Recover an endpoint
Handle lost evidence keys, revoke and re-enroll, and compare a machine to a known state, knowing what cannot come back.
1. Inspect evidence keys
Recursift seals the endpoint's local evidence with keys protected by the Mac's login keychain. There is no separate inspect command: status reports evidence_keys with the key provider, whether it answered, each key file, each sealed store, and a failure class when something is wrong. status creates no files.
| Failure | What it means | What to do |
|---|---|---|
| locked | The keychain is locked. | Sign in to the Mac as the service's user. Do not reset. |
| unavailable | The keychain could not be asked, or the answer was ambiguous. | Retry later. Do not reset; this can be transient. |
| key_lost | A key can no longer be opened: reimage, keychain reset or a deleted key file. | The sealed evidence is gone. Reset (step 2). |
2. Reset lost evidence keys
A reset deletes only the sealed stores whose key is lost, then lets the agent start with new keys. Run it once without --confirm to see what would be deleted; that run changes nothing and exits with an error on purpose.
export RECURSIFT_AGENT_HOME="$HOME/Library/Application Support/Recursift/native-agent"
launchctl bootout "gui/$(id -u)/com.recursift.agent"
/Applications/Recursift/recursift-agent evidence-keys reset
/Applications/Recursift/recursift-agent evidence-keys reset --confirm
launchctl bootstrap "gui/$(id -u)" ~/Library/LaunchAgents/com.recursift.agent.plistThe first run lists files under would delete:. The confirmed run prints the deleted list as JSON and records it in evidence-reset.json in the state folder. It refuses while the keychain is only locked. Afterwards status should show no failure.
3. Revoke and re-enroll
Revoke an endpoint when the Mac is lost, reimaged, handed to someone else or suspected of compromise. In the console, open the agent, use its menu and choose Revoke agent. Its key stops working at once; the endpoint logs the revocation once and stops sending. Revocation cannot be undone, and the endpoint's history stays readable in the console.
To bring the same Mac back, create a new agent in the console and enroll with its token, replacing the old enrollment, then restart the service. The Mac appears as a new endpoint; its earlier history stays under the revoked entry.
export RECURSIFT_AGENT_HOME="$HOME/Library/Application Support/Recursift/native-agent"
/Applications/Recursift/recursift-agent enroll --server https://recursift.app --token-stdin --force
launchctl kickstart -k "gui/$(id -u)/com.recursift.agent"4. Compare against a known state
Gold builds, at /dashboard/gold-builds, describe a known-good Mac: its installed applications and versions, its third-party launch services, and its security settings. Capture a candidate from a reference endpoint, review it, publish it and assign it. Published builds cannot be edited. Assigned endpoints compare themselves on the schedule the console sets and report which requirements match, differ or are unknown. Extra software is allowed.
A match means the required values were observed. It does not mean the machine is uncompromised.
What cannot be recovered
Sealed local evidence whose key is lost cannot be recovered by anyone; there is no key escrow and no copy of the key outside the Mac. A revoked enrollment cannot be restored. Deleting the state folder removes the endpoint's identity, audit log and evidence for good; back up identity and audit files together if you need them. Question data expires on the endpoint after 24 hours, and activity that happened between polls was never collected.
Two limits apply to tampering. Someone with full control of the Mac can delete the whole state folder, or put back an older, consistent copy of it, and the endpoint cannot detect that on its own. Backups taken before evidence sealing was introduced still hold that evidence unsealed.