_users()
+            ok = self.good()
+            return self.result(ok, "within limit" if ok else f"too long for: {users.split(', ')[0]} ({self.pick([1800, 3600, 0])}s)", expected, f"Users checked: {users}")
+        idle = self.pick([120, 300, 600]) if self.good() else self.pick([1200, 1800, 3600])
+        delay = self.pick([0, 5, 60, 300])
+        if not getattr(self, "_lock_on", True):
+            return ("Non-Compliant", f"{idle} idle, password delay off", expected, "")
+        total = idle + delay
+        if total <= limit:
+            return ("Compliant", f"{total} seconds", expected, f"Idle {idle}s (screen saver/display sleep) + {delay}s password delay.")
+        return ("Non-Compliant", f"{idle} idle, password delay {delay}", expected, "")
+
+    def _win_user(self):
+        return f"{self._domain()}\\{self._desktop_users().split(', ')[0]}"
+
+    def _domain(self):
+        if not hasattr(self, "_dom"):
+            self._dom = self.pick(["CONTOSO", "DEVSEIS", "FABRIKAM", self.hostname])
+        return self._dom
+
+    def c_screen_lock_password(self):
+        if self.os == "linux" and not hasattr(self, "_lock_on"):
+            return ("NotApplicable", "no GNOME desktop", "password required", "No graphical desktop settings found.")
+        if self.os == "windows":
+            ok = self.good(0.1)
+            return self.result(ok, self.pick(["machine inactivity limit locks the session", "screen saver requires sign-in for all signed-in users"]) if ok
+                               else f"screen saver does not require sign-in for: {self._win_user()}", "sign-in required to unlock")
+        if self.os == "linux":
+            ok = getattr(self, "_lock_on", False) and self.good(0.2)
+            users = self._desktop_users()
+            return self.result(ok, "required" if ok else f"not required for: {users}", "password required", f"Users checked: {users}")
+        delay = self.pick([0, 5]) if self.good(-0.1) else self.pick([60, 300, 900])
+        if not getattr(self, "_lock_on", True):
+            return ("Non-Compliant", "password after off seconds", "password within 5 seconds", "")
+        return self.result(delay <= 5, f"password after {delay} seconds", "password within 5 seconds")
+
+    # --- USB ------------------------------------------------------------------------
+    def c_usb_read(self):
+        expected = self.b("USB_READ").lower()
+        self._usb_blocked_all = self.rng.random() < 0.08
+        actual = "deny" if self._usb_blocked_all else "allow"
+        detail = {"windows": "all removable storage denied by policy", "linux": "usb-storage module disabled",
+                  "macos": ""}[self.os] if self._usb_blocked_all else ""
+        return self.result(actual == expected, actual, self.b("USB_READ"), detail)
+
+    def c_usb_write(self):
+        expected = self.b("USB_WRITE").lower()
+        if self._usb_blocked_all:
+            self.usb_write = "deny"
+        else:
+            self.usb_write = "deny" if self.good(-0.25) else "allow"
+        detail = ""
+        if self.usb_write == "deny" and not self._usb_blocked_all:
+            detail = {"windows": "removable disk write denied by policy", "linux": "udev rule makes USB storage read-only", "macos": ""}[self.os]
+        elif self.os == "macos" and self.usb_write == "allow":
+            detail = "No configuration profile restricts external drives."
+        return self.result(self.usb_write == expected, self.usb_write, self.b("USB_WRITE"), detail)
+
+    # --- administrators -------------------------------------------------------------
+    def c_admin_approved(self):
+        approved = self.b("APPROVED_ADMINS")
+        expected = approved or "none configured"
+        if approved and self.good(0.05):
+            name = approved.split(",")[0].strip()
+            return self.result(True, f"{self._domain()}\\{name}" if self.os == "windows" else name, expected)
+        return self.result(False, "none of the approved accounts is an enabled administrator" if self.os == "windows"
+                           else "none of the approved accounts is an administrator", expected)
+
+    def c_admin_unauthorized(self):
+        if self.good(-0.1):
+            return ("Compliant", "none", "none", "")
+        extra = self.rng.sample(EMPLOYEE_ACCOUNTS, self.pick([1, 1, 2]))
+        if self.os == "windows":
+            names = [f"{self.hostname}\\{u}" for u in extra]
+            if self.rng.random() < 0.3:
+                names.append(f"{self.hostname}\\Administrator")
+            return ("Non-Compliant", ", ".join(names), "none", "")
+        return ("Non-Compliant", ", ".join(extra), "none", "")
+
+    # --- encryption -------------------------------------------------------------------
+    def c_encryption_feature(self):
+        self._enc = self.good(0.1)
+        return self.result(self._enc, "on" if self._enc else "off", "on")
+
+    def c_encryption_enabled(self):
+        if self.os != "windows":
+            self._enc = self.good(0.05)
+        if self.os == "windows":
+            return self.result(self._enc, "FullyEncrypted (100%)" if self._enc else self.pick(["FullyDecrypted (0%)", "EncryptionInProgress (42%)"]), "fully encrypted")
+        if self.os == "linux":
+            return self.result(self._enc, "root filesystem on LUKS (dm_crypt-0)" if self._enc else "root filesystem not encrypted", "system disk encrypted")
+        return self.result(self._enc, "FileVault on" if self._enc else "FileVault off", "FileVault on")
+
+    def c_encryption_protection(self):
+        if self.os == "windows":
+            ok = self._enc and self.good(0.15)
+            return self.result(ok, "protection On, XtsAes128" if ok else f"protection {'Off' if self._enc else 'Off'}, {'XtsAes128' if self._enc else 'None'}", "protection on, AES")
+        if self.os == "linux":
+            if not self._enc:
+                return ("Non-Compliant", "not encrypted", "active, strong cipher", "")
+            ok = self.good(0.25)
+            return self.result(ok, "LUKS2 aes-xts-plain64 512-bit key" if ok else "LUKS1 aes-cbc-essiv:sha256 128-bit key", "active, strong cipher")
+        if not self._enc:
+            return ("Non-Compliant", "not encrypted", "fully encrypted", "")
+        return ("Compliant", "fully encrypted", "fully encrypted", "")
+
+    def c_encryption_recovery(self):
+        if self.os == "windows":
+            ok = self._enc and self.good(0.1)
+            return self.result(ok, "key protectors: Tpm, RecoveryPassword" if ok else "key protectors: Tpm", "recovery password present")
+        if self.os == "linux":
+            if not self._enc:
+                return ("Non-Compliant", "not encrypted", "recovery key or second unlock method", "")
+            ok = self.good()
+            return self.result(ok, f"{self.pick([2, 3])} key slots, 0 unlock tokens" if ok else "1 key slots, 0 unlock tokens", "recovery key or second unlock method")
+        if not self._enc:
+            return ("Non-Compliant", "no FileVault", "recovery key present", "")
+        ok = self.good(0.1)
+        return self.result(ok, f"recovery key present (personal: {'true' if ok else 'false'}, institutional: false)" if ok else "no recovery key", "recovery key present")
+
+    # --- GDPR ----------------------------------------------------------------------------
+    def c_gdpr_auto_updates(self):
+        ok = self.good(0.1)
+        if self.os == "windows":
+            return self.result(ok, self.pick(["Windows default (automatic)", "AUOptions=4"]) if ok else self.pick(["automatic updates turned off by policy", "AUOptions=2", "Windows Update service disabled"]), "automatic")
+        if self.os == "linux":
+            if self.distro == "rhel":
+                return self.result(ok, "dnf-automatic timer on, apply_updates=yes" if ok else "dnf-automatic timer off, apply_updates=no", "automatic")
+            return self.result(ok, "unattended-upgrades installed=1, enabled=1" if ok else self.pick(["unattended-upgrades installed=0, enabled=0", "unattended-upgrades installed=1, enabled=0"]), "automatic")
+        return self.result(ok, "check, download and install automatic" if ok else "check=1 download=1 security=1 macOS-install=0", "automatic")
+
+    def c_gdpr_updates_recent(self):
+        limit = self.n("UPDATES_MAX_AGE_DAYS")
+        age = self.rng.randint(0, limit) if self.good() else self.rng.randint(limit + 1, 240)
+        when = (self.started - timedelta(days=age)).strftime("%Y-%m-%d")
+        detail = {"windows": f"Last update: 2026-{self.rng.randint(1, 9):02d} Cumulative Update for Windows 11 ({when})",
+                  "linux": f"Last package upgrade: {when}  {self.rng.randint(0, 23):02d}:{self.rng.randint(0, 59):02d}:{self.rng.randint(0, 59):02d}",
+                  "macos": f"Last software update: {when} {self.rng.randint(0, 23):02d}:{self.rng.randint(0, 59):02d}:00 +0000"}[self.os]
+        return self.result(age <= limit, f"{age} days ago", f"<= {limit} days ago", detail)
+
+    def c_gdpr_os_supported(self):
+        if self.os == "windows":
+            ok = int(self.build) >= self.n("WINDOWS_MIN_BUILD")
+            return self.result(ok, f"{self.os_name} build {self.build}", f"build {self.b('WINDOWS_MIN_BUILD')} or later")
+        if self.os == "linux":
+            minimum = {"ubuntu": ("UBUNTU_MIN_VERSION", "Ubuntu"), "debian": ("DEBIAN_MIN_VERSION", "Debian"), "rhel": ("RHEL_MIN_VERSION", "RHEL")}[self.distro]
+            need = self.b(minimum[0])
+            version = self.os_version if self.distro == "ubuntu" else self.os_version.split(".")[0]
+            ok = tuple(int(x) for x in version.split(".")) >= tuple(int(x) for x in need.split("."))
+            return self.result(ok, self.os_name, f"{minimum[1]} {need} or later")
+        ok = int(self.os_version.split(".")[0]) >= self.n("MACOS_MIN_MAJOR")
+        return self.result(ok, f"macOS {self.os_version}", f"macOS {self.b('MACOS_MIN_MAJOR')} or later")
+
+    def c_gdpr_security_logging(self):
+        ok = self.good()
+        if self.os == "windows":
+            return self.result(ok, "logon: success+failure; account management: success+failure" if ok
+                               else self.pick(["logon: success; account management: none", "logon: none; account management: none"]),
+                               "logon success+failure and account changes audited")
+        if self.os == "linux":
+            return self.result(ok, f"auditd running, journal {self.pick(['persistent', 'volatile'])}" if ok else f"auditd not running, journal {self.pick(['persistent', 'volatile'])}", "auditd running")
+        return ("Compliant", "unified logging active", "security events logged", "macOS unified log records authentication events; retention is managed by the OS.")
+
+    def c_gdpr_time_sync(self):
+        ok = self.good(0.25)
+        if self.os == "windows":
+            return self.result(ok, f"type {self.pick(['NTP', 'NT5DS'])}, service Running/Manual" if ok else "type NoSync, service Stopped/Manual", "NTP or domain time")
+        if self.os == "linux":
+            return self.result(ok, "NTP service yes, synchronised yes" if ok else "NTP service no, synchronised no", "time synchronised")
+        return self.result(ok, "network time on" if ok else "Network Time: Off", "network time on")
+
+    def c_gdpr_backup_configured(self):
+        options = {"windows": ["OneDrive folder backup (policy)", "File History (jdoe)", "Veeam Agent for Microsoft Windows"],
+                   "linux": ["Timeshift", "Deja Dup (jdoe)", "restic-backup.timer"],
+                   "macos": ["Time Machine", "bzserv", "ArqAgent"]}[self.os]
+        self.backup_tool = self.pick(options) if self.good(-0.15) else None
+        if self.backup_tool:
+            return ("Compliant", self.backup_tool, "backup configured", "")
+        return ("Non-Compliant", "none found" if self.os == "windows" else "none", "backup configured", "")
+
+    def c_gdpr_backup_recent(self):
+        limit = self.n("BACKUP_MAX_AGE_DAYS")
+        expected = f"<= {limit} days ago"
+        if not self.backup_tool:
+            return ("Non-Compliant", "no backup", expected, "")
+        readable = {"windows": False, "linux": self.backup_tool == "Timeshift" or self.backup_tool.startswith("Deja"), "macos": self.backup_tool == "Time Machine"}[self.os]
+        if not readable:
+            return ("Pending", "date not readable", expected, f"Confirm the last backup date in{':' if self.os != 'macos' else ''} {self.backup_tool}.")
+        age = self.rng.randint(0, limit) if self.good() else self.rng.randint(limit + 1, 120)
+        return self.result(age <= limit, f"{age} days ago", expected)
+
+    def c_gdpr_removable_encryption(self):
+        if self.os == "windows" and self.usb_write != "deny" and self.good(-0.35):
+            return ("Compliant", "BitLocker To Go required before writing", "no unencrypted writes", "")
+        if self.usb_write == "deny":
+            return ("Compliant", "writing to USB storage blocked" if self.os != "macos" else "writing to external drives blocked", "no unencrypted writes", "")
+        text = {"windows": "USB drives writable without encryption", "linux": "USB storage writable without enforced encryption",
+                "macos": "external drives writable without enforced encryption"}[self.os]
+        return ("Non-Compliant", text, "no unencrypted writes", "")
+
+    def c_gdpr_guest_account(self):
+        ok = self.good(0.3)
+        if self.os == "windows":
+            return self.result(ok, "disabled" if ok else "enabled", "disabled")
+        if self.os == "linux":
+            return self.result(ok, "no guest login" if ok else "LightDM guest session allowed", "no guest login")
+        return self.result(ok, "guest login off" if ok else "guest login 1, guest file sharing 0", "guest login off")
+
+    def c_gdpr_remote_access(self):
+        approved = [s.strip() for s in self.b("APPROVED_REMOTE_SERVICES").split(",") if s.strip()]
+        expected = f"only: {self.b('APPROVED_REMOTE_SERVICES') or 'none'}"
+        enabled = [] if self.good(-0.1) else self.rng.sample(REMOTE_SERVICES[self.os], self.pick([1, 1, 2]))
+        unapproved = [s for s in enabled if s not in approved]
+        if not unapproved:
+            return ("Compliant", ", ".join(enabled) or "none enabled", expected, "")
+        return ("Non-Compliant", ", ".join(unapproved), expected, "")
+
+    def c_gdpr_telemetry(self):
+        ok = self.good(-0.1)
+        if self.os == "windows":
+            return self.result(ok, f"AllowTelemetry={self.pick([0, 1])} ({self.pick(['policy', 'Settings'])})" if ok
+                               else self.pick(["AllowTelemetry=3 (Settings)", "not configured"]), "required diagnostic data only (0-1)",
+                               "" if ok else "Windows may send optional diagnostic data.")
+        if self.os == "linux":
+            return self.result(ok, "usage reporting off" if ok else self.pick(["popularity-contest on", "whoopsie error reporting on"]), "usage reporting off")
+        return self.result(ok, "analytics sharing off" if ok else "share Mac analytics=1, share with app developers=0", "analytics sharing off")
+
+    def c_gdpr_personal_data_discovery(self):
+        return ("NotApplicable", "not run", "opt-in scan", f"Opt-in scan (PERSONAL_DATA_SCAN={self.b('PERSONAL_DATA_SCAN')}) is planned for a later stage.")
+
+    # --- EU AI Act -----------------------------------------------------------------------
+    def c_aiact_inventory(self):
+        if self.rng.random() < 0.35:
+            self.ai_tools = []
+        else:
+            self.ai_tools = self.rng.sample(AI_TOOLS[self.os], self.pick([1, 1, 2, 3]))
+        detail = []
+        if "Ollama" in self.ai_tools and self.rng.random() < 0.5:
+            detail.append("Local AI service listening on port 11434.")
+        for tool, path in (("Ollama", ".ollama/models"), ("Hugging Face models", ".cache/huggingface/hub")):
+            if tool in self.ai_tools:
+                size = self.rng.randint(2, 60)
+                home = {"windows": "C:\\Users\\jdoe\\", "linux": "/home/jdoe/", "macos": "/Users/jdoe/"}[self.os]
+                shown = home + (path.replace("/", "\\") if self.os == "windows" else path)
+                detail.append(f"Local models: {shown} ({size} GB)." if self.os == "windows" else f"Local models: {shown} ({size}G).")
+        return ("Compliant", ", ".join(self.ai_tools) or "no AI tools found", "inventory taken", " ".join(detail))
+
+    def c_aiact_unapproved(self):
+        approved = self.b("APPROVED_AI_TOOLS")
+        approved_list = [a.strip().lower() for a in approved.split(",") if a.strip()]
+        expected = f"only: {approved or 'none'}"
+        unapproved = [t for t in self.ai_tools if t.lower() not in approved_list]
+        if not unapproved:
+            return ("Compliant", "none", expected, "")
+        return ("Non-Compliant", ", ".join(unapproved), expected, "")
+
+    def c_aiact_risk_classification(self):
+        if self.ai_tools:
+            return ("Pending", ", ".join(self.ai_tools), "every AI tool classified", "Classified by the auditor model (Caveat classifier) in a later step.")
+        return ("NotApplicable", "no AI tools found", "every AI tool classified", "")
+
+    def c_aiact_os_ai_features(self):
+        if self.os == "linux":
+            return ("NotApplicable", "none built in", "restricted by policy", "Linux distributions ship no built-in AI assistant.")
+        if self.os == "macos":
+            if self.architecture != "arm64":
+                return ("NotApplicable", "Intel Mac", "restricted by profile", "Apple Intelligence needs Apple silicon.")
+            ok = self.good(-0.35)
+            return self.result(ok, "restricted by profile" if ok else "not restricted", "restricted by profile",
+                               "" if ok else "No profile sets allowExternalIntelligenceIntegrations to false.")
+        if self.good(-0.3):
+            return ("Compliant", "Recall disabled by policy", "disabled by policy", "DisableAIDataAnalysis=1; AllowRecallEnablement=0; TurnOffWindowsCopilot=")
+        if self.rng.random() < 0.5:
+            return ("NotApplicable", "Recall not available on this device", "disabled by policy", "DisableAIDataAnalysis=; AllowRecallEnablement=; TurnOffWindowsCopilot=")
+        return ("Non-Compliant", f"Recall feature {self.pick(['Enabled', 'Disabled'])}, not disabled by policy", "disabled by policy", "DisableAIDataAnalysis=; AllowRecallEnablement=; TurnOffWindowsCopilot=")
+
+    def c_aiact_log_retention(self):
+        if self.ai_tools:
+            return ("Pending", "depends on classification", ">= 6 months for high-risk AI", "Required only if a tool is classified high-risk.")
+        return ("NotApplicable", "no AI tools found", ">= 6 months for high-risk AI", "")
+
+
+def org_result(rng, profile, answer_key):
+    choices, weights = zip(*ORG_ANSWERS[profile])
+    answer = rng.choices(choices, weights=weights)[0]
+    if answer == "yes":
+        return ("Compliant", "yes", "yes", "")
+    if answer in ("no", "partial"):
+        return ("Non-Compliant", answer, "yes", "")
+    return ("Pending", "not answered", "yes", f"Answer {answer_key} in organisational.conf.")
+
+
+def random_hostname(rng, os_family):
+    if os_family == "windows":
+        return rng.choice(["DESKTOP-", "LAPTOP-"]) + "".join(rng.choices(string.ascii_uppercase + string.digits, k=7))
+    team = rng.choice(["fin", "hr", "dev", "ops", "sales", "legal", "mkt"])
+    if os_family == "linux":
+        return f"{team}-{rng.choice(['ws', 'lt', 'ubuntu', 'dev'])}-{rng.randint(1, 99):02d}"
+    return f"{team.upper()}-MacBook-{rng.randint(1, 60):02d}"
+
+
+def make_record(rng, seed, os_family, profile, baseline, catalog, checks):
+    device = Device(rng, os_family, profile, baseline)
+    offset = timezone(timedelta(hours=rng.choice([1, 2, 5])))
+    started = datetime(2026, 10, 1, tzinfo=offset) + timedelta(minutes=rng.randint(0, 60 * 24 * 6))
+    device.started = started
+    device.hostname = random_hostname(rng, os_family)
+    host = {"hostname": device.hostname, "os_family": os_family}
+    if os_family == "windows":
+        name, version, build = rng.choice(OS_VERSIONS["windows"])
+        device.os_name, device.os_version, device.build = name, version, build
+        device.architecture = "AMD64"
+        host.update(os_name=name, os_version=version, build=build, architecture="AMD64",
+                    serial_number="".join(rng.choices(string.ascii_uppercase + string.digits, k=7)))
+        user = "NT AUTHORITY\\SYSTEM" if device.is_admin and rng.random() < 0.7 else f"{device.hostname}\\{rng.choice(EMPLOYEE_ACCOUNTS)}"
+    elif os_family == "linux":
+        name, version, distro = rng.choice(OS_VERSIONS["linux"])
+        device.os_name, device.os_version, device.distro = name, version, distro
+        device.architecture = "x86_64"
+        host.update(os_name=name, os_version=version, kernel=rng.choice(KERNELS[distro]), architecture="x86_64",
+                    serial_number="".join(rng.choices(string.ascii_uppercase + string.digits, k=7)))
+        user = "root" if device.is_admin else rng.choice(EMPLOYEE_ACCOUNTS)
+    else:
+        version, build = rng.choice(OS_VERSIONS["macos"])
+        device.os_name, device.os_version = "macOS", version
+        device.architecture = rng.choice(["arm64", "arm64", "arm64", "x86_64"])
+        host.update(os_name="macOS", os_version=version, build=build, architecture=device.architecture,
+                    serial_number="C02" + "".join(rng.choices(string.ascii_uppercase + string.digits, k=9)))
+        user = "root" if device.is_admin else rng.choice(EMPLOYEE_ACCOUNTS)
+
+    results = []
+    for check_id in ORDER[os_family]:
+        check = checks[check_id]
+        if check["section"] == "org":
+            status, actual, expected, detail = org_result(rng, profile, check["answer_key"])
+        else:
+            status, actual, expected, detail = device.value(check_id)
+            if not device.is_admin and check_id in NEEDS_ADMIN[os_family]:
+                detail = ("Requires an elevated (administrator) PowerShell." if os_family == "windows"
+                          else "Requires root: run the collector with sudo.")
+                status, actual = "Error", "not read"
+            elif status in ("Compliant", "Non-Compliant") and rng.random() < 0.01:
+                status, actual, detail = "Error", "not read", "Value could not be read."
+        item = {"id": check_id, "section": check["section"], "name": check_name(check, os_family),
+                "status": status, "actual": actual, "expected": expected}
+        if detail:
+            item["detail"] = detail
+        results.append(item)
+
+    summary = {s: sum(1 for r in results if r["status"] == s) for s in catalog["statuses"]}
+    return {
+        "schema_version": "1.0",
+        "catalog_version": catalog["catalog_version"],
+        "source": {"kind": "synthetic", "collector": os_family, "collector_version": GENERATOR_VERSION,
+                   "synthetic_seed": seed, "synthetic_profile": profile},
+        "audit": {"mode": "READ-ONLY", "started_at": started.isoformat(timespec="seconds"),
+                  "execution_user": user, "is_admin": device.is_admin},
+        "host": host,
+        "baseline": dict(baseline),
+        "results": results,
+        "summary": summary,
+    }
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
+    parser.add_argument("--count", type=int, default=100, help="number of audit runs to generate")
+    parser.add_argument("--seed", type=int, default=1, help="random seed (same seed = same data)")
+    parser.add_argument("--os", default="windows,linux,macos", help="comma-separated OS families")
+    parser.add_argument("--baseline", default=os.path.join(ROOT, "baseline.conf"))
+    parser.add_argument("--out", default=os.path.join(ROOT, "synthetic", "out", "evidence.jsonl"), help="JSONL output file")
+    parser.add_argument("--files", help="write one pretty JSON file per run into this folder instead of JSONL")
+    args = parser.parse_args()
+
+    catalog, checks = load_catalog()
+    baseline = read_conf(args.baseline)
+    families = [f.strip() for f in args.os.split(",") if f.strip()]
+    rng = random.Random(args.seed)
+    records = []
+    for index in range(args.count):
+        record_seed = args.seed * 1_000_003 + index
+        local = random.Random(record_seed)
+        records.append(make_record(local, record_seed, rng.choice(families), rng.choices(list(PROFILES), weights=[2, 5, 3])[0],
+                                   baseline, catalog, checks))
+
+    if args.files:
+        os.makedirs(args.files, exist_ok=True)
+        for record in records:
+            path = os.path.join(args.files, f"synthetic-{record['host']['os_family']}-{record['source']['synthetic_seed']}.json")
+            with open(path, "w", encoding="utf-8") as handle:
+                json.dump(record, handle, indent=2, ensure_ascii=False)
+        print(f"Wrote {len(records)} files to {args.files}")
+    else:
+        os.makedirs(os.path.dirname(os.path.abspath(args.out)), exist_ok=True)
+        with open(args.out, "w", encoding="utf-8") as handle:
+            for record in records:
+                handle.write(json.dumps(record, ensure_ascii=False) + "\n")
+        print(f"Wrote {len(records)} records to {args.out}")
+
+
+if __name__ == "__main__":
+    main()

synthetic/samples/synthetic-linux-42000126.json

@@ -0,0 +1,482 @@
+{
+  "schema_version": "1.0",
+  "catalog_version": "0.1.0",
+  "source": {
+    "kind": "synthetic",
+    "collector": "linux",
+    "collector_version": "0.1.0",
+    "synthetic_seed": 42000126,
+    "synthetic_profile": "hardened"
+  },
+  "audit": {
+    "mode": "READ-ONLY",
+    "started_at": "2026-10-05T19:36:00+05:00",
+    "execution_user": "root",
+    "is_admin": true
+  },
+  "host": {
+    "hostname": "legal-lt-70",
+    "os_family": "linux",
+    "os_name": "Ubuntu 22.04.5 LTS",
+    "os_version": "22.04",
+    "kernel": "5.15.0-151-generic",
+    "architecture": "x86_64",
+    "serial_number": "R9DP33X"
+  },
+  "baseline": {
+    "PASSWORD_MIN_LENGTH": "14",
+    "PASSWORD_HISTORY": "24",
+    "PASSWORD_MAX_AGE_DAYS": "365",
+    "PASSWORD_MIN_AGE_DAYS": "1",
+    "PASSWORD_COMPLEXITY": "1",
+    "LOCKOUT_THRESHOLD_MAX": "5",
+    "LOCKOUT_DURATION_MIN_MINUTES": "15",
+    "LOCKOUT_OBSERVATION_MIN_MINUTES": "15",
+    "SIGNATURE_MAX_AGE_DAYS": "3",
+    "MACOS_XPROTECT_MAX_AGE_DAYS": "30",
+    "FIREWALL_OUTBOUND": "allow",
+    "SCREEN_LOCK_MAX_SECONDS": "900",
+    "USB_READ": "allow",
+    "USB_WRITE": "deny",
+    "APPROVED_ADMINS": "itadmin",
+    "ALLOW_DISABLED_BUILTIN_ADMIN": "1",
+    "UPDATES_MAX_AGE_DAYS": "30",
+    "BACKUP_MAX_AGE_DAYS": "7",
+    "APPROVED_REMOTE_SERVICES": "",
+    "WINDOWS_MIN_BUILD": "22631",
+    "MACOS_MIN_MAJOR": "14",
+    "UBUNTU_MIN_VERSION": "22.04",
+    "DEBIAN_MIN_VERSION": "12",
+    "RHEL_MIN_VERSION": "9",
+    "PERSONAL_DATA_SCAN": "0",
+    "APPROVED_AI_TOOLS": ""
+  },
+  "results": [
+    {
+      "id": "password.min_length",
+      "section": "baseline",
+      "name": "Minimum password length",
+      "status": "Compliant",
+      "actual": "14",
+      "expected": ">= 14",
+      "detail": "pam_pwquality"
+    },
+    {
+      "id": "password.history",
+      "section": "baseline",
+      "name": "Password history",
+      "status": "Compliant",
+      "actual": "24",
+      "expected": ">= 24"
+    },
+    {
+      "id": "password.expiration",
+      "section": "baseline",
+      "name": "Password expiration",
+      "status": "Compliant",
+      "actual": "90 days",
+      "expected": "1-365 days"
+    },
+    {
+      "id": "password.min_age",
+      "section": "baseline",
+      "name": "Minimum password age",
+      "status": "Compliant",
+      "actual": "1 days",
+      "expected": ">= 1 days"
+    },
+    {
+      "id": "password.complexity",
+      "section": "baseline",
+      "name": "Password complexity",
+      "status": "Compliant",
+      "actual": "minclass=0, required classes=4",
+      "expected": "3 or more character classes"
+    },
+    {
+      "id": "lockout.threshold",
+      "section": "baseline",
+      "name": "Account lockout threshold",
+      "status": "Compliant",
+      "actual": "5",
+      "expected": "1-5",
+      "detail": "pam_faillock"
+    },
+    {
+      "id": "lockout.duration",
+      "section": "baseline",
+      "name": "Account lockout duration",
+      "status": "Compliant",
+      "actual": "until an administrator unlocks",
+      "expected": ">= 15 minutes"
+    },
+    {
+      "id": "lockout.observation",
+      "section": "baseline",
+      "name": "Lockout observation period",
+      "status": "Compliant",
+      "actual": "30 minutes",
+      "expected": ">= 15 minutes"
+    },
+    {
+      "id": "malware.antivirus",
+      "section": "baseline",
+      "name": "Antivirus",
+      "status": "Compliant",
+      "actual": "ClamAV (clamav-daemon)",
+      "expected": "antivirus running"
+    },
+    {
+      "id": "malware.service",
+      "section": "baseline",
+      "name": "ClamAV malware protection service",
+      "status": "Compliant",
+      "actual": "clamav-daemon",
+      "expected": "running"
+    },
+    {
+      "id": "malware.signature_updates",
+      "section": "baseline",
+      "name": "Malware signature updates",
+      "status": "Compliant",
+      "actual": "clamav-freshclam",
+      "expected": "automatic"
+    },
+    {
+      "id": "malware.signatures",
+      "section": "baseline",
+      "name": "Malware signatures",
+      "status": "Non-Compliant",
+      "actual": "no signature database",
+      "expected": "<= 3 days old"
+    },
+    {
+      "id": "malware.on_access",
+      "section": "baseline",
+      "name": "On-access malware protection",
+      "status": "Non-Compliant",
+      "actual": "not running",
+      "expected": "on-access scanning"
+    },
+    {
+      "id": "firewall.enabled",
+      "section": "baseline",
+      "name": "Firewall",
+      "status": "Compliant",
+      "actual": "firewalld active",
+      "expected": "active"
+    },
+    {
+      "id": "firewall.inbound",
+      "section": "baseline",
+      "name": "Firewall inbound policy",
+      "status": "Compliant",
+      "actual": "deny",
+      "expected": "deny"
+    },
+    {
+      "id": "firewall.outbound",
+      "section": "baseline",
+      "name": "Firewall outbound policy",
+      "status": "Compliant",
+      "actual": "allow",
+      "expected": "allow"
+    },
+    {
+      "id": "screen_lock.enabled",
+      "section": "baseline",
+      "name": "Screen lock",
+      "status": "Compliant",
+      "actual": "on",
+      "expected": "on",
+      "detail": "Users checked: akaya, jdoe"
+    },
+    {
+      "id": "screen_lock.timeout",
+      "section": "baseline",
+      "name": "Screen lock timeout",
+      "status": "Compliant",
+      "actual": "within limit",
+      "expected": "<= 900 seconds",
+      "detail": "Users checked: akaya, jdoe"
+    },
+    {
+      "id": "screen_lock.password",
+      "section": "baseline",
+      "name": "Screen lock password requirement",
+      "status": "Compliant",
+      "actual": "required",
+      "expected": "password required",
+      "detail": "Users checked: akaya, jdoe"
+    },
+    {
+      "id": "usb.read",
+      "section": "baseline",
+      "name": "USB storage read",
+      "status": "Compliant",
+      "actual": "allow",
+      "expected": "allow"
+    },
+    {
+      "id": "usb.write",
+      "section": "baseline",
+      "name": "USB storage write",
+      "status": "Non-Compliant",
+      "actual": "allow",
+      "expected": "deny"
+    },
+    {
+      "id": "admin.approved",
+      "section": "baseline",
+      "name": "Approved IT administrator",
+      "status": "Compliant",
+      "actual": "itadmin",
+      "expected": "itadmin"
+    },
+    {
+      "id": "admin.unauthorized",
+      "section": "baseline",
+      "name": "Unauthorized employee administrator accounts",
+      "status": "Non-Compliant",
+      "actual": "akaya",
+      "expected": "none"
+    },
+    {
+      "id": "encryption.enabled",
+      "section": "baseline",
+      "name": "Encryption",
+      "status": "Compliant",
+      "actual": "root filesystem on LUKS (dm_crypt-0)",
+      "expected": "system disk encrypted"
+    },
+    {
+      "id": "encryption.protection",
+      "section": "baseline",
+      "name": "Disk encryption protection",
+      "status": "Compliant",
+      "actual": "LUKS2 aes-xts-plain64 512-bit key",
+      "expected": "active, strong cipher"
+    },
+    {
+      "id": "encryption.recovery",
+      "section": "baseline",
+      "name": "Disk encryption recovery",
+      "status": "Compliant",
+      "actual": "2 key slots, 0 unlock tokens",
+      "expected": "recovery key or second unlock method"
+    },
+    {
+      "id": "gdpr.auto_updates",
+      "section": "gdpr",
+      "name": "Automatic security updates",
+      "status": "Compliant",
+      "actual": "unattended-upgrades installed=1, enabled=1",
+      "expected": "automatic"
+    },
+    {
+      "id": "gdpr.updates_recent",
+      "section": "gdpr",
+      "name": "Security updates installed recently",
+      "status": "Non-Compliant",
+      "actual": "156 days ago",
+      "expected": "<= 30 days ago",
+      "detail": "Last package upgrade: 2026-05-02  11:51:26"
+    },
+    {
+      "id": "gdpr.os_supported",
+      "section": "gdpr",
+      "name": "Supported operating system version",
+      "status": "Compliant",
+      "actual": "Ubuntu 22.04.5 LTS",
+      "expected": "Ubuntu 22.04 or later"
+    },
+    {
+      "id": "gdpr.security_logging",
+      "section": "gdpr",
+      "name": "Security event logging",
+      "status": "Compliant",
+      "actual": "auditd running, journal persistent",
+      "expected": "auditd running"
+    },
+    {
+      "id": "gdpr.time_sync",
+      "section": "gdpr",
+      "name": "Time synchronisation",
+      "status": "Compliant",
+      "actual": "NTP service yes, synchronised yes",
+      "expected": "time synchronised"
+    },
+    {
+      "id": "gdpr.backup_configured",
+      "section": "gdpr",
+      "name": "Backup configured",
+      "status": "Compliant",
+      "actual": "Deja Dup (jdoe)",
+      "expected": "backup configured"
+    },
+    {
+      "id": "gdpr.backup_recent",
+      "section": "gdpr",
+      "name": "Recent backup",
+      "status": "Compliant",
+      "actual": "1 days ago",
+      "expected": "<= 7 days ago"
+    },
+    {
+      "id": "gdpr.removable_encryption",
+      "section": "gdpr",
+      "name": "Removable media encryption",
+      "status": "Non-Compliant",
+      "actual": "USB storage writable without enforced encryption",
+      "expected": "no unencrypted writes"
+    },
+    {
+      "id": "gdpr.guest_account",
+      "section": "gdpr",
+      "name": "Guest account disabled",
+      "status": "Compliant",
+      "actual": "no guest login",
+      "expected": "no guest login"
+    },
+    {
+      "id": "gdpr.remote_access",
+      "section": "gdpr",
+      "name": "Remote access services restricted",
+      "status": "Compliant",
+      "actual": "none enabled",
+      "expected": "only: none"
+    },
+    {
+      "id": "gdpr.telemetry",
+      "section": "gdpr",
+      "name": "Diagnostic data minimised",
+      "status": "Compliant",
+      "actual": "usage reporting off",
+      "expected": "usage reporting off"
+    },
+    {
+      "id": "gdpr.personal_data_discovery",
+      "section": "gdpr",
+      "name": "Personal data discovery",
+      "status": "NotApplicable",
+      "actual": "not run",
+      "expected": "opt-in scan",
+      "detail": "Opt-in scan (PERSONAL_DATA_SCAN=0) is planned for a later stage."
+    },
+    {
+      "id": "aiact.inventory",
+      "section": "aiact",
+      "name": "AI software inventory",
+      "status": "Compliant",
+      "actual": "LM Studio, Alpaca (Ollama client)",
+      "expected": "inventory taken"
+    },
+    {
+      "id": "aiact.unapproved",
+      "section": "aiact",
+      "name": "Unapproved AI tools (shadow AI)",
+      "status": "Non-Compliant",
+      "actual": "LM Studio, Alpaca (Ollama client)",
+      "expected": "only: none"
+    },
+    {
+      "id": "aiact.risk_classification",
+      "section": "aiact",
+      "name": "AI system risk classification",
+      "status": "Pending",
+      "actual": "LM Studio, Alpaca (Ollama client)",
+      "expected": "every AI tool classified",
+      "detail": "Classified by the auditor model (Caveat classifier) in a later step."
+    },
+    {
+      "id": "aiact.os_ai_features",
+      "section": "aiact",
+      "name": "Operating system AI features restricted",
+      "status": "NotApplicable",
+      "actual": "none built in",
+      "expected": "restricted by policy",
+      "detail": "Linux distributions ship no built-in AI assistant."
+    },
+    {
+      "id": "aiact.log_retention",
+      "section": "aiact",
+      "name": "AI usage log retention",
+      "status": "Pending",
+      "actual": "depends on classification",
+      "expected": ">= 6 months for high-risk AI",
+      "detail": "Required only if a tool is classified high-risk."
+    },
+    {
+      "id": "org.ropa",
+      "section": "org",
+      "name": "Record of processing activities",
+      "status": "Non-Compliant",
+      "actual": "partial",
+      "expected": "yes"
+    },
+    {
+      "id": "org.dpia",
+      "section": "org",
+      "name": "Data protection impact assessment",
+      "status": "Pending",
+      "actual": "not answered",
+      "expected": "yes",
+      "detail": "Answer ORG_DPIA in organisational.conf."
+    },
+    {
+      "id": "org.breach_procedure",
+      "section": "org",
+      "name": "Breach response procedure",
+      "status": "Compliant",
+      "actual": "yes",
+      "expected": "yes"
+    },
+    {
+      "id": "org.processor_agreements",
+      "section": "org",
+      "name": "Data processing agreements",
+      "status": "Compliant",
+      "actual": "yes",
+      "expected": "yes"
+    },
+    {
+      "id": "org.ai_register",
+      "section": "org",
+      "name": "AI register",
+      "status": "Compliant",
+      "actual": "yes",
+      "expected": "yes"
+    },
+    {
+      "id": "org.ai_literacy",
+      "section": "org",
+      "name": "AI literacy training",
+      "status": "Compliant",
+      "actual": "yes",
+      "expected": "yes"
+    },
+    {
+      "id": "org.human_oversight",
+      "section": "org",
+      "name": "Human oversight for high-risk AI",
+      "status": "Compliant",
+      "actual": "yes",
+      "expected": "yes"
+    },
+    {
+      "id": "org.ai_transparency",
+      "section": "org",
+      "name": "AI transparency to users",
+      "status": "Compliant",
+      "actual": "yes",
+      "expected": "yes"
+    }
+  ],
+  "summary": {
+    "Compliant": 38,
+    "Non-Compliant": 8,
+    "NotApplicable": 2,
+    "Pending": 3,
+    "Error": 0
+  }
+}

synthetic/samples/synthetic-macos-42000126.json

@@ -0,0 +1,482 @@
+{
+  "schema_version": "1.0",
+  "catalog_version": "0.1.0",
+  "source": {
+    "kind": "synthetic",
+    "collector": "macos",
+    "collector_version": "0.1.0",
+    "synthetic_seed": 42000126,
+    "synthetic_profile": "hardened"
+  },
+  "audit": {
+    "mode": "READ-ONLY",
+    "started_at": "2026-10-05T19:36:00+05:00",
+    "execution_user": "root",
+    "is_admin": true
+  },
+  "host": {
+    "hostname": "LEGAL-MacBook-34",
+    "os_family": "macos",
+    "os_name": "macOS",
+    "os_version": "26.0.1",
+    "build": "25A362",
+    "architecture": "arm64",
+    "serial_number": "C02VWA6H79QN"
+  },
+  "baseline": {
+    "PASSWORD_MIN_LENGTH": "14",
+    "PASSWORD_HISTORY": "24",
+    "PASSWORD_MAX_AGE_DAYS": "365",
+    "PASSWORD_MIN_AGE_DAYS": "1",
+    "PASSWORD_COMPLEXITY": "1",
+    "LOCKOUT_THRESHOLD_MAX": "5",
+    "LOCKOUT_DURATION_MIN_MINUTES": "15",
+    "LOCKOUT_OBSERVATION_MIN_MINUTES": "15",
+    "SIGNATURE_MAX_AGE_DAYS": "3",
+    "MACOS_XPROTECT_MAX_AGE_DAYS": "30",
+    "FIREWALL_OUTBOUND": "allow",
+    "SCREEN_LOCK_MAX_SECONDS": "900",
+    "USB_READ": "allow",
+    "USB_WRITE": "deny",
+    "APPROVED_ADMINS": "itadmin",
+    "ALLOW_DISABLED_BUILTIN_ADMIN": "1",
+    "UPDATES_MAX_AGE_DAYS": "30",
+    "BACKUP_MAX_AGE_DAYS": "7",
+    "APPROVED_REMOTE_SERVICES": "",
+    "WINDOWS_MIN_BUILD": "22631",
+    "MACOS_MIN_MAJOR": "14",
+    "UBUNTU_MIN_VERSION": "22.04",
+    "DEBIAN_MIN_VERSION": "12",
+    "RHEL_MIN_VERSION": "9",
+    "PERSONAL_DATA_SCAN": "0",
+    "APPROVED_AI_TOOLS": ""
+  },
+  "results": [
+    {
+      "id": "password.min_length",
+      "section": "baseline",
+      "name": "Minimum password length",
+      "status": "Non-Compliant",
+      "actual": "not set",
+      "expected": ">= 14",
+      "detail": "pwpolicy global account policy"
+    },
+    {
+      "id": "password.history",
+      "section": "baseline",
+      "name": "Password history",
+      "status": "Compliant",
+      "actual": "24",
+      "expected": ">= 24"
+    },
+    {
+      "id": "password.expiration",
+      "section": "baseline",
+      "name": "Password expiration",
+      "status": "Compliant",
+      "actual": "90 days",
+      "expected": "1-365 days"
+    },
+    {
+      "id": "password.min_age",
+      "section": "baseline",
+      "name": "Minimum password age",
+      "status": "NotApplicable",
+      "actual": "no such setting",
+      "expected": ">= 1 days",
+      "detail": "macOS account policies have no minimum password age."
+    },
+    {
+      "id": "password.complexity",
+      "section": "baseline",
+      "name": "Password complexity",
+      "status": "Compliant",
+      "actual": "letters and numbers required",
+      "expected": "enforced"
+    },
+    {
+      "id": "lockout.threshold",
+      "section": "baseline",
+      "name": "Account lockout threshold",
+      "status": "Non-Compliant",
+      "actual": "not set",
+      "expected": "1-5"
+    },
+    {
+      "id": "lockout.duration",
+      "section": "baseline",
+      "name": "Account lockout duration",
+      "status": "Compliant",
+      "actual": "15 minutes",
+      "expected": ">= 15 minutes"
+    },
+    {
+      "id": "lockout.observation",
+      "section": "baseline",
+      "name": "Lockout observation period",
+      "status": "Compliant",
+      "actual": "15 minutes",
+      "expected": ">= 15 minutes",
+      "detail": "macOS resets the failed-attempt count when the lockout ends."
+    },
+    {
+      "id": "malware.antivirus",
+      "section": "baseline",
+      "name": "Antivirus",
+      "status": "Compliant",
+      "actual": "XProtect 5283",
+      "expected": "antivirus present"
+    },
+    {
+      "id": "malware.service",
+      "section": "baseline",
+      "name": "Apple malware protection service",
+      "status": "Compliant",
+      "actual": "XProtect scanning on; Gatekeeper on",
+      "expected": "XProtect and Gatekeeper on"
+    },
+    {
+      "id": "malware.signatures",
+      "section": "baseline",
+      "name": "Malware protection signatures",
+      "status": "Compliant",
+      "actual": "XProtect 5270, 12 days old",
+      "expected": "<= 30 days old"
+    },
+    {
+      "id": "malware.signature_updates",
+      "section": "baseline",
+      "name": "Malware security updates",
+      "status": "Compliant",
+      "actual": "security responses and system data files install automatically",
+      "expected": "automatic"
+    },
+    {
+      "id": "malware.on_access",
+      "section": "baseline",
+      "name": "On-access malware protection",
+      "status": "NotApplicable",
+      "actual": "XProtect only",
+      "expected": "on-access scanning",
+      "detail": "XProtect scans at launch and download; macOS has no built-in on-access scanning."
+    },
+    {
+      "id": "firewall.enabled",
+      "section": "baseline",
+      "name": "Firewall",
+      "status": "Compliant",
+      "actual": "on",
+      "expected": "on"
+    },
+    {
+      "id": "firewall.inbound",
+      "section": "baseline",
+      "name": "Firewall inbound policy",
+      "status": "Compliant",
+      "actual": "block (firewall on, stealth mode on)",
+      "expected": "block"
+    },
+    {
+      "id": "firewall.outbound",
+      "section": "baseline",
+      "name": "Firewall outbound policy",
+      "status": "Compliant",
+      "actual": "allow",
+      "expected": "allow",
+      "detail": "The macOS application firewall filters inbound connections only."
+    },
+    {
+      "id": "screen_lock.timeout",
+      "section": "baseline",
+      "name": "Screen lock timeout",
+      "status": "Compliant",
+      "actual": "420 seconds",
+      "expected": "<= 900 seconds",
+      "detail": "Idle 120s (screen saver/display sleep) + 300s password delay."
+    },
+    {
+      "id": "screen_lock.enabled",
+      "section": "baseline",
+      "name": "Screen lock",
+      "status": "Compliant",
+      "actual": "on",
+      "expected": "on"
+    },
+    {
+      "id": "screen_lock.password",
+      "section": "baseline",
+      "name": "Screen lock password requirement",
+      "status": "Compliant",
+      "actual": "password after 0 seconds",
+      "expected": "password within 5 seconds"
+    },
+    {
+      "id": "usb.read",
+      "section": "baseline",
+      "name": "USB storage read",
+      "status": "Non-Compliant",
+      "actual": "deny",
+      "expected": "allow"
+    },
+    {
+      "id": "usb.write",
+      "section": "baseline",
+      "name": "USB storage write",
+      "status": "Compliant",
+      "actual": "deny",
+      "expected": "deny"
+    },
+    {
+      "id": "admin.approved",
+      "section": "baseline",
+      "name": "Approved IT administrator",
+      "status": "Compliant",
+      "actual": "itadmin",
+      "expected": "itadmin"
+    },
+    {
+      "id": "admin.unauthorized",
+      "section": "baseline",
+      "name": "Unauthorized employee administrator accounts",
+      "status": "Compliant",
+      "actual": "none",
+      "expected": "none"
+    },
+    {
+      "id": "encryption.enabled",
+      "section": "baseline",
+      "name": "Encryption",
+      "status": "Compliant",
+      "actual": "FileVault on",
+      "expected": "FileVault on"
+    },
+    {
+      "id": "encryption.protection",
+      "section": "baseline",
+      "name": "Disk encryption protection",
+      "status": "Compliant",
+      "actual": "fully encrypted",
+      "expected": "fully encrypted"
+    },
+    {
+      "id": "encryption.recovery",
+      "section": "baseline",
+      "name": "Disk encryption recovery",
+      "status": "Compliant",
+      "actual": "recovery key present (personal: true, institutional: false)",
+      "expected": "recovery key present"
+    },
+    {
+      "id": "gdpr.auto_updates",
+      "section": "gdpr",
+      "name": "Automatic security updates",
+      "status": "Compliant",
+      "actual": "check, download and install automatic",
+      "expected": "automatic"
+    },
+    {
+      "id": "gdpr.updates_recent",
+      "section": "gdpr",
+      "name": "Security updates installed recently",
+      "status": "Compliant",
+      "actual": "5 days ago",
+      "expected": "<= 30 days ago",
+      "detail": "Last software update: 2026-09-30 06:07:00 +0000"
+    },
+    {
+      "id": "gdpr.os_supported",
+      "section": "gdpr",
+      "name": "Supported operating system version",
+      "status": "Compliant",
+      "actual": "macOS 26.0.1",
+      "expected": "macOS 14 or later"
+    },
+    {
+      "id": "gdpr.security_logging",
+      "section": "gdpr",
+      "name": "Security event logging",
+      "status": "Compliant",
+      "actual": "unified logging active",
+      "expected": "security events logged",
+      "detail": "macOS unified log records authentication events; retention is managed by the OS."
+    },
+    {
+      "id": "gdpr.time_sync",
+      "section": "gdpr",
+      "name": "Time synchronisation",
+      "status": "Compliant",
+      "actual": "network time on",
+      "expected": "network time on"
+    },
+    {
+      "id": "gdpr.backup_configured",
+      "section": "gdpr",
+      "name": "Backup configured",
+      "status": "Compliant",
+      "actual": "Time Machine",
+      "expected": "backup configured"
+    },
+    {
+      "id": "gdpr.backup_recent",
+      "section": "gdpr",
+      "name": "Recent backup",
+      "status": "Compliant",
+      "actual": "7 days ago",
+      "expected": "<= 7 days ago"
+    },
+    {
+      "id": "gdpr.removable_encryption",
+      "section": "gdpr",
+      "name": "Removable media encryption",
+      "status": "Compliant",
+      "actual": "writing to external drives blocked",
+      "expected": "no unencrypted writes"
+    },
+    {
+      "id": "gdpr.guest_account",
+      "section": "gdpr",
+      "name": "Guest account disabled",
+      "status": "Compliant",
+      "actual": "guest login off",
+      "expected": "guest login off"
+    },
+    {
+      "id": "gdpr.remote_access",
+      "section": "gdpr",
+      "name": "Remote access services restricted",
+      "status": "Compliant",
+      "actual": "none enabled",
+      "expected": "only: none"
+    },
+    {
+      "id": "gdpr.telemetry",
+      "section": "gdpr",
+      "name": "Diagnostic data minimised",
+      "status": "Non-Compliant",
+      "actual": "share Mac analytics=1, share with app developers=0",
+      "expected": "analytics sharing off"
+    },
+    {
+      "id": "gdpr.personal_data_discovery",
+      "section": "gdpr",
+      "name": "Personal data discovery",
+      "status": "NotApplicable",
+      "actual": "not run",
+      "expected": "opt-in scan",
+      "detail": "Opt-in scan (PERSONAL_DATA_SCAN=0) is planned for a later stage."
+    },
+    {
+      "id": "aiact.inventory",
+      "section": "aiact",
+      "name": "AI software inventory",
+      "status": "Compliant",
+      "actual": "no AI tools found",
+      "expected": "inventory taken"
+    },
+    {
+      "id": "aiact.unapproved",
+      "section": "aiact",
+      "name": "Unapproved AI tools (shadow AI)",
+      "status": "Compliant",
+      "actual": "none",
+      "expected": "only: none"
+    },
+    {
+      "id": "aiact.risk_classification",
+      "section": "aiact",
+      "name": "AI system risk classification",
+      "status": "NotApplicable",
+      "actual": "no AI tools found",
+      "expected": "every AI tool classified"
+    },
+    {
+      "id": "aiact.os_ai_features",
+      "section": "aiact",
+      "name": "Apple Intelligence external integrations restricted",
+      "status": "Non-Compliant",
+      "actual": "not restricted",
+      "expected": "restricted by profile",
+      "detail": "No profile sets allowExternalIntelligenceIntegrations to false."
+    },
+    {
+      "id": "aiact.log_retention",
+      "section": "aiact",
+      "name": "AI usage log retention",
+      "status": "NotApplicable",
+      "actual": "no AI tools found",
+      "expected": ">= 6 months for high-risk AI"
+    },
+    {
+      "id": "org.ropa",
+      "section": "org",
+      "name": "Record of processing activities",
+      "status": "Compliant",
+      "actual": "yes",
+      "expected": "yes"
+    },
+    {
+      "id": "org.dpia",
+      "section": "org",
+      "name": "Data protection impact assessment",
+      "status": "Compliant",
+      "actual": "yes",
+      "expected": "yes"
+    },
+    {
+      "id": "org.breach_procedure",
+      "section": "org",
+      "name": "Breach response procedure",
+      "status": "Compliant",
+      "actual": "yes",
+      "expected": "yes"
+    },
+    {
+      "id": "org.processor_agreements",
+      "section": "org",
+      "name": "Data processing agreements",
+      "status": "Pending",
+      "actual": "not answered",
+      "expected": "yes",
+      "detail": "Answer ORG_PROCESSOR_AGREEMENTS in organisational.conf."
+    },
+    {
+      "id": "org.ai_register",
+      "section": "org",
+      "name": "AI register",
+      "status": "Compliant",
+      "actual": "yes",
+      "expected": "yes"
+    },
+    {
+      "id": "org.ai_literacy",
+      "section": "org",
+      "name": "AI literacy training",
+      "status": "Compliant",
+      "actual": "yes",
+      "expected": "yes"
+    },
+    {
+      "id": "org.human_oversight",
+      "section": "org",
+      "name": "Human oversight for high-risk AI",
+      "status": "Compliant",
+      "actual": "yes",
+      "expected": "yes"
+    },
+    {
+      "id": "org.ai_transparency",
+      "section": "org",
+      "name": "AI transparency to users",
+      "status": "Compliant",
+      "actual": "yes",
+      "expected": "yes"
+    }
+  ],
+  "summary": {
+    "Compliant": 40,
+    "Non-Compliant": 5,
+    "NotApplicable": 5,
+    "Pending": 1,
+    "Error": 0
+  }
+}

synthetic/samples/synthetic-windows-42000126.json

@@ -0,0 +1,538 @@
+{
+  "schema_version": "1.0",
+  "catalog_version": "0.1.0",
+  "source": {
+    "kind": "synthetic",
+    "collector": "windows",
+    "collector_version": "0.1.0",
+    "synthetic_seed": 42000126,
+    "synthetic_profile": "hardened"
+  },
+  "audit": {
+    "mode": "READ-ONLY",
+    "started_at": "2026-10-05T19:36:00+05:00",
+    "execution_user": "NT AUTHORITY\\SYSTEM",
+    "is_admin": true
+  },
+  "host": {
+    "hostname": "DESKTOP-TYVWA6H",
+    "os_family": "windows",
+    "os_name": "Microsoft Windows 10 Pro",
+    "os_version": "10.0.19045",
+    "build": "19045",
+    "architecture": "AMD64",
+    "serial_number": "QN9DCV4"
+  },
+  "baseline": {
+    "PASSWORD_MIN_LENGTH": "14",
+    "PASSWORD_HISTORY": "24",
+    "PASSWORD_MAX_AGE_DAYS": "365",
+    "PASSWORD_MIN_AGE_DAYS": "1",
+    "PASSWORD_COMPLEXITY": "1",
+    "LOCKOUT_THRESHOLD_MAX": "5",
+    "LOCKOUT_DURATION_MIN_MINUTES": "15",
+    "LOCKOUT_OBSERVATION_MIN_MINUTES": "15",
+    "SIGNATURE_MAX_AGE_DAYS": "3",
+    "MACOS_XPROTECT_MAX_AGE_DAYS": "30",
+    "FIREWALL_OUTBOUND": "allow",
+    "SCREEN_LOCK_MAX_SECONDS": "900",
+    "USB_READ": "allow",
+    "USB_WRITE": "deny",
+    "APPROVED_ADMINS": "itadmin",
+    "ALLOW_DISABLED_BUILTIN_ADMIN": "1",
+    "UPDATES_MAX_AGE_DAYS": "30",
+    "BACKUP_MAX_AGE_DAYS": "7",
+    "APPROVED_REMOTE_SERVICES": "",
+    "WINDOWS_MIN_BUILD": "22631",
+    "MACOS_MIN_MAJOR": "14",
+    "UBUNTU_MIN_VERSION": "22.04",
+    "DEBIAN_MIN_VERSION": "12",
+    "RHEL_MIN_VERSION": "9",
+    "PERSONAL_DATA_SCAN": "0",
+    "APPROVED_AI_TOOLS": ""
+  },
+  "results": [
+    {
+      "id": "password.min_length",
+      "section": "baseline",
+      "name": "Minimum password length",
+      "status": "Compliant",
+      "actual": "16",
+      "expected": ">= 14"
+    },
+    {
+      "id": "password.history",
+      "section": "baseline",
+      "name": "Password history",
+      "status": "Compliant",
+      "actual": "24",
+      "expected": ">= 24"
+    },
+    {
+      "id": "password.expiration",
+      "section": "baseline",
+      "name": "Password expiration",
+      "status": "Compliant",
+      "actual": "90 days",
+      "expected": "1-365 days"
+    },
+    {
+      "id": "password.min_age",
+      "section": "baseline",
+      "name": "Minimum password age",
+      "status": "Compliant",
+      "actual": "1 days",
+      "expected": ">= 1 days"
+    },
+    {
+      "id": "password.complexity",
+      "section": "baseline",
+      "name": "Password complexity",
+      "status": "Compliant",
+      "actual": "enabled",
+      "expected": "enabled"
+    },
+    {
+      "id": "lockout.threshold",
+      "section": "baseline",
+      "name": "Account lockout threshold",
+      "status": "Compliant",
+      "actual": "3",
+      "expected": "1-5"
+    },
+    {
+      "id": "lockout.duration",
+      "section": "baseline",
+      "name": "Account lockout duration",
+      "status": "Compliant",
+      "actual": "15 minutes",
+      "expected": ">= 15 minutes"
+    },
+    {
+      "id": "lockout.observation",
+      "section": "baseline",
+      "name": "Lockout observation period",
+      "status": "Compliant",
+      "actual": "30 minutes",
+      "expected": ">= 15 minutes"
+    },
+    {
+      "id": "malware.antivirus",
+      "section": "baseline",
+      "name": "Antivirus",
+      "status": "Compliant",
+      "actual": "Windows Defender (on, up to date)",
+      "expected": "enabled and up to date"
+    },
+    {
+      "id": "malware.service",
+      "section": "baseline",
+      "name": "Microsoft Defender Antimalware",
+      "status": "Compliant",
+      "actual": "service True, antivirus True",
+      "expected": "running"
+    },
+    {
+      "id": "malware.realtime",
+      "section": "baseline",
+      "name": "Real-time protection",
+      "status": "Compliant",
+      "actual": "on",
+      "expected": "on"
+    },
+    {
+      "id": "malware.on_access",
+      "section": "baseline",
+      "name": "On-access protection",
+      "status": "Compliant",
+      "actual": "on",
+      "expected": "on"
+    },
+    {
+      "id": "malware.tamper",
+      "section": "baseline",
+      "name": "Tamper protection",
+      "status": "Compliant",
+      "actual": "on",
+      "expected": "on"
+    },
+    {
+      "id": "malware.signatures",
+      "section": "baseline",
+      "name": "Security intelligence",
+      "status": "Compliant",
+      "actual": "3 days old (version 1.439.890.0)",
+      "expected": "<= 3 days old"
+    },
+    {
+      "id": "firewall.domain.enabled",
+      "section": "baseline",
+      "name": "Domain firewall",
+      "status": "Compliant",
+      "actual": "on",
+      "expected": "on"
+    },
+    {
+      "id": "firewall.domain.inbound",
+      "section": "baseline",
+      "name": "Domain inbound",
+      "status": "Compliant",
+      "actual": "block",
+      "expected": "block",
+      "detail": "Not configured: Windows default (Block) applies."
+    },
+    {
+      "id": "firewall.domain.outbound",
+      "section": "baseline",
+      "name": "Domain outbound",
+      "status": "Compliant",
+      "actual": "allow",
+      "expected": "allow"
+    },
+    {
+      "id": "firewall.private.enabled",
+      "section": "baseline",
+      "name": "Private firewall",
+      "status": "Compliant",
+      "actual": "on",
+      "expected": "on"
+    },
+    {
+      "id": "firewall.private.inbound",
+      "section": "baseline",
+      "name": "Private inbound",
+      "status": "Compliant",
+      "actual": "block",
+      "expected": "block",
+      "detail": "Not configured: Windows default (Block) applies."
+    },
+    {
+      "id": "firewall.private.outbound",
+      "section": "baseline",
+      "name": "Private outbound",
+      "status": "Compliant",
+      "actual": "allow",
+      "expected": "allow"
+    },
+    {
+      "id": "firewall.public.enabled",
+      "section": "baseline",
+      "name": "Public firewall",
+      "status": "Compliant",
+      "actual": "on",
+      "expected": "on"
+    },
+    {
+      "id": "firewall.public.inbound",
+      "section": "baseline",
+      "name": "Public inbound",
+      "status": "Compliant",
+      "actual": "block",
+      "expected": "block",
+      "detail": "Not configured: Windows default (Block) applies."
+    },
+    {
+      "id": "firewall.public.outbound",
+      "section": "baseline",
+      "name": "Public outbound",
+      "status": "Compliant",
+      "actual": "allow",
+      "expected": "allow",
+      "detail": "Not configured: Windows default (Allow) applies."
+    },
+    {
+      "id": "screen_lock.timeout",
+      "section": "baseline",
+      "name": "Screen lock timeout",
+      "status": "Compliant",
+      "actual": "300 seconds (machine inactivity limit)",
+      "expected": "<= 900 seconds"
+    },
+    {
+      "id": "screen_lock.password",
+      "section": "baseline",
+      "name": "Screen lock password requirement",
+      "status": "Compliant",
+      "actual": "screen saver requires sign-in for all signed-in users",
+      "expected": "sign-in required to unlock"
+    },
+    {
+      "id": "usb.read",
+      "section": "baseline",
+      "name": "USB storage read",
+      "status": "Compliant",
+      "actual": "allow",
+      "expected": "allow"
+    },
+    {
+      "id": "usb.write",
+      "section": "baseline",
+      "name": "USB storage write",
+      "status": "Non-Compliant",
+      "actual": "allow",
+      "expected": "deny"
+    },
+    {
+      "id": "admin.approved",
+      "section": "baseline",
+      "name": "Approved IT administrator",
+      "status": "Compliant",
+      "actual": "FABRIKAM\\itadmin",
+      "expected": "itadmin"
+    },
+    {
+      "id": "admin.unauthorized",
+      "section": "baseline",
+      "name": "Unauthorized employee local administrator accounts",
+      "status": "Compliant",
+      "actual": "none",
+      "expected": "none"
+    },
+    {
+      "id": "encryption.feature",
+      "section": "baseline",
+      "name": "BitLocker",
+      "status": "Compliant",
+      "actual": "on",
+      "expected": "on"
+    },
+    {
+      "id": "encryption.enabled",
+      "section": "baseline",
+      "name": "Encryption",
+      "status": "Compliant",
+      "actual": "FullyEncrypted (100%)",
+      "expected": "fully encrypted"
+    },
+    {
+      "id": "encryption.protection",
+      "section": "baseline",
+      "name": "BitLocker protection",
+      "status": "Compliant",
+      "actual": "protection On, XtsAes128",
+      "expected": "protection on, AES"
+    },
+    {
+      "id": "encryption.recovery",
+      "section": "baseline",
+      "name": "BitLocker recovery",
+      "status": "Compliant",
+      "actual": "key protectors: Tpm, RecoveryPassword",
+      "expected": "recovery password present"
+    },
+    {
+      "id": "gdpr.auto_updates",
+      "section": "gdpr",
+      "name": "Automatic security updates",
+      "status": "Compliant",
+      "actual": "AUOptions=4",
+      "expected": "automatic"
+    },
+    {
+      "id": "gdpr.updates_recent",
+      "section": "gdpr",
+      "name": "Security updates installed recently",
+      "status": "Non-Compliant",
+      "actual": "63 days ago",
+      "expected": "<= 30 days ago",
+      "detail": "Last update: 2026-05 Cumulative Update for Windows 11 (2026-08-03)"
+    },
+    {
+      "id": "gdpr.os_supported",
+      "section": "gdpr",
+      "name": "Supported operating system version",
+      "status": "Non-Compliant",
+      "actual": "Microsoft Windows 10 Pro build 19045",
+      "expected": "build 22631 or later"
+    },
+    {
+      "id": "gdpr.security_logging",
+      "section": "gdpr",
+      "name": "Security event logging",
+      "status": "Compliant",
+      "actual": "logon: success+failure; account management: success+failure",
+      "expected": "logon success+failure and account changes audited"
+    },
+    {
+      "id": "gdpr.time_sync",
+      "section": "gdpr",
+      "name": "Time synchronisation",
+      "status": "Compliant",
+      "actual": "type NTP, service Running/Manual",
+      "expected": "NTP or domain time"
+    },
+    {
+      "id": "gdpr.backup_configured",
+      "section": "gdpr",
+      "name": "Backup configured",
+      "status": "Compliant",
+      "actual": "OneDrive folder backup (policy)",
+      "expected": "backup configured"
+    },
+    {
+      "id": "gdpr.backup_recent",
+      "section": "gdpr",
+      "name": "Recent backup",
+      "status": "Pending",
+      "actual": "date not readable",
+      "expected": "<= 7 days ago",
+      "detail": "Confirm the last backup date in: OneDrive folder backup (policy)."
+    },
+    {
+      "id": "gdpr.removable_encryption",
+      "section": "gdpr",
+      "name": "Removable media encryption",
+      "status": "Compliant",
+      "actual": "BitLocker To Go required before writing",
+      "expected": "no unencrypted writes"
+    },
+    {
+      "id": "gdpr.guest_account",
+      "section": "gdpr",
+      "name": "Guest account disabled",
+      "status": "Compliant",
+      "actual": "disabled",
+      "expected": "disabled"
+    },
+    {
+      "id": "gdpr.remote_access",
+      "section": "gdpr",
+      "name": "Remote access services restricted",
+      "status": "Non-Compliant",
+      "actual": "ssh",
+      "expected": "only: none"
+    },
+    {
+      "id": "gdpr.telemetry",
+      "section": "gdpr",
+      "name": "Diagnostic data minimised",
+      "status": "Compliant",
+      "actual": "AllowTelemetry=0 (policy)",
+      "expected": "required diagnostic data only (0-1)"
+    },
+    {
+      "id": "gdpr.personal_data_discovery",
+      "section": "gdpr",
+      "name": "Personal data discovery",
+      "status": "NotApplicable",
+      "actual": "not run",
+      "expected": "opt-in scan",
+      "detail": "Opt-in scan (PERSONAL_DATA_SCAN=0) is planned for a later stage."
+    },
+    {
+      "id": "aiact.inventory",
+      "section": "aiact",
+      "name": "AI software inventory",
+      "status": "Compliant",
+      "actual": "Ollama",
+      "expected": "inventory taken",
+      "detail": "Local models: C:\\Users\\jdoe\\.ollama\\models (2 GB)."
+    },
+    {
+      "id": "aiact.unapproved",
+      "section": "aiact",
+      "name": "Unapproved AI tools (shadow AI)",
+      "status": "Non-Compliant",
+      "actual": "Ollama",
+      "expected": "only: none"
+    },
+    {
+      "id": "aiact.risk_classification",
+      "section": "aiact",
+      "name": "AI system risk classification",
+      "status": "Pending",
+      "actual": "Ollama",
+      "expected": "every AI tool classified",
+      "detail": "Classified by the auditor model (Caveat classifier) in a later step."
+    },
+    {
+      "id": "aiact.os_ai_features",
+      "section": "aiact",
+      "name": "Windows Recall / Copilot data analysis disabled",
+      "status": "Compliant",
+      "actual": "Recall disabled by policy",
+      "expected": "disabled by policy",
+      "detail": "DisableAIDataAnalysis=1; AllowRecallEnablement=0; TurnOffWindowsCopilot="
+    },
+    {
+      "id": "aiact.log_retention",
+      "section": "aiact",
+      "name": "AI usage log retention",
+      "status": "Pending",
+      "actual": "depends on classification",
+      "expected": ">= 6 months for high-risk AI",
+      "detail": "Required only if a tool is classified high-risk."
+    },
+    {
+      "id": "org.ropa",
+      "section": "org",
+      "name": "Record of processing activities",
+      "status": "Non-Compliant",
+      "actual": "partial",
+      "expected": "yes"
+    },
+    {
+      "id": "org.dpia",
+      "section": "org",
+      "name": "Data protection impact assessment",
+      "status": "Compliant",
+      "actual": "yes",
+      "expected": "yes"
+    },
+    {
+      "id": "org.breach_procedure",
+      "section": "org",
+      "name": "Breach response procedure",
+      "status": "Compliant",
+      "actual": "yes",
+      "expected": "yes"
+    },
+    {
+      "id": "org.processor_agreements",
+      "section": "org",
+      "name": "Data processing agreements",
+      "status": "Compliant",
+      "actual": "yes",
+      "expected": "yes"
+    },
+    {
+      "id": "org.ai_register",
+      "section": "org",
+      "name": "AI register",
+      "status": "Compliant",
+      "actual": "yes",
+      "expected": "yes"
+    },
+    {
+      "id": "org.ai_literacy",
+      "section": "org",
+      "name": "AI literacy training",
+      "status": "Compliant",
+      "actual": "yes",
+      "expected": "yes"
+    },
+    {
+      "id": "org.human_oversight",
+      "section": "org",
+      "name": "Human oversight for high-risk AI",
+      "status": "Non-Compliant",
+      "actual": "partial",
+      "expected": "yes"
+    },
+    {
+      "id": "org.ai_transparency",
+      "section": "org",
+      "name": "AI transparency to users",
+      "status": "Compliant",
+      "actual": "yes",
+      "expected": "yes"
+    }
+  ],
+  "summary": {
+    "Compliant": 47,
+    "Non-Compliant": 7,
+    "NotApplicable": 1,
+    "Pending": 3,
+    "Error": 0
+  }
+}

tools/render_report.py

@@ -0,0 +1,80 @@
+#!/usr/bin/env python3
+"""Render audit evidence (JSON) as the text report printed by the collectors.
+
+Usage:
+    python3 tools/render_report.py audit-macos-host-20261007.json
+    python3 tools/render_report.py synthetic/out/evidence.jsonl --index 3
+
+Useful for synthetic records (which have no printed report) and for checking that
+collector output and evidence stay in sync. Standard library only.
+"""
+import argparse
+import json
+from datetime import datetime
+
+LINE = "=" * 60
+SECTIONS = [("baseline", None), ("gdpr", "GDPR TECHNICAL CONTROLS"), ("aiact", "EU AI ACT CONTROLS"), ("org", "ORGANISATIONAL CONTROLS")]
+LAYOUT = {
+    "windows": {"title": "WINDOWS ENDPOINT SECURITY BASELINE - AUDIT", "results": "COMPLIANCE RESULTS",
+                "end": "END OF READ-ONLY AUDIT", "blank_before_sections": True,
+                "fields": [("Hostname", "hostname"), ("Operating System", "os_name"), ("OS Version", "os_version"), ("Build", "build"),
+                           ("Serial Number", "serial_number"), ("Execution User", None), ("Audit Date", None), ("Audit Mode", None)]},
+    "linux": {"title": "LINUX ENDPOINT SECURITY BASELINE - AUDIT", "results": "LINUX ENDPOINT SECURITY BASELINE - RESULTS",
+              "end": "END OF LINUX ENDPOINT SECURITY BASELINE AUDIT", "blank_before_sections": False,
+              "fields": [("Hostname", "hostname"), ("Operating System", "os_name"), ("OS Version", "os_version"), ("Kernel", "kernel"),
+                         ("Serial Number", "serial_number"), ("Execution User", None), ("Audit Date", None), ("Audit Mode", None)]},
+    "macos": {"title": "macOS ENDPOINT SECURITY BASELINE - AUDIT", "results": "COMPLIANCE RESULTS",
+              "end": "END OF AUDIT", "blank_before_sections": False,
+              "fields": [("Hostname", "hostname"), ("Operating System", "os_name"), ("OS Version", "os_version"), ("Build", "build"),
+                         ("Serial Number", "serial_number"), ("Execution User", None), ("Audit Date", None), ("Audit Mode", None)]},
+}
+
+
+def audit_date(record, os_family):
+    started = datetime.fromisoformat(record["audit"]["started_at"])
+    text = started.strftime("%Y-%m-%d %H:%M:%S")
+    # Linux/macOS collectors print the time zone abbreviation, which the ISO offset cannot recover exactly.
+    return text if os_family == "windows" else f"{text} {record.get('_tz', started.strftime('%z'))}"
+
+
+def render(record):
+    os_family = record["host"]["os_family"]
+    layout = LAYOUT[os_family]
+    out = [LINE, f" {layout['title']}", LINE]
+    for label, key in layout["fields"]:
+        if key:
+            value = record["host"].get(key, "")
+        elif label == "Execution User":
+            value = record["audit"]["execution_user"]
+        elif label == "Audit Date":
+            value = audit_date(record, os_family)
+        else:
+            value = record["audit"]["mode"]
+        out.append(f"{label:<16}: {value}")
+    out.append(LINE)
+    for section, title in SECTIONS:
+        if layout["blank_before_sections"]:
+            out.append("")
+        out += [LINE, f" {title or layout['results']}", LINE]
+        for result in record["results"]:
+            if result["section"] == section:
+                out += [result["name"], result["status"]]
+    out += [LINE, f" {layout['end']}", LINE]
+    return "\n".join(out)
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
+    parser.add_argument("path")
+    parser.add_argument("--index", type=int, default=0, help="record number in a .jsonl file (0-based)")
+    args = parser.parse_args()
+    with open(args.path, encoding="utf-8-sig") as handle:
+        if args.path.endswith(".jsonl"):
+            record = json.loads(handle.readlines()[args.index])
+        else:
+            record = json.load(handle)
+    print(render(record))
+
+
+if __name__ == "__main__":
+    main()

tools/validate_evidence.py

@@ -0,0 +1,129 @@
+#!/usr/bin/env python3
+"""Validate audit evidence (collector or synthetic) against the schema rules and the check catalog.
+
+Usage:
+    python3 tools/validate_evidence.py audit-macos-host-20261007.json
+    python3 tools/validate_evidence.py synthetic/out/evidence.jsonl
+
+Accepts .json (one record) or .jsonl (one record per line). Exit code 1 if any record is invalid.
+Standard library only.
+"""
+import json
+import os
+import sys
+
+ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+REQUIRED = {"schema_version", "catalog_version", "source", "audit", "host", "baseline", "results", "summary"}
+RESULT_KEYS = {"id", "section", "name", "status", "actual", "expected"}
+OPTIONAL_RESULT_KEYS = {"detail"}
+
+
+def load_catalog():
+    with open(os.path.join(ROOT, "catalog", "checks.json"), encoding="utf-8") as handle:
+        catalog = json.load(handle)
+    return catalog, {c["id"]: c for c in catalog["checks"]}
+
+
+def validate(record, catalog, checks):
+    errors = []
+    missing = REQUIRED - record.keys()
+    extra = record.keys() - REQUIRED
+    if missing:
+        errors.append(f"missing top-level keys: {sorted(missing)}")
+    if extra:
+        errors.append(f"unexpected top-level keys: {sorted(extra)}")
+    if errors:
+        return errors
+    if record["schema_version"] != "1.0":
+        errors.append(f"schema_version {record['schema_version']!r} != '1.0'")
+    if record["catalog_version"] != catalog["catalog_version"]:
+        errors.append(f"catalog_version {record['catalog_version']} != {catalog['catalog_version']}")
+    if record["source"].get("kind") not in ("collector", "synthetic"):
+        errors.append("source.kind must be collector or synthetic")
+    os_family = record["host"].get("os_family")
+    if os_family not in ("windows", "linux", "macos"):
+        errors.append(f"host.os_family invalid: {os_family!r}")
+        return errors
+    if record["source"].get("collector") != os_family:
+        errors.append("source.collector does not match host.os_family")
+    if record["audit"].get("mode") != "READ-ONLY":
+        errors.append("audit.mode must be READ-ONLY")
+    if not isinstance(record["audit"].get("is_admin"), bool):
+        errors.append("audit.is_admin must be true/false")
+    for key in ("hostname", "os_name", "os_version"):
+        if not record["host"].get(key):
+            errors.append(f"host.{key} is empty")
+    if not all(isinstance(v, str) for v in record["baseline"].values()):
+        errors.append("baseline values must all be strings")
+
+    seen = set()
+    for index, result in enumerate(record["results"]):
+        where = f"results[{index}]"
+        keys = set(result.keys())
+        if not RESULT_KEYS <= keys:
+            errors.append(f"{where}: missing {sorted(RESULT_KEYS - keys)}")
+            continue
+        if keys - RESULT_KEYS - OPTIONAL_RESULT_KEYS:
+            errors.append(f"{where}: unexpected keys {sorted(keys - RESULT_KEYS - OPTIONAL_RESULT_KEYS)}")
+        check_id = result["id"]
+        if check_id in seen:
+            errors.append(f"{where}: duplicate id {check_id}")
+        seen.add(check_id)
+        check = checks.get(check_id)
+        if not check:
+            errors.append(f"{where}: unknown check id {check_id}")
+            continue
+        if os_family not in check["os"]:
+            errors.append(f"{where}: {check_id} does not apply to {os_family}")
+        if result["section"] != check["section"]:
+            errors.append(f"{where}: {check_id} section {result['section']} != {check['section']}")
+        expected_name = check.get("names", {}).get(os_family, check["name"])
+        if result["name"] != expected_name:
+            errors.append(f"{where}: {check_id} name {result['name']!r} != catalog {expected_name!r}")
+        if result["status"] not in catalog["statuses"]:
+            errors.append(f"{where}: {check_id} invalid status {result['status']!r}")
+        for key in ("actual", "expected") + (("detail",) if "detail" in result else ()):
+            if not isinstance(result[key], str):
+                errors.append(f"{where}: {check_id}.{key} must be a string")
+
+    expected_ids = {c["id"] for c in catalog["checks"] if os_family in c["os"]}
+    if seen != expected_ids:
+        if expected_ids - seen:
+            errors.append(f"checks missing for {os_family}: {sorted(expected_ids - seen)}")
+        if seen - expected_ids:
+            errors.append(f"checks not expected for {os_family}: {sorted(seen - expected_ids)}")
+
+    counts = {s: sum(1 for r in record["results"] if r.get("status") == s) for s in catalog["statuses"]}
+    if record["summary"] != counts:
+        errors.append(f"summary {record['summary']} != counted {counts}")
+    return errors
+
+
+def read_records(path):
+    with open(path, encoding="utf-8-sig") as handle:
+        if path.endswith(".jsonl"):
+            return [json.loads(line) for line in handle if line.strip()]
+        return [json.load(handle)]
+
+
+def main():
+    if len(sys.argv) < 2:
+        print(__doc__)
+        return 2
+    catalog, checks = load_catalog()
+    total = bad = 0
+    for path in sys.argv[1:]:
+        for number, record in enumerate(read_records(path), 1):
+            total += 1
+            errors = validate(record, catalog, checks)
+            if errors:
+                bad += 1
+                print(f"INVALID {path} record {number}:")
+                for error in errors[:20]:
+                    print(f"  - {error}")
+    print(f"{total - bad}/{total} records valid")
+    return 1 if bad else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())