Refine macOS imaging presentation and repository specifications

franklesniak · franklesniak · commit eeb0cf2fa689 · 2026-05-06T00:47:15.000-05:00
- Updated slide content in the macOS imaging presentation to clarify timing, structure, and key points for better audience engagement.
- Adjusted the appendix descriptions and added details about the extended Q&amp;A session.
- Enhanced visual concepts and talking points across multiple slides for clarity and emphasis on key messages.
- Revised repository specifications to explicitly exclude VMware Fusion as a v1 macOS guest provider due to current documentation limitations.
- Updated documentation references to reflect changes in cleanup processes and evidence capture requirements.
diff --git a/docs/Demo-Runbook.md b/docs/Demo-Runbook.md
@@ -107,7 +107,7 @@ PASS  Blocking dialog captured
 PASS  Evidence redaction applied
 PASS  Rollback restored Post-Enroll-Baseline
 PASS  VS Code accepted after rollback
-WARN  Intune cloud assignment would still need cleanup before production expansion
+WARN  Intune cloud assignment would still need report-only cleanup review before production expansion
 ```
 
 ## Recovery Pivots
diff --git a/docs/Hypervisor-Decision-Guide.md b/docs/Hypervisor-Decision-Guide.md
@@ -5,9 +5,9 @@
 
 - **Status:** Active
 - **Owner:** Frank Lesniak
-- **Last Updated:** 2026-05-05
-- **Scope:** Decision guide for choosing Parallels, UTM, or Tart in the `macOSLab` v1 lab.
-- **Related:** [Prerequisites](Prereqs.md), [Apple Silicon Constraints](Apple-Silicon-Constraints.md), [Provider Version Matrix](Provider-Version-Matrix.md), [UTM macOS guest documentation](https://docs.getutm.app/guest-support/macos/), [Parallels macOS VM CLI documentation](https://docs.parallels.com/landing/parallels-desktop-developers-guide/command-line-interface-utility/manage-virtual-machines-from-cli/general-virtual-machine-management/create-a-virtual-machine)
+- **Last Updated:** 2026-05-06
+- **Scope:** Decision guide for choosing Parallels, UTM, or Tart in the `macOSLab` v1 lab, and for explaining why VMware Fusion is not a v1 macOS guest provider.
+- **Related:** [Prerequisites](Prereqs.md), [Apple Silicon Constraints](Apple-Silicon-Constraints.md), [Provider Version Matrix](Provider-Version-Matrix.md), [UTM macOS guest documentation](https://docs.getutm.app/guest-support/macos/), [Parallels macOS VM CLI documentation](https://docs.parallels.com/landing/parallels-desktop-developers-guide/command-line-interface-utility/manage-virtual-machines-from-cli/general-virtual-machine-management/create-a-virtual-machine), [Broadcom Fusion Apple silicon compatibility](https://knowledge.broadcom.com/external/article/315602/compatibility-considerations-for-arm-gue.html)
 
 Use Parallels first when you need the shortest path to the live demo. Use UTM when cost, openness, or provider-swap comparison matters more than full automation. Treat Tart as an advanced stub in v1.
 
@@ -19,6 +19,12 @@ Use Parallels first when you need the shortest path to the live demo. Use UTM wh
 | UTM | Documented/manual provider-swap path | Secondary path, budget-sensitive labs, and provider comparison | Partial lifecycle automation where `utmctl` behavior is proven; creation and checkpoint paths are manual-step-required in v1 | Do not present UTM as full live Parallels parity. |
 | Tart | Stubbed advanced path | Later CI/runner conversation | Mutating primitives fail clearly in v1 | Full Tart parity requires later explicit owner approval. |
 
+## VMware Fusion Scope Note
+
+VMware Fusion supports Apple-silicon hosts for Arm guest operating systems, including Arm Windows and Arm Linux. It is not a v1 `macOSLab` provider because current Broadcom documentation says Arm variants of macOS are not supported in Fusion VMs on Apple silicon.
+
+Treat Fusion as a Q&A clarification, not a fourth core provider. The question is not whether Fusion supports Apple silicon; it does. The question is whether it supports the Apple-silicon macOS guest workflow this repository is built around; current Broadcom documentation says it does not.
+
 ## Parallels Default Path
 
 Choose Parallels when you need:
diff --git a/docs/Snapshot-Strategy.md b/docs/Snapshot-Strategy.md
@@ -6,7 +6,7 @@
 - **Status:** Active
 - **Owner:** Frank Lesniak
 - **Last Updated:** 2026-05-06
-- **Scope:** Defines the five-checkpoint model, restore warnings, cloud cleanup posture, and checkpoint readiness expectations for `macOSLab`.
+- **Scope:** Defines the five-checkpoint model, restore warnings, report-only cloud cleanup posture, and checkpoint readiness expectations for `macOSLab`.
 - **Related:** [Fidelity Boundaries](Fidelity-Boundaries.md), [Provider Version Matrix](Provider-Version-Matrix.md), [Prerequisites](Prereqs.md), [macOSLab repository specification](spec/macOSLab-repository-spec.md)
 
 Snapshots are the reason the lab is fast, but they are also where local state and cloud state can drift. Use the five canonical checkpoint names exactly.
@@ -19,7 +19,7 @@ Snapshots are the reason the lab is fast, but they are also where local state an
 | `Pre-Enroll` | `Clean-OS` plus Intune Company Portal at the sign-in screen; not enrolled. |
 | `Post-Enroll-Baseline` | Fully enrolled, recently synced, deterministic healthy baseline. For Demo 4, Visual Studio Code is installed and launches successfully here. |
 | `Broken-Policy-State` | Deterministic intentionally broken state for the engineered demo failure. For Demo 4, the Gatekeeper/System Policy Control profile blocks VS Code. |
-| `Recovered-Known-Good` | Post-rollback healthy state, captured after cloud cleanup or reconciliation. For Demo 4, `spctl` accepts VS Code and the app launches again. |
+| `Recovered-Known-Good` | Post-rollback healthy state, captured after report-only cloud cleanup review or manual reconciliation notes. For Demo 4, `spctl` accepts VS Code and the app launches again. |
 
 Alternative checkpoint names are not allowed in v1 unless a caller explicitly opts into non-canonical names for local experimentation.
 
@@ -33,7 +33,7 @@ Capture `Post-Enroll-Baseline` after enrollment, policy receipt, and enough sync
 
 Capture `Broken-Policy-State` only when the failure is intentional and documented in the test plan.
 
-Capture `Recovered-Known-Good` after rollback and any required cloud cleanup or reconciliation notes are complete.
+Capture `Recovered-Known-Good` after rollback and after any required report-only cloud cleanup review or manual reconciliation notes are complete.
 
 ## Restore Rule
 
@@ -47,9 +47,9 @@ Restore commands must require explicit acknowledgement for non-interactive or un
 
 Checkpoint capture should prefer a stopped guest. Snapshotting a running or paused VM can preserve transient identity, network, or MDM timing state that makes later evidence harder to explain. Providers must enforce or clearly document clean-shutdown requirements.
 
-## Cloud Cleanup Posture
+## Cloud Cleanup Review Posture
 
-V1 local rollback does not delete or retire cloud records. Cloud cleanup remains report-only unless a later owner-approved Phase 10 change adds mutation. A valid report-only cleanup result may identify candidate Intune, Entra, and Defender records, explain why they may be stale, and show portal paths or Graph commands for manual cleanup.
+V1 local rollback does not delete or retire cloud records. The cloud cleanup step is a report-only review unless a later owner-approved Phase 10 change adds mutation. A valid report-only cleanup result may identify candidate Intune, Entra, and Defender records, explain why they may be stale, and show portal paths or Graph commands for manual cleanup.
 
 For the Gatekeeper stage path, disconnect VM networking immediately before restoring `Post-Enroll-Baseline` so the bad Intune assignment cannot immediately reapply during the local recovery proof. Capture `Post-Enroll-Baseline` itself in the normal enrolled and network-capable state.
 
diff --git a/docs/planning/demo-pivot-plan.md b/docs/planning/demo-pivot-plan.md
@@ -405,7 +405,7 @@ PASS  Blocking dialog captured
 PASS  Evidence redaction applied
 PASS  Rollback restored Post-Enroll-Baseline
 PASS  VS Code accepted after rollback
-WARN  Intune cloud assignment would still need cleanup before production expansion
+WARN  Intune cloud assignment would still need report-only cleanup review before production expansion
 ```
 
 The key live payoff is:
@@ -715,9 +715,10 @@ The slide description must preserve the CFP contract:
 | 22 | Demo 4 evidence: VS Code blocked, `spctl` rejects, rollback restores. | During Demo 4 |
 | 23 | FileVault and Defender proof boundaries: still required, not the live failure. | 68:00 |
 | 24 | Dragons checklist updated for Gatekeeper and cloud state. | 70:00 |
-| 25 | Repo tree and `Start-Here.md`. | 73:00 |
-| 26 | Q&A buckets. | 75:00 |
-| 27 | Monday plan and final reminder. | 102:00 |
+| 25 | Repo tree and `Start-Here.md`. | 72:25 |
+| 26 | Monday plan and CFP recap. | 73:15 |
+| 27 | Q&A buckets. | 74:30 |
+| 28 | Final thank-you. | 104:30 |
 
 The artifact should include speaker lines for the delicate transition:
 
diff --git a/docs/planning/macOS-imaging-03a-bolstered-outline.md b/docs/planning/macOS-imaging-03a-bolstered-outline.md
@@ -49,8 +49,8 @@ The session outline now aligns with the final `macOSLab` repository decisions:
 | Primary speaker | Frank Lesniak |
 | Co-speaker | Michael Niehaus |
 | Event | Midwest Management Summit at the Mall of America 2026 |
-| Total length | 105 minutes |
-| Core content | 75 minutes |
+| Total length | 90-105 minutes |
+| Core content | 60-75 minutes; current deck target is 74:30 |
 | Extended Q&A | 30 minutes |
 | Q&A format | Raise-hand questions; mic runner if the room is large; no live polling |
 | Primary technology | Intune |
@@ -232,6 +232,8 @@ Use this once. Do not turn the session into polling.
 | UTM | Cost-free experimentation path with Apple Virtualization and QEMU options; automation exists but does not mirror Parallels one-for-one. | Budget-sensitive labs, learning, and teams comfortable with templates/configuration artifacts. | Provider-swap demo. |
 | Tart | CLI-first Apple Silicon VM tooling built for automation, CI, and image distribution. | Teams building repeatable macOS runners or pipeline-based test loops. | Repo/Q&A/appendix path, not a third equal branch in the core. |
 
+VMware Fusion supports Apple-silicon hosts for Arm guest operating systems, including Arm Windows and Arm Linux. It is not a core provider for this session because current Broadcom documentation says Arm variants of macOS are not supported as Fusion guests on Apple silicon. Fusion may come up in Q&A as a Windows/Linux Arm option, but it is not a macOS guest lab path for this talk.
+
 Do not frame the section as "which product is best." Frame it as:
 
 > Which tool makes the safe behavior easiest for your team?
@@ -295,13 +297,13 @@ Avoid trying to show every Graph query, every profile payload, and every Intune
 | `Pre-Enroll` | You want a clean device identity path for each enrollment test. | Best default for enrollment and MDM identity fidelity. | Slower because enrollment and sync rerun. |
 | `Post-Enroll-Baseline` | You need a fast repeated policy regression loop. | Fastest and most stage-reliable. | Intune/Entra cloud state keeps moving while the VM rolls backward. |
 | `Broken-Policy-State` | You need a deterministic demo failure. | Excellent for stage reliability. | Must be explained honestly as a checkpointed failure. |
-| `Recovered-Known-Good` | You need proof that rollback returns the VM to a useful baseline. | Makes recovery visible. | Can hide cloud cleanup problems if not documented. |
+| `Recovered-Known-Good` | You need proof that rollback returns the VM to a useful baseline. | Makes recovery visible. | Can hide cloud reconciliation problems if the report-only cleanup review is skipped. |
 
 Recommended operational rule:
 
 - Use `Pre-Enroll` as the gold-standard identity baseline.
 - Use `Post-Enroll-Baseline` for speed and demo reliability.
-- Pair post-enroll rollback with a documented cloud cleanup routine. In v1, that routine is report-only: it identifies candidate cloud records and manual cleanup steps, but it does not mutate Intune, Entra, or Defender records.
+- Pair post-enroll rollback with a documented cloud cleanup review. In v1, that review is report-only: it identifies candidate cloud records and manual cleanup steps, but it does not mutate Intune, Entra, or Defender records.
 - Teach "snapshot time travel" as a real anti-pattern.
 
 Important stage warning:
@@ -324,14 +326,14 @@ The audience should believe that even the failure was engineered.
 
 ### Repo Timing
 
-**Decision:** Publish the repo before the session, but reveal the QR/short URL near the end of the core.
+**Decision:** Publish the repo before the session, but reveal the QR code and `https://github.com/franklesniak/macOSLab` URL near the end of the core.
 
 Recommended stage pattern:
 
 1. Show the command you would run.
 2. Open a pre-cloned local copy.
 3. Show the exact demo paths.
-4. Reveal the QR/short URL at 73:00.
+4. Reveal the QR target, `https://github.com/franklesniak/macOSLab`, near the end of the core talk.
 5. Keep attention on the stage until the core content is done.
 
 Do not depend on a live `git clone` over conference Wi-Fi.
@@ -1121,7 +1123,7 @@ Primary live flow:
 7. Restore `Post-Enroll-Baseline`.
 8. Run the recovered validation plan.
 9. Show `spctl` accepts VS Code and the app launches.
-10. State clearly that the Intune assignment still needs cleanup before production expansion.
+10. State clearly that the Intune assignment still needs report-only cleanup review before production expansion.
 
 Example commands:
 
@@ -1155,7 +1157,7 @@ PASS  Blocking dialog captured
 PASS  Evidence redaction applied
 PASS  Rollback restored Post-Enroll-Baseline
 PASS  VS Code accepted after rollback
-WARN  Intune cloud assignment would still need cleanup before production expansion
+WARN  Intune cloud assignment would still need report-only cleanup review before production expansion
 ```
 
 Controlled failure options:
@@ -1178,9 +1180,9 @@ Recovery playbook:
 - If rollback fails, stop and diagnose before the session; do not claim the rollback restores app launch until `spctl` accepts VS Code.
 - If a secret appears on screen, stop, switch to redacted screenshots, and continue calmly.
 
-## Wrap-Up: 70:00-75:00
+## Wrap-Up: 71:30-74:30
 
-### Dragons Checklist, 70:00-73:00
+### Dragons Checklist and Anti-Patterns, 71:30-72:25
 
 Show a prebuilt triage table.
 
@@ -1214,12 +1216,12 @@ Explicit dragons to name:
 - Gatekeeper/System Policy Control app-execution controls.
 - Disk and snapshot sprawl.
 
-### Repo Handoff and Q&A Rules, 73:00-75:00
+### Repo Handoff, Monday Plan, and Recap, 72:25-74:30
 
 Show:
 
 - QR code.
-- Short URL.
+- URL: `https://github.com/franklesniak/macOSLab`.
 - Repo tree.
 - `docs/Start-Here.md` highlighted.
 - `examples/MMSMOA-2026` highlighted.
@@ -1236,9 +1238,11 @@ Q&A rules:
 - Follow-ups if time permits.
 - Include hypervisor and enrollment method if relevant.
 
-## Extended Q&A: 75:00-105:00
+Keep the CFP recap slide in the core talk. It repeats the four accepted takeaways with green checkmarks and one-line delivery notes.
+
+## Extended Q&A: 74:30-104:30
 
-### Mechanics, 75:00-78:00
+### Mechanics, 74:30-77:30
 
 Leave the Q&A bucket slide up.
 
@@ -1261,7 +1265,7 @@ Six buckets. Few enough that the slide is a real menu rather than a wall of text
 | Evidence and change-board outputs | What do I attach to a change ticket? What does Log Analytics ingestion look like? How do I redact recovery-key proof safely? |
 | CI, Tart, and inventory adjacencies | When do I move beyond desktop labs? Should I bridge any of this into ConfigMgr inventory? |
 
-### Structured Answer Framework, 78:00-102:00
+### Structured Answer Framework, 77:30-104:30
 
 Use this pattern:
 
@@ -1285,18 +1289,9 @@ Use these if needed:
 - "Who has a change board that wants more than 'the portal says assigned'?"
 - "Who is trying to decide whether Tart belongs in a CI path?"
 
-### Close-Out, 102:00-105:00
-
-End with the Monday plan:
+### Final Thank-You, 104:30-105:00
 
-1. Clone the repo.
-2. Build one VM.
-3. Take a `Pre-Enroll` snapshot.
-4. Enroll into a lab scope.
-5. Test one risky policy.
-6. Export redacted evidence.
-7. Roll back.
-8. Clean up the cloud record.
+End with the QR code, speaker names, and one sentence of thanks.
 
 Final line:
 
@@ -1330,9 +1325,10 @@ Final line:
 | 22 | Demo 4 evidence: VS Code blocked, `spctl` rejects, rollback restores. | During Demo 4 |
 | 23 | FileVault and Defender proof boundaries: still required, not the live failure. | 68:00 |
 | 24 | Dragons checklist updated for Gatekeeper and cloud state. | 70:00 |
-| 25 | Repo tree and Start Here. | 73:00 |
-| 26 | Q&A buckets. | 75:00 |
-| 27 | Monday plan and final reminder. | 102:00 |
+| 25 | Repo tree and Start Here. | 72:25 |
+| 26 | Monday plan and CFP recap. | 73:15 |
+| 27 | Q&A buckets. | 74:30 |
+| 28 | Final thank-you. | 104:30 |
 
 ## Windows-Admin Translation Cheat Sheet
 
@@ -1669,7 +1665,7 @@ Answer:
 
 Answer:
 
-> No. Snapshot rollback restores the VM state. It does not erase Intune, Entra, Defender portal state, audit logs, or reporting history. The starter kit treats cloud cleanup as part of the lab lifecycle because otherwise you create haunted device objects.
+> No. Snapshot rollback restores the VM state. It does not erase Intune, Entra, Defender portal state, audit logs, or reporting history. The starter kit treats report-only cloud cleanup review as part of the lab lifecycle because otherwise you create stale cloud records that no longer match the restored VM.
 
 ### "Can you show the FileVault recovery key?"
 
@@ -1686,11 +1682,11 @@ Answer:
 - Freeze demo tenant policies.
 - Update placeholder build values throughout the deck and demo configs to your actual pinned build.
 - Publish repo privately or publicly enough to validate links.
-- Run full 105-minute rehearsal.
+- Run a full 75-minute core rehearsal plus a 30-minute Q&A drill.
 - Record Demo 4 success path.
 - Rehearse the break-glass narration over the recording at least once.
 - Validate screenshots.
-- Validate QR code and short URL.
+- Validate QR code and `https://github.com/franklesniak/macOSLab`.
 - Confirm both speakers know handoffs.
 - Confirm evidence redaction behavior.
 - Confirm no full recovery key, token, secret, or private tenant detail appears in any public artifact.
@@ -1702,7 +1698,7 @@ Answer:
 - Confirm all checkpoints.
 - Export evidence from a clean run.
 - Test hotspot or fallback network.
-- Confirm repo short URL.
+- Confirm repo URL.
 - Re-run `Test-LabReadiness.ps1`.
 - Rehearse failure pivots.
 - Re-check Parallels, UTM, Tart, Apple, and Microsoft documentation for any changed behavior or version notes.
diff --git a/docs/planning/macOS-imaging-09a-generated-slides.md b/docs/planning/macOS-imaging-09a-generated-slides.md
diff --git a/docs/spec/macOSLab-repository-spec.md b/docs/spec/macOSLab-repository-spec.md
