Deployment Validation Matrix

Post-deployment validation checklist for Homebrew, PKG, Jamf, Intune, Kandji, and Santa rollout paths.

Use this matrix after each thoth/v* rollout to confirm endpoint health, governance enforcement, and trust controls.

Global pre-check (all paths)

Run on a representative endpoint:

thoth --version
thothctl --version
thoth health --json
thoth status

Required outcomes:

Installed version matches intended release tag.
thoth health --json reports healthy registration.
Governed servers appear in thoth status.

Validation matrix

Path	Verify install	Verify trust	Verify runtime behavior
Homebrew	`brew list --versions thoth`	`sha256sum -c checksums.sha256` on release assets used in tap update	`thoth health --json` + one governed MCP tool call
Notarized PKG	`pkgutil --pkg-info com.atensecurity.thoth.cli`	`pkgutil --check-signature` + `spctl --assess --type install` on package	`thoth status` after Claude restart
Jamf macOS	Jamf policy success + binary present in `/usr/local/bin`	Validate signed PKG source + optional Santa rule check	`thoth health --json` on test/pilot devices
Intune macOS	Assignment success + binary present	Verify source checksums and package provenance	`thoth status` + config path exists
Intune Windows	Win32 app install success + `thoth.exe` on PATH	Verify artifact checksums and Sigstore bundle	`thoth health --json` in PowerShell
Intune Linux	Script/package assignment success	Verify artifact checksums	`thoth status` + config path exists
Kandji macOS	Custom App install success + script success	Validate package notarization + signatures	`thoth health --json` on scoped devices
Santa macOS	`santa-cli rule` state matches policy repo	Team ID/hash rules match `santa-metadata.json` and `checksums.sha256`	Thoth binaries execute under Santa enforcement

Path-specific commands

Homebrew

brew update
brew list --versions thoth
thoth --version

macOS PKG / Jamf / Kandji

pkgutil --check-signature thoth-macos-universal.pkg
spctl --assess --type install --verbose=4 thoth-macos-universal.pkg
codesign -dv --verbose=4 /usr/local/bin/thoth 2>&1 | grep -E 'TeamIdentifier|Authority='

Intune Windows

thoth --version
thothctl --version
thoth health --json
Test-Path "C:\ProgramData\Thoth\thoth-config.json"

Intune Linux

thoth --version
thothctl --version
thoth health --json
test -f /etc/thoth/thoth-config.json

Santa

TEAM_ID_EXPECTED="$(jq -r '.teamId' santa-metadata.json)"
sudo santa-cli rule --check --teamid "$TEAM_ID_EXPECTED"

Release artifact validation (required per release)

sha256sum -c checksums.sha256
jq -e '.provenanceType == "release-artifact-provenance"' provenance.json
jq -e '.bomFormat == "CycloneDX"' sbom.cdx.json
jq -e '.spdxVersion | startswith("SPDX-")' sbom.spdx.json

Optional attestation verification:

gh attestation verify checksums.sha256 --repo atensecurity/thoth

Suggested rollout gates

Test: 1-5 endpoints per platform.
Pilot: 5-15% of platform fleet.
Production: full scope after pilot SLO passes.

Gate to next stage only if:

health checks remain stable for 24h,
no policy regression tickets are opened,
drift remediation scripts remain idempotent.

Deployment Validation Matrix

On this page