Action1 POC — Acceptance Evidence

Acceptance run of runbooks/action1-setup-and-deployment.md (Part 8) on the internal test PC + test Mac. Fill a dated pass/fail per row; all 8 must pass on both OSes (Mac caveats from Parts 6–7 count as expected-limits, not failures) before Action1 is used on a paying customer.

Environment

Item	Value
Action1 account	CyberSuite-owned, MFA on (creds in 1Password)
Test group	CS-INTERNAL
Test Windows PC	hostname / OS build:
Test Mac	hostname / macOS version:
Huntress org	ORG name; ACCT_KEY/ORG_KEY from deploy page
Escrow keypair	RSA-4096; public in fallback scripts, private in 1Password — see runbooks/action1-scripts/README.md

Test plan results

#	Test	Pass criteria	Win	Mac	Notes
1	Agent enrollment	Endpoint appears in CS-INTERNAL, checks in	☐	✅
2	Inventory	HW + installed-software inventory populates	☐	✅
3	Software deploy (test app)	Test app installs silently from a package	☐	✅	8x8 Work installed remotely via Action1.
4	Huntress deploy	Agent installs and reports healthy in Huntress portal	☐	✅	Silent/root install via Action1 — no password. Only manual step: grant network content filter in Huntress app wizard (Intune PPPC pre-approves on managed customers). curl fixed to -fsSL (kills false Error status).
5a	Security/encryption — Win preferred	BitLocker XTS-AES256 on; key retrievable in Entra	☐	—	Intune disk-encryption policy (Stage C Phase 2c) or bitlocker-enable-escrow-entra.ps1.
5b	Security/encryption — Win fallback	BitLocker on; ESCROW_BLOB decrypts + key matches	☐	—	bitlocker-enable-escrow.ps1 (RSA→1Password). Needs escrow keypair.
5c	Security/encryption — Mac preferred	FileVault on; key retrievable in MDM	—	☐	Intune/Mosyle FileVault policy + filevault-verify-escrow.sh.
5d	Security/encryption — Mac fallback	FileVault on; ESCROW_BLOB decrypts + validaterecovery	—	☐	filevault-enable-escrow.sh (RSA→1Password). Needs escrow keypair; confirm LibreSSL rsa_oaep_md:sha256.
6	Patch policy	Policy applies; a pending patch installs in window	☐	☐
7	Remote access	Connect to the endpoint from the console	☐	☐
8	Removal/cleanup	Uninstall test app; endpoint retired from group	☐	☐

Acceptance: ☐ all rows pass on both OSes (each encryption path 5a–5d on its OS) → file as Action1 POC evidence. C-10 PASS requires the key escrowed and retrievable, not just encryption on.

Run log

• 2026-06-16 — POC started. Prereqs confirmed: Action1 account + MFA, Huntress keys, test PC, test Mac all in place.
• 2026-06-16 — Built reusable Deploy Huntress — macOS (Bash) library script (ACCT_KEY baked in, ORG_KEY parameterized) and ran it via Automation against the test Mac. Install was fully silent (root context, no password). Mac reports healthy in Huntress. Sole manual step on the unmanaged test Mac: approve the network content filter via the Huntress app wizard. Test #4 (Mac) PASS.
• 2026-06-18 — Tests #1–#3 (Mac) PASS recorded (enrollment, inventory, 8x8 Work remote install). Huntress curl corrected to -fsSL (false Error status fixed).
• 2026-06-18 — Test #5 split into 5a–5d (Win/Mac × preferred/fallback escrow paths). Designed the C-10 escrow tier model (MDM → AD → customer vault → CS 1Password bridge, Day-30 time-box) and the RSA public-key escrow transport (key encrypted to a CS public key on the endpoint; ciphertext via Action1; back-office decrypt — no cleartext key or vault token ever on the endpoint or in Action1 logs). Drafted all four scripts in runbooks/action1-scripts/. Canonical specs updated: Licensing Rule 6 (Mac/MDM selection), intake v1.0.2 (MDM “other”, BYOD mobile/computer split), shared-responsibility (co-manage/hand-off + BYOD boundaries), C-10 coverage PARTIAL reasoning (firm-owned-only).
• 2026-06-18 — Began Stage C (MS tenant: licensing → Entra → Intune/MDM) to enable the preferred path (5a/5c) on the internal tenant.