Release FileVault Escrow and Apple Silicon Readiness · macvfx/SOFA

Simple Security Check 3.4 Build 12

FileVault encryption and recovery-key escrow are now reported as separate states across Devices, Reports, Device Inspector, copied summaries, CSV, and JSON.
Security Report flags Macs that have FileVault enabled without an escrowed recovery key and preserves unknown inventory as unknown.
Recovery-key values are excluded from ordinary exports, diagnostic logging, and the SQLite cache.
Revealing or copying an individual key requires Touch ID or Mac login authentication; revealed and copied values are automatically cleared.
A separate authenticated SENSITIVE_ recovery-key CSV export uses an explicit warning, a user-selected destination, and owner-only permissions.
Existing caches are migrated and compacted to remove recovery-key values retained by earlier versions.

Adds an optional Compatibility Risk report with By Device and By Application views.
Reads the optional SimpleMDM intel_inventory custom attribute populated by the public SimpleMDM-IntelInventory.sh script.
Distinguishes Ready, Intel-only applications, Stale, Missing, and Invalid inventory.
Adds an Intel readiness indicator to Devices and an Apple Silicon Readiness section to Device Inspector only when the selected account configures the attribute.
Keeps the report discoverable with a link to public setup instructions when Intel inventory is not configured.

Adds a fleet Custom Attributes report with an attribute picker, reported values, empty or missing coverage, sortable Last Seen, and long-form CSV export.
Adds Intel compatibility CSV export with device status, application names, scan time, architecture, and Last Seen.
Device dashboards and reports default to newest Last Seen first, with sortable table columns where supported.

Demo Mode now provides deterministic FileVault escrow, current/stale/missing/invalid Intel inventory, Intel-only application, custom-attribute coverage, and Last Seen fixtures.
Expands the private XCTest suite to 15 tests covering legacy and v2 Intel inventory parsing, normalization, validation, stale/risk state, Demo Mode fixtures, SOFA cache policy, and same-alias Keychain replacement.
Updates in-app Help and documentation for the new security indicators, reports, exports, and optional Intel setup.
Fixes Force Refresh so it bypasses and revalidates the HTTP response cache as well as the app's SQLite cache, allowing same-day SOFA releases to appear immediately.
Reserves dedicated widths for the Devices security and Last Seen columns so FileVault, XP, and optional Intel indicators remain visible.
Replaces ambiguous Device Inspector “Loading” labels with explicit SimpleMDM download progress, visible request or permission errors, and Retry controls. Custom attributes and installed apps now load concurrently, and invalid Intel inventory is distinct from missing inventory.
Fixes Settings API-key rotation so an existing alias can replace its Keychain value in place; leaving the key field empty retains the current key, and duplicate aliases show a clear validation error.