# Deployment Validation Matrix

> Post-deployment validation checklist for Homebrew, PKG, Jamf, Intune, Kandji, and Santa rollout paths.

Source: https://docs.atensecurity.com/docs/deployments/validation-matrix

Use this matrix after each `thoth/v*` rollout to confirm endpoint health, governance enforcement, and trust controls.

## Global pre-check (all paths)

Run on a representative endpoint:

```bash
thoth --version
thothctl --version
thoth health --json
thoth status
```

Required outcomes:

- Installed version matches intended release tag.
- `thoth health --json` reports healthy registration.
- Governed servers appear in `thoth status`.

## Validation matrix

| Path | Verify install | Verify trust | Verify runtime behavior |
|---|---|---|---|
| Homebrew | `brew list --versions thoth` | `sha256sum -c checksums.sha256` on release assets used in tap update | `thoth health --json` + one governed MCP tool call |
| Notarized PKG | `pkgutil --pkg-info com.atensecurity.thoth.cli` | `pkgutil --check-signature` + `spctl --assess --type install` on package | `thoth status` after Claude restart |
| Jamf macOS | Jamf policy success + binary present in `/usr/local/bin` | Validate signed PKG source + optional Santa rule check | `thoth health --json` on test/pilot devices |
| Intune macOS | Assignment success + binary present | Verify source checksums and package provenance | `thoth status` + config path exists |
| Intune Windows | Win32 app install success + `thoth.exe` on PATH | Verify artifact checksums and Sigstore bundle | `thoth health --json` in PowerShell |
| Intune Linux | Script/package assignment success | Verify artifact checksums | `thoth status` + config path exists |
| Kandji macOS | Custom App install success + script success | Validate package notarization + signatures | `thoth health --json` on scoped devices |
| Santa macOS | `santa-cli rule` state matches policy repo | Team ID/hash rules match `santa-metadata.json` and `checksums.sha256` | Thoth binaries execute under Santa enforcement |

## Path-specific commands

## Homebrew

```bash
brew update
brew list --versions thoth
thoth --version
```

## macOS PKG / Jamf / Kandji

```bash
pkgutil --check-signature thoth-macos-universal.pkg
spctl --assess --type install --verbose=4 thoth-macos-universal.pkg
codesign -dv --verbose=4 /usr/local/bin/thoth 2>&1 | grep -E 'TeamIdentifier|Authority='
```

## Intune Windows

```powershell
thoth --version
thothctl --version
thoth health --json
Test-Path "C:\ProgramData\Thoth\thoth-config.json"
```

## Intune Linux

```bash
thoth --version
thothctl --version
thoth health --json
test -f /etc/thoth/thoth-config.json
```

## Santa

```bash
TEAM_ID_EXPECTED="$(jq -r '.teamId' santa-metadata.json)"
sudo santa-cli rule --check --teamid "$TEAM_ID_EXPECTED"
```

## Release artifact validation (required per release)

```bash
sha256sum -c checksums.sha256
jq -e '.provenanceType == "release-artifact-provenance"' provenance.json
jq -e '.bomFormat == "CycloneDX"' sbom.cdx.json
jq -e '.spdxVersion | startswith("SPDX-")' sbom.spdx.json
```

Optional attestation verification:

```bash
gh attestation verify checksums.sha256 --repo atensecurity/thoth
```

## Suggested rollout gates

1. Test: 1-5 endpoints per platform.
2. Pilot: 5-15% of platform fleet.
3. Production: full scope after pilot SLO passes.

Gate to next stage only if:

- health checks remain stable for 24h,
- no policy regression tickets are opened,
- drift remediation scripts remain idempotent.

## Related docs

- [Release Channels + Verification](https://docs.atensecurity.com/docs/deployments/release-channels)
- [Jamf macOS Runbook](https://docs.atensecurity.com/docs/deployments/jamf-macos)
- [Intune Onboarding Overview](https://docs.atensecurity.com/docs/deployments/intune-overview)
- [Kandji macOS Runbook](https://docs.atensecurity.com/docs/deployments/kandji-macos)
- [Santa macOS Trust Policy](https://docs.atensecurity.com/docs/deployments/santa-macos)