#!/usr/bin/env bash
# SAFE DEFENSIVE VALIDATOR — macOS SYSTEM SURFACE (SIP, XProtect, updates)
#
# Purpose: Captures key macOS security posture (SIP status, last XProtect update,
#          softwareupdate list) using only safe read-only commands.
#
# Safety: No changes, no privilege escalation.
#
# Generated by Vigil safe-poc-generator (Phase 1, template A).

set -euo pipefail

STARTED=$(date -u +%Y-%m-%dT%H:%M:%SZ)

echo '{
  "validator": "macos-system-validator",
  "schemaVersion": "1.0.0",
  "generatedBy": "Vigil safe-poc-generator (Phase 1, template A)",
  "startedAt": "'"$STARTED"'",
  "sip": "'$(csrutil status 2>/dev/null || echo "unknown")'",
  "xprotect": "'$(ls -l /Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Info.plist 2>/dev/null | awk "{print \$6,\$7,\$8}" || echo "unknown")'",
  "softwareupdate": "'$(softwareupdate -l 2>/dev/null | head -20 | tr '\n' ' ' | sed 's/"/\\"/g' || echo "n/a")'",
  "completedAt": "'$(date -u +%Y-%m-%dT%H:%M:%SZ)'",
  "conclusion": "macOS security surface captured read-only for operator review."
}'
exit 0