One Mac, five controls, three verdicts

Before you start

You've been asked to produce an endpoint compliance-evidence packet for one Mac, built entirely from the command line: five controls — encryption at rest, OS tamper protection, software-execution control, central management, and an enforced screen-lock policy — each line labeled to the control it evidences, each carrying the machine's own raw reply and a defensible PASS / FAIL / UNKNOWN verdict. This terminal is a simulated managed Mac: the status commands answer with the same canonical strings the lab's committed fixtures hold, and one query path is deliberately broken so you must handle the verdict nobody likes to write down. The discipline that carries the whole lab: a check that did not run is never a pass — and never a clean fail.