v0.3: phone check (iPhone, Android) as the Space front page, catalog 0.3 (74 checks), shared vulnerability rules, real-CVE training data

.gitignore

@@ -15,3 +15,5 @@ synthetic/out-v0.2/
 training/out-v0.2/
 vulndb/cache/
 vulndb/out/
+synthetic/out-v0.3/
+training/out-v0.3/

README.md

@@ -151,6 +151,20 @@ npm start                           # run the app
 
 Offline fine-tuning on CPU: `training/train_lora.py` (LoRA on Qwen2.5-0.5B-Instruct; see `--benchmark` and `--resume`).
 
+## Phone check (iPhone, iPad, Android)
+
+The Space's front page (`index.html`) is a phone self-check that runs entirely in the browser:
+
+1. **Detects** what a browser can see: OS and version (Safari 26+ hides the iOS version in its user agent, so Safari's own version is used; Android uses client hints), device model (Android), browser, whether a device unlock method is set up (WebAuthn), and WebGPU support.
+2. **Asks** the rest, one question at a time with *where to look* in Settings (`catalog/mobile_questions.json`). Every result is labelled `detected` or `self-reported` in the evidence and the report.
+3. **Matches** the iOS version against the signed phone subset of the vulnerability bundle (55 KB, signature checked with WebCrypto).
+4. **Writes** the findings with the same auditor model in WebLLM (about 350 MB download, roughly 1 GB of GPU memory, so newer phones) or with the built-in writer, and builds the same report as the desktop app.
+5. **Saves or shares** the report as a PDF (share sheet or download). Phones do not allow a silent auto-save.
+
+`mobile/mobile-core.js` turns detections and answers into evidence; the synthetic generator calls the same code through `mobile/build-evidence.mjs`, so training data has exactly the page's wording. Organisation answers can be passed in the link: `index.html#org=<base64 JSON {"ORG_ROPA": "yes", ...}>`.
+
+Test without a phone: serve the repo (`python3 -m http.server 8765`) and run `app/node_modules/.bin/electron mobile/test/e2e.cjs ios out.json` (or `android`); it answers every question in a phone-sized window with a phone user agent and builds the PDF; then check the evidence with `python3 tools/validate_evidence.py out.json`.
+
 ## Vulnerability matching (offline)
 
 `vuln.known_vulnerabilities` is decided by exact version comparison, never by the model:
@@ -165,10 +179,11 @@ Devseis builds the bundle with `python3 vulndb/build_bundle.py` (needs internet;
 
 | Part | Version | Notes |
 |---|---|---|
-| Catalog, library, synthetic data, training data | **0.2** | 68 checks: adds signed-in user account type, USB device access, pending security updates, outdated apps, known vulnerabilities, Windows screen lock line; screen lock limit 5 minutes |
-| Collectors (Windows, Linux, macOS) | **0.2** | macOS tested on a real Mac; Linux tested on Ubuntu 24.04 and Fedora 42 containers; Windows parse-checked only (needs a real Windows test). Known vulnerabilities: inventory only, matching comes with the offline vulnerability bundle |
+| Catalog, library, synthetic data, training data | **0.3** | 74 checks: Windows 64, Linux 56, macOS 56, iPhone 29, Android 30. 0.3 adds phones, real CVEs in training data and wording identical to the collectors and the phone page; 39,500 grounded examples |
+| Collectors (Windows, Linux, macOS) | **0.2** (catalog 0.3) | macOS tested on a real Mac; Linux tested on Ubuntu 24.04 and Fedora 42 containers; Windows parse-checked only (needs a real Windows test). Known vulnerabilities: inventory only, matching comes with the offline vulnerability bundle |
 | Vulnerability matcher and bundle | 0.1 | Tested: this Mac (Chrome 154 → 58 critical/high, fixed in 155), Ubuntu 24.04 (OpenSSL), Rocky 9 (25 of 25 packages agree with dnf's own security list), Fedora reported as not covered |
-| Fine-tuned model | training on 0.1 data | First run in progress on CPU |
+| Phone check (web) | **0.3** | Tested in a phone-sized window as iPhone (Safari 26) and Android (Chrome 141); needs testing on real phones |
+| Fine-tuned model | training on 0.1 data | First run in progress on CPU; next run on 0.3 data |
 
 ## Test status (collector version 0.1.0)
 

about.html

@@ -0,0 +1,161 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Devseis Endpoint Auditor</title>
+<meta name="description" content="Read-only endpoint audit for ISO 27001, GDPR and the EU AI Act. Stage 1, step 1: collectors, evidence format and synthetic data.">
+<style>
+  :root {
+    --bg: #f7f8fb; --card: #ffffff; --text: #16181d; --muted: #5b6270; --line: #e3e6ec;
+    --red: #ED2939; --blue: #00A1DE; --ok: #1a7f37; --bad: #c4242f; --na: #6e7781; --pending: #9a6700; --err: #8250df;
+    --code-bg: #0f1218; --code-text: #e6edf3;
+  }
+  @media (prefers-color-scheme: dark) {
+    :root:not([data-theme="light"]) {
+      --bg: #0d1117; --card: #161b22; --text: #e6edf3; --muted: #9da7b3; --line: #2b313a;
+      --ok: #3fb950; --bad: #ff6b6b; --na: #8b949e; --pending: #d29922; --err: #b392f0; --code-bg: #0a0d12;
+    }
+  }
+  * { box-sizing: border-box; }
+  body { margin: 0; background: var(--bg); color: var(--text); font: 16px/1.55 system-ui, -apple-system, "Segoe UI", Roboto, sans-serif; }
+  main { max-width: 1040px; margin: 0 auto; padding: 32px 16px 64px; }
+  .tag { display: inline-block; font-size: 12px; font-weight: 600; letter-spacing: .04em; text-transform: uppercase; color: var(--red); border: 1px solid var(--red); border-radius: 999px; padding: 2px 10px; }
+  h1 { font-size: clamp(28px, 5vw, 40px); line-height: 1.15; margin: 14px 0 8px; }
+  h2 { font-size: 20px; margin: 36px 0 12px; }
+  p.lead { color: var(--muted); font-size: 18px; max-width: 760px; margin: 0; }
+  .grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(220px, 1fr)); gap: 12px; margin-top: 20px; }
+  .card { background: var(--card); border: 1px solid var(--line); border-radius: 12px; padding: 16px; }
+  .card b { display: block; font-size: 15px; margin-bottom: 4px; }
+  .card span { color: var(--muted); font-size: 14px; }
+  .tabs { display: flex; gap: 8px; flex-wrap: wrap; margin: 12px 0; }
+  .tabs button { font: inherit; font-size: 14px; padding: 6px 14px; border-radius: 999px; border: 1px solid var(--line); background: var(--card); color: var(--text); cursor: pointer; }
+  .tabs button[aria-selected="true"] { background: var(--blue); border-color: var(--blue); color: #fff; }
+  .counts { display: flex; gap: 8px; flex-wrap: wrap; margin-bottom: 12px; }
+  .pill { font-size: 13px; font-weight: 600; padding: 3px 10px; border-radius: 999px; background: var(--card); border: 1px solid var(--line); }
+  .s-Compliant { color: var(--ok); } .s-Non-Compliant { color: var(--bad); } .s-NotApplicable { color: var(--na); }
+  .s-Pending { color: var(--pending); } .s-Error { color: var(--err); }
+  .split { display: grid; grid-template-columns: minmax(0, 1fr) minmax(0, 1.25fr); gap: 12px; }
+  @media (max-width: 760px) { .split { grid-template-columns: 1fr; } }
+  pre { margin: 0; background: var(--code-bg); color: var(--code-text); border-radius: 12px; padding: 14px; font: 12.5px/1.45 ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; overflow: auto; max-height: 560px; }
+  table { width: 100%; border-collapse: collapse; font-size: 13.5px; }
+  .table-wrap { background: var(--card); border: 1px solid var(--line); border-radius: 12px; overflow: auto; max-height: 560px; }
+  th, td { text-align: left; padding: 7px 10px; border-bottom: 1px solid var(--line); vertical-align: top; }
+  th { position: sticky; top: 0; background: var(--card); font-size: 12px; text-transform: uppercase; letter-spacing: .03em; color: var(--muted); }
+  td.ref { color: var(--muted); font-size: 12.5px; }
+  code { font: 13px ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; background: var(--card); border: 1px solid var(--line); border-radius: 6px; padding: 1px 6px; }
+  .note { border-left: 4px solid var(--red); background: var(--card); padding: 12px 16px; border-radius: 0 12px 12px 0; color: var(--muted); }
+  ol li { margin: 4px 0; }
+  a { color: var(--blue); }
+  footer { margin-top: 48px; color: var(--muted); font-size: 14px; }
+</style>
+</head>
+<body>
+<main>
+  <span class="tag">Open source · stage 1</span>
+  <h1>Devseis Endpoint Auditor</h1>
+  <p class="lead">A read-only audit of Windows, Linux, macOS, iPhone and Android devices against a security baseline, GDPR technical controls, EU AI Act controls and organisational controls, written up by a small AI auditor model that runs on the device. <a href="index.html">Check your phone now</a>.</p>
+
+  <div class="grid">
+    <div class="card"><b>Read-only collectors</b><span>PowerShell, Linux shell and macOS shell scripts. They read settings and never change the system.</span></div>
+    <div class="card"><b>One evidence format</b><span>Same JSON for every OS, joined to a catalog with ISO 27001, GDPR and AI Act references.</span></div>
+    <div class="card"><b>Synthetic data</b><span>Realistic evidence with the same rules, so the auditor model can be built before real data exists.</span></div>
+    <div class="card"><b>Runs locally</b><span>Evidence stays on the device. Nothing is sent anywhere.</span></div>
+    <div class="card"><b>Offline vulnerability matching</b><span>Installed software is matched against a signed OSV/NVD/CISA KEV bundle by exact version rules.</span></div>
+    <div class="card"><b>Phones too</b><span>A browser check for iPhone and Android: what the browser can detect plus guided questions, each result labelled detected or self-reported.</span></div>
+  </div>
+
+  <h2>Sample audit (synthetic)</h2>
+  <div class="tabs" role="tablist" id="tabs"></div>
+  <div class="counts" id="counts"></div>
+  <div class="split">
+    <pre id="report" aria-label="Text report">Loading…</pre>
+    <div class="table-wrap">
+      <table>
+        <thead><tr><th>Check</th><th>Status</th><th>Found</th><th>References</th></tr></thead>
+        <tbody id="rows"></tbody>
+      </table>
+    </div>
+  </div>
+
+  <h2>Roadmap</h2>
+  <ol>
+    <li><b>Collectors, evidence format, catalog (74 checks), synthetic data</b> — done</li>
+    <li><b>Control library and fix guidance</b> in Devseis's own wording — done; expert review welcome</li>
+    <li><b>Training data</b> v0.3: 39,500 grounded examples for Windows, Linux, macOS, iPhone and Android — done</li>
+    <li><b>Offline vulnerability matching</b> (OSV, NVD, CISA KEV, EPSS), signed bundle — done</li>
+    <li><b>Desktop app</b> (Electron + WebLLM) and <b>phone check</b> (this Space) — done, with the base model</li>
+    <li>Fine-tune Qwen2.5-0.5B-Instruct on this Mac (CPU, LoRA) — in progress</li>
+    <li>Evaluate on held-out data, publish the scores and the model</li>
+    <li>Installers per OS; tests on real Windows and Linux machines</li>
+  </ol>
+
+  <p class="note">Not a certification. ISO 27001 certification needs an accredited auditor, and much of GDPR and AI Act compliance is organisational. The tool collects evidence and flags gaps. See the <a href="README.md">README</a> for how to run the collectors.</p>
+
+  <footer>Open source by Devseis: code Apache-2.0, data CC BY 4.0 · <a href="https://huggingface.co/datasets/Devseis/endpoint-auditor-synthetic">training data</a> · <a href="https://huggingface.co/datasets/Devseis/endpoint-auditor-vulndb">vulnerability data</a> · <a href="CITATION.cff">cite</a></footer>
+</main>
+<script>
+const SAMPLES = Object.fromEntries(['windows', 'linux', 'macos', 'ios', 'android'].map(os => [os, `synthetic/samples/synthetic-${os}-42000126.json`]));
+const LABELS = { windows: 'Windows', linux: 'Linux', macos: 'macOS', ios: 'iPhone', android: 'Android' };
+const LAYOUT = {
+  windows: { title: 'WINDOWS ENDPOINT SECURITY BASELINE - AUDIT', results: 'COMPLIANCE RESULTS', end: 'END OF READ-ONLY AUDIT', blank: true, extra: ['Build', 'build'] },
+  linux: { title: 'LINUX ENDPOINT SECURITY BASELINE - AUDIT', results: 'LINUX ENDPOINT SECURITY BASELINE - RESULTS', end: 'END OF LINUX ENDPOINT SECURITY BASELINE AUDIT', blank: false, extra: ['Kernel', 'kernel'] },
+  macos: { title: 'macOS ENDPOINT SECURITY BASELINE - AUDIT', results: 'COMPLIANCE RESULTS', end: 'END OF AUDIT', blank: false, extra: ['Build', 'build'] },
+  ios: { title: 'iPHONE SECURITY CHECK (BROWSER)', results: 'COMPLIANCE RESULTS', end: 'END OF PHONE CHECK', blank: false, extra: ['Browser', 'browser'] },
+  android: { title: 'ANDROID SECURITY CHECK (BROWSER)', results: 'COMPLIANCE RESULTS', end: 'END OF PHONE CHECK', blank: false, extra: ['Browser', 'browser'] },
+};
+const SECTIONS = [['baseline', null], ['gdpr', 'GDPR TECHNICAL CONTROLS'], ['aiact', 'EU AI ACT CONTROLS'], ['org', 'ORGANISATIONAL CONTROLS']];
+let catalog = null;
+
+function render(rec) {
+  const L = LAYOUT[rec.host.os_family], line = '='.repeat(60), pad = s => (s + ' '.repeat(16)).slice(0, 16);
+  const out = [line, ' ' + L.title, line,
+    pad('Hostname') + ': ' + rec.host.hostname, pad('Operating System') + ': ' + rec.host.os_name,
+    pad('OS Version') + ': ' + rec.host.os_version, pad(L.extra[0]) + ': ' + (rec.host[L.extra[1]] || ''),
+    pad('Serial Number') + ': ' + (rec.host.serial_number || ''), pad('Execution User') + ': ' + rec.audit.execution_user,
+    pad('Audit Date') + ': ' + rec.audit.started_at.replace('T', ' ').slice(0, 19), pad('Audit Mode') + ': ' + rec.audit.mode, line];
+  for (const [id, title] of SECTIONS) {
+    if (L.blank) out.push('');
+    out.push(line, ' ' + (title || L.results), line);
+    for (const r of rec.results) if (r.section === id) out.push(r.name, r.status + (r.evidence ? ` (${r.evidence})` : ''));
+  }
+  out.push(line, ' ' + L.end, line);
+  return out.join('\n');
+}
+
+function refs(id) {
+  const c = catalog && catalog.checks.find(x => x.id === id);
+  if (!c) return '';
+  return [...c.controls.iso27001.map(x => 'ISO ' + x), ...c.controls.gdpr.map(x => 'GDPR ' + x), ...c.controls.ai_act.map(x => 'AI Act ' + x)].join(' · ');
+}
+
+function esc(s) { const d = document.createElement('div'); d.textContent = s; return d.innerHTML; }
+
+async function show(os) {
+  document.querySelectorAll('#tabs button').forEach(b => b.setAttribute('aria-selected', String(b.dataset.os === os)));
+  try {
+    const rec = await (await fetch(SAMPLES[os])).json();
+    document.getElementById('report').textContent = render(rec);
+    document.getElementById('counts').innerHTML = Object.entries(rec.summary)
+      .map(([k, v]) => `<span class="pill s-${k}">${v} ${k}</span>`).join('');
+    document.getElementById('rows').innerHTML = rec.results.map(r =>
+      `<tr><td>${esc(r.name)}</td><td class="s-${r.status}"><b>${r.status}</b></td><td>${esc(r.actual)}</td><td class="ref">${esc(refs(r.id))}</td></tr>`).join('');
+  } catch (e) {
+    document.getElementById('report').textContent = 'Could not load the sample: ' + e.message;
+  }
+}
+
+(async () => {
+  try { catalog = await (await fetch('catalog/checks.json')).json(); } catch (e) { catalog = null; }
+  const tabs = document.getElementById('tabs');
+  for (const os of Object.keys(SAMPLES)) {
+    const b = document.createElement('button');
+    b.textContent = LABELS[os]; b.dataset.os = os; b.setAttribute('role', 'tab');
+    b.addEventListener('click', () => show(os));
+    tabs.appendChild(b);
+  }
+  show('windows');
+})();
+</script>
+</body>
+</html>

app/renderer/auditor-core.js

@@ -58,6 +58,12 @@ const deviceLine = record => `${record.host.os_name} ${record.host.os_version} (
 const sentence = text => { const t = text.trim(); return !t || /[.!?]$/.test(t) ? t : `${t}.`; };
 
 // --- Task A: finding ----------------------------------------------------------
+export const EVIDENCE_TEXT = { 'self-reported': 'self-reported by the user', detected: 'detected by the browser' };
+export const SELF_REPORTED = 'Self-reported by the user, not verified on the device.';
+export function evidenceCounts(results) {
+  return [results.filter(r => r.evidence === 'detected').length, results.filter(r => r.evidence === 'self-reported').length];
+}
+
 export function findingPrompt(record, result, lib) {
   const osFamily = record.host.os_family;
   const baseline = record.baseline;
@@ -72,6 +78,7 @@ export function findingPrompt(record, result, lib) {
     `REQUIRED: ${result.expected}`,
   ];
   if (result.detail) lines.push(`DETAIL: ${result.detail}`);
+  if (result.evidence) lines.push(`EVIDENCE: ${EVIDENCE_TEXT[result.evidence]}`);
   lines.push('REFERENCES:');
   for (const [label, title, summary] of lib.references(result.id)) lines.push(`- ${label} ${title}: ${summary}`);
   lines.push('GUIDANCE:');
@@ -126,8 +133,10 @@ export function findingTemplate(record, result, lib) {
     risk = { level: 'None', reason: 'Not applicable to this device.' };
     recommendation = [];
   }
+  if (result.evidence === 'self-reported') finding = `${finding.replace('The device reports', 'The user reports')} ${SELF_REPORTED}`;
   const answer = { check_id: result.id, status, title, finding: finding.trim(), risk, recommendation, references };
   if (verification) answer.verification = verification;
+  if (result.evidence) answer.evidence = result.evidence;
   return answer;
 }
 
@@ -142,7 +151,10 @@ export function summaryPrompt(record, lib) {
   const { results, summary, host } = record;
   const lines = ['TASK: summary', `DEVICE: ${deviceLine(record)}`, `HOSTNAME: ${host.hostname}`,
     `AUDIT RUN AS ADMIN: ${record.audit.is_admin ? 'yes' : 'no'}`,
-    'COUNTS: ' + Object.entries(summary).map(([k, v]) => `${k}=${v}`).join(', '), 'RESULTS (id | name | status | found):'];
+    'COUNTS: ' + Object.entries(summary).map(([k, v]) => `${k}=${v}`).join(', ')];
+  const [detected, reported] = evidenceCounts(results);
+  if (detected || reported) lines.push(`EVIDENCE: ${detected} detected by the browser, ${reported} self-reported by the user`);
+  lines.push('RESULTS (id | name | status | found):');
   for (const r of results) lines.push(`- ${r.id} | ${r.name} | ${r.status} | ${r.actual}`);
   lines.push('RISK LEVELS (from guidance):');
   for (const r of results.filter(x => x.status === 'Non-Compliant')) lines.push(`- ${r.id}: ${lib.guide(r.id).risk.level}`);
@@ -172,6 +184,8 @@ export function summaryTemplate(record, lib) {
   }
   if (summary.Error) text += ` ${summary.Error} checks could not be read` + (record.audit.is_admin ? '.' : ' because the audit was not run as administrator.');
   if (summary.Pending) text += ` ${summary.Pending} items are pending.`;
+  const reported = evidenceCounts(results)[1];
+  if (reported) text += ` ${reported} results are self-reported by the user and were not verified on the device.`;
   const nextSteps = [];
   if (summary.Error) nextSteps.push('Re-run the audit as administrator/root so that every check can be read.');
   for (const r of ranked.slice(0, 3)) {

app/renderer/model-core.js

@@ -0,0 +1,47 @@
+// Loads the auditor model in WebLLM (runs on the device's GPU through WebGPU), for the desktop app and the phone page.
+// The model is downloaded once and cached by the browser, so later runs work offline.
+
+// Until the fine-tuned Devseis model is converted to MLC format and published, the matching base model
+// is used. To switch, set CUSTOM_MODEL to:
+//   { model: 'https://huggingface.co/Devseis/<repo>', model_id: 'devseis-auditor-0.5b-q4f16_1', model_lib: '<Qwen2.5-0.5B q4f16_1 WebGPU lib URL from prebuiltAppConfig>' }
+const CUSTOM_MODEL = null;
+// q4f16 needs 16-bit GPU maths (shader-f16); many older and integrated GPUs only support the q4f32 build.
+const BASE_MODEL = { f16: 'Qwen2.5-0.5B-Instruct-q4f16_1-MLC', f32: 'Qwen2.5-0.5B-Instruct-q4f32_1-MLC' };
+
+// webllm: the @mlc-ai/web-llm module (bundled in the app, from a CDN on the phone page).
+export async function loadModelWith(webllm, onProgress) {
+  const { CreateMLCEngine, prebuiltAppConfig } = webllm;
+  if (!('gpu' in navigator)) throw new Error('WebGPU is not available on this device.');
+  const adapter = await navigator.gpu.requestAdapter();
+  if (!adapter) throw new Error('No WebGPU-capable graphics adapter was found.');
+
+  let appConfig = prebuiltAppConfig;
+  let modelId;
+  if (CUSTOM_MODEL) {
+    appConfig = { ...prebuiltAppConfig, model_list: [...prebuiltAppConfig.model_list, CUSTOM_MODEL] };
+    modelId = CUSTOM_MODEL.model_id;
+  } else {
+    const wanted = adapter.features.has('shader-f16') ? BASE_MODEL.f16 : BASE_MODEL.f32;
+    const entry = prebuiltAppConfig.model_list.find(m => m.model_id === wanted);
+    if (!entry) throw new Error('The base model is not in this WebLLM version.');
+    modelId = entry.model_id;
+  }
+
+  const engine = await CreateMLCEngine(modelId, {
+    appConfig,
+    initProgressCallback: report => onProgress({ progress: report.progress, text: report.text }),
+  });
+  return {
+    name: modelId,
+    fineTuned: Boolean(CUSTOM_MODEL),
+    async generate(system, prompt) {
+      const reply = await engine.chat.completions.create({
+        messages: [{ role: 'system', content: system }, { role: 'user', content: prompt }],
+        temperature: 0,
+        max_tokens: 900,
+        response_format: { type: 'json_object' },
+      });
+      return reply.choices[0].message.content;
+    },
+  };
+}

app/renderer/model.js

@@ -1,46 +1,5 @@
-// Loads the auditor model in WebLLM (runs on this computer's GPU through WebGPU).
-// The model is downloaded once and cached by WebLLM, so later runs work offline.
-import { CreateMLCEngine, prebuiltAppConfig } from '../node_modules/@mlc-ai/web-llm/lib/index.js';
+// Desktop app: WebLLM from the app's own node_modules (works offline once the model is cached).
+import * as webllm from '../node_modules/@mlc-ai/web-llm/lib/index.js';
+import { loadModelWith } from './model-core.js';
 
-// Until the fine-tuned Devseis model is converted to MLC format and published, the matching base model
-// is used. To switch, set CUSTOM_MODEL to:
-//   { model: 'https://huggingface.co/Devseis/<repo>', model_id: 'devseis-auditor-0.5b-q4f16_1', model_lib: '<Qwen2.5-0.5B q4f16_1 WebGPU lib URL from prebuiltAppConfig>' }
-const CUSTOM_MODEL = null;
-// q4f16 needs 16-bit GPU maths (shader-f16); many older and integrated GPUs only support the q4f32 build.
-const BASE_MODEL = { f16: 'Qwen2.5-0.5B-Instruct-q4f16_1-MLC', f32: 'Qwen2.5-0.5B-Instruct-q4f32_1-MLC' };
-
-export async function loadModel(onProgress) {
-  if (!('gpu' in navigator)) throw new Error('WebGPU is not available on this computer.');
-  const adapter = await navigator.gpu.requestAdapter();
-  if (!adapter) throw new Error('No WebGPU-capable graphics adapter was found.');
-
-  let appConfig = prebuiltAppConfig;
-  let modelId;
-  if (CUSTOM_MODEL) {
-    appConfig = { ...prebuiltAppConfig, model_list: [...prebuiltAppConfig.model_list, CUSTOM_MODEL] };
-    modelId = CUSTOM_MODEL.model_id;
-  } else {
-    const wanted = adapter.features.has('shader-f16') ? BASE_MODEL.f16 : BASE_MODEL.f32;
-    const entry = prebuiltAppConfig.model_list.find(m => m.model_id === wanted);
-    if (!entry) throw new Error('The base model is not in this WebLLM version.');
-    modelId = entry.model_id;
-  }
-
-  const engine = await CreateMLCEngine(modelId, {
-    appConfig,
-    initProgressCallback: report => onProgress({ progress: report.progress, text: report.text }),
-  });
-  return {
-    name: modelId,
-    fineTuned: Boolean(CUSTOM_MODEL),
-    async generate(system, prompt) {
-      const reply = await engine.chat.completions.create({
-        messages: [{ role: 'system', content: system }, { role: 'user', content: prompt }],
-        temperature: 0,
-        max_tokens: 900,
-        response_format: { type: 'json_object' },
-      });
-      return reply.choices[0].message.content;
-    },
-  };
-}
+export const loadModel = onProgress => loadModelWith(webllm, onProgress);

app/renderer/report.js

@@ -10,6 +10,8 @@ export function buildReportHtml({ evidence, findings, summary, ai, sha256, model
   const host = evidence.host;
   const started = evidence.audit.started_at.replace('T', ' ').slice(0, 19);
   const counts = evidence.summary;
+  const phone = evidence.source.kind === 'web' || ['ios', 'android'].includes(host.os_family);
+  const EVIDENCE_LABEL = { detected: 'detected', 'self-reported': 'self-reported' };
 
   const sectionHtml = ['baseline', 'gdpr', 'aiact', 'org'].map(sectionId => {
     const rows = evidence.results.filter(r => r.section === sectionId).map(r => {
@@ -24,7 +26,8 @@ export function buildReportHtml({ evidence, findings, summary, ai, sha256, model
           <p class="refs">${f.references.map(esc).join(' · ')}</p>
         </td></tr>`;
       }
-      return `<tr><td>${esc(r.name)}</td><td>${badge(r.status, STATUS_COLOR[r.status])}</td><td>${esc(r.actual)}</td><td>${esc(r.expected)}</td></tr>${detail}`;
+      const source = r.evidence ? `<br><span class="muted">${esc(EVIDENCE_LABEL[r.evidence])}</span>` : '';
+      return `<tr><td>${esc(r.name)}${source}</td><td>${badge(r.status, STATUS_COLOR[r.status])}</td><td>${esc(r.actual)}</td><td>${esc(r.expected)}</td></tr>${detail}`;
     }).join('');
     return `<h2>${esc(SECTION_TITLES[sectionId])}</h2>
       <table><thead><tr><th style="width:30%">Check</th><th style="width:14%">Status</th><th>Found</th><th style="width:20%">Required</th></tr></thead><tbody>${rows}</tbody></table>`;
@@ -64,9 +67,11 @@ export function buildReportHtml({ evidence, findings, summary, ai, sha256, model
   <h1>${esc(host.hostname)}</h1>
   <div class="meta">
     <b>Operating system</b><span>${esc(host.os_name)} ${esc(host.os_version)}${host.build ? ` (build ${esc(host.build)})` : ''}</span>
-    <b>Serial number</b><span>${esc(host.serial_number || '')}</span>
+    ${phone ? `<b>Device</b><span>${esc(host.device_model || '')}</span>
+    <b>Browser</b><span>${esc(host.browser || '')}</span>` : `<b>Serial number</b><span>${esc(host.serial_number || '')}</span>`}
     <b>Audit date</b><span>${esc(started)}</span>
-    <b>Run as</b><span>${esc(evidence.audit.execution_user)}${evidence.audit.is_admin ? ' (administrator)' : ' (not administrator — some checks could not be read)'}</span>
+    ${phone ? `<b>Checked by</b><span>Phone self-check in the browser: ${evidence.results.filter(r => r.evidence === 'detected').length} results detected, ${evidence.results.filter(r => r.evidence === 'self-reported').length} self-reported</span>`
+      : `<b>Run as</b><span>${esc(evidence.audit.execution_user)}${evidence.audit.is_admin ? ' (administrator)' : ' (not administrator — some checks could not be read)'}</span>`}
   </div>
   <div class="score"><div class="big">${summary.score.percent}%</div>
     <div>${summary.score.compliant} of ${summary.score.assessed} assessed checks compliant<br>
@@ -82,11 +87,15 @@ ${summary.top_gaps.length ? `<h2>TOP GAPS</h2><ul class="gaps">${summary.top_gap
 ${sectionHtml}
 ${aiHtml}
 
-<div class="note">This report records the settings found on this computer at the audit date and compares them with the
+<div class="note">${phone
+  ? `This report records what the browser detected on this phone and the answers given by its user at the audit date, and compares them with the
+Devseis baseline. Results marked self-reported were not verified on the device; a browser cannot read a phone's security settings.
+It supports ISO 27001 internal audits, GDPR Article 32 and EU AI Act deployer duties; it is not a certification and not legal advice.`
+  : `This report records the settings found on this computer at the audit date and compares them with the
 Devseis baseline. It supports ISO 27001 internal audits, GDPR Article 32 and EU AI Act deployer duties; it is not a
-certification and not legal advice. Organisational controls reflect the answers given in organisational.conf.</div>
+certification and not legal advice. Organisational controls reflect the answers given in organisational.conf.`}</div>
 <div class="foot">Evidence SHA-256: ${esc(sha256)}<br>
 Findings written by: ${esc(model || 'built-in report writer')} (${sources.model} by the AI model, ${sources.template} by the built-in writer)<br>
-Collector ${esc(evidence.source.collector)} ${esc(evidence.source.collector_version)} · catalog ${esc(evidence.catalog_version)}</div>
+${phone ? 'Phone self-check' : 'Collector'} ${esc(evidence.source.collector)} ${esc(evidence.source.collector_version)} · catalog ${esc(evidence.catalog_version)}</div>
 </body></html>`;
 }

app/renderer/vuln-core.js

@@ -0,0 +1,228 @@
+// Vulnerability matching rules shared by the desktop app (vulndb.cjs) and the phone web check.
+// Pure functions only: no file, network or DOM access, so it runs in Node and in browsers.
+// Matching is exact version comparison; the language model never decides whether a CVE applies.
+export const MAX_AGE_DAYS = 14;
+const SEVERE = new Set(['critical', 'high']);
+
+// --- Version comparison ----------------------------------------------------------------------
+// Debian policy 5.6.12: [epoch:]upstream[-revision]; letters sort before non-letters, '~' before everything.
+function dpkgOrder(c) {
+  if (c === '~') return -1;
+  if (/\d/.test(c)) return 0;
+  if (!c) return 0;
+  if (/[A-Za-z]/.test(c)) return c.charCodeAt(0);
+  return c.charCodeAt(0) + 256;
+}
+function dpkgPart(a, b) {
+  let i = 0, j = 0;
+  while (i < a.length || j < b.length) {
+    let diff = 0;
+    while ((i < a.length && !/\d/.test(a[i])) || (j < b.length && !/\d/.test(b[j]))) {
+      const ac = dpkgOrder(a[i] || ''), bc = dpkgOrder(b[j] || '');
+      if (ac !== bc) return ac - bc;
+      i++; j++;
+    }
+    while (a[i] === '0') i++;
+    while (b[j] === '0') j++;
+    while (/\d/.test(a[i] || '') && /\d/.test(b[j] || '')) {
+      if (!diff) diff = a.charCodeAt(i) - b.charCodeAt(j);
+      i++; j++;
+    }
+    if (/\d/.test(a[i] || '')) return 1;
+    if (/\d/.test(b[j] || '')) return -1;
+    if (diff) return diff;
+  }
+  return 0;
+}
+function splitDeb(v) {
+  let epoch = 0, rest = v;
+  const colon = v.indexOf(':');
+  if (colon > 0) { epoch = parseInt(v.slice(0, colon), 10) || 0; rest = v.slice(colon + 1); }
+  const dash = rest.lastIndexOf('-');
+  return dash > 0 ? [epoch, rest.slice(0, dash), rest.slice(dash + 1)] : [epoch, rest, ''];
+}
+export function dpkgCompare(a, b) {
+  const [ea, ua, ra] = splitDeb(a), [eb, ub, rb] = splitDeb(b);
+  if (ea !== eb) return ea - eb;
+  return dpkgPart(ua, ub) || dpkgPart(ra, rb);
+}
+
+// rpmvercmp, with epoch:version-release handling.
+function rpmSegment(a, b) {
+  if (a === b) return 0;
+  const sa = a.match(/~|\^|[A-Za-z]+|\d+/g) || [], sb = b.match(/~|\^|[A-Za-z]+|\d+/g) || [];
+  for (let k = 0; k < Math.max(sa.length, sb.length); k++) {
+    const x = sa[k], y = sb[k];
+    if (x === '~' || y === '~') { if (x !== y) return x === '~' ? -1 : 1; continue; }
+    if (x === '^' || y === '^') {
+      if (x === undefined) return -1;
+      if (y === undefined) return 1;
+      if (x !== y) return x === '^' ? 1 : -1;
+      continue;
+    }
+    if (x === undefined) return -1;
+    if (y === undefined) return 1;
+    const xn = /^\d/.test(x), yn = /^\d/.test(y);
+    if (xn !== yn) return xn ? 1 : -1;
+    if (xn) {
+      const xs = x.replace(/^0+/, ''), ys = y.replace(/^0+/, '');
+      if (xs.length !== ys.length) return xs.length - ys.length;
+      if (xs !== ys) return xs < ys ? -1 : 1;
+    } else if (x !== y) return x < y ? -1 : 1;
+  }
+  return 0;
+}
+export function splitRpm(v) {
+  let epoch = 0, rest = v;
+  const colon = v.indexOf(':');
+  if (colon > 0) { epoch = parseInt(v.slice(0, colon), 10) || 0; rest = v.slice(colon + 1); }
+  const dash = rest.lastIndexOf('-');
+  return dash > 0 ? [epoch, rest.slice(0, dash), rest.slice(dash + 1)] : [epoch, rest, ''];
+}
+export function rpmCompare(a, b) {
+  const [ea, va, ra] = splitRpm(a), [eb, vb, rb] = splitRpm(b);
+  if (ea !== eb) return ea - eb;
+  return rpmSegment(va, vb) || rpmSegment(ra, rb);
+}
+
+// Desktop application versions: compare the numbers ("6.2.5 (42037)" -> 6.2.5.42037 is avoided by
+// cutting at the first space or parenthesis).
+function appNumbers(v) { return (String(v).split(/[\s(]/)[0].match(/\d+/g) || []).map(Number); }
+export function appCompare(a, b) {
+  const x = appNumbers(a), y = appNumbers(b);
+  for (let k = 0; k < Math.max(x.length, y.length); k++) {
+    const d = (x[k] || 0) - (y[k] || 0);
+    if (d) return d;
+  }
+  return 0;
+}
+
+// --- Matching ------------------------------------------------------------------------------------
+// Linux release key in the bundle, from the inventory's os-release fields.
+export function releaseKey(inventory) {
+  const id = String(inventory.distro_id || '').toLowerCase();
+  const version = String(inventory.version_id || '');
+  const major = version.split('.')[0];
+  if (id === 'ubuntu') return `ubuntu:${version}`;
+  if (id === 'debian') return `debian:${major}`;
+  if (id === 'rhel') return `rhel:${major}`;
+  if (id === 'almalinux') return `almalinux:${major}`;
+  if (id === 'rocky') return `rocky:${major}`;
+  return null;
+}
+
+export function matchLinux(inventory, bundle) {
+  const key = releaseKey(inventory);
+  const advisories = key && bundle.releases[key];
+  if (!advisories) return { covered: false, reason: `${inventory.pretty_name || inventory.distro_id || 'this distribution'} is not in the vulnerability data (covered: ${Object.keys(bundle.releases).join(', ')})` };
+  const deb = inventory.kind === 'deb';
+  const compare = deb ? dpkgCompare : rpmCompare;
+  // Group installed packages by source package: Debian/Ubuntu advisories name source packages; Red Hat-family
+  // advisories name binary packages, sometimes only the main one (openssl) when sub-packages (openssl-libs) are installed.
+  const installed = new Map();
+  for (const pkg of inventory.packages || []) {
+    const group = pkg.source || pkg.name;
+    const version = deb ? (pkg.source_version || pkg.version) : pkg.version;
+    const names = deb ? [group] : [pkg.name, group];
+    const prev = installed.get(group);
+    if (!prev) installed.set(group, { version, names: new Set(names) });
+    else {
+      names.forEach(n => prev.names.add(n));
+      if (compare(version, prev.version) > 0) prev.version = version;
+    }
+  }
+  const hits = [];
+  for (const [group, { version, names }] of installed) {
+    const seen = new Set();
+    for (const name of names) {
+      for (const [cves, advisory, fixed, severity] of advisories[name] || []) {
+        const key = `${cves}|${fixed}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        // Red Hat module streams: only compare within the same major version (nodejs 20 fix does not apply to nodejs 22).
+        if (!deb && /\.module[+_]/.test(fixed) && splitRpm(fixed)[1].split('.')[0] !== splitRpm(version)[1].split('.')[0]) continue;
+        if (compare(version, fixed) < 0) hits.push({ software: group, version, fixed, severity, cves: cves.split('|'), advisory });
+      }
+    }
+  }
+  return { covered: true, source: key, checked: installed.size, hits };
+}
+
+export function matchApps(inventory, bundle, osFamily) {
+  const hits = [];
+  const matched = new Set();
+  for (const app of inventory.apps || []) {
+    if (!app.version) continue;
+    for (const product of bundle.apps) {
+      const pattern = product[osFamily];
+      if (!pattern || !new RegExp(pattern, 'i').test(app.name)) continue;
+      matched.add(product.id);
+      for (const [cve, severity, si, se, ei, ee, exact] of product.cves) {
+        const c = bound => appCompare(app.version, bound);
+        const affected = exact ? c(exact) === 0
+          : (!si || c(si) >= 0) && (!se || c(se) > 0) && (!ei || c(ei) <= 0) && (!ee || c(ee) < 0);
+        if (affected) hits.push({ software: app.name, version: app.version, fixed: ee ? ee : '', severity, cves: [cve], advisory: '' });
+      }
+      break;
+    }
+  }
+  return { covered: true, source: 'nvd', checked: (inventory.apps || []).length, recognised: matched.size, hits };
+}
+
+// Group hits per software and CVE; flag actively exploited CVEs (CISA KEV) and likely ones (EPSS).
+export function summarise(result, bundle) {
+  const kev = new Set(bundle.kev);
+  const rank = { critical: 0, high: 1, medium: 2, low: 3, unknown: 4 };
+  const perCve = new Map();
+  for (const hit of result.hits) {
+    for (const cve of hit.cves) {
+      const id = `${hit.software}|${cve}`;
+      const prev = perCve.get(id);
+      if (!prev || rank[hit.severity] < rank[prev.severity]) perCve.set(id, { ...hit, cve, exploited: kev.has(cve), epss: bundle.epss[cve] || 0 });
+    }
+  }
+  const all = [...perCve.values()];
+  const severe = all.filter(h => SEVERE.has(h.severity) || h.exploited);
+  const bySoftware = new Map();
+  for (const h of severe) {
+    const s = bySoftware.get(h.software) || { software: h.software, version: h.version, fixed: '', cves: [], worst: 'unknown', exploited: false, epss: 0 };
+    s.cves.push(h.cve);
+    if (rank[h.severity] < rank[s.worst]) s.worst = h.severity;
+    s.exploited = s.exploited || h.exploited;
+    s.epss = Math.max(s.epss, h.epss);
+    if (h.fixed && (!s.fixed || appCompare(h.fixed, s.fixed) > 0 || /[~+]/.test(h.fixed))) s.fixed = h.fixed;
+    bySoftware.set(h.software, s);
+  }
+  const groups = [...bySoftware.values()].sort((a, b) => (b.exploited - a.exploited) || (rank[a.worst] - rank[b.worst]) || (b.cves.length - a.cves.length));
+  return { severeCount: new Set(severe.map(h => h.cve)).size, otherCount: new Set(all.filter(h => !severe.includes(h)).map(h => h.cve)).size, groups };
+}
+
+
+export function ageDays(isoDate, now) { return Math.floor((now - Date.parse(isoDate)) / 86400000); }
+
+// Turn a match into the vuln.known_vulnerabilities result fields (same wording on every platform).
+export function knownVulnResult(matched, inventory, loaded, osFamily, maxSevere, now = Date.now()) {
+  const { bundle, manifest } = loaded;
+  if (!matched.covered) return { status: 'Pending', actual: 'not covered', detail: `${matched.reason}.` };
+  const dataDate = manifest.built_at.slice(0, 10);
+  const age = ageDays(manifest.built_at, now);
+  const ageNote = age > MAX_AGE_DAYS ? ` Warning: the vulnerability data is ${age} days old; newer vulnerabilities are not included.` : '';
+  const s = summarise(matched, bundle);
+  const scope = osFamily === 'linux'
+    ? `${matched.checked} ${inventory.kind === 'deb' ? 'source packages' : 'packages'} checked against ${matched.source} advisories`
+    : osFamily === 'ios'
+      ? `${(inventory.apps || [])[0] ? inventory.apps[0].name + ' ' + inventory.apps[0].version : 'iOS'} checked against NVD iOS records`
+      : `${matched.checked} applications inventoried, ${matched.recognised} recognised (${bundle.apps.filter(a => a[osFamily]).length} common applications covered)`;
+  const listed = s.groups.slice(0, 5).map(g => {
+    const tags = [`${g.cves.length} CVE${g.cves.length > 1 ? 's' : ''}`, g.worst];
+    if (g.exploited) tags.push('actively exploited');
+    return `${g.software}${g.software.endsWith(g.version) ? '' : ` ${g.version}`} (${tags.join(', ')}${g.fixed ? `; fixed in ${g.fixed}` : ''}; e.g. ${g.cves.slice(0, 2).join(', ')})`;
+  });
+  return {
+    status: s.severeCount <= maxSevere ? 'Compliant' : 'Non-Compliant',
+    actual: `${s.severeCount} critical/high`,
+    detail: `Matched against offline OSV/NVD data from ${dataDate}. ${scope}.`
+      + (listed.length ? ` ${listed.join('; ')}${s.groups.length > 5 ? `; and ${s.groups.length - 5} more` : ''}.` : '')
+      + ` ${s.otherCount} medium/low.${ageNote}`,
+  };
+}

app/test/prompt-parity.mjs

@@ -9,7 +9,7 @@ const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '.
 const read = (...p) => JSON.parse(readFileSync(path.join(root, ...p), 'utf8'));
 const lib = new Library({ catalog: read('catalog', 'checks.json'), controls: read('library', 'controls.json'),
   guidance: read('library', 'check_guidance.json'), aiTools: read('library', 'ai_tools.json') });
-const evidence = readFileSync(path.join(root, 'synthetic', process.env.EVIDENCE_DIR || 'out-v0.2', 'evidence.jsonl'), 'utf8').trim().split('\n').slice(0, 30).map(JSON.parse);
+const evidence = readFileSync(path.join(root, 'synthetic', process.env.EVIDENCE_DIR || 'out-v0.3', 'evidence.jsonl'), 'utf8').trim().split('\n').slice(0, 60).map(JSON.parse);
 
 const python = execFileSync('python3', ['-c', `
 import json, os, sys
@@ -17,7 +17,7 @@ sys.path.insert(0, "training")
 import build_dataset as b
 lib = b.Library()
 out = []
-for line in list(open("synthetic/" + os.environ.get("EVIDENCE_DIR", "out-v0.2") + "/evidence.jsonl"))[:30]:
+for line in list(open("synthetic/" + os.environ.get("EVIDENCE_DIR", "out-v0.3") + "/evidence.jsonl"))[:60]:
     r = json.loads(line)
     item = {"findings": [b.build_finding(r, x, lib, __import__("random").Random(0))[0] for x in r["results"]],
             "summary": b.build_summary(r, lib)[0]}

app/vulndb.cjs

@@ -10,103 +10,8 @@ const zlib = require('node:zlib');
 
 // Ed25519 public key that signs bundles (private key stays with Devseis, outside the repository).
 const PUBLIC_KEY_FILE = path.join(__dirname, 'vulndb-public-key.pem');
-// Where clients download bundles from; null until the bundle is hosted publicly.
-const VULNDB_URL = null;
-const MAX_AGE_DAYS = 14;
-const SEVERE = new Set(['critical', 'high']);
-
-// --- Version comparison ----------------------------------------------------------------------
-// Debian policy 5.6.12: [epoch:]upstream[-revision]; letters sort before non-letters, '~' before everything.
-function dpkgOrder(c) {
-  if (c === '~') return -1;
-  if (/\d/.test(c)) return 0;
-  if (!c) return 0;
-  if (/[A-Za-z]/.test(c)) return c.charCodeAt(0);
-  return c.charCodeAt(0) + 256;
-}
-function dpkgPart(a, b) {
-  let i = 0, j = 0;
-  while (i < a.length || j < b.length) {
-    let diff = 0;
-    while ((i < a.length && !/\d/.test(a[i])) || (j < b.length && !/\d/.test(b[j]))) {
-      const ac = dpkgOrder(a[i] || ''), bc = dpkgOrder(b[j] || '');
-      if (ac !== bc) return ac - bc;
-      i++; j++;
-    }
-    while (a[i] === '0') i++;
-    while (b[j] === '0') j++;
-    while (/\d/.test(a[i] || '') && /\d/.test(b[j] || '')) {
-      if (!diff) diff = a.charCodeAt(i) - b.charCodeAt(j);
-      i++; j++;
-    }
-    if (/\d/.test(a[i] || '')) return 1;
-    if (/\d/.test(b[j] || '')) return -1;
-    if (diff) return diff;
-  }
-  return 0;
-}
-function splitDeb(v) {
-  let epoch = 0, rest = v;
-  const colon = v.indexOf(':');
-  if (colon > 0) { epoch = parseInt(v.slice(0, colon), 10) || 0; rest = v.slice(colon + 1); }
-  const dash = rest.lastIndexOf('-');
-  return dash > 0 ? [epoch, rest.slice(0, dash), rest.slice(dash + 1)] : [epoch, rest, ''];
-}
-function dpkgCompare(a, b) {
-  const [ea, ua, ra] = splitDeb(a), [eb, ub, rb] = splitDeb(b);
-  if (ea !== eb) return ea - eb;
-  return dpkgPart(ua, ub) || dpkgPart(ra, rb);
-}
-
-// rpmvercmp, with epoch:version-release handling.
-function rpmSegment(a, b) {
-  if (a === b) return 0;
-  const sa = a.match(/~|\^|[A-Za-z]+|\d+/g) || [], sb = b.match(/~|\^|[A-Za-z]+|\d+/g) || [];
-  for (let k = 0; k < Math.max(sa.length, sb.length); k++) {
-    const x = sa[k], y = sb[k];
-    if (x === '~' || y === '~') { if (x !== y) return x === '~' ? -1 : 1; continue; }
-    if (x === '^' || y === '^') {
-      if (x === undefined) return -1;
-      if (y === undefined) return 1;
-      if (x !== y) return x === '^' ? 1 : -1;
-      continue;
-    }
-    if (x === undefined) return -1;
-    if (y === undefined) return 1;
-    const xn = /^\d/.test(x), yn = /^\d/.test(y);
-    if (xn !== yn) return xn ? 1 : -1;
-    if (xn) {
-      const xs = x.replace(/^0+/, ''), ys = y.replace(/^0+/, '');
-      if (xs.length !== ys.length) return xs.length - ys.length;
-      if (xs !== ys) return xs < ys ? -1 : 1;
-    } else if (x !== y) return x < y ? -1 : 1;
-  }
-  return 0;
-}
-function splitRpm(v) {
-  let epoch = 0, rest = v;
-  const colon = v.indexOf(':');
-  if (colon > 0) { epoch = parseInt(v.slice(0, colon), 10) || 0; rest = v.slice(colon + 1); }
-  const dash = rest.lastIndexOf('-');
-  return dash > 0 ? [epoch, rest.slice(0, dash), rest.slice(dash + 1)] : [epoch, rest, ''];
-}
-function rpmCompare(a, b) {
-  const [ea, va, ra] = splitRpm(a), [eb, vb, rb] = splitRpm(b);
-  if (ea !== eb) return ea - eb;
-  return rpmSegment(va, vb) || rpmSegment(ra, rb);
-}
-
-// Desktop application versions: compare the numbers ("6.2.5 (42037)" -> 6.2.5.42037 is avoided by
-// cutting at the first space or parenthesis).
-function appNumbers(v) { return (String(v).split(/[\s(]/)[0].match(/\d+/g) || []).map(Number); }
-function appCompare(a, b) {
-  const x = appNumbers(a), y = appNumbers(b);
-  for (let k = 0; k < Math.max(x.length, y.length); k++) {
-    const d = (x[k] || 0) - (y[k] || 0);
-    if (d) return d;
-  }
-  return 0;
-}
+// Where clients download bundles from (public Hugging Face dataset).
+const VULNDB_URL = 'https://huggingface.co/datasets/Devseis/endpoint-auditor-vulndb/resolve/main';
 
 // --- Bundle loading -------------------------------------------------------------------------------
 function verifyBundle(dir) {
@@ -163,107 +68,9 @@ function load(dirs) {
   return { error: errors.join('; ') || 'no vulnerability bundle found' };
 }
 
-// --- Matching ------------------------------------------------------------------------------------
-// Linux release key in the bundle, from the inventory's os-release fields.
-function releaseKey(inventory) {
-  const id = String(inventory.distro_id || '').toLowerCase();
-  const version = String(inventory.version_id || '');
-  const major = version.split('.')[0];
-  if (id === 'ubuntu') return `ubuntu:${version}`;
-  if (id === 'debian') return `debian:${major}`;
-  if (id === 'rhel') return `rhel:${major}`;
-  if (id === 'almalinux') return `almalinux:${major}`;
-  if (id === 'rocky') return `rocky:${major}`;
-  return null;
-}
-
-function matchLinux(inventory, bundle) {
-  const key = releaseKey(inventory);
-  const advisories = key && bundle.releases[key];
-  if (!advisories) return { covered: false, reason: `${inventory.pretty_name || inventory.distro_id || 'this distribution'} is not in the vulnerability data (covered: ${Object.keys(bundle.releases).join(', ')})` };
-  const deb = inventory.kind === 'deb';
-  const compare = deb ? dpkgCompare : rpmCompare;
-  // Group installed packages by source package: Debian/Ubuntu advisories name source packages; Red Hat-family
-  // advisories name binary packages, sometimes only the main one (openssl) when sub-packages (openssl-libs) are installed.
-  const installed = new Map();
-  for (const pkg of inventory.packages || []) {
-    const group = pkg.source || pkg.name;
-    const version = deb ? (pkg.source_version || pkg.version) : pkg.version;
-    const names = deb ? [group] : [pkg.name, group];
-    const prev = installed.get(group);
-    if (!prev) installed.set(group, { version, names: new Set(names) });
-    else {
-      names.forEach(n => prev.names.add(n));
-      if (compare(version, prev.version) > 0) prev.version = version;
-    }
-  }
-  const hits = [];
-  for (const [group, { version, names }] of installed) {
-    const seen = new Set();
-    for (const name of names) {
-      for (const [cves, advisory, fixed, severity] of advisories[name] || []) {
-        const key = `${cves}|${fixed}`;
-        if (seen.has(key)) continue;
-        seen.add(key);
-        // Red Hat module streams: only compare within the same major version (nodejs 20 fix does not apply to nodejs 22).
-        if (!deb && /\.module[+_]/.test(fixed) && splitRpm(fixed)[1].split('.')[0] !== splitRpm(version)[1].split('.')[0]) continue;
-        if (compare(version, fixed) < 0) hits.push({ software: group, version, fixed, severity, cves: cves.split('|'), advisory });
-      }
-    }
-  }
-  return { covered: true, source: key, checked: installed.size, hits };
-}
-
-function matchApps(inventory, bundle, osFamily) {
-  const hits = [];
-  const matched = new Set();
-  for (const app of inventory.apps || []) {
-    if (!app.version) continue;
-    for (const product of bundle.apps) {
-      const pattern = product[osFamily];
-      if (!pattern || !new RegExp(pattern, 'i').test(app.name)) continue;
-      matched.add(product.id);
-      for (const [cve, severity, si, se, ei, ee, exact] of product.cves) {
-        const c = bound => appCompare(app.version, bound);
-        const affected = exact ? c(exact) === 0
-          : (!si || c(si) >= 0) && (!se || c(se) > 0) && (!ei || c(ei) <= 0) && (!ee || c(ee) < 0);
-        if (affected) hits.push({ software: app.name, version: app.version, fixed: ee ? ee : '', severity, cves: [cve], advisory: '' });
-      }
-      break;
-    }
-  }
-  return { covered: true, source: 'nvd', checked: (inventory.apps || []).length, recognised: matched.size, hits };
-}
-
-// Group hits per software and CVE; flag actively exploited CVEs (CISA KEV) and likely ones (EPSS).
-function summarise(result, bundle) {
-  const kev = new Set(bundle.kev);
-  const rank = { critical: 0, high: 1, medium: 2, low: 3, unknown: 4 };
-  const perCve = new Map();
-  for (const hit of result.hits) {
-    for (const cve of hit.cves) {
-      const id = `${hit.software}|${cve}`;
-      const prev = perCve.get(id);
-      if (!prev || rank[hit.severity] < rank[prev.severity]) perCve.set(id, { ...hit, cve, exploited: kev.has(cve), epss: bundle.epss[cve] || 0 });
-    }
-  }
-  const all = [...perCve.values()];
-  const severe = all.filter(h => SEVERE.has(h.severity) || h.exploited);
-  const bySoftware = new Map();
-  for (const h of severe) {
-    const s = bySoftware.get(h.software) || { software: h.software, version: h.version, fixed: '', cves: [], worst: 'unknown', exploited: false, epss: 0 };
-    s.cves.push(h.cve);
-    if (rank[h.severity] < rank[s.worst]) s.worst = h.severity;
-    s.exploited = s.exploited || h.exploited;
-    s.epss = Math.max(s.epss, h.epss);
-    if (h.fixed && (!s.fixed || appCompare(h.fixed, s.fixed) > 0 || /[~+]/.test(h.fixed))) s.fixed = h.fixed;
-    bySoftware.set(h.software, s);
-  }
-  const groups = [...bySoftware.values()].sort((a, b) => (b.exploited - a.exploited) || (rank[a.worst] - rank[b.worst]) || (b.cves.length - a.cves.length));
-  return { severeCount: new Set(severe.map(h => h.cve)).size, otherCount: new Set(all.filter(h => !severe.includes(h)).map(h => h.cve)).size, groups };
-}
-
-function ageDays(isoDate, now) { return Math.floor((now - Date.parse(isoDate)) / 86400000); }
+// --- Matching (rules in renderer/vuln-core.js, shared with the phone web check) -------------------
+const core = require('./renderer/vuln-core.js');
+const { dpkgCompare, rpmCompare, appCompare, releaseKey, matchLinux, matchApps, summarise, knownVulnResult } = core;
 
 // Replace the collector's "Pending" vuln.known_vulnerabilities result with the matched one.
 function apply(evidence, inventory, loaded, maxSevere, now = Date.now()) {
@@ -274,35 +81,12 @@ function apply(evidence, inventory, loaded, maxSevere, now = Date.now()) {
     result.detail = `${result.detail || ''} No vulnerability data available: ${loaded.error}.`.trim();
     return evidence;
   }
-  const { bundle, manifest } = loaded;
-  const dataDate = manifest.built_at.slice(0, 10);
-  const age = ageDays(manifest.built_at, now);
-  const ageNote = age > MAX_AGE_DAYS ? ` Warning: the vulnerability data is ${age} days old; newer vulnerabilities are not included.` : '';
   const osFamily = evidence.host && evidence.host.os_family;
-  const matched = osFamily === 'linux' ? matchLinux(inventory, bundle) : matchApps(inventory, bundle, osFamily);
-  if (!matched.covered) {
-    result.status = 'Pending';
-    result.actual = 'not covered';
-    result.detail = `${matched.reason}.`;
-    return evidence;
-  }
-  const s = summarise(matched, bundle);
-  const scope = osFamily === 'linux'
-    ? `${matched.checked} ${inventory.kind === 'deb' ? 'source packages' : 'packages'} checked against ${matched.source} advisories`
-    : `${matched.checked} applications inventoried, ${matched.recognised} recognised (${bundle.apps.length} common applications covered)`;
-  const listed = s.groups.slice(0, 5).map(g => {
-    const tags = [`${g.cves.length} CVE${g.cves.length > 1 ? 's' : ''}`, g.worst];
-    if (g.exploited) tags.push('actively exploited');
-    return `${g.software} ${g.version} (${tags.join(', ')}${g.fixed ? `; fixed in ${g.fixed}` : ''}; e.g. ${g.cves.slice(0, 2).join(', ')})`;
-  });
-  result.actual = `${s.severeCount} critical/high`;
-  result.status = s.severeCount <= maxSevere ? 'Compliant' : 'Non-Compliant';
-  result.detail = `Matched against offline OSV/NVD data from ${dataDate}. ${scope}.`
-    + (listed.length ? ` ${listed.join('; ')}${s.groups.length > 5 ? `; and ${s.groups.length - 5} more` : ''}.` : '')
-    + ` ${s.otherCount} medium/low.${ageNote}`;
+  const matched = osFamily === 'linux' ? matchLinux(inventory, loaded.bundle) : matchApps(inventory, loaded.bundle, osFamily);
+  Object.assign(result, knownVulnResult(matched, inventory, loaded, osFamily, maxSevere, now));
   evidence.summary = { Compliant: 0, 'Non-Compliant': 0, NotApplicable: 0, Pending: 0, Error: 0 };
   for (const r of evidence.results) evidence.summary[r.status] += 1;
   return evidence;
 }
 
-module.exports = { dpkgCompare, rpmCompare, appCompare, verifyBundle, refresh, load, releaseKey, matchLinux, matchApps, summarise, apply, MAX_AGE_DAYS };
+module.exports = { dpkgCompare, rpmCompare, appCompare, verifyBundle, refresh, load, releaseKey, matchLinux, matchApps, summarise, apply, MAX_AGE_DAYS: core.MAX_AGE_DAYS };

baseline.conf

@@ -63,3 +63,9 @@ PERSONAL_DATA_SCAN=0
 # --- EU AI Act -------------------------------------------------------------
 # AI tools allowed on endpoints, as named in the AI software inventory (e.g. Microsoft Copilot,ChatGPT).
 APPROVED_AI_TOOLS=
+
+# Phones (mobile web check)
+IOS_MIN_MAJOR=18
+ANDROID_MIN_MAJOR=13
+MOBILE_PATCH_MAX_AGE_DAYS=90
+MOBILE_PASSCODE_MIN_DIGITS=6

catalog/checks.json

@@ -1,6 +1,12 @@
 {
-  "catalog_version": "0.2.0",
-  "statuses": ["Compliant", "Non-Compliant", "NotApplicable", "Pending", "Error"],
+  "catalog_version": "0.3.0",
+  "statuses": [
+    "Compliant",
+    "Non-Compliant",
+    "NotApplicable",
+    "Pending",
+    "Error"
+  ],
   "status_meaning": {
     "Compliant": "The device meets the baseline value.",
     "Non-Compliant": "The device does not meet the baseline value.",
@@ -9,10 +15,22 @@
     "Error": "The value could not be read (for example the collector was not run as administrator/root)."
   },
   "sections": [
-    { "id": "baseline", "title": "COMPLIANCE RESULTS" },
-    { "id": "gdpr", "title": "GDPR TECHNICAL CONTROLS" },
-    { "id": "aiact", "title": "EU AI ACT CONTROLS" },
-    { "id": "org", "title": "ORGANISATIONAL CONTROLS" }
+    {
+      "id": "baseline",
+      "title": "COMPLIANCE RESULTS"
+    },
+    {
+      "id": "gdpr",
+      "title": "GDPR TECHNICAL CONTROLS"
+    },
+    {
+      "id": "aiact",
+      "title": "EU AI ACT CONTROLS"
+    },
+    {
+      "id": "org",
+      "title": "ORGANISATIONAL CONTROLS"
+    }
   ],
   "references": {
     "iso27001": {
@@ -71,82 +89,1804 @@
     }
   },
   "checks": [
-    { "id": "password.min_length", "section": "baseline", "name": "Minimum password length", "os": ["windows", "linux", "macos"], "baseline_keys": ["PASSWORD_MIN_LENGTH"], "rule": "Configured minimum length >= PASSWORD_MIN_LENGTH.", "controls": { "iso27001": ["A.5.17", "A.8.5"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-    { "id": "password.history", "section": "baseline", "name": "Password history", "os": ["windows", "linux", "macos"], "baseline_keys": ["PASSWORD_HISTORY"], "rule": "Remembered passwords >= PASSWORD_HISTORY.", "controls": { "iso27001": ["A.5.17", "A.8.5"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-    { "id": "password.expiration", "section": "baseline", "name": "Password expiration", "os": ["windows", "linux", "macos"], "baseline_keys": ["PASSWORD_MAX_AGE_DAYS"], "rule": "Passwords expire after 1..PASSWORD_MAX_AGE_DAYS days (0 in the baseline = expiry not required).", "controls": { "iso27001": ["A.5.17"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-    { "id": "password.min_age", "section": "baseline", "name": "Minimum password age", "os": ["windows", "linux", "macos"], "baseline_keys": ["PASSWORD_MIN_AGE_DAYS"], "rule": "Minimum age >= PASSWORD_MIN_AGE_DAYS days. macOS has no such setting (NotApplicable).", "controls": { "iso27001": ["A.5.17"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-    { "id": "password.complexity", "section": "baseline", "name": "Password complexity", "os": ["windows", "linux", "macos"], "baseline_keys": ["PASSWORD_COMPLEXITY"], "rule": "Complexity enforced (mixed character classes).", "controls": { "iso27001": ["A.5.17", "A.8.5"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-    { "id": "lockout.threshold", "section": "baseline", "name": "Account lockout threshold", "os": ["windows", "linux", "macos"], "baseline_keys": ["LOCKOUT_THRESHOLD_MAX"], "rule": "Lockout after 1..LOCKOUT_THRESHOLD_MAX failed attempts (0 = never locks).", "controls": { "iso27001": ["A.8.5"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-    { "id": "lockout.duration", "section": "baseline", "name": "Account lockout duration", "os": ["windows", "linux", "macos"], "baseline_keys": ["LOCKOUT_DURATION_MIN_MINUTES"], "rule": "Locked for >= LOCKOUT_DURATION_MIN_MINUTES minutes, or until an administrator unlocks.", "controls": { "iso27001": ["A.8.5"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-    { "id": "lockout.observation", "section": "baseline", "name": "Lockout observation period", "os": ["windows", "linux", "macos"], "baseline_keys": ["LOCKOUT_OBSERVATION_MIN_MINUTES"], "rule": "Failed-attempt counter kept for >= LOCKOUT_OBSERVATION_MIN_MINUTES minutes.", "controls": { "iso27001": ["A.8.5"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-
-    { "id": "malware.antivirus", "section": "baseline", "name": "Antivirus", "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "An enabled, up-to-date antivirus product is present.", "controls": { "iso27001": ["A.8.7"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-    { "id": "malware.service", "section": "baseline", "name": "Malware protection service", "names": { "windows": "Microsoft Defender Antimalware", "linux": "ClamAV malware protection service", "macos": "Apple malware protection service" }, "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "The platform malware protection service is running.", "controls": { "iso27001": ["A.8.7"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-    { "id": "malware.realtime", "section": "baseline", "name": "Real-time protection", "os": ["windows"], "baseline_keys": [], "rule": "Defender real-time protection is on.", "controls": { "iso27001": ["A.8.7"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-    { "id": "malware.on_access", "section": "baseline", "name": "On-access malware protection", "names": { "windows": "On-access protection" }, "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "Files are scanned when opened. macOS: NotApplicable unless a third-party scanner provides it.", "controls": { "iso27001": ["A.8.7"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-    { "id": "malware.tamper", "section": "baseline", "name": "Tamper protection", "os": ["windows"], "baseline_keys": [], "rule": "Defender tamper protection is on.", "controls": { "iso27001": ["A.8.7"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-    { "id": "malware.signatures", "section": "baseline", "name": "Malware signatures", "names": { "windows": "Security intelligence", "macos": "Malware protection signatures" }, "os": ["windows", "linux", "macos"], "baseline_keys": ["SIGNATURE_MAX_AGE_DAYS", "MACOS_XPROTECT_MAX_AGE_DAYS"], "rule": "Signatures no older than SIGNATURE_MAX_AGE_DAYS (macOS XProtect: MACOS_XPROTECT_MAX_AGE_DAYS).", "controls": { "iso27001": ["A.8.7", "A.8.8"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-    { "id": "malware.signature_updates", "section": "baseline", "name": "Malware signature updates", "names": { "macos": "Malware security updates" }, "os": ["linux", "macos"], "baseline_keys": [], "rule": "Automatic signature/security-data updates are enabled.", "controls": { "iso27001": ["A.8.7", "A.8.8"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-
-    { "id": "firewall.enabled", "section": "baseline", "name": "Firewall", "os": ["linux", "macos"], "baseline_keys": [], "rule": "A host firewall is active.", "controls": { "iso27001": ["A.8.20", "A.8.1"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-    { "id": "firewall.inbound", "section": "baseline", "name": "Firewall inbound policy", "os": ["linux", "macos"], "baseline_keys": [], "rule": "Unsolicited inbound traffic is blocked by default (macOS: firewall on with stealth mode).", "controls": { "iso27001": ["A.8.20"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-    { "id": "firewall.outbound", "section": "baseline", "name": "Firewall outbound policy", "os": ["linux", "macos"], "baseline_keys": ["FIREWALL_OUTBOUND"], "rule": "Default outbound policy equals FIREWALL_OUTBOUND.", "controls": { "iso27001": ["A.8.20"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-    { "id": "firewall.domain.enabled", "section": "baseline", "name": "Domain firewall", "os": ["windows"], "baseline_keys": [], "rule": "Domain profile enabled.", "controls": { "iso27001": ["A.8.20", "A.8.1"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-    { "id": "firewall.domain.inbound", "section": "baseline", "name": "Domain inbound", "os": ["windows"], "baseline_keys": [], "rule": "Domain profile default inbound action is Block.", "controls": { "iso27001": ["A.8.20"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-    { "id": "firewall.domain.outbound", "section": "baseline", "name": "Domain outbound", "os": ["windows"], "baseline_keys": ["FIREWALL_OUTBOUND"], "rule": "Domain profile default outbound action equals FIREWALL_OUTBOUND.", "controls": { "iso27001": ["A.8.20"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-    { "id": "firewall.private.enabled", "section": "baseline", "name": "Private firewall", "os": ["windows"], "baseline_keys": [], "rule": "Private profile enabled.", "controls": { "iso27001": ["A.8.20", "A.8.1"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-    { "id": "firewall.private.inbound", "section": "baseline", "name": "Private inbound", "os": ["windows"], "baseline_keys": [], "rule": "Private profile default inbound action is Block.", "controls": { "iso27001": ["A.8.20"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-    { "id": "firewall.private.outbound", "section": "baseline", "name": "Private outbound", "os": ["windows"], "baseline_keys": ["FIREWALL_OUTBOUND"], "rule": "Private profile default outbound action equals FIREWALL_OUTBOUND.", "controls": { "iso27001": ["A.8.20"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-    { "id": "firewall.public.enabled", "section": "baseline", "name": "Public firewall", "os": ["windows"], "baseline_keys": [], "rule": "Public profile enabled.", "controls": { "iso27001": ["A.8.20", "A.8.1"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-    { "id": "firewall.public.inbound", "section": "baseline", "name": "Public inbound", "os": ["windows"], "baseline_keys": [], "rule": "Public profile default inbound action is Block.", "controls": { "iso27001": ["A.8.20"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-    { "id": "firewall.public.outbound", "section": "baseline", "name": "Public outbound", "os": ["windows"], "baseline_keys": ["FIREWALL_OUTBOUND"], "rule": "Public profile default outbound action equals FIREWALL_OUTBOUND.", "controls": { "iso27001": ["A.8.20"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-
-    { "id": "screen_lock.enabled", "section": "baseline", "name": "Screen lock", "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "The screen locks when idle (Windows: machine inactivity limit or a password-protected screen saver).", "controls": { "iso27001": ["A.8.1", "A.7.7"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-    { "id": "screen_lock.timeout", "section": "baseline", "name": "Screen lock timeout", "os": ["windows", "linux", "macos"], "baseline_keys": ["SCREEN_LOCK_MAX_SECONDS"], "rule": "Idle time before lock (including any grace delay) is 1..SCREEN_LOCK_MAX_SECONDS seconds (baseline: 300 = 5 minutes).", "controls": { "iso27001": ["A.8.1", "A.7.7"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-    { "id": "screen_lock.password", "section": "baseline", "name": "Screen lock password requirement", "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "A password is required to unlock (macOS: within 5 seconds of the screen locking).", "controls": { "iso27001": ["A.8.1", "A.7.7", "A.8.5"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-
-    { "id": "usb.device_access", "section": "baseline", "name": "USB storage device access", "os": ["windows", "linux", "macos"], "baseline_keys": ["USB_DEVICE_ACCESS"], "rule": "Whether USB mass storage devices can connect at all equals USB_DEVICE_ACCESS (allow/deny): driver, device-installation policy, USBGuard or MDM restriction.", "controls": { "iso27001": ["A.7.10", "A.8.12"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-    { "id": "usb.read", "section": "baseline", "name": "USB storage read", "os": ["windows", "linux", "macos"], "baseline_keys": ["USB_READ"], "rule": "Effective USB storage read access equals USB_READ (allow/deny).", "controls": { "iso27001": ["A.7.10", "A.8.12"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-    { "id": "usb.write", "section": "baseline", "name": "USB storage write", "os": ["windows", "linux", "macos"], "baseline_keys": ["USB_WRITE"], "rule": "Effective USB storage write access equals USB_WRITE (allow/deny).", "controls": { "iso27001": ["A.7.10", "A.8.12"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-
-    { "id": "admin.approved", "section": "baseline", "name": "Approved IT administrator", "os": ["windows", "linux", "macos"], "baseline_keys": ["APPROVED_ADMINS"], "rule": "At least one account listed in APPROVED_ADMINS is an enabled administrator.", "controls": { "iso27001": ["A.8.2", "A.5.15"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-    { "id": "admin.unauthorized", "section": "baseline", "name": "Unauthorized employee administrator accounts", "names": { "windows": "Unauthorized employee local administrator accounts" }, "os": ["windows", "linux", "macos"], "baseline_keys": ["APPROVED_ADMINS", "ALLOW_DISABLED_BUILTIN_ADMIN"], "rule": "No administrator accounts other than APPROVED_ADMINS (and the disabled built-in Administrator on Windows).", "controls": { "iso27001": ["A.8.2", "A.5.18"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-
-    { "id": "encryption.feature", "section": "baseline", "name": "BitLocker", "os": ["windows"], "baseline_keys": [], "rule": "BitLocker is turned on for the system drive.", "controls": { "iso27001": ["A.8.24", "A.8.1"], "gdpr": ["Art. 32(1)(a)"], "ai_act": [] } },
-    { "id": "encryption.enabled", "section": "baseline", "name": "Encryption", "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "The system disk is fully encrypted (BitLocker / LUKS / FileVault).", "controls": { "iso27001": ["A.8.24", "A.8.1"], "gdpr": ["Art. 32(1)(a)"], "ai_act": [] } },
-    { "id": "encryption.protection", "section": "baseline", "name": "Disk encryption protection", "names": { "windows": "BitLocker protection" }, "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "Encryption protection is active (not suspended or in progress) with a strong cipher.", "controls": { "iso27001": ["A.8.24"], "gdpr": ["Art. 32(1)(a)"], "ai_act": [] } },
-    { "id": "encryption.recovery", "section": "baseline", "name": "Disk encryption recovery", "names": { "windows": "BitLocker recovery" }, "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "A recovery key or second unlock method exists.", "controls": { "iso27001": ["A.8.24", "A.8.13"], "gdpr": ["Art. 32(1)(a)", "Art. 32(1)(c)"], "ai_act": [] } },
-    { "id": "user.account_type", "section": "baseline", "name": "Signed-in user account type", "os": ["windows", "linux", "macos"], "baseline_keys": ["APPROVED_ADMINS"], "rule": "The everyday signed-in user is a Standard account (not an administrator), unless listed in APPROVED_ADMINS.", "controls": { "iso27001": ["A.8.2", "A.5.15"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-    { "id": "vuln.pending_updates", "section": "baseline", "name": "Pending security updates", "os": ["windows", "linux", "macos"], "baseline_keys": ["MAX_PENDING_SECURITY_UPDATES"], "rule": "Security updates offered by the OS vendor but not yet installed <= MAX_PENDING_SECURITY_UPDATES.", "controls": { "iso27001": ["A.8.8"], "gdpr": ["Art. 32(1)(b)", "Art. 32(1)(d)"], "ai_act": [] } },
-    { "id": "vuln.outdated_apps", "section": "baseline", "name": "Outdated third-party applications", "os": ["windows", "linux", "macos"], "baseline_keys": ["MAX_OUTDATED_APPS"], "rule": "Installed third-party applications with a newer version available <= MAX_OUTDATED_APPS (Windows: winget; macOS: app versions; Linux: snap/flatpak and packages).", "controls": { "iso27001": ["A.8.8", "A.8.19"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-    { "id": "vuln.known_vulnerabilities", "section": "baseline", "name": "Known vulnerabilities in installed software", "os": ["windows", "linux", "macos"], "baseline_keys": ["MAX_CRITICAL_HIGH_VULNERABILITIES"], "rule": "Installed software versions matched against an offline copy of the OSV/NVD vulnerability data: critical or high vulnerabilities <= MAX_CRITICAL_HIGH_VULNERABILITIES.", "controls": { "iso27001": ["A.8.8"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-
-    { "id": "gdpr.auto_updates", "section": "gdpr", "name": "Automatic security updates", "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "Security updates are downloaded and installed automatically.", "controls": { "iso27001": ["A.8.8"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-    { "id": "gdpr.updates_recent", "section": "gdpr", "name": "Security updates installed recently", "os": ["windows", "linux", "macos"], "baseline_keys": ["UPDATES_MAX_AGE_DAYS"], "rule": "Last successful update/package change within UPDATES_MAX_AGE_DAYS days.", "controls": { "iso27001": ["A.8.8"], "gdpr": ["Art. 32(1)(b)", "Art. 32(1)(d)"], "ai_act": [] } },
-    { "id": "gdpr.os_supported", "section": "gdpr", "name": "Supported operating system version", "os": ["windows", "linux", "macos"], "baseline_keys": ["WINDOWS_MIN_BUILD", "MACOS_MIN_MAJOR", "UBUNTU_MIN_VERSION", "DEBIAN_MIN_VERSION", "RHEL_MIN_VERSION"], "rule": "The OS version still receives security updates (minimums in the baseline).", "controls": { "iso27001": ["A.8.8"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-    { "id": "gdpr.security_logging", "section": "gdpr", "name": "Security event logging", "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "Logon and account-change events are recorded (Windows audit policy, Linux auditd, macOS unified log).", "controls": { "iso27001": ["A.8.15"], "gdpr": ["Art. 32(1)(d)", "Art. 33"], "ai_act": [] } },
-    { "id": "gdpr.time_sync", "section": "gdpr", "name": "Time synchronisation", "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "The clock is synchronised from a time server.", "controls": { "iso27001": ["A.8.17"], "gdpr": ["Art. 33"], "ai_act": [] } },
-    { "id": "gdpr.backup_configured", "section": "gdpr", "name": "Backup configured", "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "A backup solution is configured for user data.", "controls": { "iso27001": ["A.8.13"], "gdpr": ["Art. 32(1)(c)"], "ai_act": [] } },
-    { "id": "gdpr.backup_recent", "section": "gdpr", "name": "Recent backup", "os": ["windows", "linux", "macos"], "baseline_keys": ["BACKUP_MAX_AGE_DAYS"], "rule": "Last backup within BACKUP_MAX_AGE_DAYS days (Pending when the date cannot be read).", "controls": { "iso27001": ["A.8.13"], "gdpr": ["Art. 32(1)(c)"], "ai_act": [] } },
-    { "id": "gdpr.removable_encryption", "section": "gdpr", "name": "Removable media encryption", "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "Data cannot be written to unencrypted removable drives.", "controls": { "iso27001": ["A.7.10", "A.8.24"], "gdpr": ["Art. 32(1)(a)", "Art. 34"], "ai_act": [] } },
-    { "id": "gdpr.guest_account", "section": "gdpr", "name": "Guest account disabled", "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "No enabled guest login.", "controls": { "iso27001": ["A.5.16", "A.8.5"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-    { "id": "gdpr.remote_access", "section": "gdpr", "name": "Remote access services restricted", "os": ["windows", "linux", "macos"], "baseline_keys": ["APPROVED_REMOTE_SERVICES"], "rule": "Only remote access services listed in APPROVED_REMOTE_SERVICES are enabled.", "controls": { "iso27001": ["A.8.20", "A.6.7"], "gdpr": ["Art. 32(1)(b)"], "ai_act": [] } },
-    { "id": "gdpr.telemetry", "section": "gdpr", "name": "Diagnostic data minimised", "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "OS diagnostic/usage data sharing is at the minimum level.", "controls": { "iso27001": ["A.5.34"], "gdpr": ["Art. 5(1)(c)", "Art. 25"], "ai_act": [] } },
-    { "id": "gdpr.personal_data_discovery", "section": "gdpr", "name": "Personal data discovery", "os": ["windows", "linux", "macos"], "baseline_keys": ["PERSONAL_DATA_SCAN"], "rule": "Opt-in scan of user folders for personal data patterns (counts and paths only). Not implemented in stage 1: NotApplicable.", "controls": { "iso27001": ["A.5.34", "A.5.12"], "gdpr": ["Art. 5(1)(c)", "Art. 5(1)(e)", "Art. 30"], "ai_act": [] } },
-
-    { "id": "aiact.inventory", "section": "aiact", "name": "AI software inventory", "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "AI apps, local AI services and local model folders are listed (Compliant = inventory taken).", "controls": { "iso27001": ["A.5.9"], "gdpr": ["Art. 30"], "ai_act": ["Art. 26"] } },
-    { "id": "aiact.unapproved", "section": "aiact", "name": "Unapproved AI tools (shadow AI)", "os": ["windows", "linux", "macos"], "baseline_keys": ["APPROVED_AI_TOOLS"], "rule": "Every AI tool found is listed in APPROVED_AI_TOOLS.", "controls": { "iso27001": ["A.5.9", "A.8.19"], "gdpr": ["Art. 28", "Art. 44"], "ai_act": ["Art. 26"] } },
-    { "id": "aiact.risk_classification", "section": "aiact", "name": "AI system risk classification", "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "Each AI tool found is classified (prohibited / high-risk / limited / minimal). Done by the auditor model: Pending in the collector output, NotApplicable when no AI tool is found.", "controls": { "iso27001": ["A.5.9"], "gdpr": [], "ai_act": ["Art. 5", "Art. 6", "Annex III"] } },
-    { "id": "aiact.os_ai_features", "section": "aiact", "name": "Operating system AI features restricted", "names": { "windows": "Windows Recall / Copilot data analysis disabled", "macos": "Apple Intelligence external integrations restricted" }, "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "OS-level AI features that capture or send user data are disabled by policy. NotApplicable where the OS has none.", "controls": { "iso27001": ["A.5.34"], "gdpr": ["Art. 5(1)(c)", "Art. 25"], "ai_act": ["Art. 26"] } },
-    { "id": "aiact.log_retention", "section": "aiact", "name": "AI usage log retention", "os": ["windows", "linux", "macos"], "baseline_keys": [], "rule": "Logs kept >= 6 months if a high-risk AI system is used. Pending until classification; NotApplicable when no AI tool is found.", "controls": { "iso27001": ["A.8.15"], "gdpr": [], "ai_act": ["Art. 26(6)"] } },
-
-    { "id": "org.ropa", "section": "org", "name": "Record of processing activities", "os": ["windows", "linux", "macos"], "answer_key": "ORG_ROPA", "question": "Is there a current record of processing activities (RoPA)?", "baseline_keys": [], "rule": "Answer yes = Compliant, no/partial = Non-Compliant, n/a = NotApplicable, unanswered = Pending.", "controls": { "iso27001": ["A.5.34"], "gdpr": ["Art. 30"], "ai_act": [] } },
-    { "id": "org.dpia", "section": "org", "name": "Data protection impact assessment", "os": ["windows", "linux", "macos"], "answer_key": "ORG_DPIA", "question": "Has a DPIA been done for every high-risk processing activity?", "baseline_keys": [], "rule": "As above.", "controls": { "iso27001": ["A.5.34"], "gdpr": ["Art. 35"], "ai_act": [] } },
-    { "id": "org.breach_procedure", "section": "org", "name": "Breach response procedure", "os": ["windows", "linux", "macos"], "answer_key": "ORG_BREACH_PROCEDURE", "question": "Is there a tested procedure to report a personal data breach within 72 hours?", "baseline_keys": [], "rule": "As above.", "controls": { "iso27001": ["A.5.24", "A.5.26"], "gdpr": ["Art. 33", "Art. 34"], "ai_act": [] } },
-    { "id": "org.processor_agreements", "section": "org", "name": "Data processing agreements", "os": ["windows", "linux", "macos"], "answer_key": "ORG_PROCESSOR_AGREEMENTS", "question": "Are data processing agreements signed with all processors, including AI providers?", "baseline_keys": [], "rule": "As above.", "controls": { "iso27001": ["A.5.20"], "gdpr": ["Art. 28"], "ai_act": [] } },
-    { "id": "org.ai_register", "section": "org", "name": "AI register", "os": ["windows", "linux", "macos"], "answer_key": "ORG_AI_REGISTER", "question": "Is there a register of the AI systems the organisation uses?", "baseline_keys": [], "rule": "As above.", "controls": { "iso27001": ["A.5.9"], "gdpr": [], "ai_act": ["Art. 26"] } },
-    { "id": "org.ai_literacy", "section": "org", "name": "AI literacy training", "os": ["windows", "linux", "macos"], "answer_key": "ORG_AI_LITERACY", "question": "Have staff who use AI received AI literacy training?", "baseline_keys": [], "rule": "As above.", "controls": { "iso27001": ["A.6.3"], "gdpr": [], "ai_act": ["Art. 4"] } },
-    { "id": "org.human_oversight", "section": "org", "name": "Human oversight for high-risk AI", "os": ["windows", "linux", "macos"], "answer_key": "ORG_HUMAN_OVERSIGHT", "question": "Is a trained person assigned to oversee each high-risk AI system?", "baseline_keys": [], "rule": "As above.", "controls": { "iso27001": [], "gdpr": [], "ai_act": ["Art. 14", "Art. 26"] } },
-    { "id": "org.ai_transparency", "section": "org", "name": "AI transparency to users", "os": ["windows", "linux", "macos"], "answer_key": "ORG_AI_TRANSPARENCY", "question": "Are people told when they interact with AI or receive AI-generated content?", "baseline_keys": [], "rule": "As above.", "controls": { "iso27001": [], "gdpr": [], "ai_act": ["Art. 50"] } }
+    {
+      "id": "password.min_length",
+      "section": "baseline",
+      "name": "Minimum password length",
+      "os": [
+        "windows",
+        "linux",
+        "macos"
+      ],
+      "baseline_keys": [
+        "PASSWORD_MIN_LENGTH"
+      ],
+      "rule": "Configured minimum length >= PASSWORD_MIN_LENGTH.",
+      "controls": {
+        "iso27001": [
+          "A.5.17",
+          "A.8.5"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "password.history",
+      "section": "baseline",
+      "name": "Password history",
+      "os": [
+        "windows",
+        "linux",
+        "macos"
+      ],
+      "baseline_keys": [
+        "PASSWORD_HISTORY"
+      ],
+      "rule": "Remembered passwords >= PASSWORD_HISTORY.",
+      "controls": {
+        "iso27001": [
+          "A.5.17",
+          "A.8.5"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "password.expiration",
+      "section": "baseline",
+      "name": "Password expiration",
+      "os": [
+        "windows",
+        "linux",
+        "macos"
+      ],
+      "baseline_keys": [
+        "PASSWORD_MAX_AGE_DAYS"
+      ],
+      "rule": "Passwords expire after 1..PASSWORD_MAX_AGE_DAYS days (0 in the baseline = expiry not required).",
+      "controls": {
+        "iso27001": [
+          "A.5.17"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "password.min_age",
+      "section": "baseline",
+      "name": "Minimum password age",
+      "os": [
+        "windows",
+        "linux",
+        "macos"
+      ],
+      "baseline_keys": [
+        "PASSWORD_MIN_AGE_DAYS"
+      ],
+      "rule": "Minimum age >= PASSWORD_MIN_AGE_DAYS days. macOS has no such setting (NotApplicable).",
+      "controls": {
+        "iso27001": [
+          "A.5.17"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "password.complexity",
+      "section": "baseline",
+      "name": "Password complexity",
+      "os": [
+        "windows",
+        "linux",
+        "macos"
+      ],
+      "baseline_keys": [
+        "PASSWORD_COMPLEXITY"
+      ],
+      "rule": "Complexity enforced (mixed character classes).",
+      "controls": {
+        "iso27001": [
+          "A.5.17",
+          "A.8.5"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "lockout.threshold",
+      "section": "baseline",
+      "name": "Account lockout threshold",
+      "os": [
+        "windows",
+        "linux",
+        "macos"
+      ],
+      "baseline_keys": [
+        "LOCKOUT_THRESHOLD_MAX"
+      ],
+      "rule": "Lockout after 1..LOCKOUT_THRESHOLD_MAX failed attempts (0 = never locks).",
+      "controls": {
+        "iso27001": [
+          "A.8.5"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "lockout.duration",
+      "section": "baseline",
+      "name": "Account lockout duration",
+      "os": [
+        "windows",
+        "linux",
+        "macos"
+      ],
+      "baseline_keys": [
+        "LOCKOUT_DURATION_MIN_MINUTES"
+      ],
+      "rule": "Locked for >= LOCKOUT_DURATION_MIN_MINUTES minutes, or until an administrator unlocks.",
+      "controls": {
+        "iso27001": [
+          "A.8.5"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "lockout.observation",
+      "section": "baseline",
+      "name": "Lockout observation period",
+      "os": [
+        "windows",
+        "linux",
+        "macos"
+      ],
+      "baseline_keys": [
+        "LOCKOUT_OBSERVATION_MIN_MINUTES"
+      ],
+      "rule": "Failed-attempt counter kept for >= LOCKOUT_OBSERVATION_MIN_MINUTES minutes.",
+      "controls": {
+        "iso27001": [
+          "A.8.5"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "malware.antivirus",
+      "section": "baseline",
+      "name": "Antivirus",
+      "os": [
+        "windows",
+        "linux",
+        "macos",
+        "android"
+      ],
+      "baseline_keys": [],
+      "rule": "An enabled, up-to-date antivirus product is present. Android: Google Play Protect scanning is on.",
+      "controls": {
+        "iso27001": [
+          "A.8.7"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      },
+      "names": {
+        "android": "Google Play Protect"
+      }
+    },
+    {
+      "id": "malware.service",
+      "section": "baseline",
+      "name": "Malware protection service",
+      "names": {
+        "windows": "Microsoft Defender Antimalware",
+        "linux": "ClamAV malware protection service",
+        "macos": "Apple malware protection service"
+      },
+      "os": [
+        "windows",
+        "linux",
+        "macos"
+      ],
+      "baseline_keys": [],
+      "rule": "The platform malware protection service is running.",
+      "controls": {
+        "iso27001": [
+          "A.8.7"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "malware.realtime",
+      "section": "baseline",
+      "name": "Real-time protection",
+      "os": [
+        "windows"
+      ],
+      "baseline_keys": [],
+      "rule": "Defender real-time protection is on.",
+      "controls": {
+        "iso27001": [
+          "A.8.7"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "malware.on_access",
+      "section": "baseline",
+      "name": "On-access malware protection",
+      "names": {
+        "windows": "On-access protection"
+      },
+      "os": [
+        "windows",
+        "linux",
+        "macos"
+      ],
+      "baseline_keys": [],
+      "rule": "Files are scanned when opened. macOS: NotApplicable unless a third-party scanner provides it.",
+      "controls": {
+        "iso27001": [
+          "A.8.7"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "malware.tamper",
+      "section": "baseline",
+      "name": "Tamper protection",
+      "os": [
+        "windows"
+      ],
+      "baseline_keys": [],
+      "rule": "Defender tamper protection is on.",
+      "controls": {
+        "iso27001": [
+          "A.8.7"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "malware.signatures",
+      "section": "baseline",
+      "name": "Malware signatures",
+      "names": {
+        "windows": "Security intelligence",
+        "macos": "Malware protection signatures"
+      },
+      "os": [
+        "windows",
+        "linux",
+        "macos"
+      ],
+      "baseline_keys": [
+        "SIGNATURE_MAX_AGE_DAYS",
+        "MACOS_XPROTECT_MAX_AGE_DAYS"
+      ],
+      "rule": "Signatures no older than SIGNATURE_MAX_AGE_DAYS (macOS XProtect: MACOS_XPROTECT_MAX_AGE_DAYS).",
+      "controls": {
+        "iso27001": [
+          "A.8.7",
+          "A.8.8"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "malware.signature_updates",
+      "section": "baseline",
+      "name": "Malware signature updates",
+      "names": {
+        "macos": "Malware security updates"
+      },
+      "os": [
+        "linux",
+        "macos"
+      ],
+      "baseline_keys": [],
+      "rule": "Automatic signature/security-data updates are enabled.",
+      "controls": {
+        "iso27001": [
+          "A.8.7",
+          "A.8.8"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "firewall.enabled",
+      "section": "baseline",
+      "name": "Firewall",
+      "os": [
+        "linux",
+        "macos"
+      ],
+      "baseline_keys": [],
+      "rule": "A host firewall is active.",
+      "controls": {
+        "iso27001": [
+          "A.8.20",
+          "A.8.1"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "firewall.inbound",
+      "section": "baseline",
+      "name": "Firewall inbound policy",
+      "os": [
+        "linux",
+        "macos"
+      ],
+      "baseline_keys": [],
+      "rule": "Unsolicited inbound traffic is blocked by default (macOS: firewall on with stealth mode).",
+      "controls": {
+        "iso27001": [
+          "A.8.20"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "firewall.outbound",
+      "section": "baseline",
+      "name": "Firewall outbound policy",
+      "os": [
+        "linux",
+        "macos"
+      ],
+      "baseline_keys": [
+        "FIREWALL_OUTBOUND"
+      ],
+      "rule": "Default outbound policy equals FIREWALL_OUTBOUND.",
+      "controls": {
+        "iso27001": [
+          "A.8.20"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "firewall.domain.enabled",
+      "section": "baseline",
+      "name": "Domain firewall",
+      "os": [
+        "windows"
+      ],
+      "baseline_keys": [],
+      "rule": "Domain profile enabled.",
+      "controls": {
+        "iso27001": [
+          "A.8.20",
+          "A.8.1"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "firewall.domain.inbound",
+      "section": "baseline",
+      "name": "Domain inbound",
+      "os": [
+        "windows"
+      ],
+      "baseline_keys": [],
+      "rule": "Domain profile default inbound action is Block.",
+      "controls": {
+        "iso27001": [
+          "A.8.20"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "firewall.domain.outbound",
+      "section": "baseline",
+      "name": "Domain outbound",
+      "os": [
+        "windows"
+      ],
+      "baseline_keys": [
+        "FIREWALL_OUTBOUND"
+      ],
+      "rule": "Domain profile default outbound action equals FIREWALL_OUTBOUND.",
+      "controls": {
+        "iso27001": [
+          "A.8.20"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "firewall.private.enabled",
+      "section": "baseline",
+      "name": "Private firewall",
+      "os": [
+        "windows"
+      ],
+      "baseline_keys": [],
+      "rule": "Private profile enabled.",
+      "controls": {
+        "iso27001": [
+          "A.8.20",
+          "A.8.1"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "firewall.private.inbound",
+      "section": "baseline",
+      "name": "Private inbound",
+      "os": [
+        "windows"
+      ],
+      "baseline_keys": [],
+      "rule": "Private profile default inbound action is Block.",
+      "controls": {
+        "iso27001": [
+          "A.8.20"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "firewall.private.outbound",
+      "section": "baseline",
+      "name": "Private outbound",
+      "os": [
+        "windows"
+      ],
+      "baseline_keys": [
+        "FIREWALL_OUTBOUND"
+      ],
+      "rule": "Private profile default outbound action equals FIREWALL_OUTBOUND.",
+      "controls": {
+        "iso27001": [
+          "A.8.20"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "firewall.public.enabled",
+      "section": "baseline",
+      "name": "Public firewall",
+      "os": [
+        "windows"
+      ],
+      "baseline_keys": [],
+      "rule": "Public profile enabled.",
+      "controls": {
+        "iso27001": [
+          "A.8.20",
+          "A.8.1"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "firewall.public.inbound",
+      "section": "baseline",
+      "name": "Public inbound",
+      "os": [
+        "windows"
+      ],
+      "baseline_keys": [],
+      "rule": "Public profile default inbound action is Block.",
+      "controls": {
+        "iso27001": [
+          "A.8.20"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "firewall.public.outbound",
+      "section": "baseline",
+      "name": "Public outbound",
+      "os": [
+        "windows"
+      ],
+      "baseline_keys": [
+        "FIREWALL_OUTBOUND"
+      ],
+      "rule": "Public profile default outbound action equals FIREWALL_OUTBOUND.",
+      "controls": {
+        "iso27001": [
+          "A.8.20"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "screen_lock.enabled",
+      "section": "baseline",
+      "name": "Screen lock",
+      "os": [
+        "windows",
+        "linux",
+        "macos",
+        "ios",
+        "android"
+      ],
+      "baseline_keys": [],
+      "rule": "The screen locks when idle (Windows: machine inactivity limit or a password-protected screen saver). Phones: a passcode / PIN / password screen lock is set.",
+      "controls": {
+        "iso27001": [
+          "A.8.1",
+          "A.7.7"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      },
+      "names": {
+        "ios": "Passcode",
+        "android": "Screen lock"
+      }
+    },
+    {
+      "id": "screen_lock.timeout",
+      "section": "baseline",
+      "name": "Screen lock timeout",
+      "os": [
+        "windows",
+        "linux",
+        "macos",
+        "ios",
+        "android"
+      ],
+      "baseline_keys": [
+        "SCREEN_LOCK_MAX_SECONDS"
+      ],
+      "rule": "Idle time before lock (including any grace delay) is 1..SCREEN_LOCK_MAX_SECONDS seconds (baseline: 300 = 5 minutes). Phones: Auto-Lock / screen timeout.",
+      "controls": {
+        "iso27001": [
+          "A.8.1",
+          "A.7.7"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      },
+      "names": {
+        "ios": "Auto-Lock",
+        "android": "Screen timeout"
+      }
+    },
+    {
+      "id": "screen_lock.password",
+      "section": "baseline",
+      "name": "Screen lock password requirement",
+      "os": [
+        "windows",
+        "linux",
+        "macos"
+      ],
+      "baseline_keys": [],
+      "rule": "A password is required to unlock (macOS: within 5 seconds of the screen locking).",
+      "controls": {
+        "iso27001": [
+          "A.8.1",
+          "A.7.7",
+          "A.8.5"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "mobile.passcode_strength",
+      "section": "baseline",
+      "name": "Passcode strength",
+      "os": [
+        "ios",
+        "android"
+      ],
+      "names": {
+        "ios": "Passcode strength",
+        "android": "Screen lock strength"
+      },
+      "baseline_keys": [
+        "MOBILE_PASSCODE_MIN_DIGITS"
+      ],
+      "rule": "Passcode / PIN has at least MOBILE_PASSCODE_MIN_DIGITS digits, or is alphanumeric. Android pattern or swipe locks do not comply.",
+      "controls": {
+        "iso27001": [
+          "A.5.17",
+          "A.8.5"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "mobile.jailbreak_root",
+      "section": "baseline",
+      "name": "Operating system integrity",
+      "os": [
+        "ios",
+        "android"
+      ],
+      "names": {
+        "ios": "Not jailbroken",
+        "android": "Not rooted"
+      },
+      "baseline_keys": [],
+      "rule": "The phone is not jailbroken (iOS) or rooted / bootloader-unlocked (Android).",
+      "controls": {
+        "iso27001": [
+          "A.8.1",
+          "A.8.7",
+          "A.8.19"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "mobile.app_sources",
+      "section": "baseline",
+      "name": "App sources restricted",
+      "os": [
+        "ios",
+        "android"
+      ],
+      "names": {
+        "ios": "Apps only from the App Store",
+        "android": "Install unknown apps blocked"
+      },
+      "baseline_keys": [],
+      "rule": "Apps are installed only from the official store (no alternative marketplaces, web distribution or unknown sources).",
+      "controls": {
+        "iso27001": [
+          "A.8.1",
+          "A.8.7",
+          "A.8.19"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "mobile.usb_debugging",
+      "section": "baseline",
+      "name": "USB debugging off",
+      "os": [
+        "android"
+      ],
+      "baseline_keys": [],
+      "rule": "Developer options / USB debugging are off.",
+      "controls": {
+        "iso27001": [
+          "A.8.1",
+          "A.8.19"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "mobile.find_my_device",
+      "section": "baseline",
+      "name": "Find and erase a lost device",
+      "os": [
+        "ios",
+        "android"
+      ],
+      "names": {
+        "ios": "Find My iPhone",
+        "android": "Find My Device"
+      },
+      "baseline_keys": [],
+      "rule": "Find My iPhone / Find My Device is on, so a lost phone can be located, locked and erased.",
+      "controls": {
+        "iso27001": [
+          "A.5.9",
+          "A.8.1"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)",
+          "Art. 32(1)(c)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "usb.device_access",
+      "section": "baseline",
+      "name": "USB storage device access",
+      "os": [
+        "windows",
+        "linux",
+        "macos"
+      ],
+      "baseline_keys": [
+        "USB_DEVICE_ACCESS"
+      ],
+      "rule": "Whether USB mass storage devices can connect at all equals USB_DEVICE_ACCESS (allow/deny): driver, device-installation policy, USBGuard or MDM restriction.",
+      "controls": {
+        "iso27001": [
+          "A.7.10",
+          "A.8.12"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "usb.read",
+      "section": "baseline",
+      "name": "USB storage read",
+      "os": [
+        "windows",
+        "linux",
+        "macos"
+      ],
+      "baseline_keys": [
+        "USB_READ"
+      ],
+      "rule": "Effective USB storage read access equals USB_READ (allow/deny).",
+      "controls": {
+        "iso27001": [
+          "A.7.10",
+          "A.8.12"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "usb.write",
+      "section": "baseline",
+      "name": "USB storage write",
+      "os": [
+        "windows",
+        "linux",
+        "macos"
+      ],
+      "baseline_keys": [
+        "USB_WRITE"
+      ],
+      "rule": "Effective USB storage write access equals USB_WRITE (allow/deny).",
+      "controls": {
+        "iso27001": [
+          "A.7.10",
+          "A.8.12"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "admin.approved",
+      "section": "baseline",
+      "name": "Approved IT administrator",
+      "os": [
+        "windows",
+        "linux",
+        "macos"
+      ],
+      "baseline_keys": [
+        "APPROVED_ADMINS"
+      ],
+      "rule": "At least one account listed in APPROVED_ADMINS is an enabled administrator.",
+      "controls": {
+        "iso27001": [
+          "A.8.2",
+          "A.5.15"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "admin.unauthorized",
+      "section": "baseline",
+      "name": "Unauthorized employee administrator accounts",
+      "names": {
+        "windows": "Unauthorized employee local administrator accounts"
+      },
+      "os": [
+        "windows",
+        "linux",
+        "macos"
+      ],
+      "baseline_keys": [
+        "APPROVED_ADMINS",
+        "ALLOW_DISABLED_BUILTIN_ADMIN"
+      ],
+      "rule": "No administrator accounts other than APPROVED_ADMINS (and the disabled built-in Administrator on Windows).",
+      "controls": {
+        "iso27001": [
+          "A.8.2",
+          "A.5.18"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "encryption.feature",
+      "section": "baseline",
+      "name": "BitLocker",
+      "os": [
+        "windows"
+      ],
+      "baseline_keys": [],
+      "rule": "BitLocker is turned on for the system drive.",
+      "controls": {
+        "iso27001": [
+          "A.8.24",
+          "A.8.1"
+        ],
+        "gdpr": [
+          "Art. 32(1)(a)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "encryption.enabled",
+      "section": "baseline",
+      "name": "Encryption",
+      "os": [
+        "windows",
+        "linux",
+        "macos",
+        "ios",
+        "android"
+      ],
+      "baseline_keys": [],
+      "rule": "The system disk is fully encrypted (BitLocker / LUKS / FileVault). Phones: iOS data protection is on when a passcode is set; Android 10+ encrypts by default.",
+      "controls": {
+        "iso27001": [
+          "A.8.24",
+          "A.8.1"
+        ],
+        "gdpr": [
+          "Art. 32(1)(a)"
+        ],
+        "ai_act": []
+      },
+      "names": {
+        "ios": "Data protection (encryption)",
+        "android": "Device encryption"
+      }
+    },
+    {
+      "id": "encryption.protection",
+      "section": "baseline",
+      "name": "Disk encryption protection",
+      "names": {
+        "windows": "BitLocker protection"
+      },
+      "os": [
+        "windows",
+        "linux",
+        "macos"
+      ],
+      "baseline_keys": [],
+      "rule": "Encryption protection is active (not suspended or in progress) with a strong cipher.",
+      "controls": {
+        "iso27001": [
+          "A.8.24"
+        ],
+        "gdpr": [
+          "Art. 32(1)(a)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "encryption.recovery",
+      "section": "baseline",
+      "name": "Disk encryption recovery",
+      "names": {
+        "windows": "BitLocker recovery"
+      },
+      "os": [
+        "windows",
+        "linux",
+        "macos"
+      ],
+      "baseline_keys": [],
+      "rule": "A recovery key or second unlock method exists.",
+      "controls": {
+        "iso27001": [
+          "A.8.24",
+          "A.8.13"
+        ],
+        "gdpr": [
+          "Art. 32(1)(a)",
+          "Art. 32(1)(c)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "user.account_type",
+      "section": "baseline",
+      "name": "Signed-in user account type",
+      "os": [
+        "windows",
+        "linux",
+        "macos"
+      ],
+      "baseline_keys": [
+        "APPROVED_ADMINS"
+      ],
+      "rule": "The everyday signed-in user is a Standard account (not an administrator), unless listed in APPROVED_ADMINS.",
+      "controls": {
+        "iso27001": [
+          "A.8.2",
+          "A.5.15"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "vuln.pending_updates",
+      "section": "baseline",
+      "name": "Pending security updates",
+      "os": [
+        "windows",
+        "linux",
+        "macos",
+        "ios",
+        "android"
+      ],
+      "baseline_keys": [
+        "MAX_PENDING_SECURITY_UPDATES",
+        "MOBILE_PATCH_MAX_AGE_DAYS"
+      ],
+      "rule": "Security updates offered by the OS vendor but not yet installed <= MAX_PENDING_SECURITY_UPDATES. Phones: iOS is at the latest security release known to the vulnerability data; Android security patch level is at most MOBILE_PATCH_MAX_AGE_DAYS old.",
+      "controls": {
+        "iso27001": [
+          "A.8.8"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)",
+          "Art. 32(1)(d)"
+        ],
+        "ai_act": []
+      },
+      "names": {
+        "ios": "iOS security updates",
+        "android": "Android security update"
+      }
+    },
+    {
+      "id": "vuln.outdated_apps",
+      "section": "baseline",
+      "name": "Outdated third-party applications",
+      "os": [
+        "windows",
+        "linux",
+        "macos",
+        "ios",
+        "android"
+      ],
+      "baseline_keys": [
+        "MAX_OUTDATED_APPS"
+      ],
+      "rule": "Installed third-party applications with a newer version available <= MAX_OUTDATED_APPS (Windows: winget; macOS: app versions; Linux: snap/flatpak and packages). Phones: automatic app updates are on.",
+      "controls": {
+        "iso27001": [
+          "A.8.8",
+          "A.8.19"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      },
+      "names": {
+        "ios": "App updates",
+        "android": "App updates"
+      }
+    },
+    {
+      "id": "vuln.known_vulnerabilities",
+      "section": "baseline",
+      "name": "Known vulnerabilities in installed software",
+      "os": [
+        "windows",
+        "linux",
+        "macos",
+        "ios"
+      ],
+      "baseline_keys": [
+        "MAX_CRITICAL_HIGH_VULNERABILITIES"
+      ],
+      "rule": "Installed software versions matched against an offline copy of the OSV/NVD vulnerability data: critical or high vulnerabilities <= MAX_CRITICAL_HIGH_VULNERABILITIES. iOS: the iOS version is matched against NVD iOS/iPadOS records.",
+      "controls": {
+        "iso27001": [
+          "A.8.8"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      },
+      "names": {
+        "ios": "Known vulnerabilities in iOS"
+      }
+    },
+    {
+      "id": "gdpr.auto_updates",
+      "section": "gdpr",
+      "name": "Automatic security updates",
+      "os": [
+        "windows",
+        "linux",
+        "macos",
+        "ios",
+        "android"
+      ],
+      "baseline_keys": [],
+      "rule": "Security updates are downloaded and installed automatically.",
+      "controls": {
+        "iso27001": [
+          "A.8.8"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      },
+      "names": {
+        "ios": "Automatic iOS updates",
+        "android": "Automatic system updates"
+      }
+    },
+    {
+      "id": "gdpr.updates_recent",
+      "section": "gdpr",
+      "name": "Security updates installed recently",
+      "os": [
+        "windows",
+        "linux",
+        "macos"
+      ],
+      "baseline_keys": [
+        "UPDATES_MAX_AGE_DAYS"
+      ],
+      "rule": "Last successful update/package change within UPDATES_MAX_AGE_DAYS days.",
+      "controls": {
+        "iso27001": [
+          "A.8.8"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)",
+          "Art. 32(1)(d)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "gdpr.os_supported",
+      "section": "gdpr",
+      "name": "Supported operating system version",
+      "os": [
+        "windows",
+        "linux",
+        "macos",
+        "ios",
+        "android"
+      ],
+      "baseline_keys": [
+        "WINDOWS_MIN_BUILD",
+        "MACOS_MIN_MAJOR",
+        "UBUNTU_MIN_VERSION",
+        "DEBIAN_MIN_VERSION",
+        "RHEL_MIN_VERSION",
+        "IOS_MIN_MAJOR",
+        "ANDROID_MIN_MAJOR"
+      ],
+      "rule": "The OS version still receives security updates (minimums in the baseline). Phones: IOS_MIN_MAJOR / ANDROID_MIN_MAJOR.",
+      "controls": {
+        "iso27001": [
+          "A.8.8"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "gdpr.security_logging",
+      "section": "gdpr",
+      "name": "Security event logging",
+      "os": [
+        "windows",
+        "linux",
+        "macos"
+      ],
+      "baseline_keys": [],
+      "rule": "Logon and account-change events are recorded (Windows audit policy, Linux auditd, macOS unified log).",
+      "controls": {
+        "iso27001": [
+          "A.8.15"
+        ],
+        "gdpr": [
+          "Art. 32(1)(d)",
+          "Art. 33"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "gdpr.time_sync",
+      "section": "gdpr",
+      "name": "Time synchronisation",
+      "os": [
+        "windows",
+        "linux",
+        "macos",
+        "ios",
+        "android"
+      ],
+      "baseline_keys": [],
+      "rule": "The clock is synchronised from a time server.",
+      "controls": {
+        "iso27001": [
+          "A.8.17"
+        ],
+        "gdpr": [
+          "Art. 33"
+        ],
+        "ai_act": []
+      },
+      "names": {
+        "ios": "Date & time set automatically",
+        "android": "Date & time set automatically"
+      }
+    },
+    {
+      "id": "gdpr.backup_configured",
+      "section": "gdpr",
+      "name": "Backup configured",
+      "os": [
+        "windows",
+        "linux",
+        "macos",
+        "ios",
+        "android"
+      ],
+      "baseline_keys": [],
+      "rule": "A backup solution is configured for user data.",
+      "controls": {
+        "iso27001": [
+          "A.8.13"
+        ],
+        "gdpr": [
+          "Art. 32(1)(c)"
+        ],
+        "ai_act": []
+      },
+      "names": {
+        "ios": "iCloud Backup",
+        "android": "Google backup"
+      }
+    },
+    {
+      "id": "gdpr.backup_recent",
+      "section": "gdpr",
+      "name": "Recent backup",
+      "os": [
+        "windows",
+        "linux",
+        "macos"
+      ],
+      "baseline_keys": [
+        "BACKUP_MAX_AGE_DAYS"
+      ],
+      "rule": "Last backup within BACKUP_MAX_AGE_DAYS days (Pending when the date cannot be read).",
+      "controls": {
+        "iso27001": [
+          "A.8.13"
+        ],
+        "gdpr": [
+          "Art. 32(1)(c)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "gdpr.removable_encryption",
+      "section": "gdpr",
+      "name": "Removable media encryption",
+      "os": [
+        "windows",
+        "linux",
+        "macos"
+      ],
+      "baseline_keys": [],
+      "rule": "Data cannot be written to unencrypted removable drives.",
+      "controls": {
+        "iso27001": [
+          "A.7.10",
+          "A.8.24"
+        ],
+        "gdpr": [
+          "Art. 32(1)(a)",
+          "Art. 34"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "gdpr.guest_account",
+      "section": "gdpr",
+      "name": "Guest account disabled",
+      "os": [
+        "windows",
+        "linux",
+        "macos"
+      ],
+      "baseline_keys": [],
+      "rule": "No enabled guest login.",
+      "controls": {
+        "iso27001": [
+          "A.5.16",
+          "A.8.5"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "gdpr.remote_access",
+      "section": "gdpr",
+      "name": "Remote access services restricted",
+      "os": [
+        "windows",
+        "linux",
+        "macos"
+      ],
+      "baseline_keys": [
+        "APPROVED_REMOTE_SERVICES"
+      ],
+      "rule": "Only remote access services listed in APPROVED_REMOTE_SERVICES are enabled.",
+      "controls": {
+        "iso27001": [
+          "A.8.20",
+          "A.6.7"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "gdpr.telemetry",
+      "section": "gdpr",
+      "name": "Diagnostic data minimised",
+      "os": [
+        "windows",
+        "linux",
+        "macos",
+        "ios",
+        "android"
+      ],
+      "baseline_keys": [],
+      "rule": "OS diagnostic/usage data sharing is at the minimum level.",
+      "controls": {
+        "iso27001": [
+          "A.5.34"
+        ],
+        "gdpr": [
+          "Art. 5(1)(c)",
+          "Art. 25"
+        ],
+        "ai_act": []
+      },
+      "names": {
+        "ios": "Analytics sharing minimised",
+        "android": "Usage & diagnostics sharing minimised"
+      }
+    },
+    {
+      "id": "gdpr.lock_screen_previews",
+      "section": "gdpr",
+      "name": "Notification content hidden on the lock screen",
+      "os": [
+        "ios",
+        "android"
+      ],
+      "names": {
+        "ios": "Notification previews hidden when locked",
+        "android": "Sensitive notifications hidden when locked"
+      },
+      "baseline_keys": [],
+      "rule": "Message and email previews are not shown on the locked screen.",
+      "controls": {
+        "iso27001": [
+          "A.7.7",
+          "A.8.1"
+        ],
+        "gdpr": [
+          "Art. 5(1)(f)",
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "gdpr.personal_data_discovery",
+      "section": "gdpr",
+      "name": "Personal data discovery",
+      "os": [
+        "windows",
+        "linux",
+        "macos"
+      ],
+      "baseline_keys": [
+        "PERSONAL_DATA_SCAN"
+      ],
+      "rule": "Opt-in scan of user folders for personal data patterns (counts and paths only). Not implemented in stage 1: NotApplicable.",
+      "controls": {
+        "iso27001": [
+          "A.5.34",
+          "A.5.12"
+        ],
+        "gdpr": [
+          "Art. 5(1)(c)",
+          "Art. 5(1)(e)",
+          "Art. 30"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "aiact.inventory",
+      "section": "aiact",
+      "name": "AI software inventory",
+      "os": [
+        "windows",
+        "linux",
+        "macos",
+        "ios",
+        "android"
+      ],
+      "baseline_keys": [],
+      "rule": "AI apps, local AI services and local model folders are listed (Compliant = inventory taken).",
+      "controls": {
+        "iso27001": [
+          "A.5.9"
+        ],
+        "gdpr": [
+          "Art. 30"
+        ],
+        "ai_act": [
+          "Art. 26"
+        ]
+      }
+    },
+    {
+      "id": "aiact.unapproved",
+      "section": "aiact",
+      "name": "Unapproved AI tools (shadow AI)",
+      "os": [
+        "windows",
+        "linux",
+        "macos",
+        "ios",
+        "android"
+      ],
+      "baseline_keys": [
+        "APPROVED_AI_TOOLS"
+      ],
+      "rule": "Every AI tool found is listed in APPROVED_AI_TOOLS.",
+      "controls": {
+        "iso27001": [
+          "A.5.9",
+          "A.8.19"
+        ],
+        "gdpr": [
+          "Art. 28",
+          "Art. 44"
+        ],
+        "ai_act": [
+          "Art. 26"
+        ]
+      }
+    },
+    {
+      "id": "aiact.risk_classification",
+      "section": "aiact",
+      "name": "AI system risk classification",
+      "os": [
+        "windows",
+        "linux",
+        "macos",
+        "ios",
+        "android"
+      ],
+      "baseline_keys": [],
+      "rule": "Each AI tool found is classified (prohibited / high-risk / limited / minimal). Done by the auditor model: Pending in the collector output, NotApplicable when no AI tool is found.",
+      "controls": {
+        "iso27001": [
+          "A.5.9"
+        ],
+        "gdpr": [],
+        "ai_act": [
+          "Art. 5",
+          "Art. 6",
+          "Annex III"
+        ]
+      }
+    },
+    {
+      "id": "aiact.os_ai_features",
+      "section": "aiact",
+      "name": "Operating system AI features restricted",
+      "names": {
+        "windows": "Windows Recall / Copilot data analysis disabled",
+        "macos": "Apple Intelligence external integrations restricted",
+        "ios": "Apple Intelligence external integrations restricted",
+        "android": "AI assistant access restricted"
+      },
+      "os": [
+        "windows",
+        "linux",
+        "macos",
+        "ios",
+        "android"
+      ],
+      "baseline_keys": [],
+      "rule": "OS-level AI features that capture or send user data are disabled by policy. NotApplicable where the OS has none. Phones: external AI integrations (ChatGPT in Apple Intelligence, assistant access to screen content) are off unless approved.",
+      "controls": {
+        "iso27001": [
+          "A.5.34"
+        ],
+        "gdpr": [
+          "Art. 5(1)(c)",
+          "Art. 25"
+        ],
+        "ai_act": [
+          "Art. 26"
+        ]
+      }
+    },
+    {
+      "id": "aiact.log_retention",
+      "section": "aiact",
+      "name": "AI usage log retention",
+      "os": [
+        "windows",
+        "linux",
+        "macos",
+        "ios",
+        "android"
+      ],
+      "baseline_keys": [],
+      "rule": "Logs kept >= 6 months if a high-risk AI system is used. Pending until classification; NotApplicable when no AI tool is found.",
+      "controls": {
+        "iso27001": [
+          "A.8.15"
+        ],
+        "gdpr": [],
+        "ai_act": [
+          "Art. 26(6)"
+        ]
+      }
+    },
+    {
+      "id": "org.ropa",
+      "section": "org",
+      "name": "Record of processing activities",
+      "os": [
+        "windows",
+        "linux",
+        "macos",
+        "ios",
+        "android"
+      ],
+      "answer_key": "ORG_ROPA",
+      "question": "Is there a current record of processing activities (RoPA)?",
+      "baseline_keys": [],
+      "rule": "Answer yes = Compliant, no/partial = Non-Compliant, n/a = NotApplicable, unanswered = Pending.",
+      "controls": {
+        "iso27001": [
+          "A.5.34"
+        ],
+        "gdpr": [
+          "Art. 30"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "org.dpia",
+      "section": "org",
+      "name": "Data protection impact assessment",
+      "os": [
+        "windows",
+        "linux",
+        "macos",
+        "ios",
+        "android"
+      ],
+      "answer_key": "ORG_DPIA",
+      "question": "Has a DPIA been done for every high-risk processing activity?",
+      "baseline_keys": [],
+      "rule": "As above.",
+      "controls": {
+        "iso27001": [
+          "A.5.34"
+        ],
+        "gdpr": [
+          "Art. 35"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "org.breach_procedure",
+      "section": "org",
+      "name": "Breach response procedure",
+      "os": [
+        "windows",
+        "linux",
+        "macos",
+        "ios",
+        "android"
+      ],
+      "answer_key": "ORG_BREACH_PROCEDURE",
+      "question": "Is there a tested procedure to report a personal data breach within 72 hours?",
+      "baseline_keys": [],
+      "rule": "As above.",
+      "controls": {
+        "iso27001": [
+          "A.5.24",
+          "A.5.26"
+        ],
+        "gdpr": [
+          "Art. 33",
+          "Art. 34"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "org.processor_agreements",
+      "section": "org",
+      "name": "Data processing agreements",
+      "os": [
+        "windows",
+        "linux",
+        "macos",
+        "ios",
+        "android"
+      ],
+      "answer_key": "ORG_PROCESSOR_AGREEMENTS",
+      "question": "Are data processing agreements signed with all processors, including AI providers?",
+      "baseline_keys": [],
+      "rule": "As above.",
+      "controls": {
+        "iso27001": [
+          "A.5.20"
+        ],
+        "gdpr": [
+          "Art. 28"
+        ],
+        "ai_act": []
+      }
+    },
+    {
+      "id": "org.ai_register",
+      "section": "org",
+      "name": "AI register",
+      "os": [
+        "windows",
+        "linux",
+        "macos",
+        "ios",
+        "android"
+      ],
+      "answer_key": "ORG_AI_REGISTER",
+      "question": "Is there a register of the AI systems the organisation uses?",
+      "baseline_keys": [],
+      "rule": "As above.",
+      "controls": {
+        "iso27001": [
+          "A.5.9"
+        ],
+        "gdpr": [],
+        "ai_act": [
+          "Art. 26"
+        ]
+      }
+    },
+    {
+      "id": "org.ai_literacy",
+      "section": "org",
+      "name": "AI literacy training",
+      "os": [
+        "windows",
+        "linux",
+        "macos",
+        "ios",
+        "android"
+      ],
+      "answer_key": "ORG_AI_LITERACY",
+      "question": "Have staff who use AI received AI literacy training?",
+      "baseline_keys": [],
+      "rule": "As above.",
+      "controls": {
+        "iso27001": [
+          "A.6.3"
+        ],
+        "gdpr": [],
+        "ai_act": [
+          "Art. 4"
+        ]
+      }
+    },
+    {
+      "id": "org.human_oversight",
+      "section": "org",
+      "name": "Human oversight for high-risk AI",
+      "os": [
+        "windows",
+        "linux",
+        "macos",
+        "ios",
+        "android"
+      ],
+      "answer_key": "ORG_HUMAN_OVERSIGHT",
+      "question": "Is a trained person assigned to oversee each high-risk AI system?",
+      "baseline_keys": [],
+      "rule": "As above.",
+      "controls": {
+        "iso27001": [],
+        "gdpr": [],
+        "ai_act": [
+          "Art. 14",
+          "Art. 26"
+        ]
+      }
+    },
+    {
+      "id": "org.ai_transparency",
+      "section": "org",
+      "name": "AI transparency to users",
+      "os": [
+        "windows",
+        "linux",
+        "macos",
+        "ios",
+        "android"
+      ],
+      "answer_key": "ORG_AI_TRANSPARENCY",
+      "question": "Are people told when they interact with AI or receive AI-generated content?",
+      "baseline_keys": [],
+      "rule": "As above.",
+      "controls": {
+        "iso27001": [],
+        "gdpr": [],
+        "ai_act": [
+          "Art. 50"
+        ]
+      }
+    }
   ]
 }

catalog/mobile_questions.json

@@ -0,0 +1,170 @@
+{
+  "_comment": "Phone self-check: what the browser detects and what the user is asked, per check and OS. Read by mobile/mobile-core.js (web page) and, through it, by the synthetic generator, so training data uses exactly this wording. Answer fields: label (shown), actual (written to the evidence), status, detail (optional). Computed answers: seconds (timeout vs SCREEN_LOCK_MAX_SECONDS), digits/alphanumeric/pattern (passcode vs MOBILE_PASSCODE_MIN_DIGITS). Settings paths differ slightly between phone makers; the 'where' text says so.",
+  "version": "0.3.0",
+  "not_sure": {"label": "I'm not sure / I can't find it", "actual": "not answered", "status": "Pending", "detail": "The user could not find or confirm this setting."},
+  "os_version": {
+    "ios": {"question": "Which iOS version does this iPhone have?", "where": "Settings › General › About › iOS Version"},
+    "android": {"question": "Which Android version does this phone have?", "where": "Settings › About phone › Android version (sometimes under Software information)"}
+  },
+  "checks": {
+    "screen_lock.enabled": {
+      "ios": {"question": "Is a passcode set on this iPhone?", "where": "Settings › Face ID & Passcode (or Touch ID & Passcode). If it asks for your passcode before opening, one is set.", "expected": "passcode set",
+        "answers": [
+          {"label": "Yes, a passcode is set", "actual": "passcode set", "status": "Compliant"},
+          {"label": "No passcode", "actual": "no passcode", "status": "Non-Compliant", "detail": "Anyone holding the phone can open it."}]},
+      "android": {"question": "Which screen lock is set?", "where": "Settings › Security & privacy › Device unlock › Screen lock (names vary by phone maker)", "expected": "PIN, password or pattern",
+        "answers": [
+          {"label": "PIN, password or pattern", "actual": "screen lock set", "status": "Compliant"},
+          {"label": "Swipe or None", "actual": "no screen lock (Swipe/None)", "status": "Non-Compliant", "detail": "Anyone holding the phone can open it."}]}
+    },
+    "screen_lock.timeout": {
+      "ios": {"question": "What is Auto-Lock set to?", "where": "Settings › Display & Brightness › Auto-Lock", "expected_from": "seconds",
+        "answers": [
+          {"label": "30 seconds", "seconds": 30}, {"label": "1 minute", "seconds": 60}, {"label": "2 minutes", "seconds": 120},
+          {"label": "3 minutes", "seconds": 180}, {"label": "4 minutes", "seconds": 240}, {"label": "5 minutes", "seconds": 300},
+          {"label": "Never", "seconds": null}]},
+      "android": {"question": "What is Screen timeout set to?", "where": "Settings › Display › Screen timeout. If there is also 'Lock after screen timeout', it should be Immediately.", "expected_from": "seconds",
+        "answers": [
+          {"label": "15 seconds", "seconds": 15}, {"label": "30 seconds", "seconds": 30}, {"label": "1 minute", "seconds": 60},
+          {"label": "2 minutes", "seconds": 120}, {"label": "5 minutes", "seconds": 300}, {"label": "10 minutes", "seconds": 600},
+          {"label": "30 minutes", "seconds": 1800}]}
+    },
+    "mobile.passcode_strength": {
+      "ios": {"question": "What kind of passcode do you use?", "where": "The code you type to unlock. Settings › Face ID & Passcode › Change Passcode › Passcode Options shows the choices.", "expected_from": "passcode",
+        "answers": [
+          {"label": "4-digit code", "digits": 4}, {"label": "6-digit code", "digits": 6},
+          {"label": "Custom numeric code (7 or more digits)", "digits": 8}, {"label": "Custom alphanumeric code (letters and numbers)", "alphanumeric": true}]},
+      "android": {"question": "What kind of screen lock do you use?", "where": "Settings › Security & privacy › Device unlock › Screen lock", "expected_from": "passcode",
+        "answers": [
+          {"label": "Pattern", "pattern": true}, {"label": "4-digit PIN", "digits": 4}, {"label": "PIN of 6 or more digits", "digits": 6},
+          {"label": "Password (letters and numbers)", "alphanumeric": true}, {"label": "Swipe or None", "none": true}]}
+    },
+    "mobile.jailbreak_root": {
+      "ios": {"question": "Has this iPhone been jailbroken?", "where": "Jailbreaking means deliberately modifying iOS to install apps outside Apple's control. If nobody did this on purpose, answer No.", "expected": "not jailbroken",
+        "answers": [
+          {"label": "No", "actual": "not jailbroken (user confirmed)", "status": "Compliant"},
+          {"label": "Yes", "actual": "jailbroken", "status": "Non-Compliant", "detail": "iOS security protections are bypassed on a jailbroken phone."}]},
+      "android": {"question": "Is this phone rooted or is its bootloader unlocked?", "where": "Rooting means deliberately giving apps full system access. If nobody did this on purpose, answer No.", "expected": "not rooted",
+        "answers": [
+          {"label": "No", "actual": "not rooted (user confirmed)", "status": "Compliant"},
+          {"label": "Yes", "actual": "rooted or bootloader unlocked", "status": "Non-Compliant", "detail": "Android security protections are weakened on a rooted phone."}]}
+    },
+    "mobile.app_sources": {
+      "ios": {"question": "Where do the apps on this iPhone come from?", "where": "Settings › General › VPN & Device Management lists developer or enterprise profiles. Alternative app marketplaces appear as separate apps.", "expected": "App Store only",
+        "answers": [
+          {"label": "Only the App Store", "actual": "App Store only", "status": "Compliant"},
+          {"label": "App Store and apps installed by my employer", "actual": "App Store and employer-managed apps", "status": "Compliant"},
+          {"label": "Also another marketplace, a website or a developer profile", "actual": "apps from outside the App Store", "status": "Non-Compliant", "detail": "Apps from outside the App Store skip Apple's review."}]},
+      "android": {"question": "Is any app allowed to install unknown apps?", "where": "Settings › Apps › Special app access › Install unknown apps. Every app should show 'Not allowed'.", "expected": "all apps: Not allowed",
+        "answers": [
+          {"label": "All show 'Not allowed'", "actual": "unknown apps blocked for all apps", "status": "Compliant"},
+          {"label": "At least one shows 'Allowed'", "actual": "unknown apps allowed for at least one app", "status": "Non-Compliant", "detail": "Apps from outside Google Play skip Play Store checks."}]}
+    },
+    "mobile.usb_debugging": {
+      "android": {"question": "Is USB debugging on?", "where": "Settings › System › Developer options › USB debugging. If you cannot find Developer options, they are off.", "expected": "off",
+        "answers": [
+          {"label": "Off, or no Developer options", "actual": "off", "status": "Compliant"},
+          {"label": "On", "actual": "on", "status": "Non-Compliant", "detail": "A connected computer can read and change data on the phone."}]}
+    },
+    "mobile.find_my_device": {
+      "ios": {"question": "Is Find My iPhone on?", "where": "Settings › [your name] › Find My › Find My iPhone", "expected": "on",
+        "answers": [
+          {"label": "On", "actual": "on", "status": "Compliant"},
+          {"label": "Off", "actual": "off", "status": "Non-Compliant", "detail": "A lost phone cannot be located, locked or erased remotely."}]},
+      "android": {"question": "Is Find My Device (Find Hub) on?", "where": "Settings › Google › All services › Find My Device (called Find Hub on newer phones)", "expected": "on",
+        "answers": [
+          {"label": "On", "actual": "on", "status": "Compliant"},
+          {"label": "Off", "actual": "off", "status": "Non-Compliant", "detail": "A lost phone cannot be located, locked or erased remotely."}]}
+    },
+    "malware.antivirus": {
+      "android": {"question": "Is 'Scan apps with Play Protect' on?", "where": "Play Store › your profile picture › Play Protect › Settings (gear icon)", "expected": "on",
+        "answers": [
+          {"label": "On", "actual": "Play Protect scanning on", "status": "Compliant"},
+          {"label": "Off", "actual": "Play Protect scanning off", "status": "Non-Compliant", "detail": "Installed apps are not checked for harmful behaviour."}]}
+    },
+    "vuln.pending_updates": {
+      "android": {"question": "What is the Android security update date?", "where": "Settings › About phone › Android version › Android security update (or Settings › Security & privacy › Updates)", "expected_from": "patch_month", "input": "month"}
+    },
+    "vuln.outdated_apps": {
+      "ios": {"question": "Are automatic App Updates on?", "where": "Settings › App Store › App Updates", "expected": "automatic app updates on",
+        "answers": [
+          {"label": "On", "actual": "automatic app updates on", "status": "Compliant"},
+          {"label": "Off", "actual": "automatic app updates off", "status": "Non-Compliant", "detail": "Apps keep known security bugs until they are updated by hand."}]},
+      "android": {"question": "Are apps updated automatically?", "where": "Play Store › your profile picture › Settings › Network preferences › Auto-update apps", "expected": "automatic app updates on",
+        "answers": [
+          {"label": "Over any network, or over Wi-Fi only", "actual": "automatic app updates on", "status": "Compliant"},
+          {"label": "Don't auto-update apps", "actual": "automatic app updates off", "status": "Non-Compliant", "detail": "Apps keep known security bugs until they are updated by hand."}]}
+    },
+    "gdpr.auto_updates": {
+      "ios": {"question": "What do Automatic Updates show?", "where": "Settings › General › Software Update › Automatic Updates", "expected": "download and install on",
+        "answers": [
+          {"label": "Download and Install are both on", "actual": "download and install on", "status": "Compliant"},
+          {"label": "Only Download is on", "actual": "download only", "status": "Non-Compliant", "detail": "Updates wait for the user to install them."},
+          {"label": "Both off", "actual": "off", "status": "Non-Compliant", "detail": "Security updates are not installed automatically."}]},
+      "android": {"question": "Are system updates downloaded automatically?", "where": "Settings › System › Software updates (names vary: 'Auto download over Wi-Fi', 'Automatic system updates')", "expected": "automatic",
+        "answers": [
+          {"label": "Yes, automatically", "actual": "automatic", "status": "Compliant"},
+          {"label": "No, I install them by hand", "actual": "manual", "status": "Non-Compliant", "detail": "Security updates wait for the user."}]}
+    },
+    "gdpr.time_sync": {
+      "ios": {"question": "Is 'Set Automatically' on?", "where": "Settings › General › Date & Time", "expected": "set automatically",
+        "answers": [
+          {"label": "On", "actual": "set automatically", "status": "Compliant"},
+          {"label": "Off", "actual": "set by hand", "status": "Non-Compliant", "detail": "Wrong time breaks certificate checks and makes logs unreliable."}]},
+      "android": {"question": "Is 'Set time automatically' on?", "where": "Settings › System › Date & time", "expected": "set automatically",
+        "answers": [
+          {"label": "On", "actual": "set automatically", "status": "Compliant"},
+          {"label": "Off", "actual": "set by hand", "status": "Non-Compliant", "detail": "Wrong time breaks certificate checks and makes logs unreliable."}]}
+    },
+    "gdpr.backup_configured": {
+      "ios": {"question": "Is iCloud Backup on?", "where": "Settings › [your name] › iCloud › iCloud Backup", "expected": "backup on",
+        "answers": [
+          {"label": "On", "actual": "iCloud Backup on", "status": "Compliant"},
+          {"label": "Off, but I back up to a computer", "actual": "backed up to a computer", "status": "Compliant", "detail": "Manual computer backups depend on the user remembering them."},
+          {"label": "Off", "actual": "no backup", "status": "Non-Compliant", "detail": "Data on a lost or broken phone cannot be restored."}]},
+      "android": {"question": "Is phone backup on?", "where": "Settings › Google › Backup (or Settings › System › Backup; Samsung: Accounts and backup)", "expected": "backup on",
+        "answers": [
+          {"label": "Backup by Google One is on", "actual": "Google backup on", "status": "Compliant"},
+          {"label": "The phone maker's cloud backup is on", "actual": "phone maker cloud backup on", "status": "Compliant"},
+          {"label": "Off", "actual": "no backup", "status": "Non-Compliant", "detail": "Data on a lost or broken phone cannot be restored."}]}
+    },
+    "gdpr.telemetry": {
+      "ios": {"question": "Is 'Share iPhone Analytics' on?", "where": "Settings › Privacy & Security › Analytics & Improvements", "expected": "analytics sharing off",
+        "answers": [
+          {"label": "Off", "actual": "analytics sharing off", "status": "Compliant"},
+          {"label": "On", "actual": "analytics sharing on", "status": "Non-Compliant", "detail": "Usage data from the phone is sent to Apple."}]},
+      "android": {"question": "Is 'Usage & diagnostics' on?", "where": "Settings › Google › All services › Usage & diagnostics (also check the phone maker's diagnostics option)", "expected": "usage & diagnostics off",
+        "answers": [
+          {"label": "Off", "actual": "usage & diagnostics off", "status": "Compliant"},
+          {"label": "On", "actual": "usage & diagnostics on", "status": "Non-Compliant", "detail": "Usage data from the phone is sent to Google."}]}
+    },
+    "gdpr.lock_screen_previews": {
+      "ios": {"question": "What is 'Show Previews' set to?", "where": "Settings › Notifications › Show Previews", "expected": "When Unlocked or Never",
+        "answers": [
+          {"label": "When Unlocked", "actual": "When Unlocked", "status": "Compliant"},
+          {"label": "Never", "actual": "Never", "status": "Compliant"},
+          {"label": "Always", "actual": "Always", "status": "Non-Compliant", "detail": "Message and email content can be read on the locked screen."}]},
+      "android": {"question": "What do notifications show on the lock screen?", "where": "Settings › Notifications › Notifications on lock screen (or Settings › Privacy)", "expected": "sensitive content hidden",
+        "answers": [
+          {"label": "Don't show notifications", "actual": "no notifications on lock screen", "status": "Compliant"},
+          {"label": "Hide sensitive content / show only alerts", "actual": "sensitive content hidden", "status": "Compliant"},
+          {"label": "Show all notification content", "actual": "all content shown", "status": "Non-Compliant", "detail": "Message and email content can be read on the locked screen."}]}
+    },
+    "aiact.os_ai_features": {
+      "ios": {"question": "Is the ChatGPT extension in Apple Intelligence on?", "where": "Settings › Apple Intelligence & Siri › ChatGPT (only on iPhones that support Apple Intelligence)", "expected": "external AI off unless approved",
+        "answers": [
+          {"label": "Off", "actual": "ChatGPT extension off", "status": "Compliant"},
+          {"label": "On", "actual": "ChatGPT extension on", "status": "Non-Compliant", "detail": "Requests can be sent to an external AI service."},
+          {"label": "Apple Intelligence is not on this iPhone", "actual": "Apple Intelligence not available", "status": "NotApplicable"}]},
+      "android": {"question": "Can the AI assistant use what is on your screen?", "where": "Gemini app › your profile picture › Settings › 'Screen context' / 'Use screen context' (other assistants have similar options)", "expected": "screen access off unless approved",
+        "answers": [
+          {"label": "Off, or no AI assistant", "actual": "assistant screen access off", "status": "Compliant"},
+          {"label": "On", "actual": "assistant screen access on", "status": "Non-Compliant", "detail": "Screen content can be sent to an external AI service."}]}
+    }
+  },
+  "ai_apps": {
+    "question": "Which AI apps are installed on this phone?",
+    "where": "Swipe down on the Home Screen and search, or look in the App Library / app drawer.",
+    "options": ["ChatGPT", "Gemini", "Microsoft Copilot", "Claude", "Perplexity", "Meta AI", "Grok", "DeepSeek", "Character.AI", "Replika", "Otter", "Grammarly"]
+  }
+}

collectors/linux/audit.sh

@@ -11,7 +11,7 @@
 set -u
 
 COLLECTOR_VERSION="0.2.0"
-CATALOG_VERSION="0.2.0"
+CATALOG_VERSION="0.3.0"
 
 SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
 ROOT_DIR=$(cd "$SCRIPT_DIR/../.." && pwd)

collectors/macos/audit.sh

@@ -13,7 +13,7 @@
 set -u
 
 COLLECTOR_VERSION="0.2.0"
-CATALOG_VERSION="0.2.0"
+CATALOG_VERSION="0.3.0"
 
 SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
 ROOT_DIR=$(cd "$SCRIPT_DIR/../.." && pwd)

collectors/windows/audit.ps1

@@ -26,7 +26,7 @@ param(
 Set-StrictMode -Version 2.0
 $ErrorActionPreference = 'Stop'
 $CollectorVersion = '0.2.0'
-$CatalogVersion = '0.2.0'
+$CatalogVersion = '0.3.0'
 
 # ---------------------------------------------------------------------------
 # Helpers

docs/CONTROLS.md

@@ -1,96 +1,103 @@
 # Audited controls and data sources
 
-Catalog version 0.2.0 · 68 checks. Generated by `tools/build_controls_doc.py` — do not edit by hand.
+Catalog version 0.3.0 · 74 checks. Generated by `tools/build_controls_doc.py` — do not edit by hand.
 
 All sources are read-only. Internet is only used by *Pending security updates* on Windows and macOS, and by the app to refresh the vulnerability bundle.
+Phones are checked in the browser: a web page cannot read a phone's settings, so results are either detected by the browser or answered by the user (self-reported), and labelled as such.
 
-## COMPLIANCE RESULTS (43)
+## COMPLIANCE RESULTS (48)
 
-| Check | Applies to | References | Rule | Windows source | Linux source | macOS source |
-|---|---|---|---|---|---|---|
-| Minimum password length | windows, linux, macos | ISO A.5.17; ISO A.8.5; GDPR Art. 32(1)(b) | Configured minimum length >= PASSWORD_MIN_LENGTH. | secedit export: MinimumPasswordLength | PAM pam_pwquality minlen (/etc/security/pwquality.conf, PAM args) | pwpolicy -getaccountpolicies (minLength / regex) |
-| Password history | windows, linux, macos | ISO A.5.17; ISO A.8.5; GDPR Art. 32(1)(b) | Remembered passwords >= PASSWORD_HISTORY. | secedit export: PasswordHistorySize | pam_pwhistory remember (PAM args, /etc/security/pwhistory.conf) | pwpolicy: policyAttributePasswordHistoryDepth |
-| Password expiration | windows, linux, macos | ISO A.5.17; GDPR Art. 32(1)(b) | Passwords expire after 1..PASSWORD_MAX_AGE_DAYS days (0 in the baseline = expiry not required). | secedit export: MaximumPasswordAge | /etc/login.defs PASS_MAX_DAYS + /etc/shadow per account | pwpolicy: policyAttributeExpiresEveryNDays |
-| Minimum password age | windows, linux, macos | ISO A.5.17; GDPR Art. 32(1)(b) | Minimum age >= PASSWORD_MIN_AGE_DAYS days. macOS has no such setting (NotApplicable). | secedit export: MinimumPasswordAge | /etc/login.defs PASS_MIN_DAYS + /etc/shadow per account | not available on macOS (NotApplicable) |
-| Password complexity | windows, linux, macos | ISO A.5.17; ISO A.8.5; GDPR Art. 32(1)(b) | Complexity enforced (mixed character classes). | secedit export: PasswordComplexity | pam_pwquality minclass / dcredit-ucredit-lcredit-ocredit | pwpolicy: alpha + numeric requirements |
-| Account lockout threshold | windows, linux, macos | ISO A.8.5; GDPR Art. 32(1)(b) | Lockout after 1..LOCKOUT_THRESHOLD_MAX failed attempts (0 = never locks). | secedit export: LockoutBadCount | pam_faillock deny (PAM args, /etc/security/faillock.conf) | pwpolicy: policyAttributeMaximumFailedAuthentications |
-| Account lockout duration | windows, linux, macos | ISO A.8.5; GDPR Art. 32(1)(b) | Locked for >= LOCKOUT_DURATION_MIN_MINUTES minutes, or until an administrator unlocks. | secedit export: LockoutDuration | pam_faillock unlock_time | pwpolicy: autoEnableInSeconds |
-| Lockout observation period | windows, linux, macos | ISO A.8.5; GDPR Art. 32(1)(b) | Failed-attempt counter kept for >= LOCKOUT_OBSERVATION_MIN_MINUTES minutes. | secedit export: ResetLockoutCount | pam_faillock fail_interval | pwpolicy: autoEnableInSeconds (counter resets with lockout) |
-| Antivirus | windows, linux, macos | ISO A.8.7; GDPR Art. 32(1)(b) | An enabled, up-to-date antivirus product is present. | Security Center (root/SecurityCenter2 AntiVirusProduct) | systemd services: clamav-daemon, mdatp, falcon-sensor, sentinelone, sophos-spl, esets | XProtect version (xprotect version) + running third-party agents |
-| Malware protection service / Apple malware protection service / ClamAV malware protection service / Microsoft Defender Antimalware | windows, linux, macos | ISO A.8.7; GDPR Art. 32(1)(b) | The platform malware protection service is running. | Get-MpComputerStatus: AMServiceEnabled, AntivirusEnabled | systemctl is-active clamav-daemon / clamd | xprotect status + spctl --status (Gatekeeper) |
-| Real-time protection | windows | ISO A.8.7; GDPR Art. 32(1)(b) | Defender real-time protection is on. | Get-MpComputerStatus: RealTimeProtectionEnabled | — | — |
-| On-access malware protection / On-access protection | windows, linux, macos | ISO A.8.7; GDPR Art. 32(1)(b) | Files are scanned when opened. macOS: NotApplicable unless a third-party scanner provides it. | Get-MpComputerStatus: OnAccessProtectionEnabled | clamav-clamonacc service / clamonacc process | third-party agent only (XProtect has no on-access scan) |
-| Tamper protection | windows | ISO A.8.7; GDPR Art. 32(1)(b) | Defender tamper protection is on. | Get-MpComputerStatus: IsTamperProtected | — | — |
-| Malware signatures / Malware protection signatures / Security intelligence | windows, linux, macos | ISO A.8.7; ISO A.8.8; GDPR Art. 32(1)(b) | Signatures no older than SIGNATURE_MAX_AGE_DAYS (macOS XProtect: MACOS_XPROTECT_MAX_AGE_DAYS). | Get-MpComputerStatus: AntivirusSignatureAge | age of /var/lib/clamav/daily.c[lv]d | XProtect install date (xprotect version / XProtect.meta.plist) |
-| Malware signature updates / Malware security updates | linux, macos | ISO A.8.7; ISO A.8.8; GDPR Art. 32(1)(b) | Automatic signature/security-data updates are enabled. | — | systemctl is-active clamav-freshclam | com.apple.SoftwareUpdate ConfigDataInstall + CriticalUpdateInstall |
-| Firewall | linux, macos | ISO A.8.20; ISO A.8.1; GDPR Art. 32(1)(b) | A host firewall is active. | — | ufw status / firewalld / nft list ruleset / iptables -S | socketfilterfw --getglobalstate |
-| Firewall inbound policy | linux, macos | ISO A.8.20; GDPR Art. 32(1)(b) | Unsolicited inbound traffic is blocked by default (macOS: firewall on with stealth mode). | — | ufw default incoming / firewalld zone target / nft input policy | socketfilterfw --getstealthmode |
-| Firewall outbound policy | linux, macos | ISO A.8.20; GDPR Art. 32(1)(b) | Default outbound policy equals FIREWALL_OUTBOUND. | — | ufw default outgoing / nft output policy | application firewall is inbound-only |
-| Domain firewall | windows | ISO A.8.20; ISO A.8.1; GDPR Art. 32(1)(b) | Domain profile enabled. | Get-NetFirewallProfile -PolicyStore ActiveStore (Domain) | — | — |
-| Domain inbound | windows | ISO A.8.20; GDPR Art. 32(1)(b) | Domain profile default inbound action is Block. | Get-NetFirewallProfile: DefaultInboundAction (Domain) | — | — |
-| Domain outbound | windows | ISO A.8.20; GDPR Art. 32(1)(b) | Domain profile default outbound action equals FIREWALL_OUTBOUND. | Get-NetFirewallProfile: DefaultOutboundAction (Domain) | — | — |
-| Private firewall | windows | ISO A.8.20; ISO A.8.1; GDPR Art. 32(1)(b) | Private profile enabled. | Get-NetFirewallProfile -PolicyStore ActiveStore (Private) | — | — |
-| Private inbound | windows | ISO A.8.20; GDPR Art. 32(1)(b) | Private profile default inbound action is Block. | Get-NetFirewallProfile: DefaultInboundAction (Private) | — | — |
-| Private outbound | windows | ISO A.8.20; GDPR Art. 32(1)(b) | Private profile default outbound action equals FIREWALL_OUTBOUND. | Get-NetFirewallProfile: DefaultOutboundAction (Private) | — | — |
-| Public firewall | windows | ISO A.8.20; ISO A.8.1; GDPR Art. 32(1)(b) | Public profile enabled. | Get-NetFirewallProfile -PolicyStore ActiveStore (Public) | — | — |
-| Public inbound | windows | ISO A.8.20; GDPR Art. 32(1)(b) | Public profile default inbound action is Block. | Get-NetFirewallProfile: DefaultInboundAction (Public) | — | — |
-| Public outbound | windows | ISO A.8.20; GDPR Art. 32(1)(b) | Public profile default outbound action equals FIREWALL_OUTBOUND. | Get-NetFirewallProfile: DefaultOutboundAction (Public) | — | — |
-| Screen lock | windows, linux, macos | ISO A.8.1; ISO A.7.7; GDPR Art. 32(1)(b) | The screen locks when idle (Windows: machine inactivity limit or a password-protected screen saver). | InactivityTimeoutSecs policy or users' ScreenSaveActive/ScreenSaverIsSecure (HKU) | gsettings org.gnome.desktop.screensaver lock-enabled + session idle-delay (per user) | sysadminctl -screenLock status / managed com.apple.screensaver |
-| Screen lock timeout | windows, linux, macos | ISO A.8.1; ISO A.7.7; GDPR Art. 32(1)(b) | Idle time before lock (including any grace delay) is 1..SCREEN_LOCK_MAX_SECONDS seconds (baseline: 300 = 5 minutes). | InactivityTimeoutSecs policy or users' ScreenSaveTimeOut (HKU) | gsettings idle-delay + lock-delay (per user) | screen saver idleTime + pmset displaysleep + password delay |
-| Screen lock password requirement | windows, linux, macos | ISO A.8.1; ISO A.7.7; ISO A.8.5; GDPR Art. 32(1)(b) | A password is required to unlock (macOS: within 5 seconds of the screen locking). | InactivityTimeoutSecs policy or users' ScreenSaverIsSecure; DisableLockWorkstation | gsettings lock-enabled + lockdown disable-lock-screen | sysadminctl -screenLock delay / managed askForPassword |
-| USB storage device access | windows, linux, macos | ISO A.7.10; ISO A.8.12; GDPR Art. 32(1)(b) | Whether USB mass storage devices can connect at all equals USB_DEVICE_ACCESS (allow/deny): driver, device-installation policy, USBGuard or MDM restriction. | RemovableStorageDevices Deny_All policy, USBSTOR service Start | modprobe usb-storage install rule / blacklist / USBGuard | managed com.apple.systemuiserver mount-controls |
-| USB storage read | windows, linux, macos | ISO A.7.10; ISO A.8.12; GDPR Art. 32(1)(b) | Effective USB storage read access equals USB_READ (allow/deny). | RemovableStorageDevices policies (Deny_All, Deny_Read), USBSTOR Start | usb-storage module rules, USBGuard | managed mount-controls (deny) |
-| USB storage write | windows, linux, macos | ISO A.7.10; ISO A.8.12; GDPR Art. 32(1)(b) | Effective USB storage write access equals USB_WRITE (allow/deny). | RemovableStorageDevices Deny_Write, StorageDevicePolicies WriteProtect | udev read-only rules, usb-storage rules, USBGuard | managed mount-controls (deny / read-only) |
-| Approved IT administrator | windows, linux, macos | ISO A.8.2; ISO A.5.15; GDPR Art. 32(1)(b) | At least one account listed in APPROVED_ADMINS is an enabled administrator. | Administrators group by SID S-1-5-32-544 (ADSI) + Get-LocalUser | getent group sudo/admin/wheel, UID 0 accounts, /etc/sudoers(.d) | dscl . -read /Groups/admin GroupMembership |
-| Unauthorized employee administrator accounts / Unauthorized employee local administrator accounts | windows, linux, macos | ISO A.8.2; ISO A.5.18; GDPR Art. 32(1)(b) | No administrator accounts other than APPROVED_ADMINS (and the disabled built-in Administrator on Windows). | Administrators group by SID S-1-5-32-544 (ADSI) + Get-LocalUser | getent group sudo/admin/wheel, UID 0 accounts, /etc/sudoers(.d) | dscl . -read /Groups/admin GroupMembership |
-| BitLocker | windows | ISO A.8.24; ISO A.8.1; GDPR Art. 32(1)(a) | BitLocker is turned on for the system drive. | Get-BitLockerVolume (system drive): VolumeStatus | — | — |
-| Encryption | windows, linux, macos | ISO A.8.24; ISO A.8.1; GDPR Art. 32(1)(a) | The system disk is fully encrypted (BitLocker / LUKS / FileVault). | Get-BitLockerVolume: VolumeStatus, EncryptionPercentage | findmnt / + lsblk (crypt device under /) | fdesetup status |
-| Disk encryption protection / BitLocker protection | windows, linux, macos | ISO A.8.24; GDPR Art. 32(1)(a) | Encryption protection is active (not suspended or in progress) with a strong cipher. | Get-BitLockerVolume: ProtectionStatus, EncryptionMethod | cryptsetup status (type, cipher, key size) | fdesetup status (no encryption in progress) |
-| Disk encryption recovery / BitLocker recovery | windows, linux, macos | ISO A.8.24; ISO A.8.13; GDPR Art. 32(1)(a); GDPR Art. 32(1)(c) | A recovery key or second unlock method exists. | Get-BitLockerVolume: KeyProtector (RecoveryPassword) | cryptsetup luksDump (key slots, tokens) | fdesetup haspersonalrecoverykey / hasinstitutionalrecoverykey |
-| Signed-in user account type | windows, linux, macos | ISO A.8.2; ISO A.5.15; GDPR Art. 32(1)(b) | The everyday signed-in user is a Standard account (not an administrator), unless listed in APPROVED_ADMINS. | signed-in user (Win32_ComputerSystem) vs Administrators group | session users (loginctl) vs sudo/admin/wheel | console user (stat /dev/console) + dsmemberutil checkmembership |
-| Pending security updates | windows, linux, macos | ISO A.8.8; GDPR Art. 32(1)(b); GDPR Art. 32(1)(d) | Security updates offered by the OS vendor but not yet installed <= MAX_PENDING_SECURITY_UPDATES. | Windows Update Agent API (Microsoft.Update.Session search) - needs internet | apt-get -s upgrade (security) / dnf updateinfo --security - uses local package lists | softwareupdate -l - needs internet |
-| Outdated third-party applications | windows, linux, macos | ISO A.8.8; ISO A.8.19; GDPR Art. 32(1)(b) | Installed third-party applications with a newer version available <= MAX_OUTDATED_APPS (Windows: winget; macOS: app versions; Linux: snap/flatpak and packages). | winget upgrade | apt upgradable, snap refresh --list, flatpak updates | brew outdated (Homebrew; App Store apps not covered) |
-| Known vulnerabilities in installed software | windows, linux, macos | ISO A.8.8; GDPR Art. 32(1)(b) | Installed software versions matched against an offline copy of the OSV/NVD vulnerability data: critical or high vulnerabilities <= MAX_CRITICAL_HIGH_VULNERABILITIES. | installed programs (machine and per-user uninstall registry) matched by the app against the signed offline bundle (NVD ranges, CISA KEV, EPSS) | dpkg/rpm package list (with source packages) matched by the app against the signed offline bundle (OSV: Ubuntu, Debian, RHEL, AlmaLinux, Rocky) | app bundle versions (/Applications, ~/Applications) matched by the app against the signed offline bundle (NVD ranges, CISA KEV, EPSS) |
+| Check | Applies to | References | Rule | Windows source | Linux source | macOS source | iPhone source | Android source |
+|---|---|---|---|---|---|---|---|---|
+| Minimum password length | windows, linux, macos | ISO A.5.17; ISO A.8.5; GDPR Art. 32(1)(b) | Configured minimum length >= PASSWORD_MIN_LENGTH. | secedit export: MinimumPasswordLength | PAM pam_pwquality minlen (/etc/security/pwquality.conf, PAM args) | pwpolicy -getaccountpolicies (minLength / regex) | — | — |
+| Password history | windows, linux, macos | ISO A.5.17; ISO A.8.5; GDPR Art. 32(1)(b) | Remembered passwords >= PASSWORD_HISTORY. | secedit export: PasswordHistorySize | pam_pwhistory remember (PAM args, /etc/security/pwhistory.conf) | pwpolicy: policyAttributePasswordHistoryDepth | — | — |
+| Password expiration | windows, linux, macos | ISO A.5.17; GDPR Art. 32(1)(b) | Passwords expire after 1..PASSWORD_MAX_AGE_DAYS days (0 in the baseline = expiry not required). | secedit export: MaximumPasswordAge | /etc/login.defs PASS_MAX_DAYS + /etc/shadow per account | pwpolicy: policyAttributeExpiresEveryNDays | — | — |
+| Minimum password age | windows, linux, macos | ISO A.5.17; GDPR Art. 32(1)(b) | Minimum age >= PASSWORD_MIN_AGE_DAYS days. macOS has no such setting (NotApplicable). | secedit export: MinimumPasswordAge | /etc/login.defs PASS_MIN_DAYS + /etc/shadow per account | not available on macOS (NotApplicable) | — | — |
+| Password complexity | windows, linux, macos | ISO A.5.17; ISO A.8.5; GDPR Art. 32(1)(b) | Complexity enforced (mixed character classes). | secedit export: PasswordComplexity | pam_pwquality minclass / dcredit-ucredit-lcredit-ocredit | pwpolicy: alpha + numeric requirements | — | — |
+| Account lockout threshold | windows, linux, macos | ISO A.8.5; GDPR Art. 32(1)(b) | Lockout after 1..LOCKOUT_THRESHOLD_MAX failed attempts (0 = never locks). | secedit export: LockoutBadCount | pam_faillock deny (PAM args, /etc/security/faillock.conf) | pwpolicy: policyAttributeMaximumFailedAuthentications | — | — |
+| Account lockout duration | windows, linux, macos | ISO A.8.5; GDPR Art. 32(1)(b) | Locked for >= LOCKOUT_DURATION_MIN_MINUTES minutes, or until an administrator unlocks. | secedit export: LockoutDuration | pam_faillock unlock_time | pwpolicy: autoEnableInSeconds | — | — |
+| Lockout observation period | windows, linux, macos | ISO A.8.5; GDPR Art. 32(1)(b) | Failed-attempt counter kept for >= LOCKOUT_OBSERVATION_MIN_MINUTES minutes. | secedit export: ResetLockoutCount | pam_faillock fail_interval | pwpolicy: autoEnableInSeconds (counter resets with lockout) | — | — |
+| Antivirus / Google Play Protect | windows, linux, macos, android | ISO A.8.7; GDPR Art. 32(1)(b) | An enabled, up-to-date antivirus product is present. Android: Google Play Protect scanning is on. | Security Center (root/SecurityCenter2 AntiVirusProduct) | systemd services: clamav-daemon, mdatp, falcon-sensor, sentinelone, sophos-spl, esets | XProtect version (xprotect version) + running third-party agents | — | asked: Play Store › your profile picture › Play Protect › Settings (gear icon) |
+| Malware protection service / Apple malware protection service / ClamAV malware protection service / Microsoft Defender Antimalware | windows, linux, macos | ISO A.8.7; GDPR Art. 32(1)(b) | The platform malware protection service is running. | Get-MpComputerStatus: AMServiceEnabled, AntivirusEnabled | systemctl is-active clamav-daemon / clamd | xprotect status + spctl --status (Gatekeeper) | — | — |
+| Real-time protection | windows | ISO A.8.7; GDPR Art. 32(1)(b) | Defender real-time protection is on. | Get-MpComputerStatus: RealTimeProtectionEnabled | — | — | — | — |
+| On-access malware protection / On-access protection | windows, linux, macos | ISO A.8.7; GDPR Art. 32(1)(b) | Files are scanned when opened. macOS: NotApplicable unless a third-party scanner provides it. | Get-MpComputerStatus: OnAccessProtectionEnabled | clamav-clamonacc service / clamonacc process | third-party agent only (XProtect has no on-access scan) | — | — |
+| Tamper protection | windows | ISO A.8.7; GDPR Art. 32(1)(b) | Defender tamper protection is on. | Get-MpComputerStatus: IsTamperProtected | — | — | — | — |
+| Malware signatures / Malware protection signatures / Security intelligence | windows, linux, macos | ISO A.8.7; ISO A.8.8; GDPR Art. 32(1)(b) | Signatures no older than SIGNATURE_MAX_AGE_DAYS (macOS XProtect: MACOS_XPROTECT_MAX_AGE_DAYS). | Get-MpComputerStatus: AntivirusSignatureAge | age of /var/lib/clamav/daily.c[lv]d | XProtect install date (xprotect version / XProtect.meta.plist) | — | — |
+| Malware signature updates / Malware security updates | linux, macos | ISO A.8.7; ISO A.8.8; GDPR Art. 32(1)(b) | Automatic signature/security-data updates are enabled. | — | systemctl is-active clamav-freshclam | com.apple.SoftwareUpdate ConfigDataInstall + CriticalUpdateInstall | — | — |
+| Firewall | linux, macos | ISO A.8.20; ISO A.8.1; GDPR Art. 32(1)(b) | A host firewall is active. | — | ufw status / firewalld / nft list ruleset / iptables -S | socketfilterfw --getglobalstate | — | — |
+| Firewall inbound policy | linux, macos | ISO A.8.20; GDPR Art. 32(1)(b) | Unsolicited inbound traffic is blocked by default (macOS: firewall on with stealth mode). | — | ufw default incoming / firewalld zone target / nft input policy | socketfilterfw --getstealthmode | — | — |
+| Firewall outbound policy | linux, macos | ISO A.8.20; GDPR Art. 32(1)(b) | Default outbound policy equals FIREWALL_OUTBOUND. | — | ufw default outgoing / nft output policy | application firewall is inbound-only | — | — |
+| Domain firewall | windows | ISO A.8.20; ISO A.8.1; GDPR Art. 32(1)(b) | Domain profile enabled. | Get-NetFirewallProfile -PolicyStore ActiveStore (Domain) | — | — | — | — |
+| Domain inbound | windows | ISO A.8.20; GDPR Art. 32(1)(b) | Domain profile default inbound action is Block. | Get-NetFirewallProfile: DefaultInboundAction (Domain) | — | — | — | — |
+| Domain outbound | windows | ISO A.8.20; GDPR Art. 32(1)(b) | Domain profile default outbound action equals FIREWALL_OUTBOUND. | Get-NetFirewallProfile: DefaultOutboundAction (Domain) | — | — | — | — |
+| Private firewall | windows | ISO A.8.20; ISO A.8.1; GDPR Art. 32(1)(b) | Private profile enabled. | Get-NetFirewallProfile -PolicyStore ActiveStore (Private) | — | — | — | — |
+| Private inbound | windows | ISO A.8.20; GDPR Art. 32(1)(b) | Private profile default inbound action is Block. | Get-NetFirewallProfile: DefaultInboundAction (Private) | — | — | — | — |
+| Private outbound | windows | ISO A.8.20; GDPR Art. 32(1)(b) | Private profile default outbound action equals FIREWALL_OUTBOUND. | Get-NetFirewallProfile: DefaultOutboundAction (Private) | — | — | — | — |
+| Public firewall | windows | ISO A.8.20; ISO A.8.1; GDPR Art. 32(1)(b) | Public profile enabled. | Get-NetFirewallProfile -PolicyStore ActiveStore (Public) | — | — | — | — |
+| Public inbound | windows | ISO A.8.20; GDPR Art. 32(1)(b) | Public profile default inbound action is Block. | Get-NetFirewallProfile: DefaultInboundAction (Public) | — | — | — | — |
+| Public outbound | windows | ISO A.8.20; GDPR Art. 32(1)(b) | Public profile default outbound action equals FIREWALL_OUTBOUND. | Get-NetFirewallProfile: DefaultOutboundAction (Public) | — | — | — | — |
+| Screen lock / Passcode | windows, linux, macos, ios, android | ISO A.8.1; ISO A.7.7; GDPR Art. 32(1)(b) | The screen locks when idle (Windows: machine inactivity limit or a password-protected screen saver). Phones: a passcode / PIN / password screen lock is set. | InactivityTimeoutSecs policy or users' ScreenSaveActive/ScreenSaverIsSecure (HKU) | gsettings org.gnome.desktop.screensaver lock-enabled + session idle-delay (per user) | sysadminctl -screenLock status / managed com.apple.screensaver | detected: WebAuthn platform authenticator available; otherwise asked; asked: Settings › Face ID & Passcode (or Touch ID & Passcode). If it asks for your passcode before opening, one is set. | detected: WebAuthn platform authenticator available; otherwise asked; asked: Settings › Security & privacy › Device unlock › Screen lock (names vary by phone maker) |
+| Screen lock timeout / Auto-Lock / Screen timeout | windows, linux, macos, ios, android | ISO A.8.1; ISO A.7.7; GDPR Art. 32(1)(b) | Idle time before lock (including any grace delay) is 1..SCREEN_LOCK_MAX_SECONDS seconds (baseline: 300 = 5 minutes). Phones: Auto-Lock / screen timeout. | InactivityTimeoutSecs policy or users' ScreenSaveTimeOut (HKU) | gsettings idle-delay + lock-delay (per user) | screen saver idleTime + pmset displaysleep + password delay | asked: Settings › Display & Brightness › Auto-Lock | asked: Settings › Display › Screen timeout. If there is also 'Lock after screen timeout', it should be Immediately. |
+| Screen lock password requirement | windows, linux, macos | ISO A.8.1; ISO A.7.7; ISO A.8.5; GDPR Art. 32(1)(b) | A password is required to unlock (macOS: within 5 seconds of the screen locking). | InactivityTimeoutSecs policy or users' ScreenSaverIsSecure; DisableLockWorkstation | gsettings lock-enabled + lockdown disable-lock-screen | sysadminctl -screenLock delay / managed askForPassword | — | — |
+| Passcode strength / Screen lock strength | ios, android | ISO A.5.17; ISO A.8.5; GDPR Art. 32(1)(b) | Passcode / PIN has at least MOBILE_PASSCODE_MIN_DIGITS digits, or is alphanumeric. Android pattern or swipe locks do not comply. | — | — | — | asked: The code you type to unlock. Settings › Face ID & Passcode › Change Passcode › Passcode Options shows the choices. | asked: Settings › Security & privacy › Device unlock › Screen lock |
+| Operating system integrity / Not jailbroken / Not rooted | ios, android | ISO A.8.1; ISO A.8.7; ISO A.8.19; GDPR Art. 32(1)(b) | The phone is not jailbroken (iOS) or rooted / bootloader-unlocked (Android). | — | — | — | asked: Jailbreaking means deliberately modifying iOS to install apps outside Apple's control. If nobody did this on purpose, answer No. | asked: Rooting means deliberately giving apps full system access. If nobody did this on purpose, answer No. |
+| App sources restricted / Apps only from the App Store / Install unknown apps blocked | ios, android | ISO A.8.1; ISO A.8.7; ISO A.8.19; GDPR Art. 32(1)(b) | Apps are installed only from the official store (no alternative marketplaces, web distribution or unknown sources). | — | — | — | asked: Settings › General › VPN & Device Management lists developer or enterprise profiles. Alternative app marketplaces appear as separate apps. | asked: Settings › Apps › Special app access › Install unknown apps. Every app should show 'Not allowed'. |
+| USB debugging off | android | ISO A.8.1; ISO A.8.19; GDPR Art. 32(1)(b) | Developer options / USB debugging are off. | — | — | — | — | asked: Settings › System › Developer options › USB debugging. If you cannot find Developer options, they are off. |
+| Find and erase a lost device / Find My Device / Find My iPhone | ios, android | ISO A.5.9; ISO A.8.1; GDPR Art. 32(1)(b); GDPR Art. 32(1)(c) | Find My iPhone / Find My Device is on, so a lost phone can be located, locked and erased. | — | — | — | asked: Settings › [your name] › Find My › Find My iPhone | asked: Settings › Google › All services › Find My Device (called Find Hub on newer phones) |
+| USB storage device access | windows, linux, macos | ISO A.7.10; ISO A.8.12; GDPR Art. 32(1)(b) | Whether USB mass storage devices can connect at all equals USB_DEVICE_ACCESS (allow/deny): driver, device-installation policy, USBGuard or MDM restriction. | RemovableStorageDevices Deny_All policy, USBSTOR service Start | modprobe usb-storage install rule / blacklist / USBGuard | managed com.apple.systemuiserver mount-controls | — | — |
+| USB storage read | windows, linux, macos | ISO A.7.10; ISO A.8.12; GDPR Art. 32(1)(b) | Effective USB storage read access equals USB_READ (allow/deny). | RemovableStorageDevices policies (Deny_All, Deny_Read), USBSTOR Start | usb-storage module rules, USBGuard | managed mount-controls (deny) | — | — |
+| USB storage write | windows, linux, macos | ISO A.7.10; ISO A.8.12; GDPR Art. 32(1)(b) | Effective USB storage write access equals USB_WRITE (allow/deny). | RemovableStorageDevices Deny_Write, StorageDevicePolicies WriteProtect | udev read-only rules, usb-storage rules, USBGuard | managed mount-controls (deny / read-only) | — | — |
+| Approved IT administrator | windows, linux, macos | ISO A.8.2; ISO A.5.15; GDPR Art. 32(1)(b) | At least one account listed in APPROVED_ADMINS is an enabled administrator. | Administrators group by SID S-1-5-32-544 (ADSI) + Get-LocalUser | getent group sudo/admin/wheel, UID 0 accounts, /etc/sudoers(.d) | dscl . -read /Groups/admin GroupMembership | — | — |
+| Unauthorized employee administrator accounts / Unauthorized employee local administrator accounts | windows, linux, macos | ISO A.8.2; ISO A.5.18; GDPR Art. 32(1)(b) | No administrator accounts other than APPROVED_ADMINS (and the disabled built-in Administrator on Windows). | Administrators group by SID S-1-5-32-544 (ADSI) + Get-LocalUser | getent group sudo/admin/wheel, UID 0 accounts, /etc/sudoers(.d) | dscl . -read /Groups/admin GroupMembership | — | — |
+| BitLocker | windows | ISO A.8.24; ISO A.8.1; GDPR Art. 32(1)(a) | BitLocker is turned on for the system drive. | Get-BitLockerVolume (system drive): VolumeStatus | — | — | — | — |
+| Encryption / Data protection (encryption) / Device encryption | windows, linux, macos, ios, android | ISO A.8.24; ISO A.8.1; GDPR Art. 32(1)(a) | The system disk is fully encrypted (BitLocker / LUKS / FileVault). Phones: iOS data protection is on when a passcode is set; Android 10+ encrypts by default. | Get-BitLockerVolume: VolumeStatus, EncryptionPercentage | findmnt / + lsblk (crypt device under /) | fdesetup status | derived: on when a passcode is set (iOS data protection) | detected: Android 10+ encrypts by default |
+| Disk encryption protection / BitLocker protection | windows, linux, macos | ISO A.8.24; GDPR Art. 32(1)(a) | Encryption protection is active (not suspended or in progress) with a strong cipher. | Get-BitLockerVolume: ProtectionStatus, EncryptionMethod | cryptsetup status (type, cipher, key size) | fdesetup status (no encryption in progress) | — | — |
+| Disk encryption recovery / BitLocker recovery | windows, linux, macos | ISO A.8.24; ISO A.8.13; GDPR Art. 32(1)(a); GDPR Art. 32(1)(c) | A recovery key or second unlock method exists. | Get-BitLockerVolume: KeyProtector (RecoveryPassword) | cryptsetup luksDump (key slots, tokens) | fdesetup haspersonalrecoverykey / hasinstitutionalrecoverykey | — | — |
+| Signed-in user account type | windows, linux, macos | ISO A.8.2; ISO A.5.15; GDPR Art. 32(1)(b) | The everyday signed-in user is a Standard account (not an administrator), unless listed in APPROVED_ADMINS. | signed-in user (Win32_ComputerSystem) vs Administrators group | session users (loginctl) vs sudo/admin/wheel | console user (stat /dev/console) + dsmemberutil checkmembership | — | — |
+| Pending security updates / Android security update / iOS security updates | windows, linux, macos, ios, android | ISO A.8.8; GDPR Art. 32(1)(b); GDPR Art. 32(1)(d) | Security updates offered by the OS vendor but not yet installed <= MAX_PENDING_SECURITY_UPDATES. Phones: iOS is at the latest security release known to the vulnerability data; Android security patch level is at most MOBILE_PATCH_MAX_AGE_DAYS old. | Windows Update Agent API (Microsoft.Update.Session search) - needs internet | apt-get -s upgrade (security) / dnf updateinfo --security - uses local package lists | softwareupdate -l - needs internet | detected: iOS version vs newest fixed release in the signed phone bundle | asked: Settings › About phone › Android version › Android security update (or Settings › Security & privacy › Updates) |
+| Outdated third-party applications / App updates | windows, linux, macos, ios, android | ISO A.8.8; ISO A.8.19; GDPR Art. 32(1)(b) | Installed third-party applications with a newer version available <= MAX_OUTDATED_APPS (Windows: winget; macOS: app versions; Linux: snap/flatpak and packages). Phones: automatic app updates are on. | winget upgrade | apt upgradable, snap refresh --list, flatpak updates | brew outdated (Homebrew; App Store apps not covered) | asked: Settings › App Store › App Updates | asked: Play Store › your profile picture › Settings › Network preferences › Auto-update apps |
+| Known vulnerabilities in installed software / Known vulnerabilities in iOS | windows, linux, macos, ios | ISO A.8.8; GDPR Art. 32(1)(b) | Installed software versions matched against an offline copy of the OSV/NVD vulnerability data: critical or high vulnerabilities <= MAX_CRITICAL_HIGH_VULNERABILITIES. iOS: the iOS version is matched against NVD iOS/iPadOS records. | installed programs (machine and per-user uninstall registry) matched by the app against the signed offline bundle (NVD ranges, CISA KEV, EPSS) | dpkg/rpm package list (with source packages) matched by the app against the signed offline bundle (OSV: Ubuntu, Debian, RHEL, AlmaLinux, Rocky) | app bundle versions (/Applications, ~/Applications) matched by the app against the signed offline bundle (NVD ranges, CISA KEV, EPSS) | detected: iOS version matched against NVD iOS/iPadOS records in the signed phone bundle | — |
 
-## GDPR TECHNICAL CONTROLS (12)
+## GDPR TECHNICAL CONTROLS (13)
 
-| Check | Applies to | References | Rule | Windows source | Linux source | macOS source |
-|---|---|---|---|---|---|---|
-| Automatic security updates | windows, linux, macos | ISO A.8.8; GDPR Art. 32(1)(b) | Security updates are downloaded and installed automatically. | WindowsUpdate\AU policy (NoAutoUpdate, AUOptions), wuauserv start type | apt-config Unattended-Upgrade / dnf-automatic timer | com.apple.SoftwareUpdate AutomaticCheck/Download/Install keys |
-| Security updates installed recently | windows, linux, macos | ISO A.8.8; GDPR Art. 32(1)(b); GDPR Art. 32(1)(d) | Last successful update/package change within UPDATES_MAX_AGE_DAYS days. | Windows Update history (COM) or Get-HotFix | /var/log/apt/history.log / rpm -qa --last | /Library/Receipts/InstallHistory.plist (softwareupdated) |
-| Supported operating system version | windows, linux, macos | ISO A.8.8; GDPR Art. 32(1)(b) | The OS version still receives security updates (minimums in the baseline). | Win32_OperatingSystem BuildNumber vs WINDOWS_MIN_BUILD | /etc/os-release VERSION_ID vs baseline minimum | sw_vers -productVersion vs MACOS_MIN_MAJOR |
-| Security event logging | windows, linux, macos | ISO A.8.15; GDPR Art. 32(1)(d); GDPR Art. 33 | Logon and account-change events are recorded (Windows audit policy, Linux auditd, macOS unified log). | auditpol /backup (Logon, User Account Management) + legacy audit policy | systemctl is-active auditd, journal persistence | logd running (unified logging) |
-| Time synchronisation | windows, linux, macos | ISO A.8.17; GDPR Art. 33 | The clock is synchronised from a time server. | W32Time Parameters Type + service start type | timedatectl NTP / chronyd / ntpd | systemsetup -getusingnetworktime (needs root) |
-| Backup configured | windows, linux, macos | ISO A.8.13; GDPR Art. 32(1)(c) | A backup solution is configured for user data. | OneDrive KFM policy, File History config, backup agent services | Timeshift config, Deja Dup (gsettings), restic/borg timers | tmutil destinationinfo, backup agent processes |
-| Recent backup | windows, linux, macos | ISO A.8.13; GDPR Art. 32(1)(c) | Last backup within BACKUP_MAX_AGE_DAYS days (Pending when the date cannot be read). | not readable for most tools (Pending) | Timeshift snapshot names, Deja Dup last-backup | tmutil latestbackup |
-| Removable media encryption | windows, linux, macos | ISO A.7.10; ISO A.8.24; GDPR Art. 32(1)(a); GDPR Art. 34 | Data cannot be written to unencrypted removable drives. | FVE RDVDenyWriteAccess (BitLocker To Go) or USB write denied | USB write denied | USB write denied |
-| Guest account disabled | windows, linux, macos | ISO A.5.16; ISO A.8.5; GDPR Art. 32(1)(b) | No enabled guest login. | Get-LocalUser (SID -501): Enabled | LightDM allow-guest, 'guest' account shell | com.apple.loginwindow GuestEnabled, SMB AllowGuestAccess |
-| Remote access services restricted | windows, linux, macos | ISO A.8.20; ISO A.6.7; GDPR Art. 32(1)(b) | Only remote access services listed in APPROVED_REMOTE_SERVICES are enabled. | fDenyTSConnections (RDP), sshd/WinRM/TeamViewer/AnyDesk/chromoting services, non-admin SMB shares | ssh/xrdp/vnc/samba/teamviewer/anydesk/chrome-remote-desktop | launchctl print-disabled (sshd, screensharing, smbd, chromoting), ARDAgent/TeamViewer/AnyDesk |
-| Diagnostic data minimised | windows, linux, macos | ISO A.5.34; GDPR Art. 5(1)(c); GDPR Art. 25 | OS diagnostic/usage data sharing is at the minimum level. | DataCollection AllowTelemetry (policy / Settings) | popularity-contest, whoopsie | DiagnosticMessagesHistory AutoSubmit, ThirdPartyDataSubmit |
-| Personal data discovery | windows, linux, macos | ISO A.5.34; ISO A.5.12; GDPR Art. 5(1)(c); GDPR Art. 5(1)(e); GDPR Art. 30 | Opt-in scan of user folders for personal data patterns (counts and paths only). Not implemented in stage 1: NotApplicable. | planned opt-in scan | planned opt-in scan | planned opt-in scan |
+| Check | Applies to | References | Rule | Windows source | Linux source | macOS source | iPhone source | Android source |
+|---|---|---|---|---|---|---|---|---|
+| Automatic security updates / Automatic iOS updates / Automatic system updates | windows, linux, macos, ios, android | ISO A.8.8; GDPR Art. 32(1)(b) | Security updates are downloaded and installed automatically. | WindowsUpdate\AU policy (NoAutoUpdate, AUOptions), wuauserv start type | apt-config Unattended-Upgrade / dnf-automatic timer | com.apple.SoftwareUpdate AutomaticCheck/Download/Install keys | asked: Settings › General › Software Update › Automatic Updates | asked: Settings › System › Software updates (names vary: 'Auto download over Wi-Fi', 'Automatic system updates') |
+| Security updates installed recently | windows, linux, macos | ISO A.8.8; GDPR Art. 32(1)(b); GDPR Art. 32(1)(d) | Last successful update/package change within UPDATES_MAX_AGE_DAYS days. | Windows Update history (COM) or Get-HotFix | /var/log/apt/history.log / rpm -qa --last | /Library/Receipts/InstallHistory.plist (softwareupdated) | — | — |
+| Supported operating system version | windows, linux, macos, ios, android | ISO A.8.8; GDPR Art. 32(1)(b) | The OS version still receives security updates (minimums in the baseline). Phones: IOS_MIN_MAJOR / ANDROID_MIN_MAJOR. | Win32_OperatingSystem BuildNumber vs WINDOWS_MIN_BUILD | /etc/os-release VERSION_ID vs baseline minimum | sw_vers -productVersion vs MACOS_MIN_MAJOR | detected: OS version (Safari version on iOS 26+, client hints on Android), confirmed by the user | detected: OS version (Safari version on iOS 26+, client hints on Android), confirmed by the user |
+| Security event logging | windows, linux, macos | ISO A.8.15; GDPR Art. 32(1)(d); GDPR Art. 33 | Logon and account-change events are recorded (Windows audit policy, Linux auditd, macOS unified log). | auditpol /backup (Logon, User Account Management) + legacy audit policy | systemctl is-active auditd, journal persistence | logd running (unified logging) | — | — |
+| Time synchronisation / Date & time set automatically | windows, linux, macos, ios, android | ISO A.8.17; GDPR Art. 33 | The clock is synchronised from a time server. | W32Time Parameters Type + service start type | timedatectl NTP / chronyd / ntpd | systemsetup -getusingnetworktime (needs root) | asked: Settings › General › Date & Time | asked: Settings › System › Date & time |
+| Backup configured / Google backup / iCloud Backup | windows, linux, macos, ios, android | ISO A.8.13; GDPR Art. 32(1)(c) | A backup solution is configured for user data. | OneDrive KFM policy, File History config, backup agent services | Timeshift config, Deja Dup (gsettings), restic/borg timers | tmutil destinationinfo, backup agent processes | asked: Settings › [your name] › iCloud › iCloud Backup | asked: Settings › Google › Backup (or Settings › System › Backup; Samsung: Accounts and backup) |
+| Recent backup | windows, linux, macos | ISO A.8.13; GDPR Art. 32(1)(c) | Last backup within BACKUP_MAX_AGE_DAYS days (Pending when the date cannot be read). | not readable for most tools (Pending) | Timeshift snapshot names, Deja Dup last-backup | tmutil latestbackup | — | — |
+| Removable media encryption | windows, linux, macos | ISO A.7.10; ISO A.8.24; GDPR Art. 32(1)(a); GDPR Art. 34 | Data cannot be written to unencrypted removable drives. | FVE RDVDenyWriteAccess (BitLocker To Go) or USB write denied | USB write denied | USB write denied | — | — |
+| Guest account disabled | windows, linux, macos | ISO A.5.16; ISO A.8.5; GDPR Art. 32(1)(b) | No enabled guest login. | Get-LocalUser (SID -501): Enabled | LightDM allow-guest, 'guest' account shell | com.apple.loginwindow GuestEnabled, SMB AllowGuestAccess | — | — |
+| Remote access services restricted | windows, linux, macos | ISO A.8.20; ISO A.6.7; GDPR Art. 32(1)(b) | Only remote access services listed in APPROVED_REMOTE_SERVICES are enabled. | fDenyTSConnections (RDP), sshd/WinRM/TeamViewer/AnyDesk/chromoting services, non-admin SMB shares | ssh/xrdp/vnc/samba/teamviewer/anydesk/chrome-remote-desktop | launchctl print-disabled (sshd, screensharing, smbd, chromoting), ARDAgent/TeamViewer/AnyDesk | — | — |
+| Diagnostic data minimised / Analytics sharing minimised / Usage & diagnostics sharing minimised | windows, linux, macos, ios, android | ISO A.5.34; GDPR Art. 5(1)(c); GDPR Art. 25 | OS diagnostic/usage data sharing is at the minimum level. | DataCollection AllowTelemetry (policy / Settings) | popularity-contest, whoopsie | DiagnosticMessagesHistory AutoSubmit, ThirdPartyDataSubmit | asked: Settings › Privacy & Security › Analytics & Improvements | asked: Settings › Google › All services › Usage & diagnostics (also check the phone maker's diagnostics option) |
+| Notification content hidden on the lock screen / Notification previews hidden when locked / Sensitive notifications hidden when locked | ios, android | ISO A.7.7; ISO A.8.1; GDPR Art. 5(1)(f); GDPR Art. 32(1)(b) | Message and email previews are not shown on the locked screen. | — | — | — | asked: Settings › Notifications › Show Previews | asked: Settings › Notifications › Notifications on lock screen (or Settings › Privacy) |
+| Personal data discovery | windows, linux, macos | ISO A.5.34; ISO A.5.12; GDPR Art. 5(1)(c); GDPR Art. 5(1)(e); GDPR Art. 30 | Opt-in scan of user folders for personal data patterns (counts and paths only). Not implemented in stage 1: NotApplicable. | planned opt-in scan | planned opt-in scan | planned opt-in scan | — | — |
 
 ## EU AI ACT CONTROLS (5)
 
-| Check | Applies to | References | Rule | Windows source | Linux source | macOS source |
-|---|---|---|---|---|---|---|
-| AI software inventory | windows, linux, macos | ISO A.5.9; GDPR Art. 30; AI Act Art. 26 | AI apps, local AI services and local model folders are listed (Compliant = inventory taken). | uninstall registry + Store apps (AI apps), port 11434, model folders, Claude Code CLI | AI CLIs, snaps, flatpaks, /opt apps, port 11434, model folders | /Applications AI apps, AI CLIs, port 11434, model folders |
-| Unapproved AI tools (shadow AI) | windows, linux, macos | ISO A.5.9; ISO A.8.19; GDPR Art. 28; GDPR Art. 44; AI Act Art. 26 | Every AI tool found is listed in APPROVED_AI_TOOLS. | AI inventory vs APPROVED_AI_TOOLS | AI inventory vs APPROVED_AI_TOOLS | AI inventory vs APPROVED_AI_TOOLS |
-| AI system risk classification | windows, linux, macos | ISO A.5.9; AI Act Art. 5; AI Act Art. 6; AI Act Annex III | Each AI tool found is classified (prohibited / high-risk / limited / minimal). Done by the auditor model: Pending in the collector output, NotApplicable when no AI tool is found. | AI inventory, classified by the model | AI inventory, classified by the model | AI inventory, classified by the model |
-| Operating system AI features restricted / Apple Intelligence external integrations restricted / Windows Recall / Copilot data analysis disabled | windows, linux, macos | ISO A.5.34; GDPR Art. 5(1)(c); GDPR Art. 25; AI Act Art. 26 | OS-level AI features that capture or send user data are disabled by policy. NotApplicable where the OS has none. | WindowsAI policies (DisableAIDataAnalysis, AllowRecallEnablement), Recall optional feature | none built in (NotApplicable) | managed com.apple.applicationaccess allowExternalIntelligenceIntegrations (Apple silicon) |
-| AI usage log retention | windows, linux, macos | ISO A.8.15; AI Act Art. 26(6) | Logs kept >= 6 months if a high-risk AI system is used. Pending until classification; NotApplicable when no AI tool is found. | depends on AI classification | depends on AI classification | depends on AI classification |
+| Check | Applies to | References | Rule | Windows source | Linux source | macOS source | iPhone source | Android source |
+|---|---|---|---|---|---|---|---|---|
+| AI software inventory | windows, linux, macos, ios, android | ISO A.5.9; GDPR Art. 30; AI Act Art. 26 | AI apps, local AI services and local model folders are listed (Compliant = inventory taken). | uninstall registry + Store apps (AI apps), port 11434, model folders, Claude Code CLI | AI CLIs, snaps, flatpaks, /opt apps, port 11434, model folders | /Applications AI apps, AI CLIs, port 11434, model folders | asked: AI apps installed (checklist); classified by the auditor model | asked: AI apps installed (checklist); classified by the auditor model |
+| Unapproved AI tools (shadow AI) | windows, linux, macos, ios, android | ISO A.5.9; ISO A.8.19; GDPR Art. 28; GDPR Art. 44; AI Act Art. 26 | Every AI tool found is listed in APPROVED_AI_TOOLS. | AI inventory vs APPROVED_AI_TOOLS | AI inventory vs APPROVED_AI_TOOLS | AI inventory vs APPROVED_AI_TOOLS | asked: AI apps installed (checklist); classified by the auditor model | asked: AI apps installed (checklist); classified by the auditor model |
+| AI system risk classification | windows, linux, macos, ios, android | ISO A.5.9; AI Act Art. 5; AI Act Art. 6; AI Act Annex III | Each AI tool found is classified (prohibited / high-risk / limited / minimal). Done by the auditor model: Pending in the collector output, NotApplicable when no AI tool is found. | AI inventory, classified by the model | AI inventory, classified by the model | AI inventory, classified by the model | asked: AI apps installed (checklist); classified by the auditor model | asked: AI apps installed (checklist); classified by the auditor model |
+| Operating system AI features restricted / AI assistant access restricted / Apple Intelligence external integrations restricted / Windows Recall / Copilot data analysis disabled | windows, linux, macos, ios, android | ISO A.5.34; GDPR Art. 5(1)(c); GDPR Art. 25; AI Act Art. 26 | OS-level AI features that capture or send user data are disabled by policy. NotApplicable where the OS has none. Phones: external AI integrations (ChatGPT in Apple Intelligence, assistant access to screen content) are off unless approved. | WindowsAI policies (DisableAIDataAnalysis, AllowRecallEnablement), Recall optional feature | none built in (NotApplicable) | managed com.apple.applicationaccess allowExternalIntelligenceIntegrations (Apple silicon) | asked: Settings › Apple Intelligence & Siri › ChatGPT (only on iPhones that support Apple Intelligence) | asked: Gemini app › your profile picture › Settings › 'Screen context' / 'Use screen context' (other assistants have similar options) |
+| AI usage log retention | windows, linux, macos, ios, android | ISO A.8.15; AI Act Art. 26(6) | Logs kept >= 6 months if a high-risk AI system is used. Pending until classification; NotApplicable when no AI tool is found. | depends on AI classification | depends on AI classification | depends on AI classification | asked: AI apps installed (checklist); classified by the auditor model | asked: AI apps installed (checklist); classified by the auditor model |
 
 ## ORGANISATIONAL CONTROLS (8)
 
-| Check | Applies to | References | Rule | Windows source | Linux source | macOS source |
-|---|---|---|---|---|---|---|
-| Record of processing activities | windows, linux, macos | ISO A.5.34; GDPR Art. 30 | Answer yes = Compliant, no/partial = Non-Compliant, n/a = NotApplicable, unanswered = Pending. | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation) |
-| Data protection impact assessment | windows, linux, macos | ISO A.5.34; GDPR Art. 35 | As above. | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation) |
-| Breach response procedure | windows, linux, macos | ISO A.5.24; ISO A.5.26; GDPR Art. 33; GDPR Art. 34 | As above. | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation) |
-| Data processing agreements | windows, linux, macos | ISO A.5.20; GDPR Art. 28 | As above. | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation) |
-| AI register | windows, linux, macos | ISO A.5.9; AI Act Art. 26 | As above. | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation) |
-| AI literacy training | windows, linux, macos | ISO A.6.3; AI Act Art. 4 | As above. | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation) |
-| Human oversight for high-risk AI | windows, linux, macos | AI Act Art. 14; AI Act Art. 26 | As above. | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation) |
-| AI transparency to users | windows, linux, macos | AI Act Art. 50 | As above. | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation) |
+| Check | Applies to | References | Rule | Windows source | Linux source | macOS source | iPhone source | Android source |
+|---|---|---|---|---|---|---|---|---|
+| Record of processing activities | windows, linux, macos, ios, android | ISO A.5.34; GDPR Art. 30 | Answer yes = Compliant, no/partial = Non-Compliant, n/a = NotApplicable, unanswered = Pending. | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation); Pending in a phone check unless passed in the link | organisational.conf (answered once by the organisation); Pending in a phone check unless passed in the link |
+| Data protection impact assessment | windows, linux, macos, ios, android | ISO A.5.34; GDPR Art. 35 | As above. | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation); Pending in a phone check unless passed in the link | organisational.conf (answered once by the organisation); Pending in a phone check unless passed in the link |
+| Breach response procedure | windows, linux, macos, ios, android | ISO A.5.24; ISO A.5.26; GDPR Art. 33; GDPR Art. 34 | As above. | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation); Pending in a phone check unless passed in the link | organisational.conf (answered once by the organisation); Pending in a phone check unless passed in the link |
+| Data processing agreements | windows, linux, macos, ios, android | ISO A.5.20; GDPR Art. 28 | As above. | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation); Pending in a phone check unless passed in the link | organisational.conf (answered once by the organisation); Pending in a phone check unless passed in the link |
+| AI register | windows, linux, macos, ios, android | ISO A.5.9; AI Act Art. 26 | As above. | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation); Pending in a phone check unless passed in the link | organisational.conf (answered once by the organisation); Pending in a phone check unless passed in the link |
+| AI literacy training | windows, linux, macos, ios, android | ISO A.6.3; AI Act Art. 4 | As above. | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation); Pending in a phone check unless passed in the link | organisational.conf (answered once by the organisation); Pending in a phone check unless passed in the link |
+| Human oversight for high-risk AI | windows, linux, macos, ios, android | AI Act Art. 14; AI Act Art. 26 | As above. | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation); Pending in a phone check unless passed in the link | organisational.conf (answered once by the organisation); Pending in a phone check unless passed in the link |
+| AI transparency to users | windows, linux, macos, ios, android | AI Act Art. 50 | As above. | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation) | organisational.conf (answered once by the organisation); Pending in a phone check unless passed in the link | organisational.conf (answered once by the organisation); Pending in a phone check unless passed in the link |
 
 ## Reference titles
 

index.html

@@ -1,155 +1,91 @@
 <!doctype html>
 <html lang="en">
 <head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Endpoint Auditor — Devseis</title>
-<meta name="description" content="Read-only endpoint audit for ISO 27001, GDPR and the EU AI Act. Stage 1, step 1: collectors, evidence format and synthetic data.">
-<style>
-  :root {
-    --bg: #f7f8fb; --card: #ffffff; --text: #16181d; --muted: #5b6270; --line: #e3e6ec;
-    --red: #ED2939; --blue: #00A1DE; --ok: #1a7f37; --bad: #c4242f; --na: #6e7781; --pending: #9a6700; --err: #8250df;
-    --code-bg: #0f1218; --code-text: #e6edf3;
-  }
-  @media (prefers-color-scheme: dark) {
-    :root:not([data-theme="light"]) {
-      --bg: #0d1117; --card: #161b22; --text: #e6edf3; --muted: #9da7b3; --line: #2b313a;
-      --ok: #3fb950; --bad: #ff6b6b; --na: #8b949e; --pending: #d29922; --err: #b392f0; --code-bg: #0a0d12;
-    }
-  }
-  * { box-sizing: border-box; }
-  body { margin: 0; background: var(--bg); color: var(--text); font: 16px/1.55 system-ui, -apple-system, "Segoe UI", Roboto, sans-serif; }
-  main { max-width: 1040px; margin: 0 auto; padding: 32px 16px 64px; }
-  .tag { display: inline-block; font-size: 12px; font-weight: 600; letter-spacing: .04em; text-transform: uppercase; color: var(--red); border: 1px solid var(--red); border-radius: 999px; padding: 2px 10px; }
-  h1 { font-size: clamp(28px, 5vw, 40px); line-height: 1.15; margin: 14px 0 8px; }
-  h2 { font-size: 20px; margin: 36px 0 12px; }
-  p.lead { color: var(--muted); font-size: 18px; max-width: 760px; margin: 0; }
-  .grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(220px, 1fr)); gap: 12px; margin-top: 20px; }
-  .card { background: var(--card); border: 1px solid var(--line); border-radius: 12px; padding: 16px; }
-  .card b { display: block; font-size: 15px; margin-bottom: 4px; }
-  .card span { color: var(--muted); font-size: 14px; }
-  .tabs { display: flex; gap: 8px; flex-wrap: wrap; margin: 12px 0; }
-  .tabs button { font: inherit; font-size: 14px; padding: 6px 14px; border-radius: 999px; border: 1px solid var(--line); background: var(--card); color: var(--text); cursor: pointer; }
-  .tabs button[aria-selected="true"] { background: var(--blue); border-color: var(--blue); color: #fff; }
-  .counts { display: flex; gap: 8px; flex-wrap: wrap; margin-bottom: 12px; }
-  .pill { font-size: 13px; font-weight: 600; padding: 3px 10px; border-radius: 999px; background: var(--card); border: 1px solid var(--line); }
-  .s-Compliant { color: var(--ok); } .s-Non-Compliant { color: var(--bad); } .s-NotApplicable { color: var(--na); }
-  .s-Pending { color: var(--pending); } .s-Error { color: var(--err); }
-  .split { display: grid; grid-template-columns: minmax(0, 1fr) minmax(0, 1.25fr); gap: 12px; }
-  @media (max-width: 760px) { .split { grid-template-columns: 1fr; } }
-  pre { margin: 0; background: var(--code-bg); color: var(--code-text); border-radius: 12px; padding: 14px; font: 12.5px/1.45 ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; overflow: auto; max-height: 560px; }
-  table { width: 100%; border-collapse: collapse; font-size: 13.5px; }
-  .table-wrap { background: var(--card); border: 1px solid var(--line); border-radius: 12px; overflow: auto; max-height: 560px; }
-  th, td { text-align: left; padding: 7px 10px; border-bottom: 1px solid var(--line); vertical-align: top; }
-  th { position: sticky; top: 0; background: var(--card); font-size: 12px; text-transform: uppercase; letter-spacing: .03em; color: var(--muted); }
-  td.ref { color: var(--muted); font-size: 12.5px; }
-  code { font: 13px ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; background: var(--card); border: 1px solid var(--line); border-radius: 6px; padding: 1px 6px; }
-  .note { border-left: 4px solid var(--red); background: var(--card); padding: 12px 16px; border-radius: 0 12px 12px 0; color: var(--muted); }
-  ol li { margin: 4px 0; }
-  a { color: var(--blue); }
-  footer { margin-top: 48px; color: var(--muted); font-size: 14px; }
-</style>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
+  <meta name="description" content="Free, private security and compliance check for your phone (ISO 27001, GDPR, EU AI Act). Runs in your browser; nothing about your phone is uploaded.">
+  <meta name="theme-color" content="#ED2939">
+  <title>Devseis Phone Check</title>
+  <link rel="stylesheet" href="mobile/styles.css">
 </head>
 <body>
-<main>
-  <span class="tag">Experimental · stage 1 · steps 1–3</span>
-  <h1>Devseis Endpoint Auditor</h1>
-  <p class="lead">A read-only audit of Windows, Linux and macOS endpoints against a security baseline, GDPR technical controls, EU AI Act controls and organisational controls — producing a plain report and JSON evidence for a local auditor model.</p>
+  <header class="top">
+    <div class="brand"><span class="mark">D</span><span>Devseis <b>Phone Check</b></span></div>
+    <div id="model-chip" class="chip hidden"></div>
+  </header>
 
-  <div class="grid">
-    <div class="card"><b>Read-only collectors</b><span>PowerShell, Linux shell and macOS shell scripts. They read settings and never change the system.</span></div>
-    <div class="card"><b>One evidence format</b><span>Same JSON for every OS, joined to a catalog with ISO 27001, GDPR and AI Act references.</span></div>
-    <div class="card"><b>Synthetic data</b><span>Realistic evidence with the same rules, so the auditor model can be built before real data exists.</span></div>
-    <div class="card"><b>Runs locally</b><span>Evidence stays on the device. Nothing is sent anywhere.</span></div>
-  </div>
+  <main>
+    <!-- 1. Start -->
+    <section id="s-start" class="screen">
+      <h1>Is this phone ready for work?</h1>
+      <p class="lead">A free check against <b>ISO 27001</b>, <b>GDPR</b> and the <b>EU AI Act</b>, written by the Devseis AI auditor <b>inside your browser</b>.</p>
+      <div id="device-card" class="card device"><span class="muted">Detecting this device…</span></div>
+      <div id="desktop-note" class="card note hidden">
+        <p><b>You are on a computer.</b> The Devseis desktop app audits Windows, macOS and Linux automatically (a web page cannot read a computer's settings).</p>
+        <p>To try the phone check here, choose a phone type:</p>
+        <div class="row"><button class="secondary" data-demo="ios">iPhone</button><button class="secondary" data-demo="android">Android</button></div>
+      </div>
+      <ul class="facts">
+        <li><b>Private:</b> your answers and the report stay on this phone. Only the AI model and vulnerability data are downloaded.</li>
+        <li><b>About 5 minutes:</b> the browser detects what it can; you answer the rest, with help on where to look.</li>
+        <li><b>Honest:</b> every result says whether it was <i>detected</i> or <i>self-reported</i>.</li>
+      </ul>
+      <button id="start" class="primary" disabled>Start the check</button>
+      <p class="muted center"><a href="about.html">About the project</a></p>
+    </section>
 
-  <h2>Sample audit (synthetic)</h2>
-  <div class="tabs" role="tablist" id="tabs"></div>
-  <div class="counts" id="counts"></div>
-  <div class="split">
-    <pre id="report" aria-label="Text report">Loading…</pre>
-    <div class="table-wrap">
-      <table>
-        <thead><tr><th>Check</th><th>Status</th><th>Found</th><th>References</th></tr></thead>
-        <tbody id="rows"></tbody>
-      </table>
-    </div>
-  </div>
+    <!-- 2. Approval -->
+    <section id="s-consent" class="screen hidden">
+      <h1>Before we start</h1>
+      <div class="card">
+        <p><b>What will be checked</b> (<span id="check-count"></span> checks):</p>
+        <ul id="plan" class="plan"></ul>
+      </div>
+      <label class="card toggle">
+        <input type="checkbox" id="use-ai">
+        <span><b>Use the AI auditor</b><br><span id="ai-note" class="muted"></span></span>
+      </label>
+      <p class="muted">Nothing on the phone is changed. You can stop at any time.</p>
+      <div class="row"><button class="secondary" id="consent-back">Back</button><button class="primary" id="consent-ok">I agree, continue</button></div>
+    </section>
 
-  <h2>Roadmap</h2>
-  <ol>
-    <li><b>Collectors, evidence format, catalog, synthetic data</b> — done</li>
-    <li><b>Control library</b> in Devseis's own wording, for retrieval by the model — done</li>
-    <li><b>Training data</b>: evidence → auditor findings (29,000 synthetic examples) — done; expert review pending</li>
-    <li>Fine-tune a small open-weight model to run locally</li>
-    <li>Evaluate on held-out data and publish the scores</li>
-    <li>One installer per OS: detect the OS, run the audit, write the report locally</li>
-  </ol>
+    <!-- 3. Questions -->
+    <section id="s-question" class="screen hidden">
+      <div class="progress"><div id="q-bar" class="bar"></div></div>
+      <p class="muted" id="q-count"></p>
+      <h2 id="q-check" class="check-name"></h2>
+      <h1 id="q-text"></h1>
+      <div class="where"><span class="where-label">Where to look</span><span id="q-where"></span></div>
+      <div id="q-answers" class="answers"></div>
+      <div class="row"><button class="secondary" id="q-back">Back</button></div>
+    </section>
 
-  <p class="note">Not a certification. ISO 27001 certification needs an accredited auditor, and much of GDPR and AI Act compliance is organisational. The tool collects evidence and flags gaps. See the <a href="README.md">README</a> for how to run the collectors.</p>
+    <!-- 4. Writing the report -->
+    <section id="s-work" class="screen hidden">
+      <h1 id="w-title">Writing your report</h1>
+      <p id="w-step" class="muted"></p>
+      <div class="progress big"><div id="w-bar" class="bar"></div></div>
+      <p id="w-current" class="muted"></p>
+    </section>
 
-  <footer>Devseis · <a href="https://huggingface.co/Devseis">huggingface.co/Devseis</a></footer>
-</main>
-<script>
-const SAMPLES = { windows: 'synthetic/samples/synthetic-windows-42000126.json', linux: 'synthetic/samples/synthetic-linux-42000126.json', macos: 'synthetic/samples/synthetic-macos-42000126.json' };
-const LABELS = { windows: 'Windows', linux: 'Linux', macos: 'macOS' };
-const LAYOUT = {
-  windows: { title: 'WINDOWS ENDPOINT SECURITY BASELINE - AUDIT', results: 'COMPLIANCE RESULTS', end: 'END OF READ-ONLY AUDIT', blank: true, extra: ['Build', 'build'] },
-  linux: { title: 'LINUX ENDPOINT SECURITY BASELINE - AUDIT', results: 'LINUX ENDPOINT SECURITY BASELINE - RESULTS', end: 'END OF LINUX ENDPOINT SECURITY BASELINE AUDIT', blank: false, extra: ['Kernel', 'kernel'] },
-  macos: { title: 'macOS ENDPOINT SECURITY BASELINE - AUDIT', results: 'COMPLIANCE RESULTS', end: 'END OF AUDIT', blank: false, extra: ['Build', 'build'] },
-};
-const SECTIONS = [['baseline', null], ['gdpr', 'GDPR TECHNICAL CONTROLS'], ['aiact', 'EU AI ACT CONTROLS'], ['org', 'ORGANISATIONAL CONTROLS']];
-let catalog = null;
+    <!-- 5. Result -->
+    <section id="s-done" class="screen hidden">
+      <div id="result"></div>
+      <div class="actions">
+        <button class="primary" id="share-pdf">Save or share PDF</button>
+        <button class="secondary" id="view-report">View full report</button>
+        <button class="secondary" id="save-json">Download evidence (JSON)</button>
+      </div>
+      <p id="pdf-note" class="muted"></p>
+      <button class="link" id="again">Check again</button>
+    </section>
+  </main>
 
-function render(rec) {
-  const L = LAYOUT[rec.host.os_family], line = '='.repeat(60), pad = s => (s + ' '.repeat(16)).slice(0, 16);
-  const out = [line, ' ' + L.title, line,
-    pad('Hostname') + ': ' + rec.host.hostname, pad('Operating System') + ': ' + rec.host.os_name,
-    pad('OS Version') + ': ' + rec.host.os_version, pad(L.extra[0]) + ': ' + (rec.host[L.extra[1]] || ''),
-    pad('Serial Number') + ': ' + (rec.host.serial_number || ''), pad('Execution User') + ': ' + rec.audit.execution_user,
-    pad('Audit Date') + ': ' + rec.audit.started_at.replace('T', ' ').slice(0, 19), pad('Audit Mode') + ': ' + rec.audit.mode, line];
-  for (const [id, title] of SECTIONS) {
-    if (L.blank) out.push('');
-    out.push(line, ' ' + (title || L.results), line);
-    for (const r of rec.results) if (r.section === id) out.push(r.name, r.status);
-  }
-  out.push(line, ' ' + L.end, line);
-  return out.join('\n');
-}
-
-function refs(id) {
-  const c = catalog && catalog.checks.find(x => x.id === id);
-  if (!c) return '';
-  return [...c.controls.iso27001.map(x => 'ISO ' + x), ...c.controls.gdpr.map(x => 'GDPR ' + x), ...c.controls.ai_act.map(x => 'AI Act ' + x)].join(' · ');
-}
-
-function esc(s) { const d = document.createElement('div'); d.textContent = s; return d.innerHTML; }
-
-async function show(os) {
-  document.querySelectorAll('#tabs button').forEach(b => b.setAttribute('aria-selected', String(b.dataset.os === os)));
-  try {
-    const rec = await (await fetch(SAMPLES[os])).json();
-    document.getElementById('report').textContent = render(rec);
-    document.getElementById('counts').innerHTML = Object.entries(rec.summary)
-      .map(([k, v]) => `<span class="pill s-${k}">${v} ${k}</span>`).join('');
-    document.getElementById('rows').innerHTML = rec.results.map(r =>
-      `<tr><td>${esc(r.name)}</td><td class="s-${r.status}"><b>${r.status}</b></td><td>${esc(r.actual)}</td><td class="ref">${esc(refs(r.id))}</td></tr>`).join('');
-  } catch (e) {
-    document.getElementById('report').textContent = 'Could not load the sample: ' + e.message;
-  }
-}
-
-(async () => {
-  try { catalog = await (await fetch('catalog/checks.json')).json(); } catch (e) { catalog = null; }
-  const tabs = document.getElementById('tabs');
-  for (const os of Object.keys(SAMPLES)) {
-    const b = document.createElement('button');
-    b.textContent = LABELS[os]; b.dataset.os = os; b.setAttribute('role', 'tab');
-    b.addEventListener('click', () => show(os));
-    tabs.appendChild(b);
-  }
-  show('windows');
-})();
-</script>
+  <footer class="foot">
+    Open source by Devseis · <a href="about.html">about</a> ·
+    <a href="https://huggingface.co/spaces/Devseis/endpoint-auditor/tree/main">code (Apache-2.0)</a> ·
+    <a href="https://huggingface.co/datasets/Devseis/endpoint-auditor-synthetic">data (CC BY 4.0)</a> · Not legal advice or a certification.
+  </footer>
+  <script type="module" src="mobile/app.js"></script>
 </body>
 </html>

library/ai_tools.json

@@ -1,27 +1,179 @@
 {
-  "library_version": "0.1.0",
+  "library_version": "0.3.0",
   "note": "Default classifications assume general office use by a deployer. Under the AI Act the risk class depends on the purpose of use, not on the tool alone. Not legal advice.",
   "purpose_rules": {
-    "prohibited": ["Emotion recognition of employees or students (except for medical or safety reasons)", "Social scoring of people", "Manipulative or exploitative techniques that cause significant harm", "Untargeted scraping of facial images to build face recognition databases", "Biometric categorisation inferring sensitive traits such as political views or sexual orientation"],
-    "high_risk_examples": ["Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions", "Assessing creditworthiness or credit scores of individuals", "Deciding access to education or grading students", "Assessing eligibility for public benefits or essential services", "Risk assessment and pricing in life and health insurance", "Biometric identification of people"],
+    "prohibited": [
+      "Emotion recognition of employees or students (except for medical or safety reasons)",
+      "Social scoring of people",
+      "Manipulative or exploitative techniques that cause significant harm",
+      "Untargeted scraping of facial images to build face recognition databases",
+      "Biometric categorisation inferring sensitive traits such as political views or sexual orientation"
+    ],
+    "high_risk_examples": [
+      "Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions",
+      "Assessing creditworthiness or credit scores of individuals",
+      "Deciding access to education or grading students",
+      "Assessing eligibility for public benefits or essential services",
+      "Risk assessment and pricing in life and health insurance",
+      "Biometric identification of people"
+    ],
     "limited_risk": "Chatbots and AI-generated content: people must be told they are dealing with AI, and published deepfakes or AI-written public-interest text must be labelled (Art. 50).",
     "minimal_risk": "Drafting, summarising, translation, coding help and similar general productivity use."
   },
   "tools": {
-    "Microsoft Copilot": { "kind": "Cloud AI assistant", "provider": "Microsoft (US)", "data_location": "Microsoft cloud; enterprise plans keep data under Microsoft's commercial data protection terms", "default_risk": "minimal", "gdpr_notes": "Use the Microsoft 365 work account version covered by the organisation's Microsoft data processing terms; consumer Copilot is not covered." },
-    "ChatGPT": { "kind": "Cloud AI assistant", "provider": "OpenAI (US)", "data_location": "Provider cloud outside the EEA unless an EU data residency plan is used", "default_risk": "minimal", "gdpr_notes": "Needs a business plan with a data processing agreement and a transfer basis (Art. 28, Art. 44); consumer accounts may use prompts for training unless opted out." },
-    "Claude": { "kind": "Cloud AI assistant", "provider": "Anthropic (US)", "data_location": "Provider cloud outside the EEA", "default_risk": "minimal", "gdpr_notes": "Needs a commercial plan with a data processing agreement and a transfer basis (Art. 28, Art. 44)." },
-    "Claude Code": { "kind": "AI coding assistant (command line)", "provider": "Anthropic (US)", "data_location": "Code and prompts sent to the provider's cloud", "default_risk": "minimal", "gdpr_notes": "Source code may contain personal data or secrets; use a commercial plan with a data processing agreement and keep secrets out of repositories." },
-    "Gemini": { "kind": "Cloud AI assistant", "provider": "Google (US)", "data_location": "Provider cloud", "default_risk": "minimal", "gdpr_notes": "Use the Workspace version under the organisation's Google data processing terms; consumer use is not covered." },
-    "Perplexity": { "kind": "Cloud AI search assistant", "provider": "Perplexity (US)", "data_location": "Provider cloud outside the EEA", "default_risk": "minimal", "gdpr_notes": "Needs an enterprise agreement and a transfer basis before work or personal data is entered." },
-    "Cursor": { "kind": "AI code editor", "provider": "Anysphere (US)", "data_location": "Code sent to the provider and its model providers unless privacy mode is enforced", "default_risk": "minimal", "gdpr_notes": "Enforce privacy mode through a business plan and sign a data processing agreement." },
-    "Windsurf": { "kind": "AI code editor", "provider": "US-based provider", "data_location": "Code sent to the provider's cloud", "default_risk": "minimal", "gdpr_notes": "Use a business plan with a data processing agreement and zero-retention settings." },
-    "Ollama": { "kind": "Local model runner", "provider": "Open source (runs locally)", "data_location": "On the device; nothing leaves unless a cloud model is selected", "default_risk": "minimal", "gdpr_notes": "No transfer to a provider, but check each model's licence and keep the local API (port 11434) closed to the network." },
-    "LM Studio": { "kind": "Local model runner", "provider": "Element Labs (runs locally)", "data_location": "On the device", "default_risk": "minimal", "gdpr_notes": "No transfer to a provider; check model licences and whether its local server is exposed." },
-    "GPT4All": { "kind": "Local model runner", "provider": "Nomic AI (runs locally)", "data_location": "On the device unless optional data sharing is enabled", "default_risk": "minimal", "gdpr_notes": "Keep the optional data lake sharing switched off." },
-    "Jan": { "kind": "Local model runner", "provider": "Open source (runs locally)", "data_location": "On the device unless a cloud model is connected", "default_risk": "minimal", "gdpr_notes": "Check whether remote API providers are configured; if so, the cloud provider rules apply." },
-    "Msty": { "kind": "Desktop AI client", "provider": "Desktop app (local and cloud models)", "data_location": "Local, or the cloud provider of any connected model", "default_risk": "minimal", "gdpr_notes": "Treat connected cloud models like the corresponding cloud assistant." },
-    "Alpaca (Ollama client)": { "kind": "Desktop client for local models", "provider": "Open source (runs locally)", "data_location": "On the device", "default_risk": "minimal", "gdpr_notes": "No transfer to a provider; check model licences." },
-    "Hugging Face models": { "kind": "Local model files", "provider": "Various model publishers", "data_location": "On the device", "default_risk": "minimal", "gdpr_notes": "Record which models are present and their licences; the risk class depends on what the models are used for." }
+    "Microsoft Copilot": {
+      "kind": "Cloud AI assistant",
+      "provider": "Microsoft (US)",
+      "data_location": "Microsoft cloud; enterprise plans keep data under Microsoft's commercial data protection terms",
+      "default_risk": "minimal",
+      "gdpr_notes": "Use the Microsoft 365 work account version covered by the organisation's Microsoft data processing terms; consumer Copilot is not covered."
+    },
+    "ChatGPT": {
+      "kind": "Cloud AI assistant",
+      "provider": "OpenAI (US)",
+      "data_location": "Provider cloud outside the EEA unless an EU data residency plan is used",
+      "default_risk": "minimal",
+      "gdpr_notes": "Needs a business plan with a data processing agreement and a transfer basis (Art. 28, Art. 44); consumer accounts may use prompts for training unless opted out."
+    },
+    "Claude": {
+      "kind": "Cloud AI assistant",
+      "provider": "Anthropic (US)",
+      "data_location": "Provider cloud outside the EEA",
+      "default_risk": "minimal",
+      "gdpr_notes": "Needs a commercial plan with a data processing agreement and a transfer basis (Art. 28, Art. 44)."
+    },
+    "Claude Code": {
+      "kind": "AI coding assistant (command line)",
+      "provider": "Anthropic (US)",
+      "data_location": "Code and prompts sent to the provider's cloud",
+      "default_risk": "minimal",
+      "gdpr_notes": "Source code may contain personal data or secrets; use a commercial plan with a data processing agreement and keep secrets out of repositories."
+    },
+    "Gemini": {
+      "kind": "Cloud AI assistant",
+      "provider": "Google (US)",
+      "data_location": "Provider cloud",
+      "default_risk": "minimal",
+      "gdpr_notes": "Use the Workspace version under the organisation's Google data processing terms; consumer use is not covered."
+    },
+    "Perplexity": {
+      "kind": "Cloud AI search assistant",
+      "provider": "Perplexity (US)",
+      "data_location": "Provider cloud outside the EEA",
+      "default_risk": "minimal",
+      "gdpr_notes": "Needs an enterprise agreement and a transfer basis before work or personal data is entered."
+    },
+    "Cursor": {
+      "kind": "AI code editor",
+      "provider": "Anysphere (US)",
+      "data_location": "Code sent to the provider and its model providers unless privacy mode is enforced",
+      "default_risk": "minimal",
+      "gdpr_notes": "Enforce privacy mode through a business plan and sign a data processing agreement."
+    },
+    "Windsurf": {
+      "kind": "AI code editor",
+      "provider": "US-based provider",
+      "data_location": "Code sent to the provider's cloud",
+      "default_risk": "minimal",
+      "gdpr_notes": "Use a business plan with a data processing agreement and zero-retention settings."
+    },
+    "Ollama": {
+      "kind": "Local model runner",
+      "provider": "Open source (runs locally)",
+      "data_location": "On the device; nothing leaves unless a cloud model is selected",
+      "default_risk": "minimal",
+      "gdpr_notes": "No transfer to a provider, but check each model's licence and keep the local API (port 11434) closed to the network."
+    },
+    "LM Studio": {
+      "kind": "Local model runner",
+      "provider": "Element Labs (runs locally)",
+      "data_location": "On the device",
+      "default_risk": "minimal",
+      "gdpr_notes": "No transfer to a provider; check model licences and whether its local server is exposed."
+    },
+    "GPT4All": {
+      "kind": "Local model runner",
+      "provider": "Nomic AI (runs locally)",
+      "data_location": "On the device unless optional data sharing is enabled",
+      "default_risk": "minimal",
+      "gdpr_notes": "Keep the optional data lake sharing switched off."
+    },
+    "Jan": {
+      "kind": "Local model runner",
+      "provider": "Open source (runs locally)",
+      "data_location": "On the device unless a cloud model is connected",
+      "default_risk": "minimal",
+      "gdpr_notes": "Check whether remote API providers are configured; if so, the cloud provider rules apply."
+    },
+    "Msty": {
+      "kind": "Desktop AI client",
+      "provider": "Desktop app (local and cloud models)",
+      "data_location": "Local, or the cloud provider of any connected model",
+      "default_risk": "minimal",
+      "gdpr_notes": "Treat connected cloud models like the corresponding cloud assistant."
+    },
+    "Alpaca (Ollama client)": {
+      "kind": "Desktop client for local models",
+      "provider": "Open source (runs locally)",
+      "data_location": "On the device",
+      "default_risk": "minimal",
+      "gdpr_notes": "No transfer to a provider; check model licences."
+    },
+    "Hugging Face models": {
+      "kind": "Local model files",
+      "provider": "Various model publishers",
+      "data_location": "On the device",
+      "default_risk": "minimal",
+      "gdpr_notes": "Record which models are present and their licences; the risk class depends on what the models are used for."
+    },
+    "Meta AI": {
+      "kind": "Cloud AI assistant (built into WhatsApp, Instagram and Facebook apps)",
+      "provider": "Meta (US)",
+      "data_location": "Provider cloud outside the EEA",
+      "default_risk": "minimal",
+      "gdpr_notes": "Consumer service with no business data processing terms; do not share work or customer data in chats with Meta AI."
+    },
+    "Grok": {
+      "kind": "Cloud AI assistant",
+      "provider": "xAI (US)",
+      "data_location": "Provider cloud outside the EEA",
+      "default_risk": "minimal",
+      "gdpr_notes": "Consumer service; needs an enterprise agreement and a transfer basis before work or personal data is entered."
+    },
+    "DeepSeek": {
+      "kind": "Cloud AI assistant",
+      "provider": "DeepSeek (China)",
+      "data_location": "Provider cloud in the People's Republic of China",
+      "default_risk": "minimal",
+      "gdpr_notes": "No EU adequacy decision for China and no business data processing terms; EU data protection authorities have restricted or investigated it. Do not use with work or personal data."
+    },
+    "Character.AI": {
+      "kind": "AI companion chatbot",
+      "provider": "Character Technologies (US)",
+      "data_location": "Provider cloud outside the EEA",
+      "default_risk": "limited",
+      "gdpr_notes": "Consumer entertainment chatbot; not suitable for work use. Users must be told they are talking to an AI (AI Act Art. 50)."
+    },
+    "Replika": {
+      "kind": "AI companion chatbot",
+      "provider": "Luka (US)",
+      "data_location": "Provider cloud outside the EEA",
+      "default_risk": "limited",
+      "gdpr_notes": "Consumer companion app that collects sensitive personal conversations and has been subject to EU data protection enforcement; not suitable for work use."
+    },
+    "Otter": {
+      "kind": "AI meeting transcription",
+      "provider": "Otter.ai (US)",
+      "data_location": "Provider cloud outside the EEA",
+      "default_risk": "minimal",
+      "gdpr_notes": "Records and transcribes other people's voices: needs a lawful basis and notice to meeting participants, plus a data processing agreement."
+    },
+    "Grammarly": {
+      "kind": "AI writing assistant (keyboard and browser)",
+      "provider": "Grammarly (US)",
+      "data_location": "Provider cloud outside the EEA",
+      "default_risk": "minimal",
+      "gdpr_notes": "Reads everything typed where it is enabled, including personal data; use the business plan with a data processing agreement or disable it in work apps."
+    }
   }
 }

library/check_guidance.json

@@ -1,10 +1,16 @@
 {
-  "library_version": "0.2.0",
+  "library_version": "0.3.0",
   "note": "Per-check guidance used to write findings. Fix steps are written for administrators; prefer central management (Group Policy/Intune, MDM, configuration management) over per-device changes. Review by a security professional before use with customers.",
   "aliases": {
-    "firewall.domain.enabled": "firewall.enabled", "firewall.private.enabled": "firewall.enabled", "firewall.public.enabled": "firewall.enabled",
-    "firewall.domain.inbound": "firewall.inbound", "firewall.private.inbound": "firewall.inbound", "firewall.public.inbound": "firewall.inbound",
-    "firewall.domain.outbound": "firewall.outbound", "firewall.private.outbound": "firewall.outbound", "firewall.public.outbound": "firewall.outbound",
+    "firewall.domain.enabled": "firewall.enabled",
+    "firewall.private.enabled": "firewall.enabled",
+    "firewall.public.enabled": "firewall.enabled",
+    "firewall.domain.inbound": "firewall.inbound",
+    "firewall.private.inbound": "firewall.inbound",
+    "firewall.public.inbound": "firewall.inbound",
+    "firewall.domain.outbound": "firewall.outbound",
+    "firewall.private.outbound": "firewall.outbound",
+    "firewall.public.outbound": "firewall.outbound",
     "encryption.feature": "encryption.enabled"
   },
   "status_notes": {
@@ -15,537 +21,1204 @@
   "checks": {
     "password.min_length": {
       "why": "Short passwords can be guessed or cracked quickly; length is the strongest single factor in password strength.",
-      "risk": { "level": "Medium", "reason": "Weak passwords make account takeover through guessing or credential stuffing easier." },
+      "risk": {
+        "level": "Medium",
+        "reason": "Weak passwords make account takeover through guessing or credential stuffing easier."
+      },
       "fix": {
-        "windows": ["Set Group Policy: Computer Configuration > Windows Settings > Security Settings > Account Policies > Password Policy > Minimum password length = {PASSWORD_MIN_LENGTH} (or the Intune equivalent).", "For a stand-alone device: net accounts /minpwlen:{PASSWORD_MIN_LENGTH}"],
-        "linux": ["Install pam_pwquality (Debian/Ubuntu: apt install libpam-pwquality) and make sure it is listed in the PAM password stack.", "Set minlen = {PASSWORD_MIN_LENGTH} in /etc/security/pwquality.conf."],
-        "macos": ["Deploy a Passcode configuration profile through your MDM with minLength = {PASSWORD_MIN_LENGTH}."]
+        "windows": [
+          "Set Group Policy: Computer Configuration > Windows Settings > Security Settings > Account Policies > Password Policy > Minimum password length = {PASSWORD_MIN_LENGTH} (or the Intune equivalent).",
+          "For a stand-alone device: net accounts /minpwlen:{PASSWORD_MIN_LENGTH}"
+        ],
+        "linux": [
+          "Install pam_pwquality (Debian/Ubuntu: apt install libpam-pwquality) and make sure it is listed in the PAM password stack.",
+          "Set minlen = {PASSWORD_MIN_LENGTH} in /etc/security/pwquality.conf."
+        ],
+        "macos": [
+          "Deploy a Passcode configuration profile through your MDM with minLength = {PASSWORD_MIN_LENGTH}."
+        ]
       },
       "verify": "Re-run the audit; Minimum password length should read {PASSWORD_MIN_LENGTH} or more."
     },
     "password.history": {
       "why": "Without a password history, users can return to old, possibly exposed passwords.",
-      "risk": { "level": "Low", "reason": "Reused passwords keep compromised credentials valid." },
+      "risk": {
+        "level": "Low",
+        "reason": "Reused passwords keep compromised credentials valid."
+      },
       "fix": {
-        "windows": ["Set Group Policy: Account Policies > Password Policy > Enforce password history = {PASSWORD_HISTORY}.", "For a stand-alone device: net accounts /uniquepw:{PASSWORD_HISTORY}"],
-        "linux": ["Add pam_pwhistory to the PAM password stack before pam_unix (e.g. 'password requisite pam_pwhistory.so remember={PASSWORD_HISTORY} use_authtok').", "Or set remember = {PASSWORD_HISTORY} in /etc/security/pwhistory.conf where supported."],
-        "macos": ["Deploy a Passcode configuration profile with pinHistory = {PASSWORD_HISTORY}."]
+        "windows": [
+          "Set Group Policy: Account Policies > Password Policy > Enforce password history = {PASSWORD_HISTORY}.",
+          "For a stand-alone device: net accounts /uniquepw:{PASSWORD_HISTORY}"
+        ],
+        "linux": [
+          "Add pam_pwhistory to the PAM password stack before pam_unix (e.g. 'password requisite pam_pwhistory.so remember={PASSWORD_HISTORY} use_authtok').",
+          "Or set remember = {PASSWORD_HISTORY} in /etc/security/pwhistory.conf where supported."
+        ],
+        "macos": [
+          "Deploy a Passcode configuration profile with pinHistory = {PASSWORD_HISTORY}."
+        ]
       },
       "verify": "Re-run the audit; Password history should read {PASSWORD_HISTORY} or more."
     },
     "password.expiration": {
       "why": "The baseline requires passwords to be changed within a set period, limiting how long a stolen password stays useful.",
-      "risk": { "level": "Low", "reason": "A leaked password can stay valid indefinitely." },
+      "risk": {
+        "level": "Low",
+        "reason": "A leaked password can stay valid indefinitely."
+      },
       "fix": {
-        "windows": ["Set Group Policy: Account Policies > Password Policy > Maximum password age = {PASSWORD_MAX_AGE_DAYS} days.", "For a stand-alone device: net accounts /maxpwage:{PASSWORD_MAX_AGE_DAYS}"],
-        "linux": ["Set PASS_MAX_DAYS {PASSWORD_MAX_AGE_DAYS} in /etc/login.defs (applies to new accounts).", "Apply it to existing accounts: chage --maxdays {PASSWORD_MAX_AGE_DAYS} <user>"],
-        "macos": ["Deploy a Passcode configuration profile with maxPINAgeInDays = {PASSWORD_MAX_AGE_DAYS}."]
+        "windows": [
+          "Set Group Policy: Account Policies > Password Policy > Maximum password age = {PASSWORD_MAX_AGE_DAYS} days.",
+          "For a stand-alone device: net accounts /maxpwage:{PASSWORD_MAX_AGE_DAYS}"
+        ],
+        "linux": [
+          "Set PASS_MAX_DAYS {PASSWORD_MAX_AGE_DAYS} in /etc/login.defs (applies to new accounts).",
+          "Apply it to existing accounts: chage --maxdays {PASSWORD_MAX_AGE_DAYS} <user>"
+        ],
+        "macos": [
+          "Deploy a Passcode configuration profile with maxPINAgeInDays = {PASSWORD_MAX_AGE_DAYS}."
+        ]
       },
       "verify": "Re-run the audit; Password expiration should be between 1 and {PASSWORD_MAX_AGE_DAYS} days.",
       "note": "Current NIST guidance (SP 800-63B) advises against forced periodic changes when passwords are long and checked against breach lists. Set PASSWORD_MAX_AGE_DAYS=0 in baseline.conf if your policy follows that approach."
     },
     "password.min_age": {
       "why": "A minimum age stops users cycling through passwords immediately to get back to an old one.",
-      "risk": { "level": "Low", "reason": "Without it, the password history rule can be bypassed." },
+      "risk": {
+        "level": "Low",
+        "reason": "Without it, the password history rule can be bypassed."
+      },
       "fix": {
-        "windows": ["Set Group Policy: Account Policies > Password Policy > Minimum password age = {PASSWORD_MIN_AGE_DAYS} day(s).", "For a stand-alone device: net accounts /minpwage:{PASSWORD_MIN_AGE_DAYS}"],
-        "linux": ["Set PASS_MIN_DAYS {PASSWORD_MIN_AGE_DAYS} in /etc/login.defs and apply to existing accounts: chage --mindays {PASSWORD_MIN_AGE_DAYS} <user>"],
-        "macos": ["macOS has no minimum password age setting; rely on password history instead."]
+        "windows": [
+          "Set Group Policy: Account Policies > Password Policy > Minimum password age = {PASSWORD_MIN_AGE_DAYS} day(s).",
+          "For a stand-alone device: net accounts /minpwage:{PASSWORD_MIN_AGE_DAYS}"
+        ],
+        "linux": [
+          "Set PASS_MIN_DAYS {PASSWORD_MIN_AGE_DAYS} in /etc/login.defs and apply to existing accounts: chage --mindays {PASSWORD_MIN_AGE_DAYS} <user>"
+        ],
+        "macos": [
+          "macOS has no minimum password age setting; rely on password history instead."
+        ]
       },
       "verify": "Re-run the audit; Minimum password age should read {PASSWORD_MIN_AGE_DAYS} day(s) or more."
     },
     "password.complexity": {
       "why": "Mixing character types makes passwords harder to guess.",
-      "risk": { "level": "Medium", "reason": "Simple passwords are cracked quickly by dictionary attacks." },
+      "risk": {
+        "level": "Medium",
+        "reason": "Simple passwords are cracked quickly by dictionary attacks."
+      },
       "fix": {
-        "windows": ["Set Group Policy: Account Policies > Password Policy > Password must meet complexity requirements = Enabled."],
-        "linux": ["Enable pam_pwquality and set minclass = 3 (or 4) in /etc/security/pwquality.conf."],
-        "macos": ["Deploy a Passcode configuration profile with requireAlphanumeric = true (and minComplexChars = 1 if special characters are required)."]
+        "windows": [
+          "Set Group Policy: Account Policies > Password Policy > Password must meet complexity requirements = Enabled."
+        ],
+        "linux": [
+          "Enable pam_pwquality and set minclass = 3 (or 4) in /etc/security/pwquality.conf."
+        ],
+        "macos": [
+          "Deploy a Passcode configuration profile with requireAlphanumeric = true (and minComplexChars = 1 if special characters are required)."
+        ]
       },
       "verify": "Re-run the audit; Password complexity should be Compliant."
     },
     "lockout.threshold": {
       "why": "Locking an account after a few wrong passwords stops online guessing.",
-      "risk": { "level": "Medium", "reason": "Unlimited attempts allow brute-force attacks against local accounts." },
+      "risk": {
+        "level": "Medium",
+        "reason": "Unlimited attempts allow brute-force attacks against local accounts."
+      },
       "fix": {
-        "windows": ["Set Group Policy: Account Policies > Account Lockout Policy > Account lockout threshold = {LOCKOUT_THRESHOLD_MAX} invalid attempts (or fewer, not 0).", "For a stand-alone device: net accounts /lockoutthreshold:{LOCKOUT_THRESHOLD_MAX}"],
-        "linux": ["Enable pam_faillock in the PAM auth stack (RHEL: authselect enable-feature with-faillock; Debian/Ubuntu: add the preauth/authfail lines described in pam_faillock(8)).", "Set deny = {LOCKOUT_THRESHOLD_MAX} in /etc/security/faillock.conf."],
-        "macos": ["Deploy a Passcode configuration profile with maxFailedAttempts = {LOCKOUT_THRESHOLD_MAX}."]
+        "windows": [
+          "Set Group Policy: Account Policies > Account Lockout Policy > Account lockout threshold = {LOCKOUT_THRESHOLD_MAX} invalid attempts (or fewer, not 0).",
+          "For a stand-alone device: net accounts /lockoutthreshold:{LOCKOUT_THRESHOLD_MAX}"
+        ],
+        "linux": [
+          "Enable pam_faillock in the PAM auth stack (RHEL: authselect enable-feature with-faillock; Debian/Ubuntu: add the preauth/authfail lines described in pam_faillock(8)).",
+          "Set deny = {LOCKOUT_THRESHOLD_MAX} in /etc/security/faillock.conf."
+        ],
+        "macos": [
+          "Deploy a Passcode configuration profile with maxFailedAttempts = {LOCKOUT_THRESHOLD_MAX}."
+        ]
       },
       "verify": "Re-run the audit; Account lockout threshold should be between 1 and {LOCKOUT_THRESHOLD_MAX}."
     },
     "lockout.duration": {
       "why": "The lockout must last long enough to slow down repeated guessing.",
-      "risk": { "level": "Low", "reason": "A short lockout lets attackers resume guessing almost at once." },
+      "risk": {
+        "level": "Low",
+        "reason": "A short lockout lets attackers resume guessing almost at once."
+      },
       "fix": {
-        "windows": ["Set Group Policy: Account Lockout Policy > Account lockout duration = {LOCKOUT_DURATION_MIN_MINUTES} minutes or more.", "For a stand-alone device: net accounts /lockoutduration:{LOCKOUT_DURATION_MIN_MINUTES}"],
-        "linux": ["Set unlock_time = {LOCKOUT_DURATION_SECONDS} (seconds) in /etc/security/faillock.conf."],
-        "macos": ["Deploy a Passcode configuration profile with minutesUntilFailedLoginReset = {LOCKOUT_DURATION_MIN_MINUTES}."]
+        "windows": [
+          "Set Group Policy: Account Lockout Policy > Account lockout duration = {LOCKOUT_DURATION_MIN_MINUTES} minutes or more.",
+          "For a stand-alone device: net accounts /lockoutduration:{LOCKOUT_DURATION_MIN_MINUTES}"
+        ],
+        "linux": [
+          "Set unlock_time = {LOCKOUT_DURATION_SECONDS} (seconds) in /etc/security/faillock.conf."
+        ],
+        "macos": [
+          "Deploy a Passcode configuration profile with minutesUntilFailedLoginReset = {LOCKOUT_DURATION_MIN_MINUTES}."
+        ]
       },
       "verify": "Re-run the audit; Account lockout duration should be {LOCKOUT_DURATION_MIN_MINUTES} minutes or more."
     },
     "lockout.observation": {
       "why": "Failed attempts must be counted over a long enough window to detect slow guessing.",
-      "risk": { "level": "Low", "reason": "A short window lets attackers pace their guesses to avoid lockout." },
+      "risk": {
+        "level": "Low",
+        "reason": "A short window lets attackers pace their guesses to avoid lockout."
+      },
       "fix": {
-        "windows": ["Set Group Policy: Account Lockout Policy > Reset account lockout counter after = {LOCKOUT_OBSERVATION_MIN_MINUTES} minutes or more.", "For a stand-alone device: net accounts /lockoutwindow:{LOCKOUT_OBSERVATION_MIN_MINUTES}"],
-        "linux": ["Set fail_interval = {LOCKOUT_OBSERVATION_SECONDS} (seconds) in /etc/security/faillock.conf."],
-        "macos": ["On macOS the counter resets when the lockout ends; set minutesUntilFailedLoginReset = {LOCKOUT_OBSERVATION_MIN_MINUTES} in the Passcode profile."]
+        "windows": [
+          "Set Group Policy: Account Lockout Policy > Reset account lockout counter after = {LOCKOUT_OBSERVATION_MIN_MINUTES} minutes or more.",
+          "For a stand-alone device: net accounts /lockoutwindow:{LOCKOUT_OBSERVATION_MIN_MINUTES}"
+        ],
+        "linux": [
+          "Set fail_interval = {LOCKOUT_OBSERVATION_SECONDS} (seconds) in /etc/security/faillock.conf."
+        ],
+        "macos": [
+          "On macOS the counter resets when the lockout ends; set minutesUntilFailedLoginReset = {LOCKOUT_OBSERVATION_MIN_MINUTES} in the Passcode profile."
+        ]
       },
       "verify": "Re-run the audit; Lockout observation period should be {LOCKOUT_OBSERVATION_MIN_MINUTES} minutes or more."
     },
     "malware.antivirus": {
       "why": "Anti-malware software detects and blocks known malicious files and behaviour.",
-      "risk": { "level": "High", "reason": "Without working anti-malware, ransomware and info-stealers can run unchallenged." },
+      "risk": {
+        "level": "High",
+        "reason": "Without working anti-malware, ransomware and info-stealers can run unchallenged."
+      },
       "fix": {
-        "windows": ["Turn Microsoft Defender Antivirus back on (Windows Security > Virus & threat protection) or make sure the third-party product is installed, enabled and reporting to Security Center."],
-        "linux": ["Install an endpoint protection product, or ClamAV: apt install clamav clamav-daemon (RHEL: dnf install clamav clamd), then systemctl enable --now clamav-daemon."],
-        "macos": ["XProtect is built in; if it is missing or damaged, reinstall the latest macOS update. Add a managed endpoint protection product if your policy requires on-access scanning."]
+        "windows": [
+          "Turn Microsoft Defender Antivirus back on (Windows Security > Virus & threat protection) or make sure the third-party product is installed, enabled and reporting to Security Center."
+        ],
+        "linux": [
+          "Install an endpoint protection product, or ClamAV: apt install clamav clamav-daemon (RHEL: dnf install clamav clamd), then systemctl enable --now clamav-daemon."
+        ],
+        "macos": [
+          "XProtect is built in; if it is missing or damaged, reinstall the latest macOS update. Add a managed endpoint protection product if your policy requires on-access scanning."
+        ],
+        "android": [
+          "Play Store › profile picture › Play Protect › Settings: turn on 'Scan apps with Play Protect'."
+        ]
       },
       "verify": "Re-run the audit; Antivirus should be Compliant."
     },
     "malware.service": {
       "why": "The malware protection service must be running for protection to work.",
-      "risk": { "level": "High", "reason": "A stopped protection service leaves the device unprotected." },
+      "risk": {
+        "level": "High",
+        "reason": "A stopped protection service leaves the device unprotected."
+      },
       "fix": {
-        "windows": ["Re-enable Microsoft Defender: check that no Group Policy sets 'Turn off Microsoft Defender Antivirus', then restart the device."],
-        "linux": ["systemctl enable --now clamav-daemon (RHEL: clamd@scan)."],
-        "macos": ["Re-enable Gatekeeper: sudo spctl --master-enable. Keep 'Install Security Responses and system files' on in Software Update."]
+        "windows": [
+          "Re-enable Microsoft Defender: check that no Group Policy sets 'Turn off Microsoft Defender Antivirus', then restart the device."
+        ],
+        "linux": [
+          "systemctl enable --now clamav-daemon (RHEL: clamd@scan)."
+        ],
+        "macos": [
+          "Re-enable Gatekeeper: sudo spctl --master-enable. Keep 'Install Security Responses and system files' on in Software Update."
+        ]
       },
       "verify": "Re-run the audit; the malware protection service should be Compliant."
     },
     "malware.realtime": {
       "why": "Real-time protection scans files and processes as they are used.",
-      "risk": { "level": "High", "reason": "Without it, malware is only found by scheduled scans, after it has run." },
+      "risk": {
+        "level": "High",
+        "reason": "Without it, malware is only found by scheduled scans, after it has run."
+      },
       "fix": {
-        "windows": ["Set-MpPreference -DisableRealtimeMonitoring $false, and remove any policy that disables real-time protection."]
+        "windows": [
+          "Set-MpPreference -DisableRealtimeMonitoring $false, and remove any policy that disables real-time protection."
+        ]
       },
       "verify": "Re-run the audit; Real-time protection should be on."
     },
     "malware.on_access": {
       "why": "On-access scanning checks files when they are opened or written.",
-      "risk": { "level": "Medium", "reason": "Malicious files can be opened before any scheduled scan finds them." },
+      "risk": {
+        "level": "Medium",
+        "reason": "Malicious files can be opened before any scheduled scan finds them."
+      },
       "fix": {
-        "windows": ["Enable real-time protection in Microsoft Defender (on-access protection follows it)."],
-        "linux": ["Configure OnAccessIncludePath in /etc/clamav/clamd.conf and enable clamonacc (systemctl enable --now clamav-clamonacc), or use an endpoint product with on-access scanning."],
-        "macos": ["Not provided by macOS itself; deploy a managed endpoint protection product if required."]
+        "windows": [
+          "Enable real-time protection in Microsoft Defender (on-access protection follows it)."
+        ],
+        "linux": [
+          "Configure OnAccessIncludePath in /etc/clamav/clamd.conf and enable clamonacc (systemctl enable --now clamav-clamonacc), or use an endpoint product with on-access scanning."
+        ],
+        "macos": [
+          "Not provided by macOS itself; deploy a managed endpoint protection product if required."
+        ]
       },
       "verify": "Re-run the audit; On-access malware protection should be Compliant."
     },
     "malware.tamper": {
       "why": "Tamper protection stops malware or users switching off Defender.",
-      "risk": { "level": "Medium", "reason": "Attackers commonly disable antivirus before deploying ransomware." },
+      "risk": {
+        "level": "Medium",
+        "reason": "Attackers commonly disable antivirus before deploying ransomware."
+      },
       "fix": {
-        "windows": ["Turn on Tamper Protection in Windows Security > Virus & threat protection settings, or centrally through Microsoft Intune / Defender for Endpoint (it cannot be set with PowerShell)."]
+        "windows": [
+          "Turn on Tamper Protection in Windows Security > Virus & threat protection settings, or centrally through Microsoft Intune / Defender for Endpoint (it cannot be set with PowerShell)."
+        ]
       },
       "verify": "Re-run the audit; Tamper protection should be on."
     },
     "malware.signatures": {
       "why": "Anti-malware can only detect threats it knows about; signatures must be current.",
-      "risk": { "level": "High", "reason": "Outdated signatures miss recent malware." },
+      "risk": {
+        "level": "High",
+        "reason": "Outdated signatures miss recent malware."
+      },
       "fix": {
-        "windows": ["Run Update-MpSignature and check that the device can reach Windows Update or your update server."],
-        "linux": ["systemctl enable --now clamav-freshclam, or run freshclam once to update now."],
-        "macos": ["Keep 'Install Security Responses and system files' on (Software Update > Automatic Updates); run softwareupdate --background to fetch now."]
+        "windows": [
+          "Run Update-MpSignature and check that the device can reach Windows Update or your update server."
+        ],
+        "linux": [
+          "systemctl enable --now clamav-freshclam, or run freshclam once to update now."
+        ],
+        "macos": [
+          "Keep 'Install Security Responses and system files' on (Software Update > Automatic Updates); run softwareupdate --background to fetch now."
+        ]
       },
       "verify": "Re-run the audit; signatures should be within the allowed age."
     },
     "malware.signature_updates": {
       "why": "Signature updates must happen automatically so protection stays current without user action.",
-      "risk": { "level": "Medium", "reason": "Manual updates are forgotten, leaving protection outdated." },
+      "risk": {
+        "level": "Medium",
+        "reason": "Manual updates are forgotten, leaving protection outdated."
+      },
       "fix": {
-        "linux": ["systemctl enable --now clamav-freshclam."],
-        "macos": ["Turn on 'Install Security Responses and system files' in System Settings > General > Software Update > Automatic Updates, or set ConfigDataInstall and CriticalUpdateInstall to true by configuration profile."]
+        "linux": [
+          "systemctl enable --now clamav-freshclam."
+        ],
+        "macos": [
+          "Turn on 'Install Security Responses and system files' in System Settings > General > Software Update > Automatic Updates, or set ConfigDataInstall and CriticalUpdateInstall to true by configuration profile."
+        ]
       },
       "verify": "Re-run the audit; signature updates should be automatic."
     },
     "firewall.enabled": {
       "why": "A host firewall blocks unwanted network connections to the device, especially on public networks.",
-      "risk": { "level": "High", "reason": "Network services on the device are exposed to anyone on the same network." },
+      "risk": {
+        "level": "High",
+        "reason": "Network services on the device are exposed to anyone on the same network."
+      },
       "fix": {
-        "windows": ["Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled True, or enforce it with Group Policy/Intune."],
-        "linux": ["Debian/Ubuntu: ufw default deny incoming; ufw default allow outgoing; ufw enable. RHEL: systemctl enable --now firewalld."],
-        "macos": ["sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on, or enforce the firewall by configuration profile."]
+        "windows": [
+          "Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled True, or enforce it with Group Policy/Intune."
+        ],
+        "linux": [
+          "Debian/Ubuntu: ufw default deny incoming; ufw default allow outgoing; ufw enable. RHEL: systemctl enable --now firewalld."
+        ],
+        "macos": [
+          "sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on, or enforce the firewall by configuration profile."
+        ]
       },
       "verify": "Re-run the audit; the firewall should be on."
     },
     "firewall.inbound": {
       "why": "Unsolicited inbound connections should be blocked unless a service is explicitly allowed.",
-      "risk": { "level": "High", "reason": "Open inbound access lets attackers reach vulnerable services directly." },
+      "risk": {
+        "level": "High",
+        "reason": "Open inbound access lets attackers reach vulnerable services directly."
+      },
       "fix": {
-        "windows": ["Set-NetFirewallProfile -Profile Domain,Private,Public -DefaultInboundAction Block."],
-        "linux": ["ufw default deny incoming (firewalld: keep the default zone target at default/REJECT)."],
-        "macos": ["Turn on stealth mode: sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on."]
+        "windows": [
+          "Set-NetFirewallProfile -Profile Domain,Private,Public -DefaultInboundAction Block."
+        ],
+        "linux": [
+          "ufw default deny incoming (firewalld: keep the default zone target at default/REJECT)."
+        ],
+        "macos": [
+          "Turn on stealth mode: sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on."
+        ]
       },
       "verify": "Re-run the audit; the inbound policy should be block/deny."
     },
     "firewall.outbound": {
       "why": "The baseline fixes the default outbound policy so that it is consistent across devices.",
-      "risk": { "level": "Low", "reason": "A different outbound policy either breaks applications or deviates from the agreed design." },
+      "risk": {
+        "level": "Low",
+        "reason": "A different outbound policy either breaks applications or deviates from the agreed design."
+      },
       "fix": {
-        "windows": ["Set-NetFirewallProfile -Profile Domain,Private,Public -DefaultOutboundAction {FIREWALL_OUTBOUND_TITLE}."],
-        "linux": ["ufw default {FIREWALL_OUTBOUND} outgoing (or the equivalent nftables output policy)."],
-        "macos": ["The macOS application firewall does not filter outbound traffic; use a network filter product if outbound blocking is required."]
+        "windows": [
+          "Set-NetFirewallProfile -Profile Domain,Private,Public -DefaultOutboundAction {FIREWALL_OUTBOUND_TITLE}."
+        ],
+        "linux": [
+          "ufw default {FIREWALL_OUTBOUND} outgoing (or the equivalent nftables output policy)."
+        ],
+        "macos": [
+          "The macOS application firewall does not filter outbound traffic; use a network filter product if outbound blocking is required."
+        ]
       },
       "verify": "Re-run the audit; the outbound policy should read {FIREWALL_OUTBOUND}."
     },
     "screen_lock.enabled": {
       "why": "An idle device should lock itself so nobody can use it while the owner is away.",
-      "risk": { "level": "Medium", "reason": "An unlocked, unattended device exposes all the user's data and accounts." },
+      "risk": {
+        "level": "Medium",
+        "reason": "An unlocked, unattended device exposes all the user's data and accounts."
+      },
       "fix": {
-        "windows": ["Set Group Policy: Local Policies > Security Options > Interactive logon: Machine inactivity limit = {SCREEN_LOCK_MAX_SECONDS} seconds, or enforce a password-protected screen saver by Group Policy/Intune."],
-        "linux": ["For GNOME: gsettings set org.gnome.desktop.screensaver lock-enabled true, and enforce it for all users with a locked dconf setting in /etc/dconf/db/local.d/."],
-        "macos": ["System Settings > Lock Screen: set the screen saver and display-off times and 'Require password' = Immediately, or enforce with a configuration profile."]
+        "windows": [
+          "Set Group Policy: Local Policies > Security Options > Interactive logon: Machine inactivity limit = {SCREEN_LOCK_MAX_SECONDS} seconds, or enforce a password-protected screen saver by Group Policy/Intune."
+        ],
+        "linux": [
+          "For GNOME: gsettings set org.gnome.desktop.screensaver lock-enabled true, and enforce it for all users with a locked dconf setting in /etc/dconf/db/local.d/."
+        ],
+        "macos": [
+          "System Settings > Lock Screen: set the screen saver and display-off times and 'Require password' = Immediately, or enforce with a configuration profile."
+        ],
+        "ios": [
+          "Settings › Face ID & Passcode › Turn Passcode On; for work phones the employer can require it with a configuration profile."
+        ],
+        "android": [
+          "Settings › Security & privacy › Device unlock › Screen lock: choose PIN or Password."
+        ]
       },
       "verify": "Re-run the audit; Screen lock should be on."
     },
     "screen_lock.timeout": {
       "why": "The shorter the idle time before locking, the smaller the window for misuse.",
-      "risk": { "level": "Medium", "reason": "A long or missing timeout leaves unattended devices open." },
+      "risk": {
+        "level": "Medium",
+        "reason": "A long or missing timeout leaves unattended devices open."
+      },
       "fix": {
-        "windows": ["Set Group Policy: Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > Interactive logon: Machine inactivity limit = {SCREEN_LOCK_MAX_SECONDS} seconds (or less)."],
-        "linux": ["gsettings set org.gnome.desktop.session idle-delay {SCREEN_LOCK_MAX_SECONDS} and gsettings set org.gnome.desktop.screensaver lock-delay 0; enforce with locked dconf settings."],
-        "macos": ["Set the screen saver to start within {SCREEN_LOCK_MAX_MINUTES} minutes (idleTime in com.apple.screensaver) and require the password immediately, ideally by configuration profile."]
+        "windows": [
+          "Set Group Policy: Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > Interactive logon: Machine inactivity limit = {SCREEN_LOCK_MAX_SECONDS} seconds (or less)."
+        ],
+        "linux": [
+          "gsettings set org.gnome.desktop.session idle-delay {SCREEN_LOCK_MAX_SECONDS} and gsettings set org.gnome.desktop.screensaver lock-delay 0; enforce with locked dconf settings."
+        ],
+        "macos": [
+          "Set the screen saver to start within {SCREEN_LOCK_MAX_MINUTES} minutes (idleTime in com.apple.screensaver) and require the password immediately, ideally by configuration profile."
+        ],
+        "ios": [
+          "Settings › Display & Brightness › Auto-Lock: choose {SCREEN_LOCK_MAX_MINUTES} minutes or less (not Never)."
+        ],
+        "android": [
+          "Settings › Display › Screen timeout: choose {SCREEN_LOCK_MAX_MINUTES} minutes or less, and set 'Lock after screen timeout' to Immediately where the phone offers it."
+        ]
       },
       "verify": "Re-run the audit; Screen lock timeout should be {SCREEN_LOCK_MAX_SECONDS} seconds or less."
     },
     "screen_lock.password": {
       "why": "Unlocking the screen must require the user's password.",
-      "risk": { "level": "Medium", "reason": "A screen lock that needs no password does not protect anything." },
+      "risk": {
+        "level": "Medium",
+        "reason": "A screen lock that needs no password does not protect anything."
+      },
       "fix": {
-        "windows": ["Set the machine inactivity limit by Group Policy (this always requires sign-in), or enable 'Password protect the screen saver' for users by Group Policy."],
-        "linux": ["Keep org.gnome.desktop.screensaver lock-enabled true and org.gnome.desktop.lockdown disable-lock-screen false."],
-        "macos": ["System Settings > Lock Screen > 'Require password after screen saver begins or display is turned off' = Immediately (askForPasswordDelay = 0 by profile)."]
+        "windows": [
+          "Set the machine inactivity limit by Group Policy (this always requires sign-in), or enable 'Password protect the screen saver' for users by Group Policy."
+        ],
+        "linux": [
+          "Keep org.gnome.desktop.screensaver lock-enabled true and org.gnome.desktop.lockdown disable-lock-screen false."
+        ],
+        "macos": [
+          "System Settings > Lock Screen > 'Require password after screen saver begins or display is turned off' = Immediately (askForPasswordDelay = 0 by profile)."
+        ]
       },
       "verify": "Re-run the audit; the password requirement should be Compliant."
     },
     "usb.read": {
       "why": "The baseline sets whether USB storage may be read; reading lets malware and unapproved data enter.",
-      "risk": { "level": "Low", "reason": "The setting differs from the organisation's agreed USB policy." },
+      "risk": {
+        "level": "Low",
+        "reason": "The setting differs from the organisation's agreed USB policy."
+      },
       "fix": {
-        "windows": ["Set Group Policy: Computer Configuration > Administrative Templates > System > Removable Storage Access > Removable Disks: Deny read access = {USB_READ_POLICY}."],
-        "linux": ["To block USB storage completely: echo 'install usb-storage /bin/false' > /etc/modprobe.d/usb-storage.conf, or use USBGuard."],
-        "macos": ["Restrict external storage with your MDM or an endpoint DLP product."]
+        "windows": [
+          "Set Group Policy: Computer Configuration > Administrative Templates > System > Removable Storage Access > Removable Disks: Deny read access = {USB_READ_POLICY}."
+        ],
+        "linux": [
+          "To block USB storage completely: echo 'install usb-storage /bin/false' > /etc/modprobe.d/usb-storage.conf, or use USBGuard."
+        ],
+        "macos": [
+          "Restrict external storage with your MDM or an endpoint DLP product."
+        ]
       },
       "verify": "Re-run the audit; USB storage read should read {USB_READ}."
     },
     "usb.write": {
       "why": "Writing to USB drives is a common way for data to leave the organisation, often unencrypted.",
-      "risk": { "level": "Medium", "reason": "Personal or confidential data can be copied to an unmanaged, unencrypted drive and lost." },
+      "risk": {
+        "level": "Medium",
+        "reason": "Personal or confidential data can be copied to an unmanaged, unencrypted drive and lost."
+      },
       "fix": {
-        "windows": ["Set Group Policy: Administrative Templates > System > Removable Storage Access > Removable Disks: Deny write access = Enabled, or require BitLocker To Go ('Deny write access to removable drives not protected by BitLocker')."],
-        "linux": ["Make USB storage read-only with a udev rule, or block it with USBGuard or the usb-storage modprobe rule."],
-        "macos": ["Restrict external storage to read-only or deny it with your MDM or an endpoint DLP product."]
+        "windows": [
+          "Set Group Policy: Administrative Templates > System > Removable Storage Access > Removable Disks: Deny write access = Enabled, or require BitLocker To Go ('Deny write access to removable drives not protected by BitLocker')."
+        ],
+        "linux": [
+          "Make USB storage read-only with a udev rule, or block it with USBGuard or the usb-storage modprobe rule."
+        ],
+        "macos": [
+          "Restrict external storage to read-only or deny it with your MDM or an endpoint DLP product."
+        ]
       },
       "verify": "Re-run the audit; USB storage write should read {USB_WRITE}."
     },
     "admin.approved": {
       "why": "A known, approved IT account should manage the device so that support does not depend on users' own admin rights.",
-      "risk": { "level": "Medium", "reason": "Without an approved admin account, IT tends to rely on employees' accounts having admin rights." },
+      "risk": {
+        "level": "Medium",
+        "reason": "Without an approved admin account, IT tends to rely on employees' accounts having admin rights."
+      },
       "fix": {
-        "windows": ["Add the approved IT administrator account (listed in APPROVED_ADMINS) to the local Administrators group, ideally managed with Windows LAPS or Intune."],
-        "linux": ["Add the approved IT account to the sudo (Debian/Ubuntu) or wheel (RHEL) group: usermod -aG sudo <account>."],
-        "macos": ["Create or promote the approved IT account: sudo dseditgroup -o edit -a <account> -t user admin, ideally managed by your MDM."]
+        "windows": [
+          "Add the approved IT administrator account (listed in APPROVED_ADMINS) to the local Administrators group, ideally managed with Windows LAPS or Intune."
+        ],
+        "linux": [
+          "Add the approved IT account to the sudo (Debian/Ubuntu) or wheel (RHEL) group: usermod -aG sudo <account>."
+        ],
+        "macos": [
+          "Create or promote the approved IT account: sudo dseditgroup -o edit -a <account> -t user admin, ideally managed by your MDM."
+        ]
       },
       "verify": "Re-run the audit; Approved IT administrator should list the approved account."
     },
     "admin.unauthorized": {
       "why": "Everyday user accounts with administrator rights let malware and mistakes change anything on the device.",
-      "risk": { "level": "High", "reason": "Malware running as an administrator can disable protection, install persistence and steal credentials." },
+      "risk": {
+        "level": "High",
+        "reason": "Malware running as an administrator can disable protection, install persistence and steal credentials."
+      },
       "fix": {
-        "windows": ["Remove the listed accounts from the local Administrators group: Remove-LocalGroupMember -SID S-1-5-32-544 -Member <account>; give elevation through an approved process (e.g. Windows LAPS, an endpoint privilege management tool)."],
-        "linux": ["Remove the listed accounts from the sudo/wheel groups (gpasswd -d <account> sudo) and remove their entries from /etc/sudoers.d."],
-        "macos": ["Demote the listed accounts: sudo dseditgroup -o edit -d <account> -t user admin."]
+        "windows": [
+          "Remove the listed accounts from the local Administrators group: Remove-LocalGroupMember -SID S-1-5-32-544 -Member <account>; give elevation through an approved process (e.g. Windows LAPS, an endpoint privilege management tool)."
+        ],
+        "linux": [
+          "Remove the listed accounts from the sudo/wheel groups (gpasswd -d <account> sudo) and remove their entries from /etc/sudoers.d."
+        ],
+        "macos": [
+          "Demote the listed accounts: sudo dseditgroup -o edit -d <account> -t user admin."
+        ]
       },
       "verify": "Re-run the audit; Unauthorized administrator accounts should read none."
     },
     "encryption.enabled": {
       "why": "Full-disk encryption keeps data unreadable if the device is lost or stolen.",
-      "risk": { "level": "High", "reason": "A lost unencrypted laptop is a personal data breach that may have to be reported." },
+      "risk": {
+        "level": "High",
+        "reason": "A lost unencrypted laptop is a personal data breach that may have to be reported."
+      },
       "fix": {
-        "windows": ["Turn on BitLocker for the system drive (Enable-BitLocker -MountPoint C: -EncryptionMethod XtsAes256 -TpmProtector), preferably through Intune or Group Policy with key backup."],
-        "linux": ["Disk encryption (LUKS) is usually chosen at installation; plan a reinstall with encryption, or an offline re-encryption with cryptsetup reencrypt after a full backup."],
-        "macos": ["Turn on FileVault (System Settings > Privacy & Security > FileVault, or sudo fdesetup enable), ideally enforced and escrowed by your MDM."]
+        "windows": [
+          "Turn on BitLocker for the system drive (Enable-BitLocker -MountPoint C: -EncryptionMethod XtsAes256 -TpmProtector), preferably through Intune or Group Policy with key backup."
+        ],
+        "linux": [
+          "Disk encryption (LUKS) is usually chosen at installation; plan a reinstall with encryption, or an offline re-encryption with cryptsetup reencrypt after a full backup."
+        ],
+        "macos": [
+          "Turn on FileVault (System Settings > Privacy & Security > FileVault, or sudo fdesetup enable), ideally enforced and escrowed by your MDM."
+        ],
+        "ios": [
+          "Set a passcode (Settings › Face ID & Passcode): iOS data protection encrypts the phone once a passcode is set."
+        ],
+        "android": [
+          "Update to a supported Android version (10 or later encrypts by default) or replace the phone; set a PIN or password screen lock."
+        ]
       },
       "verify": "Re-run the audit; Encryption should be Compliant."
     },
     "encryption.protection": {
       "why": "Encryption only protects the data when it is active, fully applied and uses a strong cipher.",
-      "risk": { "level": "High", "reason": "Suspended or partial encryption leaves data readable on a lost device." },
+      "risk": {
+        "level": "High",
+        "reason": "Suspended or partial encryption leaves data readable on a lost device."
+      },
       "fix": {
-        "windows": ["Resume protection if it is suspended (Resume-BitLocker -MountPoint C:) and let encryption finish; use an AES-XTS method."],
-        "linux": ["Use LUKS2 with aes-xts-plain64 and a 512-bit key (AES-256) for new installations; plan migration of weaker setups."],
-        "macos": ["Let FileVault encryption finish; keep the Mac on power until fdesetup status reports FileVault is On without progress."]
+        "windows": [
+          "Resume protection if it is suspended (Resume-BitLocker -MountPoint C:) and let encryption finish; use an AES-XTS method."
+        ],
+        "linux": [
+          "Use LUKS2 with aes-xts-plain64 and a 512-bit key (AES-256) for new installations; plan migration of weaker setups."
+        ],
+        "macos": [
+          "Let FileVault encryption finish; keep the Mac on power until fdesetup status reports FileVault is On without progress."
+        ]
       },
       "verify": "Re-run the audit; Disk encryption protection should be Compliant."
     },
     "encryption.recovery": {
       "why": "A recovery key lets IT unlock the disk if the user forgets the password or the hardware changes.",
-      "risk": { "level": "Medium", "reason": "Without a recovery key, an encrypted disk can become permanently unreadable." },
+      "risk": {
+        "level": "Medium",
+        "reason": "Without a recovery key, an encrypted disk can become permanently unreadable."
+      },
       "fix": {
-        "windows": ["Add a recovery password: Add-BitLockerKeyProtector -MountPoint C: -RecoveryPasswordProtector, and back it up to Entra ID (BackupToAAD-BitLockerKeyProtector) or Active Directory."],
-        "linux": ["Add a second key slot holding a recovery passphrase: cryptsetup luksAddKey <device>, and store it in your password vault."],
-        "macos": ["Create or rotate a personal recovery key (sudo fdesetup changerecovery -personal) and escrow it to your MDM."]
+        "windows": [
+          "Add a recovery password: Add-BitLockerKeyProtector -MountPoint C: -RecoveryPasswordProtector, and back it up to Entra ID (BackupToAAD-BitLockerKeyProtector) or Active Directory."
+        ],
+        "linux": [
+          "Add a second key slot holding a recovery passphrase: cryptsetup luksAddKey <device>, and store it in your password vault."
+        ],
+        "macos": [
+          "Create or rotate a personal recovery key (sudo fdesetup changerecovery -personal) and escrow it to your MDM."
+        ]
       },
       "verify": "Re-run the audit; Disk encryption recovery should be Compliant."
     },
     "usb.device_access": {
       "why": "Blocking USB mass storage devices completely is the strongest protection against data leaving on, or malware arriving from, removable drives.",
-      "risk": { "level": "Low", "reason": "The device access setting differs from the organisation's agreed USB policy." },
+      "risk": {
+        "level": "Low",
+        "reason": "The device access setting differs from the organisation's agreed USB policy."
+      },
       "fix": {
-        "windows": ["To block USB storage completely: Group Policy > Administrative Templates > System > Removable Storage Access > All Removable Storage classes: Deny all access = Enabled, or set the USBSTOR service Start value to 4."],
-        "linux": ["To block USB storage completely: echo 'install usb-storage /bin/false' > /etc/modprobe.d/usb-storage.conf, or enable USBGuard with ImplicitPolicyTarget=block."],
-        "macos": ["Block or allow external storage with your MDM (Restrictions / device control) or an endpoint DLP product."]
+        "windows": [
+          "To block USB storage completely: Group Policy > Administrative Templates > System > Removable Storage Access > All Removable Storage classes: Deny all access = Enabled, or set the USBSTOR service Start value to 4."
+        ],
+        "linux": [
+          "To block USB storage completely: echo 'install usb-storage /bin/false' > /etc/modprobe.d/usb-storage.conf, or enable USBGuard with ImplicitPolicyTarget=block."
+        ],
+        "macos": [
+          "Block or allow external storage with your MDM (Restrictions / device control) or an endpoint DLP product."
+        ]
       },
       "verify": "Re-run the audit; USB storage device access should read {USB_DEVICE_ACCESS}."
     },
     "user.account_type": {
       "why": "Day-to-day work under an administrator account lets any malware or mistake change the whole system.",
-      "risk": { "level": "High", "reason": "Malware started by the signed-in user runs with full administrator rights." },
+      "risk": {
+        "level": "High",
+        "reason": "Malware started by the signed-in user runs with full administrator rights."
+      },
       "fix": {
-        "windows": ["Make the signed-in user a Standard user (Settings > Accounts > Other users > Change account type, or Remove-LocalGroupMember -SID S-1-5-32-544 -Member <account>) and use a separate approved admin account or LAPS for elevation."],
-        "linux": ["Remove the signed-in user from sudo/wheel (gpasswd -d <account> sudo) and use a separate approved admin account."],
-        "macos": ["Make the signed-in user a Standard user (System Settings > Users & Groups, or sudo dseditgroup -o edit -d <account> -t user admin) and keep a separate approved admin account."]
+        "windows": [
+          "Make the signed-in user a Standard user (Settings > Accounts > Other users > Change account type, or Remove-LocalGroupMember -SID S-1-5-32-544 -Member <account>) and use a separate approved admin account or LAPS for elevation."
+        ],
+        "linux": [
+          "Remove the signed-in user from sudo/wheel (gpasswd -d <account> sudo) and use a separate approved admin account."
+        ],
+        "macos": [
+          "Make the signed-in user a Standard user (System Settings > Users & Groups, or sudo dseditgroup -o edit -d <account> -t user admin) and keep a separate approved admin account."
+        ]
       },
       "verify": "Re-run the audit; Signed-in user account type should read Standard."
     },
     "vuln.pending_updates": {
       "why": "Security updates that are offered but not installed leave known, published vulnerabilities open.",
-      "risk": { "level": "High", "reason": "Attackers target published vulnerabilities quickly after the fix is released." },
+      "risk": {
+        "level": "High",
+        "reason": "Attackers target published vulnerabilities quickly after the fix is released."
+      },
       "fix": {
-        "windows": ["Install the pending updates now (Settings > Windows Update > Install all), restart if asked, and check that automatic updates are not paused."],
-        "linux": ["Install pending security updates: apt update && apt upgrade (RHEL: dnf upgrade --security), then reboot if a new kernel was installed."],
-        "macos": ["Install the pending updates: System Settings > General > Software Update, or softwareupdate -ia, then restart if asked."]
+        "windows": [
+          "Install the pending updates now (Settings > Windows Update > Install all), restart if asked, and check that automatic updates are not paused."
+        ],
+        "linux": [
+          "Install pending security updates: apt update && apt upgrade (RHEL: dnf upgrade --security), then reboot if a new kernel was installed."
+        ],
+        "macos": [
+          "Install the pending updates: System Settings > General > Software Update, or softwareupdate -ia, then restart if asked."
+        ],
+        "ios": [
+          "Settings › General › Software Update: install the latest iOS version offered."
+        ],
+        "android": [
+          "Settings › System › Software updates (and Security & privacy › Updates): install the latest system and Google Play system updates. If the security patch stays older than {MOBILE_PATCH_MAX_AGE_DAYS} days because the maker no longer sends updates, replace the phone."
+        ]
       },
       "verify": "Re-run the audit; pending security updates should be {MAX_PENDING_SECURITY_UPDATES} or fewer."
     },
     "vuln.outdated_apps": {
       "why": "Browsers, office suites, PDF readers and meeting apps are common attack targets and need updates like the OS.",
-      "risk": { "level": "Medium", "reason": "Outdated applications contain known vulnerabilities that attackers exploit through documents and web pages." },
+      "risk": {
+        "level": "Medium",
+        "reason": "Outdated applications contain known vulnerabilities that attackers exploit through documents and web pages."
+      },
       "fix": {
-        "windows": ["Update the listed applications (winget upgrade --all, or each app's own updater) and manage updates centrally with Intune or a patch management tool."],
-        "linux": ["Update packages and app stores: apt upgrade, snap refresh, flatpak update."],
-        "macos": ["Update the listed applications from the App Store or their own updaters (or brew upgrade for Homebrew apps), and manage updates centrally with your MDM."]
+        "windows": [
+          "Update the listed applications (winget upgrade --all, or each app's own updater) and manage updates centrally with Intune or a patch management tool."
+        ],
+        "linux": [
+          "Update packages and app stores: apt upgrade, snap refresh, flatpak update."
+        ],
+        "macos": [
+          "Update the listed applications from the App Store or their own updaters (or brew upgrade for Homebrew apps), and manage updates centrally with your MDM."
+        ],
+        "ios": [
+          "Settings › App Store: turn on App Updates; then App Store › account picture › update all pending apps."
+        ],
+        "android": [
+          "Play Store › profile picture › Settings › Network preferences › Auto-update apps: Over any network or Over Wi-Fi only; then Manage apps & device › Update all."
+        ]
       },
       "verify": "Re-run the audit; outdated applications should be {MAX_OUTDATED_APPS} or fewer."
     },
     "vuln.known_vulnerabilities": {
       "why": "Installed software versions with published critical or high vulnerabilities give attackers a ready-made way in.",
-      "risk": { "level": "High", "reason": "Critical and high vulnerabilities often allow remote code execution or privilege escalation." },
+      "risk": {
+        "level": "High",
+        "reason": "Critical and high vulnerabilities often allow remote code execution or privilege escalation."
+      },
       "fix": {
-        "all": ["Update or remove each listed software package to a version without the listed vulnerabilities; where no fix exists yet, apply the vendor's workaround or restrict the software's use."],
-        "windows": ["Use winget upgrade or the vendor's installer to reach a fixed version."],
-        "linux": ["Use the package manager to reach a fixed version (apt / dnf / snap / flatpak)."],
-        "macos": ["Use the App Store, the vendor's updater or brew upgrade to reach a fixed version."]
+        "all": [
+          "Update or remove each listed software package to a version without the listed vulnerabilities; where no fix exists yet, apply the vendor's workaround or restrict the software's use."
+        ],
+        "windows": [
+          "Use winget upgrade or the vendor's installer to reach a fixed version."
+        ],
+        "linux": [
+          "Use the package manager to reach a fixed version (apt / dnf / snap / flatpak)."
+        ],
+        "macos": [
+          "Use the App Store, the vendor's updater or brew upgrade to reach a fixed version."
+        ],
+        "ios": [
+          "Settings › General › Software Update: install the newest iOS version; if the iPhone cannot run a version without the listed vulnerabilities, replace it."
+        ]
       },
       "verify": "Re-run the audit; critical or high vulnerabilities should be {MAX_CRITICAL_HIGH_VULNERABILITIES} or fewer."
     },
-
     "gdpr.auto_updates": {
       "why": "Security fixes must be installed automatically so that known vulnerabilities are closed quickly.",
-      "risk": { "level": "High", "reason": "Unpatched devices are the most common way attackers get in." },
+      "risk": {
+        "level": "High",
+        "reason": "Unpatched devices are the most common way attackers get in."
+      },
       "fix": {
-        "windows": ["Set Group Policy: Administrative Templates > Windows Components > Windows Update > Configure Automatic Updates = 4 (auto download and schedule the install), or use Windows Update for Business / Intune; make sure the Windows Update service is not disabled."],
-        "linux": ["Debian/Ubuntu: apt install unattended-upgrades && dpkg-reconfigure -plow unattended-upgrades. RHEL: dnf install dnf-automatic && systemctl enable --now dnf-automatic-install.timer."],
-        "macos": ["Turn on all options in System Settings > General > Software Update > Automatic Updates, or enforce them with a configuration profile (AutomaticallyInstallMacOSUpdates = true)."]
+        "windows": [
+          "Set Group Policy: Administrative Templates > Windows Components > Windows Update > Configure Automatic Updates = 4 (auto download and schedule the install), or use Windows Update for Business / Intune; make sure the Windows Update service is not disabled."
+        ],
+        "linux": [
+          "Debian/Ubuntu: apt install unattended-upgrades && dpkg-reconfigure -plow unattended-upgrades. RHEL: dnf install dnf-automatic && systemctl enable --now dnf-automatic-install.timer."
+        ],
+        "macos": [
+          "Turn on all options in System Settings > General > Software Update > Automatic Updates, or enforce them with a configuration profile (AutomaticallyInstallMacOSUpdates = true)."
+        ],
+        "ios": [
+          "Settings › General › Software Update › Automatic Updates: turn on iOS Updates Download and Install, and Security Responses & System Files."
+        ],
+        "android": [
+          "Settings › System › Software updates: turn on automatic download (names vary by phone maker)."
+        ]
       },
       "verify": "Re-run the audit; Automatic security updates should be Compliant."
     },
     "gdpr.updates_recent": {
       "why": "Recent installs show that patching is actually happening, not only configured.",
-      "risk": { "level": "High", "reason": "A device not updated for a long time is likely missing critical security fixes." },
+      "risk": {
+        "level": "High",
+        "reason": "A device not updated for a long time is likely missing critical security fixes."
+      },
       "fix": {
-        "windows": ["Run Windows Update now (Settings > Windows Update > Check for updates) and investigate why updates stopped (paused updates, broken update service, metered connection)."],
-        "linux": ["Run apt update && apt upgrade (RHEL: dnf upgrade) and check the automatic update logs for errors."],
-        "macos": ["Install pending updates (System Settings > General > Software Update, or softwareupdate -ia)."]
+        "windows": [
+          "Run Windows Update now (Settings > Windows Update > Check for updates) and investigate why updates stopped (paused updates, broken update service, metered connection)."
+        ],
+        "linux": [
+          "Run apt update && apt upgrade (RHEL: dnf upgrade) and check the automatic update logs for errors."
+        ],
+        "macos": [
+          "Install pending updates (System Settings > General > Software Update, or softwareupdate -ia)."
+        ]
       },
       "verify": "Re-run the audit; the last update should be within {UPDATES_MAX_AGE_DAYS} days."
     },
     "gdpr.os_supported": {
       "why": "An operating system that no longer receives security updates cannot be kept secure.",
-      "risk": { "level": "High", "reason": "New vulnerabilities in an unsupported OS are never fixed." },
+      "risk": {
+        "level": "High",
+        "reason": "New vulnerabilities in an unsupported OS are never fixed."
+      },
       "fix": {
-        "windows": ["Upgrade to a supported Windows 11 release (build {WINDOWS_MIN_BUILD} or later), or replace hardware that cannot run it."],
-        "linux": ["Upgrade to a supported release (e.g. Ubuntu {UBUNTU_MIN_VERSION} or later) or enrol in extended security maintenance."],
-        "macos": ["Upgrade to macOS {MACOS_MIN_MAJOR} or later, or replace Macs that cannot run a supported version."]
+        "windows": [
+          "Upgrade to a supported Windows 11 release (build {WINDOWS_MIN_BUILD} or later), or replace hardware that cannot run it."
+        ],
+        "linux": [
+          "Upgrade to a supported release (e.g. Ubuntu {UBUNTU_MIN_VERSION} or later) or enrol in extended security maintenance."
+        ],
+        "macos": [
+          "Upgrade to macOS {MACOS_MIN_MAJOR} or later, or replace Macs that cannot run a supported version."
+        ],
+        "ios": [
+          "Update to iOS {IOS_MIN_MAJOR} or later in Settings › General › Software Update; if the iPhone cannot run it, replace the iPhone."
+        ],
+        "android": [
+          "Update to Android {ANDROID_MIN_MAJOR} or later in Settings › System › Software updates; if the maker no longer offers it, replace the phone."
+        ]
       },
       "verify": "Re-run the audit; Supported operating system version should be Compliant."
     },
     "gdpr.security_logging": {
       "why": "Logon and account-change events are needed to detect and investigate a breach within the 72-hour GDPR deadline.",
-      "risk": { "level": "Medium", "reason": "Without these logs, a breach cannot be scoped and the notification decision becomes guesswork." },
+      "risk": {
+        "level": "Medium",
+        "reason": "Without these logs, a breach cannot be scoped and the notification decision becomes guesswork."
+      },
       "fix": {
-        "windows": ["Enable auditing: auditpol /set /subcategory:{0CCE9215-69AE-11D9-BED3-505054503030} /success:enable /failure:enable (Logon) and auditpol /set /subcategory:{0CCE9235-69AE-11D9-BED3-505054503030} /success:enable /failure:enable (User Account Management), or set the Advanced Audit Policy by Group Policy."],
-        "linux": ["Install and start auditd (apt install auditd; systemctl enable --now auditd) and keep the journal persistent (Storage=persistent in /etc/systemd/journald.conf)."],
-        "macos": ["Unified logging is built in; forward security logs to your log platform if long retention is required."]
+        "windows": [
+          "Enable auditing: auditpol /set /subcategory:{0CCE9215-69AE-11D9-BED3-505054503030} /success:enable /failure:enable (Logon) and auditpol /set /subcategory:{0CCE9235-69AE-11D9-BED3-505054503030} /success:enable /failure:enable (User Account Management), or set the Advanced Audit Policy by Group Policy."
+        ],
+        "linux": [
+          "Install and start auditd (apt install auditd; systemctl enable --now auditd) and keep the journal persistent (Storage=persistent in /etc/systemd/journald.conf)."
+        ],
+        "macos": [
+          "Unified logging is built in; forward security logs to your log platform if long retention is required."
+        ]
       },
       "verify": "Re-run the audit; Security event logging should be Compliant."
     },
     "gdpr.time_sync": {
       "why": "Accurate clocks are needed to put events in the right order during an investigation.",
-      "risk": { "level": "Low", "reason": "Wrong timestamps make incident timelines unreliable." },
+      "risk": {
+        "level": "Low",
+        "reason": "Wrong timestamps make incident timelines unreliable."
+      },
       "fix": {
-        "windows": ["w32tm /config /syncfromflags:manual /manualpeerlist:\"pool.ntp.org\" /update (domain members sync from the domain automatically); make sure the Windows Time service is not disabled."],
-        "linux": ["timedatectl set-ntp true (or enable chronyd)."],
-        "macos": ["sudo systemsetup -setusingnetworktime on."]
+        "windows": [
+          "w32tm /config /syncfromflags:manual /manualpeerlist:\"pool.ntp.org\" /update (domain members sync from the domain automatically); make sure the Windows Time service is not disabled."
+        ],
+        "linux": [
+          "timedatectl set-ntp true (or enable chronyd)."
+        ],
+        "macos": [
+          "sudo systemsetup -setusingnetworktime on."
+        ],
+        "ios": [
+          "Settings › General › Date & Time: turn on Set Automatically."
+        ],
+        "android": [
+          "Settings › System › Date & time: turn on Set time automatically."
+        ]
       },
       "verify": "Re-run the audit; Time synchronisation should be Compliant."
     },
     "gdpr.backup_configured": {
       "why": "Backups make it possible to restore personal data after loss, theft, failure or ransomware.",
-      "risk": { "level": "High", "reason": "Data that exists only on this device is lost if the device fails or is encrypted by ransomware." },
+      "risk": {
+        "level": "High",
+        "reason": "Data that exists only on this device is lost if the device fails or is encrypted by ransomware."
+      },
       "fix": {
-        "windows": ["Back up user folders with OneDrive Known Folder Move (Group Policy/Intune), File History, or the organisation's backup agent."],
-        "linux": ["Set up scheduled backups of /home with Deja Dup, restic or borg (or Timeshift for system snapshots plus a data backup)."],
-        "macos": ["Configure Time Machine (tmutil setdestination) or the organisation's backup agent."]
+        "windows": [
+          "Back up user folders with OneDrive Known Folder Move (Group Policy/Intune), File History, or the organisation's backup agent."
+        ],
+        "linux": [
+          "Set up scheduled backups of /home with Deja Dup, restic or borg (or Timeshift for system snapshots plus a data backup)."
+        ],
+        "macos": [
+          "Configure Time Machine (tmutil setdestination) or the organisation's backup agent."
+        ],
+        "ios": [
+          "Settings › [your name] › iCloud › iCloud Backup: turn on, or use the employer's approved backup; keep work data only in company-approved apps."
+        ],
+        "android": [
+          "Settings › Google › Backup: turn on Backup by Google One (or the employer's approved backup); keep work data only in company-approved apps."
+        ]
       },
       "verify": "Re-run the audit; Backup configured should be Compliant."
     },
     "gdpr.backup_recent": {
       "why": "A configured backup only helps if it has actually run recently.",
-      "risk": { "level": "Medium", "reason": "Recent work would be lost if the device failed today." },
+      "risk": {
+        "level": "Medium",
+        "reason": "Recent work would be lost if the device failed today."
+      },
       "fix": {
-        "windows": ["Check the backup tool's history and run a backup now; fix whatever stopped it (full destination, signed-out OneDrive, stopped agent)."],
-        "linux": ["Run the backup job now and check its timer and logs."],
-        "macos": ["Run tmutil startbackup and check that the destination is reachable."]
+        "windows": [
+          "Check the backup tool's history and run a backup now; fix whatever stopped it (full destination, signed-out OneDrive, stopped agent)."
+        ],
+        "linux": [
+          "Run the backup job now and check its timer and logs."
+        ],
+        "macos": [
+          "Run tmutil startbackup and check that the destination is reachable."
+        ]
       },
       "verify": "Re-run the audit; the last backup should be within {BACKUP_MAX_AGE_DAYS} days."
     },
     "gdpr.removable_encryption": {
       "why": "Personal data copied to removable media must be encrypted, or copying must be blocked.",
-      "risk": { "level": "Medium", "reason": "A lost unencrypted USB drive with personal data is a reportable breach." },
+      "risk": {
+        "level": "Medium",
+        "reason": "A lost unencrypted USB drive with personal data is a reportable breach."
+      },
       "fix": {
-        "windows": ["Enable 'Deny write access to removable drives not protected by BitLocker' (Group Policy: Windows Components > BitLocker Drive Encryption > Removable Data Drives), or deny USB write access."],
-        "linux": ["Block USB storage writes (udev read-only rule or USBGuard) and provide approved encrypted drives."],
-        "macos": ["Restrict external storage writes with your MDM or an endpoint DLP product and provide approved encrypted drives."]
+        "windows": [
+          "Enable 'Deny write access to removable drives not protected by BitLocker' (Group Policy: Windows Components > BitLocker Drive Encryption > Removable Data Drives), or deny USB write access."
+        ],
+        "linux": [
+          "Block USB storage writes (udev read-only rule or USBGuard) and provide approved encrypted drives."
+        ],
+        "macos": [
+          "Restrict external storage writes with your MDM or an endpoint DLP product and provide approved encrypted drives."
+        ]
       },
       "verify": "Re-run the audit; Removable media encryption should be Compliant."
     },
     "gdpr.guest_account": {
       "why": "Guest logins let people use the device without an identifiable account.",
-      "risk": { "level": "Medium", "reason": "Actions by a guest cannot be traced to a person, and guests may reach shared data." },
+      "risk": {
+        "level": "Medium",
+        "reason": "Actions by a guest cannot be traced to a person, and guests may reach shared data."
+      },
       "fix": {
-        "windows": ["Disable the built-in Guest account: Get-LocalUser | Where-Object { $_.SID -like '*-501' } | Disable-LocalUser"],
-        "linux": ["Set allow-guest=false in the LightDM configuration and remove any 'guest' account with a login shell."],
-        "macos": ["sudo defaults write /Library/Preferences/com.apple.loginwindow GuestEnabled -bool false, and turn off guest access to shared folders."]
+        "windows": [
+          "Disable the built-in Guest account: Get-LocalUser | Where-Object { $_.SID -like '*-501' } | Disable-LocalUser"
+        ],
+        "linux": [
+          "Set allow-guest=false in the LightDM configuration and remove any 'guest' account with a login shell."
+        ],
+        "macos": [
+          "sudo defaults write /Library/Preferences/com.apple.loginwindow GuestEnabled -bool false, and turn off guest access to shared folders."
+        ]
       },
       "verify": "Re-run the audit; Guest account disabled should be Compliant."
     },
     "gdpr.remote_access": {
       "why": "Remote access services let others reach the device over the network; only approved ones should be on.",
-      "risk": { "level": "High", "reason": "Unapproved remote access tools are a common entry point for attackers and support scams." },
+      "risk": {
+        "level": "High",
+        "reason": "Unapproved remote access tools are a common entry point for attackers and support scams."
+      },
       "fix": {
-        "windows": ["Turn off the listed services if not approved: disable Remote Desktop (fDenyTSConnections = 1), stop and disable sshd/WinRM, remove unneeded shares, and uninstall unapproved tools such as TeamViewer, AnyDesk or Chrome Remote Desktop."],
-        "linux": ["Disable unapproved services, e.g. systemctl disable --now ssh xrdp smbd, and remove unapproved remote access tools."],
-        "macos": ["Turn off Remote Login, Screen Sharing, File Sharing and Remote Management in System Settings > General > Sharing, and uninstall unapproved tools (e.g. the Chrome Remote Desktop host)."]
+        "windows": [
+          "Turn off the listed services if not approved: disable Remote Desktop (fDenyTSConnections = 1), stop and disable sshd/WinRM, remove unneeded shares, and uninstall unapproved tools such as TeamViewer, AnyDesk or Chrome Remote Desktop."
+        ],
+        "linux": [
+          "Disable unapproved services, e.g. systemctl disable --now ssh xrdp smbd, and remove unapproved remote access tools."
+        ],
+        "macos": [
+          "Turn off Remote Login, Screen Sharing, File Sharing and Remote Management in System Settings > General > Sharing, and uninstall unapproved tools (e.g. the Chrome Remote Desktop host)."
+        ]
       },
       "verify": "Re-run the audit; only approved services ({APPROVED_REMOTE_SERVICES_TEXT}) should remain.",
       "note": "If a listed service is needed, add it to APPROVED_REMOTE_SERVICES in baseline.conf and secure it (multi-factor authentication, restricted to the VPN)."
     },
     "gdpr.telemetry": {
       "why": "Operating systems can send optional usage and diagnostic data, which may contain personal data, to the vendor.",
-      "risk": { "level": "Low", "reason": "More personal data than necessary leaves the organisation." },
+      "risk": {
+        "level": "Low",
+        "reason": "More personal data than necessary leaves the organisation."
+      },
       "fix": {
-        "windows": ["Set Group Policy: Administrative Templates > Windows Components > Data Collection and Preview Builds > Allow Diagnostic Data = Send required diagnostic data (AllowTelemetry = 1; 0 on Enterprise/Education)."],
-        "linux": ["Opt out of popularity-contest (dpkg-reconfigure popularity-contest) and disable whoopsie if present (systemctl disable --now whoopsie)."],
-        "macos": ["Turn off System Settings > Privacy & Security > Analytics & Improvements > Share Mac Analytics and Share with App Developers, or enforce by profile."]
+        "windows": [
+          "Set Group Policy: Administrative Templates > Windows Components > Data Collection and Preview Builds > Allow Diagnostic Data = Send required diagnostic data (AllowTelemetry = 1; 0 on Enterprise/Education)."
+        ],
+        "linux": [
+          "Opt out of popularity-contest (dpkg-reconfigure popularity-contest) and disable whoopsie if present (systemctl disable --now whoopsie)."
+        ],
+        "macos": [
+          "Turn off System Settings > Privacy & Security > Analytics & Improvements > Share Mac Analytics and Share with App Developers, or enforce by profile."
+        ],
+        "ios": [
+          "Settings › Privacy & Security › Analytics & Improvements: turn off Share iPhone Analytics."
+        ],
+        "android": [
+          "Settings › Google › All services › Usage & diagnostics: turn off; also turn off the phone maker's diagnostics sharing."
+        ]
       },
       "verify": "Re-run the audit; Diagnostic data minimised should be Compliant."
     },
     "gdpr.personal_data_discovery": {
       "why": "Knowing where personal data is stored on endpoints is needed for the record of processing and for storage limitation.",
-      "risk": { "level": "Low", "reason": "Not assessed in stage 1." },
-      "fix": { "all": ["No action needed now: this opt-in scan is planned for a later stage of the tool."] },
+      "risk": {
+        "level": "Low",
+        "reason": "Not assessed in stage 1."
+      },
+      "fix": {
+        "all": [
+          "No action needed now: this opt-in scan is planned for a later stage of the tool."
+        ]
+      },
       "verify": "Not applicable in stage 1."
     },
-
     "aiact.inventory": {
       "why": "Deployers must know which AI systems they use before they can classify and govern them.",
-      "risk": { "level": "Low", "reason": "The inventory itself is information; the risk lies in unapproved or unclassified tools." },
-      "fix": { "all": ["Add the AI tools found on this device to the organisation's AI register, with owner and purpose."] },
+      "risk": {
+        "level": "Low",
+        "reason": "The inventory itself is information; the risk lies in unapproved or unclassified tools."
+      },
+      "fix": {
+        "all": [
+          "Add the AI tools found on this device to the organisation's AI register, with owner and purpose."
+        ]
+      },
       "verify": "The AI register lists every tool in the inventory."
     },
     "aiact.unapproved": {
       "why": "AI tools used without approval may send work and personal data to providers without contracts or a transfer basis.",
-      "risk": { "level": "Medium", "reason": "Shadow AI can leak confidential or personal data and creates unassessed AI Act and GDPR obligations." },
+      "risk": {
+        "level": "Medium",
+        "reason": "Shadow AI can leak confidential or personal data and creates unassessed AI Act and GDPR obligations."
+      },
       "fix": {
-        "all": ["Decide for each listed tool: approve it (add to APPROVED_AI_TOOLS after a data protection and AI Act review, with a data processing agreement where needed) or remove it.", "Publish an AI acceptable-use policy so staff know which tools are allowed."],
-        "windows": ["Remove unapproved apps (Settings > Apps) or block them with AppLocker / Intune app control."],
-        "linux": ["Remove unapproved tools with the package manager and restrict installation rights."],
-        "macos": ["Remove unapproved apps and restrict installations through your MDM."]
+        "all": [
+          "Decide for each listed tool: approve it (add to APPROVED_AI_TOOLS after a data protection and AI Act review, with a data processing agreement where needed) or remove it.",
+          "Publish an AI acceptable-use policy so staff know which tools are allowed."
+        ],
+        "windows": [
+          "Remove unapproved apps (Settings > Apps) or block them with AppLocker / Intune app control."
+        ],
+        "linux": [
+          "Remove unapproved tools with the package manager and restrict installation rights."
+        ],
+        "macos": [
+          "Remove unapproved apps and restrict installations through your MDM."
+        ]
       },
       "verify": "Re-run the audit; Unapproved AI tools should read none."
     },
     "aiact.risk_classification": {
       "why": "Each AI system must be checked against the banned practices and the high-risk uses in Annex III.",
-      "risk": { "level": "Medium", "reason": "An unclassified tool could be used for a high-risk or prohibited purpose without the required safeguards." },
-      "fix": { "all": ["Record the purpose for which each listed tool is used and classify it (prohibited, high-risk, limited-risk transparency, minimal). The auditor model does this from the inventory and the stated purpose."] },
+      "risk": {
+        "level": "Medium",
+        "reason": "An unclassified tool could be used for a high-risk or prohibited purpose without the required safeguards."
+      },
+      "fix": {
+        "all": [
+          "Record the purpose for which each listed tool is used and classify it (prohibited, high-risk, limited-risk transparency, minimal). The auditor model does this from the inventory and the stated purpose."
+        ]
+      },
       "verify": "Every AI tool in the inventory has a classification in the AI register."
     },
     "aiact.os_ai_features": {
       "why": "Built-in OS AI features can capture screen content or send text to external AI services.",
-      "risk": { "level": "Medium", "reason": "Screen snapshots or prompts can contain personal and confidential data processed without a defined purpose." },
+      "risk": {
+        "level": "Medium",
+        "reason": "Screen snapshots or prompts can contain personal and confidential data processed without a defined purpose."
+      },
       "fix": {
-        "windows": ["Set Group Policy: Administrative Templates > Windows Components > Windows AI > Turn off saving snapshots for use with Recall = Enabled (DisableAIDataAnalysis = 1), unless Recall has been assessed and approved."],
-        "macos": ["Deploy a Restrictions profile with allowExternalIntelligenceIntegrations = false (and restrict other Apple Intelligence features your policy does not allow)."],
-        "linux": ["No action needed: Linux distributions have no built-in AI assistant."]
+        "windows": [
+          "Set Group Policy: Administrative Templates > Windows Components > Windows AI > Turn off saving snapshots for use with Recall = Enabled (DisableAIDataAnalysis = 1), unless Recall has been assessed and approved."
+        ],
+        "macos": [
+          "Deploy a Restrictions profile with allowExternalIntelligenceIntegrations = false (and restrict other Apple Intelligence features your policy does not allow)."
+        ],
+        "linux": [
+          "No action needed: Linux distributions have no built-in AI assistant."
+        ],
+        "ios": [
+          "Settings › Apple Intelligence & Siri › ChatGPT: turn off unless the organisation has approved it; the employer can restrict it with a configuration profile."
+        ],
+        "android": [
+          "In the Gemini app (or other assistant) settings, turn off screen context / access to app content unless the organisation has approved it."
+        ]
       },
       "verify": "Re-run the audit; the OS AI features check should be Compliant or NotApplicable."
     },
     "aiact.log_retention": {
       "why": "Deployers of high-risk AI systems must keep the system's logs for at least six months.",
-      "risk": { "level": "Medium", "reason": "Missing logs prevent monitoring and investigation of high-risk AI use." },
-      "fix": { "all": ["If any listed tool is classified high-risk, keep its automatically generated logs under your control for at least six months."] },
+      "risk": {
+        "level": "Medium",
+        "reason": "Missing logs prevent monitoring and investigation of high-risk AI use."
+      },
+      "fix": {
+        "all": [
+          "If any listed tool is classified high-risk, keep its automatically generated logs under your control for at least six months."
+        ]
+      },
       "verify": "Log retention is documented for each high-risk AI system."
     },
-
     "org.ropa": {
       "why": "The record of processing activities is the core GDPR accountability document.",
-      "risk": { "level": "High", "reason": "A missing or outdated record is a direct infringement and makes every other assessment harder." },
-      "fix": { "all": ["Create or update the record of processing activities (purposes, categories of data and people, recipients, transfers, retention, security measures).", "Assign an owner and review it at least yearly."] },
+      "risk": {
+        "level": "High",
+        "reason": "A missing or outdated record is a direct infringement and makes every other assessment harder."
+      },
+      "fix": {
+        "all": [
+          "Create or update the record of processing activities (purposes, categories of data and people, recipients, transfers, retention, security measures).",
+          "Assign an owner and review it at least yearly."
+        ]
+      },
       "verify": "Answer ORG_ROPA=yes in organisational.conf once the record is current."
     },
     "org.dpia": {
       "why": "High-risk processing needs a data protection impact assessment before it starts.",
-      "risk": { "level": "Medium", "reason": "High-risk processing without a DPIA breaches GDPR and leaves risks to people unassessed." },
-      "fix": { "all": ["List processing that is likely high-risk (e.g. monitoring employees, large-scale sensitive data, new technologies such as AI) and complete a DPIA for each."] },
+      "risk": {
+        "level": "Medium",
+        "reason": "High-risk processing without a DPIA breaches GDPR and leaves risks to people unassessed."
+      },
+      "fix": {
+        "all": [
+          "List processing that is likely high-risk (e.g. monitoring employees, large-scale sensitive data, new technologies such as AI) and complete a DPIA for each."
+        ]
+      },
       "verify": "Answer ORG_DPIA=yes once DPIAs are done."
     },
     "org.breach_procedure": {
       "why": "Breaches must be reported to the supervisory authority within 72 hours where required.",
-      "risk": { "level": "High", "reason": "Without a tested procedure, the 72-hour deadline is easily missed." },
-      "fix": { "all": ["Write a breach procedure (detection, assessment, 72-hour notification to the CNPD or your authority, informing people, breach log) and test it with an exercise."] },
+      "risk": {
+        "level": "High",
+        "reason": "Without a tested procedure, the 72-hour deadline is easily missed."
+      },
+      "fix": {
+        "all": [
+          "Write a breach procedure (detection, assessment, 72-hour notification to the CNPD or your authority, informing people, breach log) and test it with an exercise."
+        ]
+      },
       "verify": "Answer ORG_BREACH_PROCEDURE=yes once the procedure is written and tested."
     },
     "org.processor_agreements": {
       "why": "Every processor, including cloud and AI providers, needs a contract with the GDPR Article 28 terms.",
-      "risk": { "level": "High", "reason": "Sharing personal data with a processor without an agreement breaches GDPR." },
-      "fix": { "all": ["List all processors (including AI services used by staff) and sign a data processing agreement with each; check the transfer basis for non-EEA providers."] },
+      "risk": {
+        "level": "High",
+        "reason": "Sharing personal data with a processor without an agreement breaches GDPR."
+      },
+      "fix": {
+        "all": [
+          "List all processors (including AI services used by staff) and sign a data processing agreement with each; check the transfer basis for non-EEA providers."
+        ]
+      },
       "verify": "Answer ORG_PROCESSOR_AGREEMENTS=yes once all agreements are in place."
     },
     "org.ai_register": {
       "why": "A register of AI systems is the basis for AI Act classification and deployer duties.",
-      "risk": { "level": "Medium", "reason": "Without a register, high-risk or prohibited AI use can go unnoticed." },
-      "fix": { "all": ["Create an AI register listing each AI system, owner, purpose, risk class and the data it uses; use the AI software inventory from this audit as input."] },
+      "risk": {
+        "level": "Medium",
+        "reason": "Without a register, high-risk or prohibited AI use can go unnoticed."
+      },
+      "fix": {
+        "all": [
+          "Create an AI register listing each AI system, owner, purpose, risk class and the data it uses; use the AI software inventory from this audit as input."
+        ]
+      },
       "verify": "Answer ORG_AI_REGISTER=yes once the register exists."
     },
     "org.ai_literacy": {
       "why": "Since 2 February 2025, organisations must ensure staff using AI have sufficient AI literacy.",
-      "risk": { "level": "Medium", "reason": "Untrained staff misuse AI tools and share data they should not." },
-      "fix": { "all": ["Provide AI literacy training matched to how staff use AI (capabilities, limits, data protection, the AI acceptable-use policy) and keep records."] },
+      "risk": {
+        "level": "Medium",
+        "reason": "Untrained staff misuse AI tools and share data they should not."
+      },
+      "fix": {
+        "all": [
+          "Provide AI literacy training matched to how staff use AI (capabilities, limits, data protection, the AI acceptable-use policy) and keep records."
+        ]
+      },
       "verify": "Answer ORG_AI_LITERACY=yes once training is delivered and recorded."
     },
     "org.human_oversight": {
       "why": "High-risk AI systems need trained people who can understand, monitor and override them.",
-      "risk": { "level": "Medium", "reason": "High-risk AI without oversight can harm people without anyone noticing." },
-      "fix": { "all": ["For each high-risk AI system, name a trained person responsible for oversight; answer n/a if no high-risk AI is used."] },
+      "risk": {
+        "level": "Medium",
+        "reason": "High-risk AI without oversight can harm people without anyone noticing."
+      },
+      "fix": {
+        "all": [
+          "For each high-risk AI system, name a trained person responsible for oversight; answer n/a if no high-risk AI is used."
+        ]
+      },
       "verify": "Answer ORG_HUMAN_OVERSIGHT=yes (or n/a) in organisational.conf."
     },
     "org.ai_transparency": {
       "why": "People must know when they deal with AI or AI-generated content.",
-      "risk": { "level": "Low", "reason": "Undisclosed AI use damages trust and breaches the AI Act transparency rules." },
-      "fix": { "all": ["Set rules for labelling AI chatbots and AI-generated or manipulated content, and include them in the AI acceptable-use policy."] },
+      "risk": {
+        "level": "Low",
+        "reason": "Undisclosed AI use damages trust and breaches the AI Act transparency rules."
+      },
+      "fix": {
+        "all": [
+          "Set rules for labelling AI chatbots and AI-generated or manipulated content, and include them in the AI acceptable-use policy."
+        ]
+      },
       "verify": "Answer ORG_AI_TRANSPARENCY=yes once the rules are in place."
+    },
+    "mobile.passcode_strength": {
+      "why": "A short numeric code or a pattern can be guessed or seen over the user's shoulder; a longer code protects the data if the phone is lost.",
+      "risk": {
+        "level": "Medium",
+        "reason": "A weak passcode lets someone who has the phone unlock it and read work data."
+      },
+      "fix": {
+        "ios": [
+          "Settings › Face ID & Passcode › Change Passcode › Passcode Options: choose a 6-digit, custom numeric (7+ digits) or alphanumeric code."
+        ],
+        "android": [
+          "Settings › Security & privacy › Device unlock › Screen lock: choose a PIN of at least {MOBILE_PASSCODE_MIN_DIGITS} digits or a password instead of a pattern."
+        ]
+      },
+      "verify": "Re-run the phone check; the passcode answer should be at least {MOBILE_PASSCODE_MIN_DIGITS} digits or alphanumeric."
+    },
+    "mobile.jailbreak_root": {
+      "why": "Jailbreaking or rooting removes the operating system's app isolation and security checks.",
+      "risk": {
+        "level": "High",
+        "reason": "Any app can then read other apps' data, including work email and files."
+      },
+      "fix": {
+        "ios": [
+          "Restore the iPhone with the latest iOS (Settings › General › Transfer or Reset iPhone › Erase All Content and Settings, or restore through a computer), then restore data from a backup."
+        ],
+        "android": [
+          "Remove root and re-lock the bootloader by installing the phone maker's official firmware, or stop using the phone for work."
+        ]
+      },
+      "verify": "Re-run the phone check after restoring; the phone should be reported as not jailbroken / not rooted."
+    },
+    "mobile.app_sources": {
+      "why": "Official app stores review apps for malware; apps from other sources skip those checks.",
+      "risk": {
+        "level": "High",
+        "reason": "Side-loaded apps are a common way malware reaches phones."
+      },
+      "fix": {
+        "ios": [
+          "Remove apps from alternative marketplaces or websites, and remove unknown profiles in Settings › General › VPN & Device Management; install work apps only from the App Store or the employer."
+        ],
+        "android": [
+          "Settings › Apps › Special app access › Install unknown apps: set every app to Not allowed; uninstall apps that did not come from Google Play."
+        ]
+      },
+      "verify": "Re-run the phone check; apps should come only from the official store (or the employer)."
+    },
+    "mobile.usb_debugging": {
+      "why": "USB debugging lets a connected computer install apps and read data without the usual checks.",
+      "risk": {
+        "level": "Medium",
+        "reason": "Anyone who can plug the unlocked phone into a computer can copy data or install software."
+      },
+      "fix": {
+        "android": [
+          "Settings › System › Developer options: turn off USB debugging, or turn off Developer options completely."
+        ]
+      },
+      "verify": "Re-run the phone check; USB debugging should be off."
+    },
+    "mobile.find_my_device": {
+      "why": "Locating, locking and erasing a lost phone limits a personal data breach.",
+      "risk": {
+        "level": "Medium",
+        "reason": "A lost phone cannot be wiped, so its data may have to be reported as a breach (GDPR Art. 33)."
+      },
+      "fix": {
+        "ios": [
+          "Settings › [your name] › Find My › Find My iPhone: turn on, together with Send Last Location."
+        ],
+        "android": [
+          "Settings › Google › All services › Find My Device (Find Hub): turn on, and make sure Location is on."
+        ]
+      },
+      "verify": "Re-run the phone check; Find My should be on."
+    },
+    "gdpr.lock_screen_previews": {
+      "why": "Previews show message and email content, often personal data, to anyone who sees the locked phone.",
+      "risk": {
+        "level": "Low",
+        "reason": "Personal data in notifications can be read without unlocking the phone."
+      },
+      "fix": {
+        "ios": [
+          "Settings › Notifications › Show Previews: choose When Unlocked or Never."
+        ],
+        "android": [
+          "Settings › Notifications › Notifications on lock screen: choose Hide sensitive content or Don't show notifications."
+        ]
+      },
+      "verify": "Re-run the phone check; previews should be hidden when the phone is locked."
     }
   }
 }

mobile/app.js

@@ -0,0 +1,352 @@
+// Devseis Phone Check: browser detection + guided questions -> evidence (mobile-core.js) -> findings written by
+// the auditor model in WebLLM (or the built-in writer) -> report the user can save or share as PDF.
+// Nothing about the phone leaves the browser; only the model and the vulnerability data are downloaded.
+import { Library, findingPrompt, findingTemplate, summaryPrompt, summaryTemplate, aiPrompt, aiTemplate, writeAnswer } from '../app/renderer/auditor-core.js';
+import { buildReportHtml } from '../app/renderer/report.js';
+import { loadModelWith } from '../app/renderer/model-core.js';
+import { buildMobileEvidence, questionsFor } from './mobile-core.js';
+import { detectDevice } from './detect.js';
+import { loadPhoneVulnData } from './vuln-web.js';
+
+const WEBLLM_URL = 'https://esm.run/@mlc-ai/web-llm@0.2.85';
+const HTML2PDF_URL = 'https://cdnjs.cloudflare.com/ajax/libs/html2pdf.js/0.10.1/html2pdf.bundle.min.js';
+const MODEL_SIZE = 'about 350 MB, downloaded once';
+
+const $ = id => document.getElementById(id);
+const show = id => { document.querySelectorAll('.screen').forEach(s => s.classList.add('hidden')); $(`s-${id}`).classList.remove('hidden'); window.scrollTo(0, 0); };
+const setBar = (id, fraction) => { $(id).style.width = `${Math.round(Math.max(0, Math.min(1, fraction)) * 100)}%`; };
+const esc = value => String(value ?? '').replace(/[&<>"']/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+
+const state = { device: null, data: null, lib: null, steps: [], index: 0, answers: {}, aiApps: [], version: null, versionEdited: false,
+  model: null, modelPromise: null, modelStatus: '', vulnPromise: null, report: null };
+
+function readConf(text) {
+  const conf = {};
+  for (const line of text.split('\n')) {
+    if (!line.includes('=') || line.trimStart().startsWith('#')) continue;
+    const i = line.indexOf('=');
+    conf[line.slice(0, i).trim()] = line.slice(i + 1).trim().replace(/^"|"$/g, '');
+  }
+  return conf;
+}
+
+// Organisation answers can be passed by the employer in the link: #org=<base64 JSON {ORG_ROPA: "yes", ...}>
+function orgFromLink() {
+  const m = /[#&]org=([^&]+)/.exec(location.hash);
+  if (!m) return null;
+  try { return JSON.parse(atob(decodeURIComponent(m[1]).replace(/-/g, '+').replace(/_/g, '/'))); } catch { return null; }
+}
+
+async function loadData() {
+  const get = async (path, type = 'json') => { const r = await fetch(path); if (!r.ok) throw new Error(`${path}: HTTP ${r.status}`); return type === 'json' ? r.json() : r.text(); };
+  const [catalog, questions, controls, guidance, aiTools, baselineText] = await Promise.all([
+    get('catalog/checks.json'), get('catalog/mobile_questions.json'), get('library/controls.json'), get('library/check_guidance.json'),
+    get('library/ai_tools.json'), get('baseline.conf', 'text')]);
+  return { catalog, questions, baseline: readConf(baselineText), library: { catalog, controls, guidance, aiTools } };
+}
+
+// --- 1. Start ---------------------------------------------------------------------------------
+function renderDevice() {
+  const d = state.device;
+  const rows = [['Device', d.device_model || (d.os_family ? 'Phone' : 'Computer')],
+    ['System', d.os_name ? `${d.os_name} ${d.os_version || '(version not visible)'}` : 'Not a phone'],
+    ['Browser', d.browser],
+    ['Screen lock', d.platform_authenticator === true ? 'Unlock method detected' : d.platform_authenticator === false ? 'Not detected (will ask)' : 'Unknown (will ask)'],
+    ['AI on this device', d.webgpu ? 'Supported (WebGPU)' : 'Not supported; the built-in writer is used']];
+  $('device-card').innerHTML = rows.map(([k, v]) => `<b>${esc(k)}</b><span>${esc(v)}</span>`).join('');
+  $('desktop-note').classList.toggle('hidden', !d.desktop);
+  $('start').disabled = !d.os_family;
+}
+
+function demo(osFamily) {
+  Object.assign(state.device, osFamily === 'ios'
+    ? { os_family: 'ios', os_name: 'iOS', os_version: null, version_precise: false, device_model: 'iPhone (demo on a computer)', platform_authenticator: null }
+    : { os_family: 'android', os_name: 'Android', os_version: null, version_precise: false, device_model: 'Android phone (demo on a computer)', platform_authenticator: null });
+  renderDevice();
+}
+
+// --- 2. Approval --------------------------------------------------------------------------------
+function showConsent() {
+  const { catalog } = state.data;
+  const os = state.device.os_family;
+  const checks = catalog.checks.filter(c => c.os.includes(os));
+  $('check-count').textContent = checks.length;
+  $('plan').innerHTML = checks.map(c => `<li>${esc((c.names && c.names[os]) || c.name)}</li>`).join('');
+  const ai = $('use-ai');
+  ai.disabled = !state.device.webgpu;
+  ai.checked = state.device.webgpu && !state.device.cellular;
+  $('ai-note').textContent = !state.device.webgpu
+    ? 'This browser has no WebGPU, so the built-in report writer is used.'
+    : `Runs on this phone (${MODEL_SIZE}; Wi-Fi recommended). Off = built-in report writer.`;
+  show('consent');
+}
+
+function startBackgroundWork() {
+  state.vulnPromise = loadPhoneVulnData();
+  if ($('use-ai').checked) {
+    const chip = $('model-chip');
+    chip.classList.remove('hidden');
+    chip.textContent = 'AI auditor: starting download';
+    state.modelPromise = import(WEBLLM_URL)
+      .then(webllm => loadModelWith(webllm, p => { chip.textContent = `AI auditor: ${Math.round((p.progress || 0) * 100)}%`; }))
+      .then(model => { state.model = model; chip.textContent = 'AI auditor ready'; return model; })
+      .catch(error => { chip.textContent = 'AI unavailable: built-in writer'; state.modelStatus = error.message; return null; });
+  } else {
+    state.modelPromise = Promise.resolve(null);
+  }
+}
+
+// --- 3. Questions -------------------------------------------------------------------------------
+function buildSteps() {
+  const { catalog, questions } = state.data;
+  const d = state.device;
+  const steps = [{ kind: 'version', ...questions.os_version[d.os_family] }];
+  for (const q of questionsFor(d.os_family, catalog, questions, { platform_authenticator: d.platform_authenticator })) steps.push({ kind: 'check', ...q });
+  steps.push({ kind: 'ai', name: 'AI software inventory', ...questions.ai_apps });
+  return steps;
+}
+
+function renderStep() {
+  const step = state.steps[state.index];
+  const total = state.steps.length;
+  setBar('q-bar', state.index / total);
+  $('q-count').textContent = `Question ${state.index + 1} of ${total}`;
+  $('q-check').textContent = step.kind === 'version' ? 'System version' : step.name;
+  $('q-text').textContent = step.question;
+  $('q-where').textContent = step.where;
+  const box = $('q-answers');
+  box.innerHTML = '';
+  const next = () => { state.index += 1; state.index < total ? renderStep() : finish(); };
+
+  if (step.kind === 'version') {
+    const input = document.createElement('input');
+    input.type = 'text'; input.inputMode = 'decimal'; input.placeholder = state.device.os_family === 'ios' ? 'for example 27.0.1' : 'for example 15';
+    input.value = state.version || state.device.os_version || '';
+    const hint = document.createElement('p');
+    hint.className = 'muted';
+    hint.textContent = state.device.os_version ? `Detected by the browser: ${state.device.os_version}. Correct it if Settings shows more detail.` : 'The browser could not see the version; please type it.';
+    const ok = button('Continue', 'primary', () => {
+      const value = input.value.trim();
+      if (!/^\d+(\.\d+){0,2}$/.test(value)) { input.focus(); return; }
+      state.version = value;
+      state.versionEdited = value !== state.device.os_version;
+      next();
+    });
+    box.append(hint, input, ok);
+    return;
+  }
+  if (step.kind === 'ai') {
+    for (const app of step.options) {
+      const label = document.createElement('label');
+      label.className = 'multi';
+      label.innerHTML = `<input type="checkbox" value="${esc(app)}" ${state.aiApps.includes(app) ? 'checked' : ''}><span>${esc(app)}</span>`;
+      box.append(label);
+    }
+    box.append(button('Continue', 'primary', () => {
+      state.aiApps = [...box.querySelectorAll('input:checked')].map(i => i.value);
+      next();
+    }));
+    return;
+  }
+  if (step.input === 'month') {
+    const input = document.createElement('input');
+    input.type = 'month';
+    input.value = typeof state.answers[step.id] === 'string' && state.answers[step.id] !== 'not_sure' ? state.answers[step.id] : '';
+    box.append(input, button('Continue', 'primary', () => { if (!/^\d{4}-\d{2}$/.test(input.value)) { input.focus(); return; } state.answers[step.id] = input.value; next(); }));
+  } else {
+    step.answers.forEach((answer, i) => box.append(button(answer.label, 'secondary', () => { state.answers[step.id] = i; next(); })));
+  }
+  box.append(button(state.data.questions.not_sure.label, 'secondary not-sure', () => { state.answers[step.id] = 'not_sure'; next(); }));
+}
+
+function button(text, className, onClick) {
+  const b = document.createElement('button');
+  b.className = className; b.textContent = text; b.type = 'button';
+  b.addEventListener('click', onClick);
+  return b;
+}
+
+// --- 4. Evidence and report -----------------------------------------------------------------------
+async function finish() {
+  show('work');
+  const d = state.device;
+  $('w-step').textContent = 'Checking the vulnerability data';
+  setBar('w-bar', 0.02);
+  const vuln = await state.vulnPromise;
+  const now = new Date();
+  const offset = -now.getTimezoneOffset();
+  const pad = n => String(Math.abs(n)).padStart(2, '0');
+  const started = `${now.getFullYear()}-${pad(now.getMonth() + 1)}-${pad(now.getDate())}T${pad(now.getHours())}:${pad(now.getMinutes())}:${pad(now.getSeconds())}${offset >= 0 ? '+' : '-'}${pad(Math.floor(Math.abs(offset) / 60))}:${pad(Math.abs(offset) % 60)}`;
+  const input = {
+    os_family: d.os_family, os_name: d.os_name, os_version: state.version, version_source: state.versionEdited || !d.os_version ? 'user' : 'browser',
+    browser: d.browser, device_model: d.device_model || (d.os_family === 'ios' ? 'iPhone' : 'Android phone'), hostname: d.device_model || d.os_name,
+    started_at: started, platform_authenticator: d.platform_authenticator, answers: state.answers, ai_apps: state.aiApps, org: orgFromLink(),
+  };
+  const evidence = buildMobileEvidence(input, { catalog: state.data.catalog, questions: state.data.questions, baseline: state.data.baseline, vuln, now: now.getTime() });
+  const evidenceText = JSON.stringify(evidence, null, 2);
+  const sha256 = [...new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(evidenceText)))].map(b => b.toString(16).padStart(2, '0')).join('');
+
+  if (state.modelPromise && !state.model) {
+    $('w-title').textContent = 'Getting the AI auditor ready';
+    $('w-step').textContent = 'Finishing the model download (only the first time)…';
+    await state.modelPromise;
+  }
+  const model = state.model;
+  const lib = state.lib;
+  const targets = evidence.results.filter(r => ['Non-Compliant', 'Error', 'Pending'].includes(r.status) && r.section !== 'org');
+  const ai = aiPrompt(evidence, lib);
+  const total = targets.length + 1 + (ai ? 1 : 0);
+  let done = 0;
+  const sources = { model: 0, template: 0 };
+  const generate = model ? model.generate : null;
+  const tick = label => { done += 1; setBar('w-bar', done / total); $('w-current').textContent = label; };
+  $('w-title').textContent = 'Writing your report';
+  $('w-step').textContent = model ? `The AI auditor is writing ${total} parts on this phone` : 'The built-in writer is writing the findings';
+
+  const findings = {};
+  for (const r of evidence.results.filter(x => x.section === 'org' && x.status !== 'Compliant')) {
+    findings[r.id] = findingTemplate(evidence, r, lib);  // organisational answers: short, fixed wording
+  }
+  for (const r of targets) {
+    $('w-current').textContent = `Writing: ${r.name}`;
+    const out = await writeAnswer('finding', findingPrompt(evidence, r, lib), findingTemplate(evidence, r, lib), generate);
+    findings[r.id] = out.answer;
+    sources[out.source] += 1;
+    tick(`Written: ${r.name}`);
+  }
+  const summaryBase = summaryTemplate(evidence, lib);
+  const summaryOut = await writeAnswer('summary', summaryPrompt(evidence, lib), summaryBase, generate);
+  const summary = summaryOut.source === 'model' ? { ...summaryBase, summary: summaryOut.answer.summary, next_steps: summaryOut.answer.next_steps } : summaryBase;
+  sources[summaryOut.source] += 1;
+  tick('Written: summary');
+  let aiResult = null;
+  if (ai) {
+    const out = await writeAnswer('ai_classification', ai, aiTemplate(evidence, lib), generate);
+    aiResult = out.answer;
+    sources[out.source] += 1;
+    tick('Written: AI app classification');
+  }
+  const html = buildReportHtml({ evidence, findings, summary, ai: aiResult, sha256, model: model ? model.name : null, sources });
+  state.report = { html, evidence, evidenceText, summary, sources };
+  showResult();
+}
+
+// --- 5. Result, PDF and sharing ----------------------------------------------------------------
+function showResult() {
+  const { evidence, summary, sources } = state.report;
+  const pills = Object.entries(evidence.summary).filter(([, v]) => v).map(([k, v]) => `<span class="pill s-${k}">${v} ${k}</span>`).join('');
+  const gaps = summary.top_gaps.map(g => `<li><b class="s-Non-Compliant">${esc(g.risk)}</b> — ${esc(g.name)}: ${esc(g.found)}</li>`).join('');
+  const reported = evidence.results.filter(r => r.evidence === 'self-reported').length;
+  const detected = evidence.results.filter(r => r.evidence === 'detected').length;
+  $('result').innerHTML = `
+    <h1>Your phone check</h1>
+    <div class="card"><div class="score">${summary.score.percent}%</div>
+      <p class="muted">${summary.score.compliant} of ${summary.score.assessed} assessed checks compliant · ${detected} detected, ${reported} self-reported</p>
+      <div class="pills">${pills}</div>
+      <p>${esc(summary.summary)}</p>
+      ${gaps ? `<b>Top gaps</b><ul class="gaps">${gaps}</ul>` : ''}
+      <p class="muted">Written ${sources.model ? `by the AI auditor (${sources.model}) and ` : ''}by the built-in writer (${sources.template}).</p>
+    </div>`;
+  $('pdf-note').textContent = 'The report stays on this phone until you save or share it.';
+  show('done');
+}
+
+function loadScript(src) {
+  return new Promise((resolve, reject) => {
+    if ([...document.scripts].some(s => s.src === src)) return resolve();
+    const s = document.createElement('script');
+    s.src = src; s.onload = resolve; s.onerror = () => reject(new Error('could not load the PDF tool'));
+    document.head.append(s);
+  });
+}
+
+async function makePdf() {
+  await loadScript(HTML2PDF_URL);
+  const doc = new DOMParser().parseFromString(state.report.html, 'text/html');
+  const holder = document.createElement('div');
+  holder.style.cssText = 'position:fixed;left:-10000px;top:0;width:794px;background:#fff;color:#16181d';
+  const style = document.createElement('style');
+  style.textContent = doc.querySelector('style').textContent.replace(/(^|\n)\s*body\s*\{/g, '$1.devseis-report {');
+  const body = document.createElement('div');
+  body.className = 'devseis-report';
+  body.innerHTML = doc.body.innerHTML;
+  holder.append(style, body);
+  document.body.append(holder);
+  try {
+    return await window.html2pdf().set({ margin: 10, image: { type: 'jpeg', quality: 0.92 }, html2canvas: { scale: 1.5, useCORS: true },
+      jsPDF: { unit: 'mm', format: 'a4' }, pagebreak: { mode: ['css', 'legacy'] } }).from(body).outputPdf('blob');
+  } finally {
+    holder.remove();
+  }
+}
+
+function fileName(ext) {
+  const e = state.report.evidence;
+  return `devseis-phone-check-${e.host.os_family}-${e.audit.started_at.slice(0, 10)}.${ext}`;
+}
+
+function download(blob, name) {
+  const a = document.createElement('a');
+  a.href = URL.createObjectURL(blob); a.download = name;
+  document.body.append(a); a.click(); a.remove();
+  setTimeout(() => URL.revokeObjectURL(a.href), 30000);
+}
+
+async function sharePdf() {
+  $('pdf-note').textContent = 'Preparing the PDF…';
+  try {
+    const blob = await makePdf();
+    const file = new File([blob], fileName('pdf'), { type: 'application/pdf' });
+    if (navigator.canShare && navigator.canShare({ files: [file] })) {
+      try {
+        await navigator.share({ files: [file], title: 'Devseis phone check' });
+        $('pdf-note').textContent = 'Shared. Choose "Save to Files" in the share sheet to keep a copy on the phone.';
+        return;
+      } catch (error) {
+        if (error.name === 'AbortError') { $('pdf-note').textContent = 'Sharing cancelled.'; return; }
+      }
+    }
+    download(blob, file.name);
+    $('pdf-note').textContent = `Saved as ${file.name} (Downloads).`;
+  } catch (error) {
+    $('pdf-note').textContent = `The PDF could not be made (${error.message}). Use "View full report" and your browser's Share › Print to save it as PDF.`;
+  }
+}
+
+function viewReport() {
+  const url = URL.createObjectURL(new Blob([state.report.html], { type: 'text/html' }));
+  window.open(url, '_blank');
+  setTimeout(() => URL.revokeObjectURL(url), 60000);
+}
+
+// --- Wiring ----------------------------------------------------------------------------------------
+async function init() {
+  try {
+    [state.device, state.data] = await Promise.all([detectDevice(), loadData()]);
+  } catch (error) {
+    $('device-card').innerHTML = `<span class="s-Error">The check could not start: ${esc(error.message)}</span>`;
+    return;
+  }
+  state.lib = new Library(state.data.library);
+  renderDevice();
+}
+
+$('start').addEventListener('click', showConsent);
+document.querySelectorAll('[data-demo]').forEach(b => b.addEventListener('click', () => demo(b.dataset.demo)));
+$('consent-back').addEventListener('click', () => show('start'));
+$('consent-ok').addEventListener('click', () => {
+  startBackgroundWork();
+  state.steps = buildSteps();
+  state.index = 0;
+  show('question');
+  renderStep();
+});
+$('q-back').addEventListener('click', () => { if (state.index > 0) { state.index -= 1; renderStep(); } else show('consent'); });
+$('share-pdf').addEventListener('click', sharePdf);
+$('view-report').addEventListener('click', viewReport);
+$('save-json').addEventListener('click', () => download(new Blob([state.report.evidenceText], { type: 'application/json' }), fileName('json')));
+$('again').addEventListener('click', () => { state.answers = {}; state.aiApps = []; state.version = null; show('start'); });
+init();
+
+// Automated tests only (?test in the URL): expose state and the PDF maker.
+if (new URLSearchParams(location.search).has('test')) Object.assign(window, { __devseisState: state, __devseisMakePdf: makePdf });

mobile/build-evidence.mjs

@@ -0,0 +1,33 @@
+// Build phone evidence records from answer sets (JSON lines on stdin -> evidence JSON lines on stdout),
+// using exactly the code the mobile web page uses. Called by synthetic/generate_evidence.py.
+// Usage: node mobile/build-evidence.mjs [--vulndb DIR] [--now ISO-DATE] < answers.jsonl > evidence.jsonl
+import { readFileSync } from 'node:fs';
+import { gunzipSync } from 'node:zlib';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { buildMobileEvidence } from './mobile-core.js';
+
+const root = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+const arg = name => { const i = process.argv.indexOf(name); return i > 0 ? process.argv[i + 1] : null; };
+const readConf = file => Object.fromEntries(readFileSync(file, 'utf8').split('\n')
+  .filter(l => l.includes('=') && !l.trimStart().startsWith('#'))
+  .map(l => { const i = l.indexOf('='); return [l.slice(0, i).trim(), l.slice(i + 1).trim().replace(/^"|"$/g, '')]; }));
+
+const catalog = JSON.parse(readFileSync(path.join(root, 'catalog', 'checks.json'), 'utf8'));
+const questions = JSON.parse(readFileSync(path.join(root, 'catalog', 'mobile_questions.json'), 'utf8'));
+const baseline = readConf(arg('--baseline') || path.join(root, 'baseline.conf'));
+let vuln = { error: 'no vulnerability data found' };
+try {
+  const dir = arg('--vulndb') || path.join(root, 'vulndb', 'out');
+  const manifest = JSON.parse(readFileSync(path.join(dir, 'manifest.json'), 'utf8'));
+  vuln = { manifest, bundle: JSON.parse(gunzipSync(readFileSync(path.join(dir, manifest.mobile.file))).toString('utf8')) };
+} catch (error) { vuln = { error: error.message }; }
+const now = arg('--now') ? Date.parse(arg('--now')) : Date.now();
+
+const lines = readFileSync(0, 'utf8').split('\n').filter(Boolean);
+for (const line of lines) {
+  const input = JSON.parse(line);
+  const record = buildMobileEvidence(input, { catalog, questions, baseline, vuln, now: input.now ? Date.parse(input.now) : now });
+  if (input.synthetic) Object.assign(record.source, { kind: 'synthetic', ...input.synthetic });
+  process.stdout.write(JSON.stringify(record) + '\n');
+}

mobile/detect.js

@@ -0,0 +1,76 @@
+// What a web page can learn about the phone it runs on. Browsers deliberately hide security settings,
+// so this is limited to the OS and version, device model (Android), browser, whether a device unlock
+// method is set up, and WebGPU support. Everything else is asked.
+
+function iosVersion(ua) {
+  // Safari 26+ freezes the OS version in the user agent (it reports 18_6), but its own Version/ follows iOS.
+  const safari = /Version\/(\d+(?:\.\d+){0,2}).*Safari/.exec(ua);
+  const os = /OS (\d+)_(\d+)(?:_(\d+))?/.exec(ua);
+  const osVersion = os ? [os[1], os[2], os[3]].filter(Boolean).join('.') : null;
+  if (safari && !/CriOS|FxiOS|EdgiOS/.test(ua) && parseInt(safari[1], 10) >= 26) return { version: safari[1], precise: false };
+  if (osVersion && osVersion !== '18.6') return { version: osVersion, precise: Boolean(os[3]) };
+  if (safari) return { version: safari[1], precise: false };
+  return { version: osVersion, precise: false };
+}
+
+function browserName(ua, brands) {
+  let m;
+  if ((m = /SamsungBrowser\/(\d+(?:\.\d+)?)/.exec(ua))) return `Samsung Internet ${m[1]}`;
+  if ((m = /EdgA\/(\d+)|EdgiOS\/(\d+)/.exec(ua))) return `Edge ${m[1] || m[2]}`;
+  if ((m = /Firefox\/(\d+)|FxiOS\/(\d+)/.exec(ua))) return `Firefox ${m[1] || m[2]}`;
+  if ((m = /CriOS\/(\d+)/.exec(ua))) return `Chrome ${m[1]} (iOS)`;
+  const chrome = (brands || []).find(b => b.brand === 'Google Chrome');
+  if (chrome) return `Chrome ${chrome.version}`;
+  if ((m = /Chrome\/(\d+)/.exec(ua))) return `Chrome ${m[1]}`;
+  if ((m = /Version\/(\d+(?:\.\d+)?).*Safari/.exec(ua))) return `Safari ${m[1]}`;
+  return 'Unknown browser';
+}
+
+async function withTimeout(promise, ms, fallback) {
+  return Promise.race([promise, new Promise(resolve => setTimeout(() => resolve(fallback), ms))]);
+}
+
+export async function detectDevice() {
+  const ua = navigator.userAgent;
+  const uaData = navigator.userAgentData;
+  const out = { os_family: null, os_name: null, os_version: null, version_precise: false, device_model: '', browser: browserName(ua, uaData && uaData.brands),
+    platform_authenticator: null, webgpu: 'gpu' in navigator, cellular: Boolean(navigator.connection && navigator.connection.type === 'cellular'), desktop: false };
+
+  const ipadDesktopMode = /Macintosh/.test(ua) && navigator.maxTouchPoints > 1;
+  if (/iPhone|iPod/.test(ua) || /iPad/.test(ua) || ipadDesktopMode) {
+    const ipad = /iPad/.test(ua) || ipadDesktopMode;
+    const v = iosVersion(ua);
+    Object.assign(out, { os_family: 'ios', os_name: ipad ? 'iPadOS' : 'iOS', os_version: v.version, version_precise: v.precise, device_model: ipad ? 'iPad' : 'iPhone' });
+  } else if (/Android/.test(ua)) {
+    out.os_family = 'android';
+    out.os_name = 'Android';
+    if (uaData && uaData.getHighEntropyValues) {
+      try {
+        const hi = await withTimeout(uaData.getHighEntropyValues(['platform', 'platformVersion', 'model']), 1500, {});
+        // Only trust the hints when they describe Android (desktop browsers emulating a phone report the host OS).
+        if (hi.platform === 'Android') {
+          if (hi.platformVersion) out.os_version = String(parseInt(hi.platformVersion, 10));
+          if (hi.model) out.device_model = hi.model;
+        }
+      } catch { /* not allowed */ }
+    }
+    if (!out.os_version) {
+      const m = /Android (\d+)/.exec(ua);
+      // Chrome's reduced user agent always says "Android 10; K": not a real version.
+      if (m && !/Android 10; K\)/.test(ua)) out.os_version = m[1];
+    }
+    if (!out.device_model) {
+      const m = /Android [\d.]+; ([^;)]+)[;)]/.exec(ua);
+      if (m && m[1] !== 'K') out.device_model = m[1].trim();
+    }
+  } else {
+    out.desktop = true;
+  }
+
+  if (window.PublicKeyCredential && PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable) {
+    try {
+      out.platform_authenticator = await withTimeout(PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable(), 2000, null);
+    } catch { out.platform_authenticator = null; }
+  }
+  return out;
+}

mobile/mobile-core.js

@@ -0,0 +1,216 @@
+// Phone self-check: turns what the browser detected and what the user answered into evidence in the
+// same format as the desktop collectors (schema/evidence.schema.json, source.kind = "web").
+// Used by the mobile web page and, through mobile/build-evidence.mjs, by the synthetic generator, so the
+// training data uses exactly the wording the page produces. Pure functions only (no DOM, no network).
+import { matchApps, knownVulnResult } from '../app/renderer/vuln-core.js';
+
+export const MOBILE_VERSION = '0.3.0';
+const MOBILE = new Set(['ios', 'android']);
+const ORG_PENDING = 'Answered once by the organisation (organisational.conf); not part of the phone self-check.';
+
+const major = version => parseInt(String(version).split('.')[0], 10) || 0;
+const plural = (n, word) => `${n} ${word}${n === 1 ? '' : 's'}`;
+
+// Text and status for an answer whose result depends on the baseline.
+function computed(spec, answer, B, os) {
+  if (spec.expected_from === 'seconds') {
+    const limit = parseInt(B.SCREEN_LOCK_MAX_SECONDS, 10);
+    const label = os === 'ios' ? 'Auto-Lock' : 'Screen timeout';
+    const ok = answer.seconds != null && answer.seconds > 0 && answer.seconds <= limit;
+    return { status: ok ? 'Compliant' : 'Non-Compliant', actual: `${label} ${answer.label}`, expected: `<= ${limit} seconds`,
+      detail: ok ? '' : answer.seconds == null ? 'The phone never locks by itself.' : `The phone stays unlocked for ${answer.label} when not in use.` };
+  }
+  if (spec.expected_from === 'passcode') {
+    const min = parseInt(B.MOBILE_PASSCODE_MIN_DIGITS, 10);
+    const expected = `>= ${min} digits or alphanumeric`;
+    if (answer.alphanumeric) return { status: 'Compliant', actual: 'alphanumeric', expected, detail: '' };
+    if (answer.pattern) return { status: 'Non-Compliant', actual: 'pattern', expected, detail: 'Pattern locks are easy to guess from screen smudges or by watching.' };
+    if (answer.none) return { status: 'Non-Compliant', actual: 'swipe or none', expected, detail: 'There is no secret needed to unlock the phone.' };
+    const ok = answer.digits >= min;
+    const shown = answer.digits >= 7 ? '7+ digit numeric code' : `${answer.digits}-digit ${os === 'android' ? 'PIN' : 'code'}`;
+    return { status: ok ? 'Compliant' : 'Non-Compliant', actual: shown, expected, detail: ok ? '' : `A ${answer.digits}-digit code has only ${10 ** answer.digits} combinations.` };
+  }
+  throw new Error(`unknown computed answer type ${spec.expected_from}`);
+}
+
+// Android security patch level ("YYYY-MM") against MOBILE_PATCH_MAX_AGE_DAYS.
+function patchResult(value, B, now) {
+  const maxDays = parseInt(B.MOBILE_PATCH_MAX_AGE_DAYS, 10);
+  const expected = `<= ${maxDays} days old`;
+  const m = /^(\d{4})-(\d{2})/.exec(value || '');
+  if (!m) return null;
+  const days = Math.floor((now - Date.UTC(+m[1], +m[2] - 1, 1)) / 86400000);
+  const months = Math.max(0, Math.round(days / 30.4));
+  const ok = days <= maxDays;
+  return { status: ok ? 'Compliant' : 'Non-Compliant', actual: `security patch ${m[1]}-${m[2]} (${plural(months, 'month')} old)`, expected,
+    detail: ok ? '' : `Security fixes published since ${m[1]}-${m[2]} are missing; Google publishes Android fixes every month.` };
+}
+
+// Newest fixed iOS version for the same major line, from the NVD ranges in the bundle.
+function latestIosFix(bundle, product, version) {
+  const app = bundle.apps.find(a => a.id === product);
+  if (!app) return null;
+  let best = null;
+  for (const row of app.cves) {
+    const fixed = row[5];
+    if (fixed && major(fixed) === major(version) && (!best || cmp(fixed, best) > 0)) best = fixed;
+  }
+  return best;
+}
+// Apple fixes some vulnerabilities only in the newest major version.
+function newerMajor(bundle, product, version) {
+  const app = bundle.apps.find(a => a.id === product);
+  let top = null;
+  for (const row of app ? app.cves : []) if (row[5] && major(row[5]) > major(version) && (!top || cmp(row[5], top) > 0)) top = row[5];
+  return top ? ` ${major(top)}.x (newest: ${top}) fixes vulnerabilities that are not fixed in ${major(version)}.x.` : '';
+}
+function cmp(a, b) {
+  const x = String(a).split('.').map(Number), y = String(b).split('.').map(Number);
+  for (let i = 0; i < Math.max(x.length, y.length); i++) { const d = (x[i] || 0) - (y[i] || 0); if (d) return d; }
+  return 0;
+}
+
+function osSupported(input, B) {
+  const ios = input.os_family === 'ios';
+  const min = parseInt(ios ? B.IOS_MIN_MAJOR : B.ANDROID_MIN_MAJOR, 10);
+  const ok = major(input.os_version) >= min;
+  return { status: ok ? 'Compliant' : 'Non-Compliant', actual: `${input.os_name} ${input.os_version}`, expected: `>= ${ios ? 'iOS' : 'Android'} ${min}`,
+    detail: (input.version_source === 'user' ? `Version entered by the user from ${ios ? 'Settings › General › About' : 'Settings › About phone'}.` : `Version reported by the browser (${input.browser}).`)
+      + (ok ? '' : ' This version no longer receives all security updates.') };
+}
+
+function aiResults(id, apps, B) {
+  const approved = (B.APPROVED_AI_TOOLS || '').split(',').map(a => a.trim().toLowerCase()).filter(Boolean);
+  if (id === 'aiact.inventory') return { status: 'Compliant', actual: apps.join(', ') || 'no AI tools found', expected: 'inventory taken', detail: 'AI apps listed by the user.' };
+  if (id === 'aiact.unapproved') {
+    const bad = apps.filter(a => !approved.includes(a.toLowerCase()));
+    return { status: bad.length ? 'Non-Compliant' : 'Compliant', actual: bad.join(', ') || 'none', expected: `only: ${B.APPROVED_AI_TOOLS || 'none'}`, detail: '' };
+  }
+  if (id === 'aiact.risk_classification') {
+    return apps.length ? { status: 'Pending', actual: apps.join(', '), expected: 'every AI tool classified', detail: 'Classified by the auditor model (Caveat classifier) in a later step.' }
+      : { status: 'NotApplicable', actual: 'no AI tools found', expected: 'every AI tool classified', detail: '' };
+  }
+  return apps.length ? { status: 'Pending', actual: 'depends on classification', expected: '>= 6 months for high-risk AI', detail: 'Required only if a tool is classified high-risk.' }
+    : { status: 'NotApplicable', actual: 'no AI tools found', expected: '>= 6 months for high-risk AI', detail: '' };
+}
+
+function orgResult(check, answer) {
+  if (answer === 'yes') return { status: 'Compliant', actual: 'yes', expected: 'yes', detail: '' };
+  if (answer === 'no' || answer === 'partial') return { status: 'Non-Compliant', actual: answer, expected: 'yes', detail: '' };
+  if (answer === 'n/a') return { status: 'NotApplicable', actual: 'n/a', expected: 'yes', detail: '' };
+  return { status: 'Pending', actual: 'not answered', expected: 'yes', detail: answer === undefined ? ORG_PENDING : `Answer ${check.answer_key} in organisational.conf.` };
+}
+
+// The questions the page shows for this OS, in catalog order (detected checks are skipped).
+export function questionsFor(osFamily, catalog, questions, detected = {}) {
+  const list = [];
+  for (const check of catalog.checks) {
+    if (!check.os.includes(osFamily)) continue;
+    const spec = (questions.checks[check.id] || {})[osFamily];
+    if (!spec) continue;
+    if (check.id === 'screen_lock.enabled' && detected.platform_authenticator === true) continue;
+    list.push({ id: check.id, name: (check.names && check.names[osFamily]) || check.name, ...spec });
+  }
+  return list;
+}
+
+/**
+ * input: { os_family, os_name, os_version, version_source: 'browser'|'user', browser, device_model, hostname, started_at,
+ *          platform_authenticator: true|false|null, answers: { checkId: answerIndex | 'not_sure' | value }, ai_apps: [...], org: {key: answer}|null }
+ * ctx:   { catalog, questions, baseline, vuln: {bundle, manifest}|null|{error}, now }
+ */
+export function buildMobileEvidence(input, ctx) {
+  const { catalog, questions, baseline: B } = ctx;
+  const now = ctx.now ?? Date.now();
+  const os = input.os_family;
+  if (!MOBILE.has(os)) throw new Error(`not a phone OS: ${os}`);
+  const answers = input.answers || {};
+  const apps = input.ai_apps || [];
+  const results = [];
+  const lockEvidence = input.platform_authenticator === true ? 'detected' : 'self-reported';
+  let lockSet = null;
+
+  for (const check of catalog.checks) {
+    if (!check.os.includes(os)) continue;
+    const name = (check.names && check.names[os]) || check.name;
+    const spec = (questions.checks[check.id] || {})[os];
+    let r, evidence = 'self-reported';
+
+    if (check.section === 'org') {
+      r = orgResult(check, input.org ? input.org[check.answer_key] : undefined);
+      evidence = null;
+    } else if (check.id === 'screen_lock.enabled' && input.platform_authenticator === true) {
+      r = { status: 'Compliant', actual: os === 'ios' ? 'passcode set' : 'screen lock set', expected: spec.expected,
+        detail: 'The browser reports that a device unlock method (passcode, PIN, Face ID or fingerprint) is set up.' };
+      evidence = 'detected';
+    } else if (check.id === 'gdpr.os_supported') {
+      r = osSupported(input, B);
+      evidence = input.version_source === 'user' ? 'self-reported' : 'detected';
+    } else if (check.id === 'encryption.enabled') {
+      if (os === 'android') {
+        const ok = major(input.os_version) >= 10;
+        r = { status: ok ? 'Compliant' : 'Non-Compliant', actual: ok ? `on (Android ${major(input.os_version)} encrypts by default)` : 'not guaranteed (Android older than 10)',
+          expected: 'on', detail: ok ? '' : 'Android encrypts by default only from version 10.' };
+        evidence = input.version_source === 'user' ? 'self-reported' : 'detected';
+      } else {
+        r = lockSet === null ? { status: 'Pending', actual: 'unknown', expected: 'on', detail: 'Depends on whether a passcode is set.' }
+          : { status: lockSet ? 'Compliant' : 'Non-Compliant', actual: lockSet ? 'on (passcode set)' : 'off (no passcode)', expected: 'on',
+            detail: lockSet ? 'iOS encrypts the data on the phone with hardware keys once a passcode is set.' : 'Without a passcode, iOS data protection is not active.' };
+        evidence = lockEvidence;
+      }
+    } else if (os === 'ios' && (check.id === 'vuln.pending_updates' || check.id === 'vuln.known_vulnerabilities')) {
+      evidence = input.version_source === 'user' ? 'self-reported' : 'detected';
+      const product = input.os_name === 'iPadOS' ? 'ipados' : 'ios';
+      if (!ctx.vuln || ctx.vuln.error) {
+        r = { status: 'Pending', actual: 'not checked', expected: check.id === 'vuln.pending_updates' ? 'latest iOS security release' : `<= ${B.MAX_CRITICAL_HIGH_VULNERABILITIES} critical/high`,
+          detail: `No vulnerability data available${ctx.vuln && ctx.vuln.error ? `: ${ctx.vuln.error}` : ''}.` };
+      } else if (check.id === 'vuln.pending_updates') {
+        const latest = latestIosFix(ctx.vuln.bundle, product, input.os_version);
+        const dataDate = ctx.vuln.manifest.built_at.slice(0, 10);
+        r = !latest ? { status: 'Pending', actual: `${input.os_name} ${input.os_version}`, expected: 'latest iOS security release', detail: `No security releases for ${input.os_name} ${major(input.os_version)} in the vulnerability data from ${dataDate}.` }
+          : cmp(input.os_version, latest) >= 0 ? { status: 'Compliant', actual: `${input.os_name} ${input.os_version} (up to date)`, expected: 'latest iOS security release', detail: `Newest fixed ${input.os_name} ${major(input.os_version)} release in the vulnerability data from ${dataDate}: ${latest}.${newerMajor(ctx.vuln.bundle, product, input.os_version)}` }
+            : { status: 'Non-Compliant', actual: `${input.os_name} ${input.os_version} (update to ${latest} available)`, expected: 'latest iOS security release', detail: `Install ${input.os_name} ${latest} or later in Settings › General › Software Update.` };
+      } else {
+        const inventory = { apps: [{ name: input.os_name, version: input.os_version }] };
+        const matched = matchApps(inventory, ctx.vuln.bundle, 'ios');
+        r = { expected: `<= ${B.MAX_CRITICAL_HIGH_VULNERABILITIES} critical/high`, ...knownVulnResult(matched, inventory, ctx.vuln, 'ios', parseInt(B.MAX_CRITICAL_HIGH_VULNERABILITIES, 10) || 0, now) };
+        if (input.version_source !== 'user') r.detail += ' Patch-level versions (x.y.z) are not always visible to the browser; confirm the version in Settings › General › About.';
+      }
+    } else if (check.section === 'aiact' && check.id !== 'aiact.os_ai_features') {
+      r = aiResults(check.id, apps, B);
+    } else if (spec) {
+      const a = answers[check.id];
+      if (a === undefined || a === 'not_sure') {
+        r = { ...questions.not_sure, expected: spec.expected || (spec.expected_from === 'seconds' ? `<= ${B.SCREEN_LOCK_MAX_SECONDS} seconds` : spec.expected_from === 'passcode' ? `>= ${B.MOBILE_PASSCODE_MIN_DIGITS} digits or alphanumeric` : `<= ${B.MOBILE_PATCH_MAX_AGE_DAYS} days old`) };
+      } else if (spec.input === 'month') {
+        r = patchResult(a, B, now) || { ...questions.not_sure, expected: `<= ${B.MOBILE_PATCH_MAX_AGE_DAYS} days old` };
+      } else {
+        const answer = spec.answers[a];
+        r = spec.expected_from ? computed(spec, answer, B, os)
+          : { status: answer.status, actual: answer.actual, expected: spec.expected, detail: answer.detail || '' };
+      }
+    } else {
+      throw new Error(`no rule for ${check.id} on ${os}`);
+    }
+    if (check.id === 'screen_lock.enabled') lockSet = r.status === 'Compliant' ? true : r.status === 'Non-Compliant' ? false : null;
+    const item = { id: check.id, section: check.section, name, status: r.status, actual: String(r.actual), expected: r.expected };
+    if (r.detail) item.detail = r.detail;
+    if (evidence) item.evidence = evidence;
+    results.push(item);
+  }
+
+  const summary = Object.fromEntries(catalog.statuses.map(s => [s, results.filter(r => r.status === s).length]));
+  const host = { hostname: input.hostname, os_family: os, os_name: input.os_name, os_version: String(input.os_version) };
+  if (input.device_model) host.device_model = input.device_model;
+  if (input.browser) host.browser = input.browser;
+  return {
+    schema_version: '1.0',
+    catalog_version: catalog.catalog_version,
+    source: { kind: 'web', collector: os, collector_version: MOBILE_VERSION },
+    audit: { mode: 'READ-ONLY', started_at: input.started_at, execution_user: 'phone self-check (browser)', is_admin: false },
+    host,
+    baseline: { ...B },
+    results,
+    summary,
+  };
+}

mobile/styles.css

@@ -0,0 +1,66 @@
+:root {
+  --red: #ED2939; --blue: #00A1DE; --bg: #f6f7fa; --card: #ffffff; --text: #16181d; --muted: #5b6270; --line: #e2e5eb;
+  --ok: #1a7f37; --bad: #c4242f; --pending: #9a6700; --na: #6e7781; --err: #8250df;
+}
+@media (prefers-color-scheme: dark) {
+  :root:not([data-theme="light"]) { --bg: #101216; --card: #1a1d23; --text: #eef0f4; --muted: #a2a9b6; --line: #2c313a; --ok: #3fb950; --bad: #ff6b6b; --pending: #d29922; --na: #8b949e; --err: #b392f0; }
+}
+:root[data-theme="dark"] { --bg: #101216; --card: #1a1d23; --text: #eef0f4; --muted: #a2a9b6; --line: #2c313a; --ok: #3fb950; --bad: #ff6b6b; --pending: #d29922; --na: #8b949e; --err: #b392f0; }
+
+* { box-sizing: border-box; }
+html, body { margin: 0; background: var(--bg); color: var(--text); }
+body { font: 16px/1.5 -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Arial, sans-serif; min-height: 100vh; display: flex; flex-direction: column; }
+main { width: 100%; max-width: 560px; margin: 0 auto; padding: 8px 16px 24px; flex: 1; }
+.hidden { display: none !important; }
+h1 { font-size: 1.5rem; line-height: 1.25; margin: 12px 0 10px; }
+h2 { font-size: 1rem; margin: 0; }
+p { margin: 8px 0; }
+a { color: var(--blue); }
+.muted { color: var(--muted); font-size: .9rem; }
+.lead { font-size: 1.05rem; }
+
+.top { display: flex; justify-content: space-between; align-items: center; padding: max(12px, env(safe-area-inset-top)) 16px 10px; border-top: 4px solid var(--red); background: var(--card); border-bottom: 1px solid var(--line); }
+.brand { display: flex; align-items: center; gap: 8px; font-size: .95rem; }
+.mark { width: 26px; height: 26px; border-radius: 6px; background: var(--red); color: #fff; display: grid; place-items: center; font-weight: 800; }
+.chip { font-size: .75rem; color: var(--muted); border: 1px solid var(--line); border-radius: 999px; padding: 2px 10px; max-width: 50%; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
+
+.card { background: var(--card); border: 1px solid var(--line); border-radius: 14px; padding: 14px 16px; margin: 12px 0; }
+.device { display: grid; grid-template-columns: auto 1fr; gap: 4px 12px; font-size: .95rem; }
+.device b { color: var(--muted); font-weight: 600; }
+.note { border-left: 4px solid var(--blue); }
+.facts { padding-left: 18px; margin: 14px 0; } .facts li { margin: 6px 0; }
+.plan { columns: 2; column-gap: 18px; padding-left: 18px; margin: 6px 0 0; font-size: .85rem; } .plan li { break-inside: avoid; }
+@media (max-width: 380px) { .plan { columns: 1; } }
+
+button { font: inherit; border-radius: 12px; padding: 13px 16px; border: 1px solid var(--line); background: var(--card); color: var(--text); cursor: pointer; width: 100%; min-height: 48px; }
+button.primary { background: var(--red); border-color: var(--red); color: #fff; font-weight: 700; }
+button.primary:disabled { opacity: .5; }
+button.secondary { background: var(--card); }
+button.link { background: none; border: none; color: var(--blue); text-decoration: underline; }
+.row { display: flex; gap: 10px; margin-top: 12px; } .row button { flex: 1; }
+.actions { display: grid; gap: 10px; margin-top: 14px; }
+
+.toggle { display: flex; gap: 12px; align-items: flex-start; cursor: pointer; }
+.toggle input { width: 22px; height: 22px; margin-top: 2px; accent-color: var(--red); flex: none; }
+
+.progress { height: 6px; background: var(--line); border-radius: 99px; overflow: hidden; margin: 12px 0 4px; }
+.progress.big { height: 10px; }
+.bar { height: 100%; width: 0; background: var(--blue); transition: width .25s; }
+.check-name { color: var(--blue); font-size: .85rem; text-transform: uppercase; letter-spacing: .04em; margin-top: 8px; }
+.where { background: var(--card); border: 1px dashed var(--line); border-radius: 12px; padding: 10px 12px; margin: 10px 0 14px; font-size: .92rem; }
+.where-label { display: block; font-size: .75rem; color: var(--muted); text-transform: uppercase; letter-spacing: .04em; }
+.answers { display: grid; gap: 10px; }
+.answers button { text-align: left; }
+.answers button.not-sure { color: var(--muted); border-style: dashed; }
+.answers input[type="text"], .answers input[type="month"] { font: inherit; width: 100%; padding: 12px; border-radius: 12px; border: 1px solid var(--line); background: var(--card); color: var(--text); min-height: 48px; }
+.answers label.multi { display: flex; gap: 12px; align-items: center; background: var(--card); border: 1px solid var(--line); border-radius: 12px; padding: 12px 14px; min-height: 48px; }
+.answers label.multi input { width: 22px; height: 22px; accent-color: var(--red); }
+
+.score { font-size: 3rem; font-weight: 800; line-height: 1; }
+.pills { display: flex; flex-wrap: wrap; gap: 6px; margin: 10px 0; }
+.pill { font-size: .8rem; font-weight: 700; border: 1px solid; border-radius: 99px; padding: 1px 9px; }
+.s-Compliant { color: var(--ok); } .s-Non-Compliant { color: var(--bad); } .s-Pending { color: var(--pending); } .s-NotApplicable { color: var(--na); } .s-Error { color: var(--err); }
+.gaps { padding-left: 18px; } .gaps li { margin: 6px 0; }
+
+.foot { text-align: center; font-size: .75rem; color: var(--muted); padding: 16px 16px max(16px, env(safe-area-inset-bottom)); }
+.center { text-align: center; }

mobile/test/e2e.cjs

@@ -0,0 +1,58 @@
+// End-to-end test of the phone check in a phone-sized Electron window with a phone user agent.
+// Usage: (serve the repo root on :8765)  npx electron mobile/test/e2e.cjs <ios|android> <out.json>
+const { app, BrowserWindow } = require('electron');
+const fs = require('node:fs');
+const UA = {
+  ios: 'Mozilla/5.0 (iPhone; CPU iPhone OS 18_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1',
+  android: 'Mozilla/5.0 (Linux; Android 15; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Mobile Safari/537.36',
+};
+const [os, out] = process.argv.slice(-2);
+const PICK = `(() => {
+  const box = document.getElementById('q-answers');
+  const buttons = [...box.querySelectorAll('button')];
+  const cont = buttons.find(b => b.textContent === 'Continue');
+  const text = box.querySelector('input[type=text]'), month = box.querySelector('input[type=month]');
+  const multi = box.querySelectorAll('input[type=checkbox]');
+  if (text) { if (!text.value) text.value = '${os === 'ios' ? '26.0.1' : '15'}'; cont.click(); return 'version'; }
+  if (month) { month.value = '2026-06'; cont.click(); return 'month'; }
+  if (multi.length) { multi[0].checked = true; multi[7].checked = true; cont.click(); return 'ai'; }
+  (buttons.length > 2 ? buttons[1] : buttons[0]).click(); return 'choice';
+})()`;
+app.disableHardwareAcceleration();
+app.whenReady().then(async () => {
+  const win = new BrowserWindow({ show: false, width: 390, height: 844 });
+  win.webContents.setUserAgent(UA[os]);
+  win.webContents.on('console-message', (e, level, message) => { if (level >= 2) console.log('[page]', message); });
+  const js = code => win.webContents.executeJavaScript(code);
+  const until = async (code, ms = 60000) => { const t = Date.now(); while (!(await js(code))) { if (Date.now() - t > ms) throw new Error(`timeout: ${code}`); await new Promise(r => setTimeout(r, 200)); } };
+  try {
+    await win.webContents.session.clearCache();
+    await win.loadURL('http://127.0.0.1:8765/index.html?test');
+    await until(`!document.getElementById('start').disabled`);
+    const device = await js(`document.getElementById('device-card').innerText`);
+    await js(`document.getElementById('start').click()`);
+    await js(`document.getElementById('use-ai').checked = false; document.getElementById('consent-ok').click()`);
+    let asked = [];
+    for (let i = 0; i < 60; i++) {
+      const inQuestions = await js(`!document.getElementById('s-question').classList.contains('hidden')`);
+      if (!inQuestions) break;
+      const q = await js(`document.getElementById('q-text').textContent`);
+      asked.push(q);
+      // Pick a mix of answers: the version as detected (or typed), a month, two AI apps, otherwise the 2nd option.
+      await js(PICK);
+      await new Promise(r => setTimeout(r, 50));
+    }
+    await until(`!document.getElementById('s-done').classList.contains('hidden')`, 120000);
+    const evidence = await js(`window.__devseisState.report.evidenceText`);
+    const result = await js(`document.getElementById('result').innerText`);
+    const pdfSize = await js(`window.__devseisMakePdf().then(b => b.size)`);
+    const html = await js(`window.__devseisState.report.html`);
+    fs.writeFileSync(out, evidence);
+    fs.writeFileSync(out.replace(/\.json$/, '.html'), html);
+    console.log(JSON.stringify({ os, device, questions: asked.length, pdfBytes: pdfSize, result: result.slice(0, 700) }, null, 1));
+  } catch (error) {
+    console.error('E2E FAILED:', error.message);
+    process.exitCode = 1;
+  }
+  app.quit();
+});

mobile/vuln-web.js

@@ -0,0 +1,35 @@
+// Downloads the small phone subset of the Devseis vulnerability bundle and checks its SHA-256 and
+// Ed25519 signature before use (WebCrypto). Only data is downloaded; nothing about the phone is sent.
+const VULNDB_URL = 'https://huggingface.co/datasets/Devseis/endpoint-auditor-vulndb/resolve/main';
+const PUBLIC_KEY_URL = 'app/vulndb-public-key.pem';
+
+const hex = buffer => [...new Uint8Array(buffer)].map(b => b.toString(16).padStart(2, '0')).join('');
+const fromBase64 = text => Uint8Array.from(atob(text), c => c.charCodeAt(0));
+
+async function verifySignature(sha, signature) {
+  const pem = await (await fetch(PUBLIC_KEY_URL)).text();
+  const der = fromBase64(pem.replace(/-----[^-]+-----/g, '').replace(/\s+/g, ''));
+  try {
+    const key = await crypto.subtle.importKey('spki', der, { name: 'Ed25519' }, false, ['verify']);
+    return await crypto.subtle.verify({ name: 'Ed25519' }, key, fromBase64(signature), new TextEncoder().encode(sha));
+  } catch (error) {
+    if (error && error.name === 'NotSupportedError') return 'unsupported';  // older browsers: SHA-256 over HTTPS only
+    throw error;
+  }
+}
+
+export async function loadPhoneVulnData() {
+  try {
+    const manifest = await (await fetch(`${VULNDB_URL}/manifest.json`, { cache: 'no-cache' })).json();
+    if (!manifest.mobile) throw new Error('the vulnerability data has no phone subset');
+    const data = await (await fetch(`${VULNDB_URL}/${manifest.mobile.file}`)).arrayBuffer();
+    const sha = hex(await crypto.subtle.digest('SHA-256', data));
+    if (sha !== manifest.mobile.sha256) throw new Error('vulnerability data checksum does not match');
+    const signed = await verifySignature(sha, manifest.mobile.signature);
+    if (signed === false) throw new Error('vulnerability data signature is not valid');
+    const text = await new Response(new Blob([data]).stream().pipeThrough(new DecompressionStream('gzip'))).text();
+    return { manifest, bundle: JSON.parse(text), signatureChecked: signed === true };
+  } catch (error) {
+    return { error: error.message };
+  }
+}

schema/evidence.schema.json

@@ -14,8 +14,8 @@
       "required": ["kind", "collector", "collector_version"],
       "additionalProperties": false,
       "properties": {
-        "kind": { "enum": ["collector", "synthetic"] },
-        "collector": { "enum": ["windows", "linux", "macos"] },
+        "kind": { "enum": ["collector", "synthetic", "web"] },
+        "collector": { "enum": ["windows", "linux", "macos", "ios", "android"] },
         "collector_version": { "type": "string" },
         "synthetic_seed": { "type": "integer" },
         "synthetic_profile": { "type": "string" }
@@ -38,7 +38,9 @@
       "additionalProperties": false,
       "properties": {
         "hostname": { "type": "string" },
-        "os_family": { "enum": ["windows", "linux", "macos"] },
+        "os_family": { "enum": ["windows", "linux", "macos", "ios", "android"] },
+        "device_model": { "type": "string" },
+        "browser": { "type": "string" },
         "os_name": { "type": "string" },
         "os_version": { "type": "string" },
         "build": { "type": "string" },
@@ -65,7 +67,8 @@
           "status": { "enum": ["Compliant", "Non-Compliant", "NotApplicable", "Pending", "Error"] },
           "actual": { "type": "string", "description": "What was found on the device" },
           "expected": { "type": "string", "description": "What the baseline requires" },
-          "detail": { "type": "string", "description": "How the value was read, or why the status was given" }
+          "detail": { "type": "string", "description": "How the value was read, or why the status was given" },
+          "evidence": { "enum": ["detected", "self-reported"], "description": "Phones: detected by the browser, or answered by the user. Absent = read by a collector." }
         }
       }
     },

synthetic/generate_evidence.py

@@ -12,14 +12,16 @@ Usage:
 Standard library only.
 """
 import argparse
+import gzip
 import json
+import subprocess
 import os
 import random
 import string
 from datetime import datetime, timedelta, timezone
 
 ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
-GENERATOR_VERSION = "0.2.0"
+GENERATOR_VERSION = "0.3.0"
 
 # Report order per OS, identical to the collectors.
 PASSWORD_LOCKOUT = ["password.min_length", "password.history", "password.expiration", "password.min_age",
@@ -83,6 +85,66 @@ AI_TOOLS = {
 REMOTE_SERVICES = {"windows": ["rdp", "winrm", "ssh", "smb", "teamviewer", "anydesk", "chromeremotedesktop"],
                    "linux": ["ssh", "rdp", "vnc", "smb", "teamviewer", "anydesk", "chromeremotedesktop"],
                    "macos": ["ssh", "screensharing", "filesharing", "remotemanagement", "chromeremotedesktop", "teamviewer", "anydesk"]}
+MAC_CODENAMES = {"26": "Tahoe", "15": "Sequoia", "14": "Sonoma", "13": "Ventura"}
+# Installed-program names as the collectors report them, per vulnerability-bundle product (vulndb/products.json).
+APP_NAMES = {
+    "windows": {"chrome": "Google Chrome", "edge": "Microsoft Edge", "firefox": "Mozilla Firefox (x64 en-US)", "acrobat_reader": "Adobe Acrobat Reader (64-bit)",
+                "7zip": "7-Zip {v} (x64)", "winrar": "WinRAR {v} (64-bit)", "notepadpp": "Notepad++ (64-bit x64)", "vlc": "VLC media player",
+                "zoom": "Zoom Workplace", "teams": "Microsoft Teams", "vscode": "Microsoft Visual Studio Code (User)", "putty": "PuTTY release {v} (64-bit)",
+                "winscp": "WinSCP {v}", "filezilla": "FileZilla {v}", "wireshark": "Wireshark {v} x64", "git": "Git", "python": "Python {v} (64-bit)",
+                "nodejs": "Node.js", "keepass": "KeePass Password Safe {v}", "teamviewer": "TeamViewer", "anydesk": "AnyDesk", "docker_desktop": "Docker Desktop",
+                "libreoffice": "LibreOffice {v}", "gimp": "GIMP {v}", "foxit_reader": "Foxit PDF Reader", "telegram": "Telegram Desktop"},
+    "macos": {"chrome": "Google Chrome", "edge": "Microsoft Edge", "firefox": "Firefox", "thunderbird": "Thunderbird", "acrobat_reader": "Adobe Acrobat Reader",
+              "vlc": "VLC", "zoom": "zoom.us", "teams": "Microsoft Teams", "vscode": "Visual Studio Code", "filezilla": "FileZilla", "wireshark": "Wireshark",
+              "teamviewer": "TeamViewer", "anydesk": "AnyDesk", "docker_desktop": "Docker", "openvpn_connect": "OpenVPN Connect", "libreoffice": "LibreOffice",
+              "gimp": "GIMP", "telegram": "Telegram", "safari": "Safari", "iterm2": "iTerm"},
+}
+COMMON_APPS = {"windows": ["chrome", "edge", "zoom", "teams", "acrobat_reader", "7zip", "vscode", "firefox", "notepadpp", "vlc"],
+               "macos": ["safari", "chrome", "zoom", "teams", "vscode", "acrobat_reader", "firefox", "vlc", "docker_desktop", "iterm2"]}
+FILLER_APPS = {"windows": ["Microsoft 365 Apps for business - en-us", "Slack", "Notion", "1Password", "Spotify", "Dell SupportAssist",
+                           "Microsoft Visual C++ 2015-2022 Redistributable (x64)", "NVIDIA Graphics Driver", "WhatsApp", "Logitech Options+", "Intel(R) Graphics Driver"],
+               "macos": ["Slack", "Notion", "1Password", "Microsoft Word", "Microsoft Excel", "Spotify", "WhatsApp", "Figma", "Postman", "Raycast", "Keynote", "Pages"]}
+BREW_FORMULAE = ["openssl@3", "python@3.13", "node", "git", "curl", "wget", "ca-certificates", "sqlite", "libpng", "icu4c@77", "jq", "gh", "ffmpeg", "pkgconf", "readline", "xz"]
+WINGET_IDS = {"Google Chrome": "Google.Chrome", "Mozilla Firefox (x64 en-US)": "Mozilla.Firefox", "Zoom Workplace": "Zoom.Zoom", "7-Zip 24.08 (x64)": "7zip.7zip",
+              "Notepad++ (64-bit x64)": "Notepad++.Notepad++", "VLC media player": "VideoLAN.VLC", "Microsoft Visual Studio Code (User)": "Microsoft.VisualStudioCode",
+              "Adobe Acrobat Reader (64-bit)": "Adobe.Acrobat.Reader.64-bit", "Git": "Git.Git", "Slack": "SlackTechnologies.Slack"}
+_BUNDLE = None
+
+
+def vuln_bundle():
+    """Real offline vulnerability bundle (vulndb/out), used to draw realistic installed versions."""
+    global _BUNDLE
+    if _BUNDLE is None:
+        out = os.path.join(ROOT, "vulndb", "out")
+        manifest = json.load(open(os.path.join(out, "manifest.json")))
+        with gzip.open(os.path.join(out, manifest["file"])) as handle:
+            _BUNDLE = json.load(handle)
+        _BUNDLE["_manifest"] = manifest
+    return _BUNDLE
+
+
+def vkey(v):
+    return [int(x) if x.isdigit() else 0 for x in v.replace("-", ".").split(".")]
+
+
+def fixed_versions(product):
+    """Real release numbers from the NVD ranges (versions that fixed something), oldest first."""
+    return sorted({row[5] for row in product["cves"] if row[5]}, key=vkey)
+
+
+def current_version(product):
+    """A version newer than every affected one in NVD: what a fully updated device runs."""
+    bounds = sorted({v for row in product["cves"] for v in (row[4], row[5], row[6]) if v}, key=vkey)
+    top = bounds[-1]
+    if any(top in (row[4], row[6]) for row in product["cves"]):  # still affected at that version: one patch newer
+        parts = top.split(".")
+        parts[-1] = str(int(parts[-1]) + 1) if parts[-1].isdigit() else parts[-1] + ".1"
+        top = ".".join(parts)
+    return top
+
+
+VULN_JOBS = []  # (result item, job) filled by Device.c_vuln_known_vulnerabilities, resolved by the real matcher in main()
+
 EMPLOYEE_ACCOUNTS = ["jdoe", "asmith", "mkhan", "lmuller", "pmartin", "sali", "tnguyen", "rschmit", "akaya", "ewagner"]
 
 
@@ -549,47 +611,116 @@ class Device:
     def c_vuln_pending_updates(self):
         limit = self.n("MAX_PENDING_SECURITY_UPDATES")
         expected = f"<= {limit} pending"
-        if self.good(-0.05):
+        good = self.good(-0.05)
+        if self.os == "macos":
+            if self.rng.random() < 0.04:
+                return ("Error", "not read", expected, "Apple's update service could not be reached.")
+            if good:
+                return ("Compliant", "0 pending", expected, "")
+            major = self.os_version.split(".")[0]
+            parts = self.os_version.split(".") + ["0", "0"]
+            newer = f"{major}.{int(parts[1]) + self.pick([0, 1, 2])}.{int(parts[2]) + 1}"
+            labels = [f"macOS {MAC_CODENAMES.get(major, '')} {newer}-{self.pick(['25G', '24H', '23J', '22H'])}{self.rng.randint(100, 899)}".replace("  ", " ")]
+            if self.rng.random() < 0.3:
+                labels.append(f"Command Line Tools for Xcode-{self.pick(['16.4', '26.0', '26.1'])}")
+            if self.rng.random() < 0.2:
+                labels.append(f"Safari{self.pick(['26.0.1', '26.1', '18.6'])}{MAC_CODENAMES.get(major, '')}-{self.pick(['26.0.1', '26.1', '18.6'])}")
+            return ("Non-Compliant", f"{len(labels)} pending", expected, f"Including: {', '.join(labels)}.")
+        if self.os == "linux":
+            note = (f" Package lists are {self.pick([0, 0, 1, 2, 3, 7, 14, 30])} days old." if self.distro in ("ubuntu", "debian") else " Uses the cached repository data.")
+            if good:
+                return ("Compliant", "0 pending", expected, note.strip())
+            names = (["libssl3t64", "openssl", "libc6", "libc-bin", "linux-image-generic", "openssh-server", "sudo", "curl", "libcurl4t64", "libxml2", "python3.12", "systemd", "libsystemd0", "tzdata"]
+                     if self.distro != "rhel" else ["openssl-libs", "krb5-libs", "glibc", "glibc-common", "kernel", "curl-minimal", "libxml2", "sudo", "systemd-libs", "python3-libs", "vim-minimal"])
+            n = self.rng.randint(1, 40)
+            listed = self.rng.sample(names, min(n, 3))
+            return ("Non-Compliant", f"{n} pending", expected, f"Including: {', '.join(listed)}.{note}")
+        if self.rng.random() < 0.04:
+            return ("Error", "not read", expected, "No answer within 300 seconds.")
+        if good:
             return ("Compliant", "0 pending", expected, "")
-        names = {"windows": [f"2026-{self.rng.randint(8, 10):02d} Cumulative Update for Windows (KB50{self.rng.randint(41000, 49999)})",
-                             f"Security Update for Microsoft Edge (version {self.rng.randint(128, 131)}.0)", ".NET Framework security update",
-                             "Servicing Stack Update"],
-                 "linux": ["openssl", "libssh-4", "linux-image-generic", "openssh-server", "sudo", "curl", "libxml2", "python3.12"],
-                 "macos": [f"macOS {self.os_version.split('.')[0]} security update", "Background Security Improvement", "Safari security update",
-                           "Command Line Tools security update"]}[self.os]
-        n = self.rng.randint(1, 12)
-        listed = self.rng.sample(names, min(len(names), self.pick([1, 2, 3])))
-        return ("Non-Compliant", f"{n} pending", expected, "Including: " + ", ".join(listed) + ".")
+        version = {"26200": "25H2", "26100": "24H2", "22631": "23H2", "22621": "22H2", "19045": "22H2"}.get(self.build, "24H2")
+        product = "Windows 10" if self.build == "19045" else "Windows 11"
+        titles = [f"2026-{self.pick(['09', '10'])} Cumulative Update for {product} Version {version} for x64-based Systems (KB50{self.rng.randint(41000, 49999)})"]
+        for extra in ("2026-{m} Cumulative Update for .NET Framework 3.5 and 4.8.1 for {p} Version {v} for x64 (KB50{k})",
+                      "Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.4{k3}.0)"):
+            if self.rng.random() < 0.35:
+                titles.append(extra.format(m=self.pick(["09", "10"]), p=product, v=version, k=self.rng.randint(41000, 49999), k3=self.rng.randint(10, 99)))
+        return ("Non-Compliant", f"{len(titles)} pending", expected, f"Including: {', '.join(titles[:3])}.")
 
     def c_vuln_outdated_apps(self):
         limit = self.n("MAX_OUTDATED_APPS")
         expected = f"<= {limit} outdated"
-        if self.good(-0.15):
-            return ("Compliant", "0 outdated", expected, "")
-        catalog = {"windows": ["Google Chrome", "Mozilla Firefox", "Zoom Workplace", "Adobe Acrobat Reader", "7-Zip", "Notepad++", "VLC media player"],
-                   "linux": ["firefox (snap)", "chromium (snap)", "zoom (flatpak)", "libreoffice", "thunderbird", "code (snap)"],
-                   "macos": ["Google Chrome", "Zoom", "Microsoft Word", "Slack", "Adobe Acrobat Reader", "Firefox", "VLC"]}[self.os]
-        apps = self.rng.sample(catalog, self.pick([1, 2, 3, 4]))
-        parts = []
-        for app in apps:
-            major = self.rng.randint(3, 130)
-            parts.append(f"{app} {major}.{self.rng.randint(0, 9)} -> {major + self.pick([0, 1, 2])}.{self.rng.randint(0, 9)}")
-        return ("Non-Compliant", f"{len(apps)} outdated", expected, "; ".join(parts) + ".")
+        good = self.good(-0.15)
+        if self.os == "macos":
+            if self.rng.random() < 0.45:
+                return ("NotApplicable", "not checked", expected, "Homebrew is not installed, so there is no local source of current application versions.")
+            if good:
+                return ("Compliant", "0 outdated", expected, "Homebrew packages checked; App Store apps are not covered.")
+            n = self.rng.randint(1, 70)
+            rows = []
+            for formula in self.rng.sample(BREW_FORMULAE, min(n, 5)):
+                a, b = self.rng.randint(1, 30), self.rng.randint(0, 20)
+                rows.append(f"{formula} ({a}.{b}.{self.rng.randint(0, 9)}) < {a}.{b + self.pick([0, 1, 2])}.{self.rng.randint(10, 19)}")
+            return ("Non-Compliant", f"{n} outdated", expected, "; ".join(rows) + ".")
+        if self.os == "linux":
+            packages = 0 if good else self.rng.randint(0, 60)
+            parts, total = [f"packages: {packages}"], packages
+            if not good and self.distro == "ubuntu" and self.rng.random() < 0.5:
+                snaps = self.rng.sample(["firefox", "snap-store", "thunderbird", "code", "chromium", "slack", "zoom-client"], self.pick([1, 2, 3]))
+                parts.append("snaps: " + ", ".join(snaps)); total += len(snaps)
+            if not good and self.rng.random() < 0.25:
+                flats = self.rng.sample(["org.mozilla.firefox", "com.slack.Slack", "us.zoom.Zoom", "org.libreoffice.LibreOffice", "org.gimp.GIMP"], self.pick([1, 2]))
+                parts.append("flatpaks: " + ", ".join(flats)); total += len(flats)
+            return self.result(total <= limit, f"{total} outdated", expected, "; ".join(parts))
+        if self.rng.random() < 0.15:
+            return ("NotApplicable", "not checked", expected, "winget (App Installer) is not available for this account, so there is no local source of current application versions.")
+        if good:
+            return ("Compliant", "0 outdated", expected, self.pick(["winget found no upgrades for packages it can match.", ""]))
+        rows = []
+        for name in self.rng.sample(list(WINGET_IDS), self.pick([1, 2, 3, 4, 6])):
+            a = self.rng.randint(1, 130)
+            rows.append(f"{name} {WINGET_IDS[name]} {a}.{self.rng.randint(0, 9)}.{self.rng.randint(0, 999)} {a + self.pick([0, 1])}.{self.rng.randint(0, 9)}.{self.rng.randint(0, 999)} winget")
+        return ("Non-Compliant", f"{len(rows)} outdated", expected, "; ".join(rows[:5]) + ".")
 
     def c_vuln_known_vulnerabilities(self):
-        limit = self.n("MAX_CRITICAL_HIGH_VULNERABILITIES")
-        expected = f"<= {limit} critical/high"
-        source = f"Matched against offline OSV/NVD data from 2026-{self.rng.randint(9, 10):02d}-{self.rng.randint(1, 28):02d}."
-        if self.good(-0.1):
-            low = self.pick([0, 0, 1, 2, 3])
-            return ("Compliant", "0 critical/high", expected, f"{source} {low} medium/low.")
-        software = {"windows": ["Google Chrome", "Adobe Acrobat Reader", "7-Zip", "Zoom Workplace", "Microsoft .NET Runtime", "Notepad++"],
-                    "linux": ["openssl", "openssh-server", "sudo", "curl", "glibc", "libxml2", "firefox"],
-                    "macos": ["Google Chrome", "Zoom", "Adobe Acrobat Reader", "OpenSSL (Homebrew)", "Python 3.11 (Homebrew)", "Firefox"]}[self.os]
-        hits = self.rng.sample(software, self.pick([1, 1, 2, 3]))
-        critical = self.rng.randint(0, len(hits))
-        found = [f"{h} (CVE-2026-{self.rng.randint(10000, 49999)}, {'critical' if i < critical else 'high'})" for i, h in enumerate(hits)]
-        return ("Non-Compliant", f"{len(hits)} critical/high", expected, f"{source} " + "; ".join(found) + ".")
+        """Builds a realistic software inventory; the real matcher fills in the result (see VULN_JOBS)."""
+        expected = f"<= {self.n('MAX_CRITICAL_HIGH_VULNERABILITIES')} critical/high"
+        bundle = vuln_bundle()
+        stale = {"neglected": 0.9, "typical": 0.5, "hardened": 0.04}[self.profile]
+        if self.os == "linux":
+            key = {"ubuntu": f"ubuntu:{self.os_version}", "debian": f"debian:{self.os_version}", "rhel": f"rhel:{self.os_version.split('.')[0]}"}[self.distro]
+            kind = "rpm" if self.distro == "rhel" else "deb"
+            packages = []
+            advisories = bundle["releases"].get(key, {})
+            # Cloud/OEM kernel flavours (linux-aws, linux-ibm, ...) are not on ordinary endpoints.
+            names = sorted(n for n in advisories if not (n.startswith("linux-") and not n.startswith(("linux-firmware", "linux-signed"))))
+            per_package = {"neglected": 0.12, "typical": 0.03, "hardened": 0.002}[self.profile]
+            for name in self.rng.sample(names, min(len(names), self.rng.randint(300, 900))):
+                entries = advisories[name]
+                if self.rng.random() < per_package:
+                    version = self.pick(entries)[2]          # an older build: the matcher decides what still applies
+                else:
+                    version = "99:99" if kind == "deb" else "99:99-1"  # newer than every fix (never shown in findings)
+                packages.append({"name": name, "version": version, "source": "", "source_version": ""})
+            inventory = {"format": 1, "os_family": "linux", "distro_id": self.distro, "version_id": self.os_version, "pretty_name": self.os_name, "kind": kind, "packages": packages}
+        else:
+            apps = []
+            products = {p["id"]: p for p in bundle["apps"]}
+            names = APP_NAMES[self.os]
+            chosen = [pid for pid in names if pid in products and (pid in COMMON_APPS[self.os] or self.rng.random() < 0.15)]
+            for pid in chosen:
+                versions = fixed_versions(products[pid])
+                if not versions:
+                    continue
+                version = self.pick(versions[-12:-1]) if (self.rng.random() < stale * 0.5 and len(versions) > 2) else current_version(products[pid])
+                apps.append({"name": names[pid].format(v=version), "version": version})
+            for filler in self.rng.sample(FILLER_APPS[self.os], self.rng.randint(3, len(FILLER_APPS[self.os]))):
+                apps.append({"name": filler, "version": f"{self.rng.randint(1, 30)}.{self.rng.randint(0, 9)}.{self.rng.randint(0, 99)}"})
+            inventory = {"format": 1, "os_family": self.os, "apps": apps}
+        self.vuln_job = {"os_family": self.os, "inventory": inventory, "max": self.n("MAX_CRITICAL_HIGH_VULNERABILITIES"),
+                         "now": self.started.isoformat(timespec="seconds")}
+        return ("Pending", "matching", expected, "")
 
     # --- GDPR ----------------------------------------------------------------------------
     def c_gdpr_auto_updates(self):
@@ -763,6 +894,98 @@ def org_result(rng, profile, answer_key):
     return ("Pending", "not answered", "yes", f"Answer {answer_key} in organisational.conf.")
 
 
+# --- Phones: answer sets for the mobile web check (mobile/mobile-core.js builds the evidence) ---------------
+ANDROID_MODELS = ["Pixel 9", "Pixel 8", "Pixel 7a", "Galaxy S25", "Galaxy S24", "Galaxy A55", "Galaxy A35", "Galaxy Tab S9", "Xiaomi 14", "OnePlus 12", "Motorola edge 50"]
+MOBILE_AI_WEIGHTS = {"ChatGPT": 10, "Gemini": 7, "Microsoft Copilot": 5, "Claude": 3, "Perplexity": 3, "Meta AI": 3, "Grok": 2, "DeepSeek": 2,
+                     "Character.AI": 1, "Replika": 1, "Otter": 2, "Grammarly": 2}
+
+
+def mobile_questions():
+    with open(os.path.join(ROOT, "catalog", "mobile_questions.json"), encoding="utf-8") as handle:
+        return json.load(handle)
+
+
+def answer_ok(spec, answer, baseline):
+    if spec.get("expected_from") == "seconds":
+        return answer["seconds"] is not None and 0 < answer["seconds"] <= int(baseline["SCREEN_LOCK_MAX_SECONDS"])
+    if spec.get("expected_from") == "passcode":
+        return bool(answer.get("alphanumeric")) or (answer.get("digits") or 0) >= int(baseline["MOBILE_PASSCODE_MIN_DIGITS"])
+    return answer.get("status") in ("Compliant", "NotApplicable")
+
+
+def make_mobile_input(rng, seed, os_family, profile, baseline, questions):
+    p_good = PROFILES[profile]
+    good = lambda bias=0.0: rng.random() < min(max(p_good + bias, 0.02), 0.98)
+    offset = timezone(timedelta(hours=rng.choice([1, 2, 5])))
+    started = datetime(2026, 10, 1, tzinfo=offset) + timedelta(minutes=rng.randint(0, 60 * 24 * 6))
+    team = rng.choice(["fin", "hr", "dev", "ops", "sales", "legal", "mkt"])
+    bundle = vuln_bundle()
+    if os_family == "ios":
+        ipad = rng.random() < 0.15
+        os_name = "iPadOS" if ipad else "iOS"
+        product = next(a for a in bundle["apps"] if a["id"] == ("ipados" if ipad else "ios"))
+        versions = fixed_versions(product)
+        lines = {m: [v for v in versions if v.split(".")[0] == m] for m in ("27", "26", "18", "17")}
+        if good(0.05):  # up to date: newest release, or the newest of the previous line (older device)
+            version = current_version(product) if rng.random() < 0.7 else rng.choice([lines["26"][-1], lines["18"][-1]])
+        else:
+            version = rng.choice(lines["26"][-8:-1] + lines["18"][-6:-1] + lines["17"][-3:])
+        version_source = "browser" if rng.random() < 0.6 else "user"
+        shown = ".".join(version.split(".")[:2]) if version_source == "browser" else version
+        browser = f"Safari {'.'.join(version.split('.')[:2])}" if rng.random() < 0.88 else f"Chrome {rng.randint(138, 142)} (iOS)"
+        model = "iPad" if ipad else "iPhone"
+        hostname = f"{team.upper()}-{model}-{rng.randint(1, 60):02d}"
+    else:
+        os_name = "Android"
+        version = str(rng.choice([16, 16, 15, 15, 14]) if good() else rng.choice([15, 14, 13, 12, 11, 10]))
+        version_source, shown = ("browser" if rng.random() < 0.85 else "user"), version
+        browser = rng.choice([f"Chrome {rng.randint(138, 142)}", f"Chrome {rng.randint(138, 142)}", "Samsung Internet 28.0", "Firefox 143"])
+        model = rng.choice(ANDROID_MODELS)
+        hostname = f"{team}-{model.split()[0].lower()}-{rng.randint(1, 60):02d}"
+
+    lock_set = good(0.25)
+    platform_authenticator = (True if rng.random() < 0.8 else rng.choice([None, False])) if lock_set else False
+    answers = {}
+    for check_id, per_os in questions["checks"].items():
+        spec = per_os.get(os_family)
+        if not spec:
+            continue
+        if check_id == "screen_lock.enabled":
+            if platform_authenticator is True:
+                continue
+            answers[check_id] = 0 if lock_set else 1
+            continue
+        if rng.random() < 0.04:
+            answers[check_id] = "not_sure"
+            continue
+        if spec.get("input") == "month":
+            months_back = rng.randint(0, 2) if good() else rng.randint(3, 20)
+            month = (started.year * 12 + started.month - 1) - months_back
+            answers[check_id] = f"{month // 12:04d}-{month % 12 + 1:02d}"
+            continue
+        ok_list = [i for i, a in enumerate(spec["answers"]) if answer_ok(spec, a, baseline)]
+        bad_list = [i for i, a in enumerate(spec["answers"]) if not answer_ok(spec, a, baseline)]
+        bias = 0.25 if check_id in ("mobile.jailbreak_root", "mobile.usb_debugging", "gdpr.time_sync") else 0.0
+        pool = ok_list if (good(bias) or not bad_list) else bad_list
+        answers[check_id] = rng.choice(pool)
+    ai_apps = [] if rng.random() < 0.4 else sorted(set(rng.choices(list(MOBILE_AI_WEIGHTS), weights=list(MOBILE_AI_WEIGHTS.values()), k=rng.choice([1, 1, 2, 3]))))
+    org = None
+    if rng.random() < 0.4:
+        choices, weights = zip(*ORG_ANSWERS[profile])
+        org = {key: rng.choices(choices, weights=weights)[0] for key in ("ORG_ROPA", "ORG_DPIA", "ORG_BREACH_PROCEDURE", "ORG_PROCESSOR_AGREEMENTS",
+                                                                          "ORG_AI_REGISTER", "ORG_AI_LITERACY", "ORG_HUMAN_OVERSIGHT", "ORG_AI_TRANSPARENCY")}
+    return {"os_family": os_family, "os_name": os_name, "os_version": shown, "version_source": version_source, "browser": browser,
+            "device_model": model, "hostname": hostname, "started_at": started.isoformat(timespec="seconds"), "now": started.isoformat(timespec="seconds"),
+            "platform_authenticator": platform_authenticator, "answers": answers, "ai_apps": ai_apps, "org": org,
+            "synthetic": {"synthetic_seed": seed, "synthetic_profile": profile, "collector_version": GENERATOR_VERSION}}
+
+
+def run_node(script, lines, *args):
+    proc = subprocess.run(["node", os.path.join(ROOT, script), *args], input="".join(json.dumps(l) + "\n" for l in lines),
+                          capture_output=True, text=True, check=True)
+    return [json.loads(l) for l in proc.stdout.splitlines() if l.strip()]
+
+
 def random_hostname(rng, os_family):
     if os_family == "windows":
         return rng.choice(["DESKTOP-", "LAPTOP-"]) + "".join(rng.choices(string.ascii_uppercase + string.digits, k=7))
@@ -818,6 +1041,8 @@ def make_record(rng, seed, os_family, profile, baseline, catalog, checks):
                 "status": status, "actual": actual, "expected": expected}
         if detail:
             item["detail"] = detail
+        if check_id == "vuln.known_vulnerabilities" and status == "Pending" and actual == "matching":
+            VULN_JOBS.append((item, device.vuln_job))
         results.append(item)
 
     summary = {s: sum(1 for r in results if r["status"] == s) for s in catalog["statuses"]}
@@ -839,7 +1064,7 @@ def main():
     parser = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
     parser.add_argument("--count", type=int, default=100, help="number of audit runs to generate")
     parser.add_argument("--seed", type=int, default=1, help="random seed (same seed = same data)")
-    parser.add_argument("--os", default="windows,linux,macos", help="comma-separated OS families")
+    parser.add_argument("--os", default="windows,linux,macos,ios,android", help="comma-separated OS families")
     parser.add_argument("--baseline", default=os.path.join(ROOT, "baseline.conf"))
     parser.add_argument("--out", default=os.path.join(ROOT, "synthetic", "out", "evidence.jsonl"), help="JSONL output file")
     parser.add_argument("--files", help="write one pretty JSON file per run into this folder instead of JSONL")
@@ -849,12 +1074,28 @@ def main():
     baseline = read_conf(args.baseline)
     families = [f.strip() for f in args.os.split(",") if f.strip()]
     rng = random.Random(args.seed)
-    records = []
+    records, mobile_inputs = [], []
+    questions = mobile_questions()
     for index in range(args.count):
         record_seed = args.seed * 1_000_003 + index
         local = random.Random(record_seed)
-        records.append(make_record(local, record_seed, rng.choice(families), rng.choices(list(PROFILES), weights=[2, 5, 3])[0],
-                                   baseline, catalog, checks))
+        family, profile = rng.choice(families), rng.choices(list(PROFILES), weights=[2, 5, 3])[0]
+        if family in ("ios", "android"):
+            mobile_inputs.append((index, make_mobile_input(local, record_seed, family, profile, baseline, questions)))
+            records.append(None)
+        else:
+            records.append(make_record(local, record_seed, family, profile, baseline, catalog, checks))
+    # Phones: the same code as the mobile web page builds the evidence.
+    if mobile_inputs:
+        built = run_node("mobile/build-evidence.mjs", [m for _, m in mobile_inputs])
+        for (index, _), record in zip(mobile_inputs, built):
+            records[index] = record
+    # Desktop known vulnerabilities: real matcher, real bundle.
+    if VULN_JOBS:
+        for (item, _), r in zip(VULN_JOBS, run_node("synthetic/vuln-helper.mjs", [job for _, job in VULN_JOBS])):
+            item.update(status=r["status"], actual=r["actual"], detail=r["detail"])
+        for record in records:
+            record["summary"] = {s: sum(1 for r in record["results"] if r["status"] == s) for s in catalog["statuses"]}
 
     if args.files:
         os.makedirs(args.files, exist_ok=True)

synthetic/samples/synthetic-android-42000126.json

@@ -0,0 +1,346 @@
+{
+  "schema_version": "1.0",
+  "catalog_version": "0.3.0",
+  "source": {
+    "kind": "synthetic",
+    "collector": "android",
+    "collector_version": "0.3.0",
+    "synthetic_seed": 42000126,
+    "synthetic_profile": "hardened"
+  },
+  "audit": {
+    "mode": "READ-ONLY",
+    "started_at": "2026-10-05T06:12:00+05:00",
+    "execution_user": "phone self-check (browser)",
+    "is_admin": false
+  },
+  "host": {
+    "hostname": "sales-oneplus-32",
+    "os_family": "android",
+    "os_name": "Android",
+    "os_version": "14",
+    "device_model": "OnePlus 12",
+    "browser": "Chrome 142"
+  },
+  "baseline": {
+    "PASSWORD_MIN_LENGTH": "14",
+    "PASSWORD_HISTORY": "24",
+    "PASSWORD_MAX_AGE_DAYS": "365",
+    "PASSWORD_MIN_AGE_DAYS": "1",
+    "PASSWORD_COMPLEXITY": "1",
+    "LOCKOUT_THRESHOLD_MAX": "5",
+    "LOCKOUT_DURATION_MIN_MINUTES": "15",
+    "LOCKOUT_OBSERVATION_MIN_MINUTES": "15",
+    "SIGNATURE_MAX_AGE_DAYS": "3",
+    "MACOS_XPROTECT_MAX_AGE_DAYS": "30",
+    "FIREWALL_OUTBOUND": "allow",
+    "SCREEN_LOCK_MAX_SECONDS": "300",
+    "USB_DEVICE_ACCESS": "allow",
+    "USB_READ": "allow",
+    "USB_WRITE": "deny",
+    "APPROVED_ADMINS": "itadmin",
+    "ALLOW_DISABLED_BUILTIN_ADMIN": "1",
+    "MAX_PENDING_SECURITY_UPDATES": "0",
+    "MAX_OUTDATED_APPS": "0",
+    "MAX_CRITICAL_HIGH_VULNERABILITIES": "0",
+    "UPDATES_MAX_AGE_DAYS": "30",
+    "BACKUP_MAX_AGE_DAYS": "7",
+    "APPROVED_REMOTE_SERVICES": "",
+    "WINDOWS_MIN_BUILD": "22631",
+    "MACOS_MIN_MAJOR": "14",
+    "UBUNTU_MIN_VERSION": "22.04",
+    "DEBIAN_MIN_VERSION": "12",
+    "RHEL_MIN_VERSION": "9",
+    "PERSONAL_DATA_SCAN": "0",
+    "APPROVED_AI_TOOLS": "",
+    "IOS_MIN_MAJOR": "18",
+    "ANDROID_MIN_MAJOR": "13",
+    "MOBILE_PATCH_MAX_AGE_DAYS": "90",
+    "MOBILE_PASSCODE_MIN_DIGITS": "6"
+  },
+  "results": [
+    {
+      "id": "malware.antivirus",
+      "section": "baseline",
+      "name": "Google Play Protect",
+      "status": "Compliant",
+      "actual": "Play Protect scanning on",
+      "expected": "on",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "screen_lock.enabled",
+      "section": "baseline",
+      "name": "Screen lock",
+      "status": "Compliant",
+      "actual": "screen lock set",
+      "expected": "PIN, password or pattern",
+      "detail": "The browser reports that a device unlock method (passcode, PIN, Face ID or fingerprint) is set up.",
+      "evidence": "detected"
+    },
+    {
+      "id": "screen_lock.timeout",
+      "section": "baseline",
+      "name": "Screen timeout",
+      "status": "Compliant",
+      "actual": "Screen timeout 2 minutes",
+      "expected": "<= 300 seconds",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "mobile.passcode_strength",
+      "section": "baseline",
+      "name": "Screen lock strength",
+      "status": "Compliant",
+      "actual": "6-digit PIN",
+      "expected": ">= 6 digits or alphanumeric",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "mobile.jailbreak_root",
+      "section": "baseline",
+      "name": "Not rooted",
+      "status": "Compliant",
+      "actual": "not rooted (user confirmed)",
+      "expected": "not rooted",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "mobile.app_sources",
+      "section": "baseline",
+      "name": "Install unknown apps blocked",
+      "status": "Compliant",
+      "actual": "unknown apps blocked for all apps",
+      "expected": "all apps: Not allowed",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "mobile.usb_debugging",
+      "section": "baseline",
+      "name": "USB debugging off",
+      "status": "Compliant",
+      "actual": "off",
+      "expected": "off",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "mobile.find_my_device",
+      "section": "baseline",
+      "name": "Find My Device",
+      "status": "Compliant",
+      "actual": "on",
+      "expected": "on",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "encryption.enabled",
+      "section": "baseline",
+      "name": "Device encryption",
+      "status": "Compliant",
+      "actual": "on (Android 14 encrypts by default)",
+      "expected": "on",
+      "evidence": "detected"
+    },
+    {
+      "id": "vuln.pending_updates",
+      "section": "baseline",
+      "name": "Android security update",
+      "status": "Compliant",
+      "actual": "security patch 2026-10 (0 months old)",
+      "expected": "<= 90 days old",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "vuln.outdated_apps",
+      "section": "baseline",
+      "name": "App updates",
+      "status": "Compliant",
+      "actual": "automatic app updates on",
+      "expected": "automatic app updates on",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "gdpr.auto_updates",
+      "section": "gdpr",
+      "name": "Automatic system updates",
+      "status": "Compliant",
+      "actual": "automatic",
+      "expected": "automatic",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "gdpr.os_supported",
+      "section": "gdpr",
+      "name": "Supported operating system version",
+      "status": "Compliant",
+      "actual": "Android 14",
+      "expected": ">= Android 13",
+      "detail": "Version reported by the browser (Chrome 142).",
+      "evidence": "detected"
+    },
+    {
+      "id": "gdpr.time_sync",
+      "section": "gdpr",
+      "name": "Date & time set automatically",
+      "status": "Compliant",
+      "actual": "set automatically",
+      "expected": "set automatically",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "gdpr.backup_configured",
+      "section": "gdpr",
+      "name": "Google backup",
+      "status": "Compliant",
+      "actual": "phone maker cloud backup on",
+      "expected": "backup on",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "gdpr.telemetry",
+      "section": "gdpr",
+      "name": "Usage & diagnostics sharing minimised",
+      "status": "Compliant",
+      "actual": "usage & diagnostics off",
+      "expected": "usage & diagnostics off",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "gdpr.lock_screen_previews",
+      "section": "gdpr",
+      "name": "Sensitive notifications hidden when locked",
+      "status": "Compliant",
+      "actual": "no notifications on lock screen",
+      "expected": "sensitive content hidden",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "aiact.inventory",
+      "section": "aiact",
+      "name": "AI software inventory",
+      "status": "Compliant",
+      "actual": "ChatGPT, Gemini, Perplexity",
+      "expected": "inventory taken",
+      "detail": "AI apps listed by the user.",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "aiact.unapproved",
+      "section": "aiact",
+      "name": "Unapproved AI tools (shadow AI)",
+      "status": "Non-Compliant",
+      "actual": "ChatGPT, Gemini, Perplexity",
+      "expected": "only: none",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "aiact.risk_classification",
+      "section": "aiact",
+      "name": "AI system risk classification",
+      "status": "Pending",
+      "actual": "ChatGPT, Gemini, Perplexity",
+      "expected": "every AI tool classified",
+      "detail": "Classified by the auditor model (Caveat classifier) in a later step.",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "aiact.os_ai_features",
+      "section": "aiact",
+      "name": "AI assistant access restricted",
+      "status": "Pending",
+      "actual": "not answered",
+      "expected": "screen access off unless approved",
+      "detail": "The user could not find or confirm this setting.",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "aiact.log_retention",
+      "section": "aiact",
+      "name": "AI usage log retention",
+      "status": "Pending",
+      "actual": "depends on classification",
+      "expected": ">= 6 months for high-risk AI",
+      "detail": "Required only if a tool is classified high-risk.",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "org.ropa",
+      "section": "org",
+      "name": "Record of processing activities",
+      "status": "Pending",
+      "actual": "not answered",
+      "expected": "yes",
+      "detail": "Answered once by the organisation (organisational.conf); not part of the phone self-check."
+    },
+    {
+      "id": "org.dpia",
+      "section": "org",
+      "name": "Data protection impact assessment",
+      "status": "Pending",
+      "actual": "not answered",
+      "expected": "yes",
+      "detail": "Answered once by the organisation (organisational.conf); not part of the phone self-check."
+    },
+    {
+      "id": "org.breach_procedure",
+      "section": "org",
+      "name": "Breach response procedure",
+      "status": "Pending",
+      "actual": "not answered",
+      "expected": "yes",
+      "detail": "Answered once by the organisation (organisational.conf); not part of the phone self-check."
+    },
+    {
+      "id": "org.processor_agreements",
+      "section": "org",
+      "name": "Data processing agreements",
+      "status": "Pending",
+      "actual": "not answered",
+      "expected": "yes",
+      "detail": "Answered once by the organisation (organisational.conf); not part of the phone self-check."
+    },
+    {
+      "id": "org.ai_register",
+      "section": "org",
+      "name": "AI register",
+      "status": "Pending",
+      "actual": "not answered",
+      "expected": "yes",
+      "detail": "Answered once by the organisation (organisational.conf); not part of the phone self-check."
+    },
+    {
+      "id": "org.ai_literacy",
+      "section": "org",
+      "name": "AI literacy training",
+      "status": "Pending",
+      "actual": "not answered",
+      "expected": "yes",
+      "detail": "Answered once by the organisation (organisational.conf); not part of the phone self-check."
+    },
+    {
+      "id": "org.human_oversight",
+      "section": "org",
+      "name": "Human oversight for high-risk AI",
+      "status": "Pending",
+      "actual": "not answered",
+      "expected": "yes",
+      "detail": "Answered once by the organisation (organisational.conf); not part of the phone self-check."
+    },
+    {
+      "id": "org.ai_transparency",
+      "section": "org",
+      "name": "AI transparency to users",
+      "status": "Pending",
+      "actual": "not answered",
+      "expected": "yes",
+      "detail": "Answered once by the organisation (organisational.conf); not part of the phone self-check."
+    }
+  ],
+  "summary": {
+    "Compliant": 18,
+    "Non-Compliant": 1,
+    "NotApplicable": 0,
+    "Pending": 11,
+    "Error": 0
+  }
+}

synthetic/samples/synthetic-ios-42000126.json

@@ -0,0 +1,331 @@
+{
+  "schema_version": "1.0",
+  "catalog_version": "0.3.0",
+  "source": {
+    "kind": "synthetic",
+    "collector": "ios",
+    "collector_version": "0.3.0",
+    "synthetic_seed": 42000126,
+    "synthetic_profile": "hardened"
+  },
+  "audit": {
+    "mode": "READ-ONLY",
+    "started_at": "2026-10-05T06:12:00+05:00",
+    "execution_user": "phone self-check (browser)",
+    "is_admin": false
+  },
+  "host": {
+    "hostname": "SALES-iPhone-39",
+    "os_family": "ios",
+    "os_name": "iOS",
+    "os_version": "26.7",
+    "device_model": "iPhone",
+    "browser": "Safari 26.7"
+  },
+  "baseline": {
+    "PASSWORD_MIN_LENGTH": "14",
+    "PASSWORD_HISTORY": "24",
+    "PASSWORD_MAX_AGE_DAYS": "365",
+    "PASSWORD_MIN_AGE_DAYS": "1",
+    "PASSWORD_COMPLEXITY": "1",
+    "LOCKOUT_THRESHOLD_MAX": "5",
+    "LOCKOUT_DURATION_MIN_MINUTES": "15",
+    "LOCKOUT_OBSERVATION_MIN_MINUTES": "15",
+    "SIGNATURE_MAX_AGE_DAYS": "3",
+    "MACOS_XPROTECT_MAX_AGE_DAYS": "30",
+    "FIREWALL_OUTBOUND": "allow",
+    "SCREEN_LOCK_MAX_SECONDS": "300",
+    "USB_DEVICE_ACCESS": "allow",
+    "USB_READ": "allow",
+    "USB_WRITE": "deny",
+    "APPROVED_ADMINS": "itadmin",
+    "ALLOW_DISABLED_BUILTIN_ADMIN": "1",
+    "MAX_PENDING_SECURITY_UPDATES": "0",
+    "MAX_OUTDATED_APPS": "0",
+    "MAX_CRITICAL_HIGH_VULNERABILITIES": "0",
+    "UPDATES_MAX_AGE_DAYS": "30",
+    "BACKUP_MAX_AGE_DAYS": "7",
+    "APPROVED_REMOTE_SERVICES": "",
+    "WINDOWS_MIN_BUILD": "22631",
+    "MACOS_MIN_MAJOR": "14",
+    "UBUNTU_MIN_VERSION": "22.04",
+    "DEBIAN_MIN_VERSION": "12",
+    "RHEL_MIN_VERSION": "9",
+    "PERSONAL_DATA_SCAN": "0",
+    "APPROVED_AI_TOOLS": "",
+    "IOS_MIN_MAJOR": "18",
+    "ANDROID_MIN_MAJOR": "13",
+    "MOBILE_PATCH_MAX_AGE_DAYS": "90",
+    "MOBILE_PASSCODE_MIN_DIGITS": "6"
+  },
+  "results": [
+    {
+      "id": "screen_lock.enabled",
+      "section": "baseline",
+      "name": "Passcode",
+      "status": "Compliant",
+      "actual": "passcode set",
+      "expected": "passcode set",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "screen_lock.timeout",
+      "section": "baseline",
+      "name": "Auto-Lock",
+      "status": "Compliant",
+      "actual": "Auto-Lock 5 minutes",
+      "expected": "<= 300 seconds",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "mobile.passcode_strength",
+      "section": "baseline",
+      "name": "Passcode strength",
+      "status": "Compliant",
+      "actual": "alphanumeric",
+      "expected": ">= 6 digits or alphanumeric",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "mobile.jailbreak_root",
+      "section": "baseline",
+      "name": "Not jailbroken",
+      "status": "Compliant",
+      "actual": "not jailbroken (user confirmed)",
+      "expected": "not jailbroken",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "mobile.app_sources",
+      "section": "baseline",
+      "name": "Apps only from the App Store",
+      "status": "Compliant",
+      "actual": "App Store only",
+      "expected": "App Store only",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "mobile.find_my_device",
+      "section": "baseline",
+      "name": "Find My iPhone",
+      "status": "Compliant",
+      "actual": "on",
+      "expected": "on",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "encryption.enabled",
+      "section": "baseline",
+      "name": "Data protection (encryption)",
+      "status": "Compliant",
+      "actual": "on (passcode set)",
+      "expected": "on",
+      "detail": "iOS encrypts the data on the phone with hardware keys once a passcode is set.",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "vuln.pending_updates",
+      "section": "baseline",
+      "name": "iOS security updates",
+      "status": "Non-Compliant",
+      "actual": "iOS 26.7 (update to 26.7.1 available)",
+      "expected": "latest iOS security release",
+      "detail": "Install iOS 26.7.1 or later in Settings › General › Software Update.",
+      "evidence": "detected"
+    },
+    {
+      "id": "vuln.outdated_apps",
+      "section": "baseline",
+      "name": "App updates",
+      "status": "Compliant",
+      "actual": "automatic app updates on",
+      "expected": "automatic app updates on",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "vuln.known_vulnerabilities",
+      "section": "baseline",
+      "name": "Known vulnerabilities in iOS",
+      "status": "Non-Compliant",
+      "actual": "15 critical/high",
+      "expected": "<= 0 critical/high",
+      "detail": "Matched against offline OSV/NVD data from 2026-10-08. iOS 26.7 checked against NVD iOS records. iOS 26.7 (15 CVEs, critical, actively exploited; fixed in 27.0; e.g. CVE-2026-20683, CVE-2026-43688). 32 medium/low. Patch-level versions (x.y.z) are not always visible to the browser; confirm the version in Settings › General › About.",
+      "evidence": "detected"
+    },
+    {
+      "id": "gdpr.auto_updates",
+      "section": "gdpr",
+      "name": "Automatic iOS updates",
+      "status": "Compliant",
+      "actual": "download and install on",
+      "expected": "download and install on",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "gdpr.os_supported",
+      "section": "gdpr",
+      "name": "Supported operating system version",
+      "status": "Compliant",
+      "actual": "iOS 26.7",
+      "expected": ">= iOS 18",
+      "detail": "Version reported by the browser (Safari 26.7).",
+      "evidence": "detected"
+    },
+    {
+      "id": "gdpr.time_sync",
+      "section": "gdpr",
+      "name": "Date & time set automatically",
+      "status": "Compliant",
+      "actual": "set automatically",
+      "expected": "set automatically",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "gdpr.backup_configured",
+      "section": "gdpr",
+      "name": "iCloud Backup",
+      "status": "Compliant",
+      "actual": "backed up to a computer",
+      "expected": "backup on",
+      "detail": "Manual computer backups depend on the user remembering them.",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "gdpr.telemetry",
+      "section": "gdpr",
+      "name": "Analytics sharing minimised",
+      "status": "Compliant",
+      "actual": "analytics sharing off",
+      "expected": "analytics sharing off",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "gdpr.lock_screen_previews",
+      "section": "gdpr",
+      "name": "Notification previews hidden when locked",
+      "status": "Compliant",
+      "actual": "Never",
+      "expected": "When Unlocked or Never",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "aiact.inventory",
+      "section": "aiact",
+      "name": "AI software inventory",
+      "status": "Compliant",
+      "actual": "ChatGPT, Microsoft Copilot",
+      "expected": "inventory taken",
+      "detail": "AI apps listed by the user.",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "aiact.unapproved",
+      "section": "aiact",
+      "name": "Unapproved AI tools (shadow AI)",
+      "status": "Non-Compliant",
+      "actual": "ChatGPT, Microsoft Copilot",
+      "expected": "only: none",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "aiact.risk_classification",
+      "section": "aiact",
+      "name": "AI system risk classification",
+      "status": "Pending",
+      "actual": "ChatGPT, Microsoft Copilot",
+      "expected": "every AI tool classified",
+      "detail": "Classified by the auditor model (Caveat classifier) in a later step.",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "aiact.os_ai_features",
+      "section": "aiact",
+      "name": "Apple Intelligence external integrations restricted",
+      "status": "NotApplicable",
+      "actual": "Apple Intelligence not available",
+      "expected": "external AI off unless approved",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "aiact.log_retention",
+      "section": "aiact",
+      "name": "AI usage log retention",
+      "status": "Pending",
+      "actual": "depends on classification",
+      "expected": ">= 6 months for high-risk AI",
+      "detail": "Required only if a tool is classified high-risk.",
+      "evidence": "self-reported"
+    },
+    {
+      "id": "org.ropa",
+      "section": "org",
+      "name": "Record of processing activities",
+      "status": "Compliant",
+      "actual": "yes",
+      "expected": "yes"
+    },
+    {
+      "id": "org.dpia",
+      "section": "org",
+      "name": "Data protection impact assessment",
+      "status": "Compliant",
+      "actual": "yes",
+      "expected": "yes"
+    },
+    {
+      "id": "org.breach_procedure",
+      "section": "org",
+      "name": "Breach response procedure",
+      "status": "Compliant",
+      "actual": "yes",
+      "expected": "yes"
+    },
+    {
+      "id": "org.processor_agreements",
+      "section": "org",
+      "name": "Data processing agreements",
+      "status": "Compliant",
+      "actual": "yes",
+      "expected": "yes"
+    },
+    {
+      "id": "org.ai_register",
+      "section": "org",
+      "name": "AI register",
+      "status": "Non-Compliant",
+      "actual": "partial",
+      "expected": "yes"
+    },
+    {
+      "id": "org.ai_literacy",
+      "section": "org",
+      "name": "AI literacy training",
+      "status": "Compliant",
+      "actual": "yes",
+      "expected": "yes"
+    },
+    {
+      "id": "org.human_oversight",
+      "section": "org",
+      "name": "Human oversight for high-risk AI",
+      "status": "Compliant",
+      "actual": "yes",
+      "expected": "yes"
+    },
+    {
+      "id": "org.ai_transparency",
+      "section": "org",
+      "name": "AI transparency to users",
+      "status": "Compliant",
+      "actual": "yes",
+      "expected": "yes"
+    }
+  ],
+  "summary": {
+    "Compliant": 22,
+    "Non-Compliant": 4,
+    "NotApplicable": 1,
+    "Pending": 2,
+    "Error": 0
+  }
+}

synthetic/samples/synthetic-linux-42000126.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.0",
-  "catalog_version": "0.2.0",
+  "catalog_version": "0.3.0",
   "source": {
     "kind": "synthetic",
     "collector": "linux",
-    "collector_version": "0.2.0",
+    "collector_version": "0.3.0",
     "synthetic_seed": 42000126,
     "synthetic_profile": "hardened"
   },
@@ -53,7 +53,11 @@
     "DEBIAN_MIN_VERSION": "12",
     "RHEL_MIN_VERSION": "9",
     "PERSONAL_DATA_SCAN": "0",
-    "APPROVED_AI_TOOLS": ""
+    "APPROVED_AI_TOOLS": "",
+    "IOS_MIN_MAJOR": "18",
+    "ANDROID_MIN_MAJOR": "13",
+    "MOBILE_PATCH_MAX_AGE_DAYS": "90",
+    "MOBILE_PASSCODE_MIN_DIGITS": "6"
   },
   "results": [
     {
@@ -290,18 +294,18 @@
       "section": "baseline",
       "name": "Pending security updates",
       "status": "Non-Compliant",
-      "actual": "6 pending",
+      "actual": "15 pending",
       "expected": "<= 0 pending",
-      "detail": "Including: libxml2, curl."
+      "detail": "Including: curl, openssh-server, libsystemd0. Package lists are 1 days old."
     },
     {
       "id": "vuln.outdated_apps",
       "section": "baseline",
       "name": "Outdated third-party applications",
-      "status": "Non-Compliant",
-      "actual": "4 outdated",
+      "status": "Compliant",
+      "actual": "0 outdated",
       "expected": "<= 0 outdated",
-      "detail": "chromium (snap) 124.4 -> 124.4; libreoffice 61.1 -> 63.7; zoom (flatpak) 115.3 -> 115.6; thunderbird 122.7 -> 124.5."
+      "detail": "packages: 0"
     },
     {
       "id": "vuln.known_vulnerabilities",
@@ -310,7 +314,7 @@
       "status": "Compliant",
       "actual": "0 critical/high",
       "expected": "<= 0 critical/high",
-      "detail": "Matched against offline OSV/NVD data from 2026-09-09. 0 medium/low."
+      "detail": "Matched against offline OSV/NVD data from 2026-10-08. 609 source packages checked against ubuntu:22.04 advisories. 0 medium/low."
     },
     {
       "id": "gdpr.auto_updates",
@@ -325,9 +329,9 @@
       "section": "gdpr",
       "name": "Security updates installed recently",
       "status": "Compliant",
-      "actual": "21 days ago",
+      "actual": "6 days ago",
       "expected": "<= 30 days ago",
-      "detail": "Last package upgrade: 2026-09-14  03:19:46"
+      "detail": "Last package upgrade: 2026-09-29  05:06:17"
     },
     {
       "id": "gdpr.os_supported",
@@ -358,17 +362,16 @@
       "section": "gdpr",
       "name": "Backup configured",
       "status": "Compliant",
-      "actual": "restic-backup.timer",
+      "actual": "Timeshift",
       "expected": "backup configured"
     },
     {
       "id": "gdpr.backup_recent",
       "section": "gdpr",
       "name": "Recent backup",
-      "status": "Pending",
-      "actual": "date not readable",
-      "expected": "<= 7 days ago",
-      "detail": "Confirm the last backup date in: restic-backup.timer."
+      "status": "Compliant",
+      "actual": "7 days ago",
+      "expected": "<= 7 days ago"
     },
     {
       "id": "gdpr.removable_encryption",
@@ -416,26 +419,24 @@
       "section": "aiact",
       "name": "AI software inventory",
       "status": "Compliant",
-      "actual": "Hugging Face models",
-      "expected": "inventory taken",
-      "detail": "Local models: /home/jdoe/.cache/huggingface/hub (17G)."
+      "actual": "no AI tools found",
+      "expected": "inventory taken"
     },
     {
       "id": "aiact.unapproved",
       "section": "aiact",
       "name": "Unapproved AI tools (shadow AI)",
-      "status": "Non-Compliant",
-      "actual": "Hugging Face models",
+      "status": "Compliant",
+      "actual": "none",
       "expected": "only: none"
     },
     {
       "id": "aiact.risk_classification",
       "section": "aiact",
       "name": "AI system risk classification",
-      "status": "Pending",
-      "actual": "Hugging Face models",
-      "expected": "every AI tool classified",
-      "detail": "Classified by the auditor model (Caveat classifier) in a later step."
+      "status": "NotApplicable",
+      "actual": "no AI tools found",
+      "expected": "every AI tool classified"
     },
     {
       "id": "aiact.os_ai_features",
@@ -450,10 +451,9 @@
       "id": "aiact.log_retention",
       "section": "aiact",
       "name": "AI usage log retention",
-      "status": "Pending",
-      "actual": "depends on classification",
-      "expected": ">= 6 months for high-risk AI",
-      "detail": "Required only if a tool is classified high-risk."
+      "status": "NotApplicable",
+      "actual": "no AI tools found",
+      "expected": ">= 6 months for high-risk AI"
     },
     {
       "id": "org.ropa",
@@ -491,8 +491,8 @@
       "id": "org.ai_register",
       "section": "org",
       "name": "AI register",
-      "status": "Compliant",
-      "actual": "yes",
+      "status": "Non-Compliant",
+      "actual": "partial",
       "expected": "yes"
     },
     {
@@ -515,16 +515,16 @@
       "id": "org.ai_transparency",
       "section": "org",
       "name": "AI transparency to users",
-      "status": "Non-Compliant",
-      "actual": "partial",
+      "status": "Compliant",
+      "actual": "yes",
       "expected": "yes"
     }
   ],
   "summary": {
-    "Compliant": 38,
-    "Non-Compliant": 13,
-    "NotApplicable": 2,
-    "Pending": 3,
+    "Compliant": 41,
+    "Non-Compliant": 11,
+    "NotApplicable": 4,
+    "Pending": 0,
     "Error": 0
   }
 }

synthetic/samples/synthetic-macos-42000126.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.0",
-  "catalog_version": "0.2.0",
+  "catalog_version": "0.3.0",
   "source": {
     "kind": "synthetic",
     "collector": "macos",
-    "collector_version": "0.2.0",
+    "collector_version": "0.3.0",
     "synthetic_seed": 42000126,
     "synthetic_profile": "hardened"
   },
@@ -53,7 +53,11 @@
     "DEBIAN_MIN_VERSION": "12",
     "RHEL_MIN_VERSION": "9",
     "PERSONAL_DATA_SCAN": "0",
-    "APPROVED_AI_TOOLS": ""
+    "APPROVED_AI_TOOLS": "",
+    "IOS_MIN_MAJOR": "18",
+    "ANDROID_MIN_MAJOR": "13",
+    "MOBILE_PATCH_MAX_AGE_DAYS": "90",
+    "MOBILE_PASSCODE_MIN_DIGITS": "6"
   },
   "results": [
     {
@@ -292,17 +296,18 @@
       "section": "baseline",
       "name": "Pending security updates",
       "status": "Non-Compliant",
-      "actual": "9 pending",
+      "actual": "1 pending",
       "expected": "<= 0 pending",
-      "detail": "Including: Background Security Improvement, macOS 26 security update."
+      "detail": "Including: macOS Tahoe 26.1.2-22H250."
     },
     {
       "id": "vuln.outdated_apps",
       "section": "baseline",
       "name": "Outdated third-party applications",
-      "status": "Compliant",
-      "actual": "0 outdated",
-      "expected": "<= 0 outdated"
+      "status": "NotApplicable",
+      "actual": "not checked",
+      "expected": "<= 0 outdated",
+      "detail": "Homebrew is not installed, so there is no local source of current application versions."
     },
     {
       "id": "vuln.known_vulnerabilities",
@@ -311,7 +316,7 @@
       "status": "Compliant",
       "actual": "0 critical/high",
       "expected": "<= 0 critical/high",
-      "detail": "Matched against offline OSV/NVD data from 2026-10-08. 2 medium/low."
+      "detail": "Matched against offline OSV/NVD data from 2026-10-08. 17 applications inventoried, 10 recognised (23 common applications covered). 0 medium/low."
     },
     {
       "id": "gdpr.auto_updates",
@@ -326,9 +331,9 @@
       "section": "gdpr",
       "name": "Security updates installed recently",
       "status": "Compliant",
-      "actual": "15 days ago",
+      "actual": "22 days ago",
       "expected": "<= 30 days ago",
-      "detail": "Last software update: 2026-09-20 07:47:00 +0000"
+      "detail": "Last software update: 2026-09-13 00:41:00 +0000"
     },
     {
       "id": "gdpr.os_supported",
@@ -360,17 +365,16 @@
       "section": "gdpr",
       "name": "Backup configured",
       "status": "Compliant",
-      "actual": "bzserv",
+      "actual": "Time Machine",
       "expected": "backup configured"
     },
     {
       "id": "gdpr.backup_recent",
       "section": "gdpr",
       "name": "Recent backup",
-      "status": "Pending",
-      "actual": "date not readable",
-      "expected": "<= 7 days ago",
-      "detail": "Confirm the last backup date in bzserv."
+      "status": "Compliant",
+      "actual": "1 days ago",
+      "expected": "<= 7 days ago"
     },
     {
       "id": "gdpr.removable_encryption",
@@ -400,8 +404,8 @@
       "id": "gdpr.telemetry",
       "section": "gdpr",
       "name": "Diagnostic data minimised",
-      "status": "Non-Compliant",
-      "actual": "share Mac analytics=1, share with app developers=0",
+      "status": "Compliant",
+      "actual": "analytics sharing off",
       "expected": "analytics sharing off"
     },
     {
@@ -418,25 +422,24 @@
       "section": "aiact",
       "name": "AI software inventory",
       "status": "Compliant",
-      "actual": "Claude",
+      "actual": "no AI tools found",
       "expected": "inventory taken"
     },
     {
       "id": "aiact.unapproved",
       "section": "aiact",
       "name": "Unapproved AI tools (shadow AI)",
-      "status": "Non-Compliant",
-      "actual": "Claude",
+      "status": "Compliant",
+      "actual": "none",
       "expected": "only: none"
     },
     {
       "id": "aiact.risk_classification",
       "section": "aiact",
       "name": "AI system risk classification",
-      "status": "Pending",
-      "actual": "Claude",
-      "expected": "every AI tool classified",
-      "detail": "Classified by the auditor model (Caveat classifier) in a later step."
+      "status": "NotApplicable",
+      "actual": "no AI tools found",
+      "expected": "every AI tool classified"
     },
     {
       "id": "aiact.os_ai_features",
@@ -450,10 +453,9 @@
       "id": "aiact.log_retention",
       "section": "aiact",
       "name": "AI usage log retention",
-      "status": "Pending",
-      "actual": "depends on classification",
-      "expected": ">= 6 months for high-risk AI",
-      "detail": "Required only if a tool is classified high-risk."
+      "status": "NotApplicable",
+      "actual": "no AI tools found",
+      "expected": ">= 6 months for high-risk AI"
     },
     {
       "id": "org.ropa",
@@ -475,8 +477,8 @@
       "id": "org.breach_procedure",
       "section": "org",
       "name": "Breach response procedure",
-      "status": "Non-Compliant",
-      "actual": "partial",
+      "status": "Compliant",
+      "actual": "yes",
       "expected": "yes"
     },
     {
@@ -521,10 +523,10 @@
     }
   ],
   "summary": {
-    "Compliant": 38,
-    "Non-Compliant": 12,
-    "NotApplicable": 3,
-    "Pending": 3,
+    "Compliant": 41,
+    "Non-Compliant": 9,
+    "NotApplicable": 6,
+    "Pending": 0,
     "Error": 0
   }
 }

synthetic/samples/synthetic-windows-42000126.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.0",
-  "catalog_version": "0.2.0",
+  "catalog_version": "0.3.0",
   "source": {
     "kind": "synthetic",
     "collector": "windows",
-    "collector_version": "0.2.0",
+    "collector_version": "0.3.0",
     "synthetic_seed": 42000126,
     "synthetic_profile": "hardened"
   },
@@ -53,7 +53,11 @@
     "DEBIAN_MIN_VERSION": "12",
     "RHEL_MIN_VERSION": "9",
     "PERSONAL_DATA_SCAN": "0",
-    "APPROVED_AI_TOOLS": ""
+    "APPROVED_AI_TOOLS": "",
+    "IOS_MIN_MAJOR": "18",
+    "ANDROID_MIN_MAJOR": "13",
+    "MOBILE_PATCH_MAX_AGE_DAYS": "90",
+    "MOBILE_PASSCODE_MIN_DIGITS": "6"
   },
   "results": [
     {
@@ -361,9 +365,10 @@
       "id": "vuln.outdated_apps",
       "section": "baseline",
       "name": "Outdated third-party applications",
-      "status": "Compliant",
-      "actual": "0 outdated",
-      "expected": "<= 0 outdated"
+      "status": "NotApplicable",
+      "actual": "not checked",
+      "expected": "<= 0 outdated",
+      "detail": "winget (App Installer) is not available for this account, so there is no local source of current application versions."
     },
     {
       "id": "vuln.known_vulnerabilities",
@@ -372,14 +377,14 @@
       "status": "Compliant",
       "actual": "0 critical/high",
       "expected": "<= 0 critical/high",
-      "detail": "Matched against offline OSV/NVD data from 2026-09-10. 1 medium/low."
+      "detail": "Matched against offline OSV/NVD data from 2026-10-08. 14 applications inventoried, 11 recognised (31 common applications covered). 0 medium/low."
     },
     {
       "id": "gdpr.auto_updates",
       "section": "gdpr",
       "name": "Automatic security updates",
       "status": "Compliant",
-      "actual": "AUOptions=4",
+      "actual": "Windows default (automatic)",
       "expected": "automatic"
     },
     {
@@ -387,9 +392,9 @@
       "section": "gdpr",
       "name": "Security updates installed recently",
       "status": "Compliant",
-      "actual": "28 days ago",
+      "actual": "18 days ago",
       "expected": "<= 30 days ago",
-      "detail": "Last update: 2026-02 Cumulative Update for Windows 11 (2026-09-07)"
+      "detail": "Last update: 2026-07 Cumulative Update for Windows 11 (2026-09-17)"
     },
     {
       "id": "gdpr.os_supported",
@@ -412,7 +417,7 @@
       "section": "gdpr",
       "name": "Time synchronisation",
       "status": "Compliant",
-      "actual": "type NTP, service Running/Manual",
+      "actual": "type NT5DS, service Running/Manual",
       "expected": "NTP or domain time"
     },
     {
@@ -452,8 +457,8 @@
       "id": "gdpr.remote_access",
       "section": "gdpr",
       "name": "Remote access services restricted",
-      "status": "Non-Compliant",
-      "actual": "smb",
+      "status": "Compliant",
+      "actual": "none enabled",
       "expected": "only: none"
     },
     {
@@ -461,7 +466,7 @@
       "section": "gdpr",
       "name": "Diagnostic data minimised",
       "status": "Compliant",
-      "actual": "AllowTelemetry=0 (Settings)",
+      "actual": "AllowTelemetry=1 (Settings)",
       "expected": "required diagnostic data only (0-1)"
     },
     {
@@ -478,16 +483,15 @@
       "section": "aiact",
       "name": "AI software inventory",
       "status": "Compliant",
-      "actual": "Cursor, Claude, Ollama",
-      "expected": "inventory taken",
-      "detail": "Local AI service listening on port 11434. Local models: C:\\Users\\jdoe\\.ollama\\models (51 GB)."
+      "actual": "Claude Code",
+      "expected": "inventory taken"
     },
     {
       "id": "aiact.unapproved",
       "section": "aiact",
       "name": "Unapproved AI tools (shadow AI)",
       "status": "Non-Compliant",
-      "actual": "Cursor, Claude, Ollama",
+      "actual": "Claude Code",
       "expected": "only: none"
     },
     {
@@ -495,7 +499,7 @@
       "section": "aiact",
       "name": "AI system risk classification",
       "status": "Pending",
-      "actual": "Cursor, Claude, Ollama",
+      "actual": "Claude Code",
       "expected": "every AI tool classified",
       "detail": "Classified by the auditor model (Caveat classifier) in a later step."
     },
@@ -503,10 +507,10 @@
       "id": "aiact.os_ai_features",
       "section": "aiact",
       "name": "Windows Recall / Copilot data analysis disabled",
-      "status": "NotApplicable",
-      "actual": "Recall not available on this device",
+      "status": "Compliant",
+      "actual": "Recall disabled by policy",
       "expected": "disabled by policy",
-      "detail": "DisableAIDataAnalysis=; AllowRecallEnablement=; TurnOffWindowsCopilot="
+      "detail": "DisableAIDataAnalysis=1; AllowRecallEnablement=0; TurnOffWindowsCopilot="
     },
     {
       "id": "aiact.log_retention",
@@ -521,8 +525,8 @@
       "id": "org.ropa",
       "section": "org",
       "name": "Record of processing activities",
-      "status": "Compliant",
-      "actual": "yes",
+      "status": "Non-Compliant",
+      "actual": "partial",
       "expected": "yes"
     },
     {
@@ -577,17 +581,16 @@
       "id": "org.ai_transparency",
       "section": "org",
       "name": "AI transparency to users",
-      "status": "Pending",
-      "actual": "not answered",
-      "expected": "yes",
-      "detail": "Answer ORG_AI_TRANSPARENCY in organisational.conf."
+      "status": "Compliant",
+      "actual": "yes",
+      "expected": "yes"
     }
   ],
   "summary": {
-    "Compliant": 55,
+    "Compliant": 56,
     "Non-Compliant": 3,
     "NotApplicable": 2,
-    "Pending": 4,
+    "Pending": 3,
     "Error": 0
   }
 }

synthetic/vuln-helper.mjs

@@ -0,0 +1,17 @@
+// Synthetic data helper: run generated software inventories through the real matcher (app/renderer/vuln-core.js)
+// and the real offline bundle, so training data has real CVEs in exactly the app's wording.
+// stdin: JSON lines {os_family, inventory, max, now}  ->  stdout: JSON lines {status, actual, detail}
+import { readFileSync } from 'node:fs';
+import { gunzipSync } from 'node:zlib';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { matchLinux, matchApps, knownVulnResult } from '../app/renderer/vuln-core.js';
+
+const dir = process.argv[2] || path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'vulndb', 'out');
+const manifest = JSON.parse(readFileSync(path.join(dir, 'manifest.json'), 'utf8'));
+const bundle = JSON.parse(gunzipSync(readFileSync(path.join(dir, manifest.file))).toString('utf8'));
+for (const line of readFileSync(0, 'utf8').split('\n').filter(Boolean)) {
+  const job = JSON.parse(line);
+  const matched = job.os_family === 'linux' ? matchLinux(job.inventory, bundle) : matchApps(job.inventory, bundle, job.os_family);
+  process.stdout.write(JSON.stringify(knownVulnResult(matched, job.inventory, { bundle, manifest }, job.os_family, job.max, Date.parse(job.now))) + '\n');
+}

tools/build_controls_doc.py

@@ -73,11 +73,37 @@ SOURCES = {
     "aiact.log_retention": {"windows": "depends on AI classification", "linux": "depends on AI classification", "macos": "depends on AI classification"},
 }
 ORG_SOURCE = "organisational.conf (answered once by the organisation)"
+# Phones: what the browser detects; everything else comes from catalog/mobile_questions.json (asked, self-reported).
+PHONE_DETECTED = {
+    "gdpr.os_supported": "detected: OS version (Safari version on iOS 26+, client hints on Android), confirmed by the user",
+    "vuln.known_vulnerabilities": "detected: iOS version matched against NVD iOS/iPadOS records in the signed phone bundle",
+    "encryption.enabled": {"ios": "derived: on when a passcode is set (iOS data protection)", "android": "detected: Android 10+ encrypts by default"},
+    "screen_lock.enabled": "detected: WebAuthn platform authenticator available; otherwise asked",
+}
+PHONE_AI = "asked: AI apps installed (checklist); classified by the auditor model"
+
+
+def phone_source(check_id, os_family, questions):
+    det = PHONE_DETECTED.get(check_id)
+    if isinstance(det, dict):
+        det = det.get(os_family)
+    if check_id == "vuln.pending_updates" and os_family == "ios":
+        return "detected: iOS version vs newest fixed release in the signed phone bundle"
+    if det and check_id != "screen_lock.enabled":
+        return det
+    spec = questions["checks"].get(check_id, {}).get(os_family)
+    if spec:
+        return (det + "; " if det else "") + f"asked: {spec['where']}"
+    if check_id.startswith("aiact."):
+        return PHONE_AI
+    return None
 
 
 def main():
     with open(os.path.join(ROOT, "catalog", "checks.json"), encoding="utf-8") as handle:
         catalog = json.load(handle)
+    with open(os.path.join(ROOT, "catalog", "mobile_questions.json"), encoding="utf-8") as handle:
+        questions = json.load(handle)
     titles = catalog["references"]
     lines = [
         "# Audited controls and data sources",
@@ -85,26 +111,30 @@ def main():
         f"Catalog version {catalog['catalog_version']} · {len(catalog['checks'])} checks. Generated by `tools/build_controls_doc.py` — do not edit by hand.",
         "",
         "All sources are read-only. Internet is only used by *Pending security updates* on Windows and macOS, and by the app to refresh the vulnerability bundle.",
+        "Phones are checked in the browser: a web page cannot read a phone's settings, so results are either detected by the browser or answered by the user (self-reported), and labelled as such.",
         "",
     ]
     for section in catalog["sections"]:
         checks = [c for c in catalog["checks"] if c["section"] == section["id"]]
         lines += [f"## {section['title']} ({len(checks)})", "",
-                  "| Check | Applies to | References | Rule | Windows source | Linux source | macOS source |",
-                  "|---|---|---|---|---|---|---|"]
+                  "| Check | Applies to | References | Rule | Windows source | Linux source | macOS source | iPhone source | Android source |",
+                  "|---|---|---|---|---|---|---|---|---|"]
         for c in checks:
             refs = [f"ISO {r}" for r in c["controls"]["iso27001"]] + [f"GDPR {r}" for r in c["controls"]["gdpr"]] + [f"AI Act {r}" for r in c["controls"]["ai_act"]]
             src = SOURCES.get(c["id"], {})
             cells = []
-            for os_family in ("windows", "linux", "macos"):
+            for os_family in ("windows", "linux", "macos", "ios", "android"):
                 if os_family not in c["os"]:
                     cells.append("—")
                 elif section["id"] == "org":
-                    cells.append(ORG_SOURCE)
+                    cells.append(ORG_SOURCE if os_family not in ("ios", "android") else ORG_SOURCE + "; Pending in a phone check unless passed in the link")
+                elif os_family in ("ios", "android"):
+                    cells.append(phone_source(c["id"], os_family, questions) or "**missing**")
                 else:
                     cells.append(src.get(os_family, "**missing**"))
             names = c.get("names", {})
-            name = c["name"] + (" / " + " / ".join(sorted(set(names.values()))) if names else "")
+            others = sorted(set(names.values()) - {c["name"]})
+            name = c["name"] + (" / " + " / ".join(others) if others else "")
             lines.append(f"| {name} | {', '.join(c['os'])} | {'; '.join(refs) or '—'} | {c['rule']} | " + " | ".join(cells) + " |")
         lines.append("")
     lines += ["## Reference titles", ""]
@@ -115,7 +145,8 @@ def main():
     out = os.path.join(ROOT, "docs", "CONTROLS.md")
     with open(out, "w", encoding="utf-8") as handle:
         handle.write("\n".join(lines))
-    missing = [c["id"] for c in catalog["checks"] if c["section"] != "org" and any(o not in SOURCES.get(c["id"], {}) for o in c["os"])]
+    missing = [f"{c['id']} ({o})" for c in catalog["checks"] if c["section"] != "org" for o in c["os"]
+               if (o in ("ios", "android") and not phone_source(c["id"], o, questions)) or (o not in ("ios", "android") and o not in SOURCES.get(c["id"], {}))]
     print(f"Wrote {out}; checks without a documented source: {missing or 'none'}")
 
 

tools/validate_evidence.py

@@ -15,7 +15,7 @@ import sys
 ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
 REQUIRED = {"schema_version", "catalog_version", "source", "audit", "host", "baseline", "results", "summary"}
 RESULT_KEYS = {"id", "section", "name", "status", "actual", "expected"}
-OPTIONAL_RESULT_KEYS = {"detail"}
+OPTIONAL_RESULT_KEYS = {"detail", "evidence"}
 
 
 def load_catalog():
@@ -38,10 +38,10 @@ def validate(record, catalog, checks):
         errors.append(f"schema_version {record['schema_version']!r} != '1.0'")
     if record["catalog_version"] != catalog["catalog_version"]:
         errors.append(f"catalog_version {record['catalog_version']} != {catalog['catalog_version']}")
-    if record["source"].get("kind") not in ("collector", "synthetic"):
-        errors.append("source.kind must be collector or synthetic")
+    if record["source"].get("kind") not in ("collector", "synthetic", "web"):
+        errors.append("source.kind must be collector, synthetic or web")
     os_family = record["host"].get("os_family")
-    if os_family not in ("windows", "linux", "macos"):
+    if os_family not in ("windows", "linux", "macos", "ios", "android"):
         errors.append(f"host.os_family invalid: {os_family!r}")
         return errors
     if record["source"].get("collector") != os_family:
@@ -82,6 +82,12 @@ def validate(record, catalog, checks):
             errors.append(f"{where}: {check_id} name {result['name']!r} != catalog {expected_name!r}")
         if result["status"] not in catalog["statuses"]:
             errors.append(f"{where}: {check_id} invalid status {result['status']!r}")
+        if "evidence" in result and result["evidence"] not in ("detected", "self-reported"):
+            errors.append(f"{where}: {check_id} evidence must be detected or self-reported")
+        if os_family in ("ios", "android") and check["section"] != "org" and "evidence" not in result:
+            errors.append(f"{where}: {check_id} needs an evidence source on phones")
+        if os_family not in ("ios", "android") and "evidence" in result:
+            errors.append(f"{where}: {check_id} evidence source is only used on phones")
         for key in ("actual", "expected") + (("detail",) if "detail" in result else ()):
             if not isinstance(result[key], str):
                 errors.append(f"{where}: {check_id}.{key} must be a string")

training/build_dataset.py

@@ -24,7 +24,7 @@ import random
 import re
 
 ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
-DATASET_VERSION = "0.2.0"
+DATASET_VERSION = "0.3.0"
 SYSTEM_PROMPT = ("You are the Devseis endpoint auditor. You write audit findings from collected evidence for "
                  "ISO 27001, GDPR and the EU AI Act. Use only the evidence and reference material in the request. "
                  "Never invent values, dates, versions, account names or tools. Reply with JSON only.")
@@ -115,6 +115,16 @@ FINDING = {
 }
 
 
+EVIDENCE_TEXT = {"self-reported": "self-reported by the user", "detected": "detected by the browser"}
+SELF_REPORTED = "Self-reported by the user, not verified on the device."
+
+
+def evidence_counts(results):
+    detected = sum(1 for r in results if r.get("evidence") == "detected")
+    reported = sum(1 for r in results if r.get("evidence") == "self-reported")
+    return detected, reported
+
+
 def sentence(text):
     text = text.strip()
     return text if not text or text.endswith((".", "!", "?")) else text + "."
@@ -139,6 +149,8 @@ def build_finding(record, result, lib, rng):
     ]
     if detail:
         lines.append(f"DETAIL: {detail}")
+    if result.get("evidence"):
+        lines.append(f"EVIDENCE: {EVIDENCE_TEXT[result['evidence']]}")
     lines.append("REFERENCES:")
     lines += [f"- {label} {title}: {summary}" for label, title, summary in refs]
     lines.append("GUIDANCE:")
@@ -158,6 +170,8 @@ def build_finding(record, result, lib, rng):
               "detail": sentence(detail) if detail else "no detail", "reason": sentence(detail or result["actual"]),
               "pending": sentence(detail) if detail else lib.status_notes["Pending"]}
     finding = rng.choice(FINDING[status]).format(**fields)
+    if result.get("evidence") == "self-reported":
+        finding = finding.replace("The device reports", "The user reports") + " " + SELF_REPORTED
     references = [label for label, _, _ in refs]
 
     if status == "Compliant":
@@ -185,6 +199,8 @@ def build_finding(record, result, lib, rng):
               "finding": finding.strip(), "risk": risk, "recommendation": recommendation, "references": references}
     if verification:
         answer["verification"] = verification
+    if result.get("evidence"):
+        answer["evidence"] = result["evidence"]
     return "\n".join(lines), answer
 
 
@@ -196,7 +212,11 @@ def build_summary(record, lib):
     host = record["host"]
     lines = ["TASK: summary", f"DEVICE: {device_line(record)}", f"HOSTNAME: {host['hostname']}",
              f"AUDIT RUN AS ADMIN: {'yes' if record['audit']['is_admin'] else 'no'}",
-             "COUNTS: " + ", ".join(f"{k}={v}" for k, v in summary.items()), "RESULTS (id | name | status | found):"]
+             "COUNTS: " + ", ".join(f"{k}={v}" for k, v in summary.items())]
+    detected, reported = evidence_counts(results)
+    if detected or reported:
+        lines.append(f"EVIDENCE: {detected} detected by the browser, {reported} self-reported by the user")
+    lines.append("RESULTS (id | name | status | found):")
     lines += [f"- {r['id']} | {r['name']} | {r['status']} | {r['actual']}" for r in results]
     lines.append("RISK LEVELS (from guidance):")
     gaps = [r for r in results if r["status"] == "Non-Compliant"]
@@ -227,6 +247,8 @@ def build_summary(record, lib):
         text += f" {summary['Error']} checks could not be read" + (" because the audit was not run as administrator." if not record["audit"]["is_admin"] else ".")
     if summary["Pending"]:
         text += f" {summary['Pending']} items are pending."
+    if reported:
+        text += f" {reported} results are self-reported by the user and were not verified on the device."
 
     next_steps = []
     if summary["Error"]:

vulndb/build_bundle.py

@@ -215,7 +215,7 @@ def build_osv(stats):
 # --- NVD (desktop applications) ----------------------------------------------------------------
 def nvd_query(cpe):
     """All CVEs for vendor:product, cached as raw pages."""
-    vendor, product = cpe.split(":", 1)
+    part, vendor, product = cpe.split(":", 2) if cpe.count(":") >= 2 and cpe[1] == ":" else ("a", *cpe.split(":", 1))
     path = os.path.join(CACHE, "nvd", re.sub(r"[^A-Za-z0-9_.-]", "_", cpe) + ".json")
     if os.path.exists(path):
         with open(path, encoding="utf-8") as handle:
@@ -223,7 +223,7 @@ def nvd_query(cpe):
     os.makedirs(os.path.dirname(path), exist_ok=True)
     items, start = [], 0
     while True:
-        params = urllib.parse.urlencode({"virtualMatchString": f"cpe:2.3:a:{vendor}:{product}", "startIndex": start, "noRejected": ""})
+        params = urllib.parse.urlencode({"virtualMatchString": f"cpe:2.3:{part}:{vendor}:{product}", "startIndex": start, "noRejected": ""})
         url = f"{NVD_URL}?{params}".replace("noRejected=", "noRejected")
         for attempt in range(5):
             try:
@@ -273,7 +273,7 @@ def build_nvd(products, stats):
     for product in products:
         ranges = {}
         for cpe in product["cpe"]:
-            vendor, name = cpe.split(":", 1)
+            vendor, name = cpe.split(":")[-2:]
             for item in nvd_query(cpe):
                 cve = item["cve"]
                 severity = nvd_severity(cve)
@@ -288,10 +288,10 @@ def build_nvd(products, stats):
                             exact = "" if version in ("*", "-") else version.replace("\\", "")
                             row = (cve["id"], severity, match.get("versionStartIncluding", ""), match.get("versionStartExcluding", ""),
                                    match.get("versionEndIncluding", ""), match.get("versionEndExcluding", ""), exact)
-                            if version == "-" or (not exact and not any(row[2:6])):
-                                continue  # "all versions" with no bound: cannot tell fixed from unfixed
+                            if version == "-" or (not exact and not row[4] and not row[5]):
+                                continue  # no upper bound ("all versions" or "from version X on"): cannot tell fixed from unfixed
                             ranges[row] = True
-        apps.append({"id": product["id"], "name": product["name"], "windows": product.get("windows", ""), "macos": product.get("macos", ""),
+        apps.append({"id": product["id"], "name": product["name"], "windows": product.get("windows", ""), "macos": product.get("macos", ""), "ios": product.get("ios", ""),
                      "cves": sorted(list(r) for r in ranges)})
         stats["nvd"][product["id"]] = len({r[0] for r in ranges})
         if not ranges:
@@ -384,6 +384,20 @@ def main():
         "counts": {"releases": stats["osv"], "apps": stats["nvd"], "kev": len(bundle["kev"]), "epss": len(bundle["epss"])},
         "signature": None,
     }
+    # Small bundle for the phone web check: mobile OS records only.
+    mobile_apps = [a for a in apps if a.get("ios")]
+    mobile_cves = {row[0] for a in mobile_apps for row in a["cves"]}
+    mobile = {**{k: bundle[k] for k in ("format", "built_at", "sources")}, "notes": "Phone web check subset: iOS and iPadOS NVD records.",
+              "releases": {}, "apps": mobile_apps, "kev": sorted(mobile_cves & kev),
+              "epss": {cve: score for cve, score in bundle["epss"].items() if cve in mobile_cves}}
+    mobile_name = f"devseis-vulndb-mobile-{today}.json.gz"
+    mobile_data = gzip.compress(json.dumps(mobile, separators=(",", ":")).encode("utf-8"), 9, mtime=0)
+    with open(os.path.join(OUT, mobile_name), "wb") as handle:
+        handle.write(mobile_data)
+    manifest["mobile"] = {"file": mobile_name, "size": len(mobile_data), "sha256": hashlib.sha256(mobile_data).hexdigest(), "signature": None}
+    for old in os.listdir(OUT):
+        if old.startswith("devseis-vulndb-") and old not in (name, mobile_name):
+            os.remove(os.path.join(OUT, old))
     with open(os.path.join(OUT, "manifest.json"), "w", encoding="utf-8") as handle:
         json.dump(manifest, handle, indent=2)
     log(f"\nWrote vulndb/out/{name}: {len(data) / 1048576:.1f} MB compressed ({len(raw) / 1048576:.1f} MB raw)")

vulndb/products.json

@@ -1,5 +1,5 @@
 {
-  "_comment": "Desktop applications matched against NVD. match: case-insensitive regex on the Windows program name (windows) or the macOS app bundle name without .app (macos). cpe: NVD vendor:product. Keep regexes tight: a wrong match produces false findings.",
+  "_comment": "Applications (and mobile OSes) matched against NVD. Regex per OS family on the program name (windows), app bundle name without .app (macos), or \"iOS\"/\"iPadOS\" (ios, from the mobile web check). cpe: NVD [part:]vendor:product, part defaults to a. Keep regexes tight: a wrong match produces false findings.",
   "version": "0.1.0",
   "products": [
     {"id": "chrome", "name": "Google Chrome", "cpe": ["google:chrome"], "windows": "^Google Chrome$", "macos": "^Google Chrome$"},
@@ -34,6 +34,8 @@
     {"id": "tightvnc", "name": "TightVNC", "cpe": ["tightvnc:tightvnc", "glavsoft:tightvnc"], "windows": "^TightVNC$"},
     {"id": "telegram", "name": "Telegram Desktop", "cpe": ["telegram:telegram_desktop"], "windows": "^Telegram Desktop", "macos": "^Telegram$"},
     {"id": "safari", "name": "Safari", "cpe": ["apple:safari"], "macos": "^Safari$"},
+    {"id": "ios", "name": "iOS", "cpe": ["o:apple:iphone_os"], "ios": "^iOS$"},
+    {"id": "ipados", "name": "iPadOS", "cpe": ["o:apple:ipados"], "ios": "^iPadOS$"},
     {"id": "iterm2", "name": "iTerm2", "cpe": ["iterm2:iterm2"], "macos": "^iTerm$"}
   ]
 }

vulndb/sign-bundle.mjs

@@ -33,6 +33,11 @@ const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
 const sha = createHash('sha256').update(readFileSync(path.join(out, manifest.file))).digest('hex');
 if (sha !== manifest.sha256) throw new Error(`${manifest.file} does not match manifest.json; rebuild the bundle`);
 manifest.signature = sign(null, Buffer.from(sha), privateKey).toString('base64');
+if (manifest.mobile) {
+  const mobileSha = createHash('sha256').update(readFileSync(path.join(out, manifest.mobile.file))).digest('hex');
+  if (mobileSha !== manifest.mobile.sha256) throw new Error(`${manifest.mobile.file} does not match manifest.json; rebuild the bundle`);
+  manifest.mobile.signature = sign(null, Buffer.from(mobileSha), privateKey).toString('base64');
+}
 manifest.signed_at = new Date().toISOString().replace(/\.\d+Z$/, 'Z');
 writeFileSync(manifestPath, JSON.stringify(manifest, null, 2));
 console.log(`Signed ${manifest.file} (sha256 ${sha.slice(0, 16)}...)`);