kawa/ImpTune
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

docs(08-08): compile v1.0-VALIDATION-INDEX rollup (45/45 pass, draft)

Browse Source 
- Flat table with one row per v1.0 success criterion across Phases 1-7
- Tally: 45/45 pass, 0 fail-fix, 0 deferred, 0 wont-do
- Gap validation block cross-checks all 5 historical-gap closures against REQUIREMENTS.md + fixing SUMMARY.md
- Attestation-gap residual risk (SCRPT-01..05 / RTVAL-02/03/04) documented explicitly for Phase 11 rollout
- Sign-off line unchecked (draft), frontmatter status=draft pending Task 2 human verification
This commit is contained in:
kawa
2026-04-13 16:24:39 +02:00
parent dc70acf5f2
commit 192a64d574
1 changed files with 122 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.planning/milestones/v1.0-VALIDATION-INDEX.md
+122
View File
@@ -0,0 +1,122 @@
---
milestone: v1.0
type: validation-index
audit_date: 2026-04-13
auditor: Sébastien QUEROL
status: draft
---
# v1.0 Validation Index — Nyquist Rollup
**Audit date:** 2026-04-13
**Auditor:** Sébastien QUEROL (pending human sign-off)
**Compiled by:** Claude (gsd-executor, plan 08-08)
**Tally:** 45/45 pass, 0 deferred-v1.2, 0 fail-fix-v1.1, 0 wont-do
Single flat pass/fail roll-up of every v1.0 success criterion across Phases 1–7. Source of truth for NYQ-02 and NYQ-03. Per-phase Nyquist Records are embedded in each `NN-VALIDATION.md` and enumerated one row per criterion below. Row counts per phase (14, 6, 10, 5, 5, 1, 4) are a function of scope — single-criterion gap-closure phases legitimately produce single-row audits.
**Key roll-up facts (for downstream verifier):**
- **Phase 5 row 2 (PKG-02) is the only artifact-backed live-tenant runtime row** in the entire track — cites RTVAL-01 PASS on tenant rubis.fr (2026-04-13) after structural fixes in commits `74535ea` + `7716246`.
- **Phase 4 rows 1–5 (SCRPT-01..05) rest on attestation-only runtime proof** (RTVAL-02/03/04, three consecutive attestation-only PASSes per STATE.md 2026-04-13). User was warned twice about cumulative audit-trail damage and explicitly approved proceeding. Phase 10 plan 10-03 signed off with written acknowledgement. Re-capture with full artifacts owned by Phase 11 rollout.
- **Phase 1 row 14, Phase 2 row 6, Phase 3 row 3, Phase 5 row 4, Phase 7 row 4** are historical-gap closure rows — all resolved in place via fixing phases (Phase 9 UX-01/02/03, Phase 6 icon embedding, Phase 10 RTVAL-01) with direct commit citations, not flipped to fail-fix-v1.1.
- **Phase 7 is the only REQUIREMENTS-free phase**, anchored to `07-VERIFICATION.md` truths rather than `REQUIREMENTS.md` IDs. Legitimate alternate anchoring pattern.
- **Bidirectional citation loop:** 05-VALIDATION row 4 ↔ 06-VALIDATION row 1 both cite `TestIntunewinIconInclusion` — closed-loop gap-closure pattern worth replicating for future gap-closure phases.
## Flat Pass/Fail Table
| Phase | # | Criterion | Status | Evidence | Gap Link |
|---|---|---|---|---|---|
| 1-Foundation | 1 | `docker compose up` serves HTTP 200 on `GET /health` | pass | [01-VALIDATION.md#nyquist-record](../phases/01-foundation/01-VALIDATION.md#nyquist-record) row 1 (test_health + 01-VERIFICATION row 1) | |
| 1-Foundation | 2 | No Node.js dependency; single `python:3.12-slim-bookworm` base image | pass | [01-VALIDATION.md row 2](../phases/01-foundation/01-VALIDATION.md#nyquist-record) (Dockerfile line 1, commit 34c7cb3) | |
| 1-Foundation | 3 | All static assets served from `/static/` with zero CDN refs | pass | [01-VALIDATION.md row 3](../phases/01-foundation/01-VALIDATION.md#nyquist-record) (test_no_cdn_urls_in_templates) | |
| 1-Foundation | 4 | Sidebar shows Dashboard / Drivers / Printers / Clients / Packages | pass | [01-VALIDATION.md row 4](../phases/01-foundation/01-VALIDATION.md#nyquist-record) (base.html nav + Phase 7 /packages closure) | |
| 1-Foundation | 5 | App follows OS dark/light theme | pass | [01-VALIDATION.md row 5](../phases/01-foundation/01-VALIDATION.md#nyquist-record) (base.html `data-theme="auto"`) | |
| 1-Foundation | 6 | SQLite initializes with all 4 tables on first run | pass | [01-VALIDATION.md row 6](../phases/01-foundation/01-VALIDATION.md#nyquist-record) (test_create_tables, commit 88d9c5f) | |
| 1-Foundation | 7 | DB uses WAL journal + foreign keys enabled | pass | [01-VALIDATION.md row 7](../phases/01-foundation/01-VALIDATION.md#nyquist-record) (test_wal_mode + test_foreign_keys) | |
| 1-Foundation | 8 | DB file lives in `DATA_DIR` volume, not container FS | pass | [01-VALIDATION.md row 8](../phases/01-foundation/01-VALIDATION.md#nyquist-record) (docker-compose volume + cfg.DB_PATH) | |
| 1-Foundation | 9 | Schema creation is idempotent across restarts | pass | [01-VALIDATION.md row 9](../phases/01-foundation/01-VALIDATION.md#nyquist-record) (test_idempotent, `safe=True`) | |
| 1-Foundation | 10 | Python function produces valid `.intunewin` from source dir + setup file | pass | [01-VALIDATION.md row 10](../phases/01-foundation/01-VALIDATION.md#nyquist-record) (test_output_is_valid_zip, commit 25f82e6) | |
| 1-Foundation | 11 | `.intunewin` outer ZIP has correct `IntuneWinPackage/` structure | pass | [01-VALIDATION.md row 11](../phases/01-foundation/01-VALIDATION.md#nyquist-record) (test_outer_zip_structure) | |
| 1-Foundation | 12 | Encrypted blob byte layout: HMAC(32) + IV(16) + AES-256-CBC ciphertext | pass | [01-VALIDATION.md row 12](../phases/01-foundation/01-VALIDATION.md#nyquist-record) (3 byte-layout tests) | |
| 1-Foundation | 13 | Detection.xml cryptographic fields match actual encryption | pass | [01-VALIDATION.md row 13](../phases/01-foundation/01-VALIDATION.md#nyquist-record) (5 crypto-field tests) | |
| 1-Foundation | 14 | `.intunewin` accepted by real Intune tenant end-to-end | pass | [01-VALIDATION.md row 14](../phases/01-foundation/01-VALIDATION.md#nyquist-record) → Phase 10 `RUNTIME-VALIDATION.md` RTVAL-01 PASS 2026-04-13 on rubis.fr (commits 74535ea + 7716246) | |
| 2-Drivers | 1 | **DRV-01** User uploads driver package (ZIP+INF) via web UI | pass | [02-VALIDATION.md row 1](../phases/02-driver-management/02-VALIDATION.md#nyquist-record) (test_upload_valid_zip/non_zip/no_inf, commit c648fc5) | |
| 2-Drivers | 2 | **DRV-02** INF parser extracts DriverDesc with encoding + token handling | pass | [02-VALIDATION.md row 2](../phases/02-driver-management/02-VALIDATION.md#nyquist-record) (16 tests in test_inf_parser.py) | |
| 2-Drivers | 3 | **DRV-03** User selects driver name from parsed-INF dropdown (no free-text) | pass | [02-VALIDATION.md row 3](../phases/02-driver-management/02-VALIDATION.md#nyquist-record) (test_drivers_page + test_upload_returns_select) | |
| 2-Drivers | 4 | **DRV-04** Uploaded driver ZIP persisted content-addressed; dedupes on re-upload | pass | [02-VALIDATION.md row 4](../phases/02-driver-management/02-VALIDATION.md#nyquist-record) (test_driver_persisted + test_dedup_upload) | |
| 2-Drivers | 5 | **DRV-05** System flags unused files not referenced by INF | pass | [02-VALIDATION.md row 5](../phases/02-driver-management/02-VALIDATION.md#nyquist-record) (test_unused_files + test_unused_files_in_response) | |
| 2-Drivers | 6 | **DRV-01 runtime gap:** `POST /drivers/upload` must not return 500 on real ZIPs | pass | [02-VALIDATION.md row 6](../phases/02-driver-management/02-VALIDATION.md#nyquist-record) → Phase 9 UX-01 commits d1de839 + 10ee09a + 72c6a98 | Historical gap closed in place via Phase 9 UX-01 (REQUIREMENTS.md UX-01 Complete). Resolved 2026-04-13. |
| 3-Printer | 1 | **PRNT-01** User sets printer display name | pass | [03-VALIDATION.md row 1](../phases/03-printer-configuration/03-VALIDATION.md#nyquist-record) (test_create_printer_persisted, commit 356c2ee) | |
| 3-Printer | 2 | **PRNT-02** User sets printer IP address or hostname | pass | [03-VALIDATION.md row 2](../phases/03-printer-configuration/03-VALIDATION.md#nyquist-record) (test_create_printer_persisted ip_address field) | |
| 3-Printer | 3 | **PRNT-03** System auto-suggests port name from IP; manual edits preserved | pass | [03-VALIDATION.md row 3](../phases/03-printer-configuration/03-VALIDATION.md#nyquist-record) → Phase 9 UX-02 Playwright commits 322fc20 + 37a06da | Historical gap closed in place via Phase 9 UX-02 (Playwright headless chromium e2e). Sole `NEEDS HUMAN` truth from 03-VERIFICATION.md 2026-04-10. |
| 3-Printer | 4 | **PRNT-04** User sets duplex mode (OneSided/LongEdge/ShortEdge) | pass | [03-VALIDATION.md row 4](../phases/03-printer-configuration/03-VALIDATION.md#nyquist-record) (test_create_printer_duplex) | |
| 3-Printer | 5 | **PRNT-05** User sets color vs. grayscale default | pass | [03-VALIDATION.md row 5](../phases/03-printer-configuration/03-VALIDATION.md#nyquist-record) (test_create_printer_color_mode) | |
| 3-Printer | 6 | **PRNT-06** User sets paper size (A4/Letter/Legal) | pass | [03-VALIDATION.md row 6](../phases/03-printer-configuration/03-VALIDATION.md#nyquist-record) (test_create_printer_paper_size) | |
| 3-Printer | 7 | **PRNT-07** User sets collate on/off | pass | [03-VALIDATION.md row 7](../phases/03-printer-configuration/03-VALIDATION.md#nyquist-record) (test_create_printer_collate) | |
| 3-Printer | 8 | **PRNT-08** User assigns printer to a client/tenant label | pass | [03-VALIDATION.md row 8](../phases/03-printer-configuration/03-VALIDATION.md#nyquist-record) (test_printer_grouped_by_client, LEFT OUTER join) | |
| 3-Printer | 9 | **PRNT-09** Printer configurations persist across SQLite sessions | pass | [03-VALIDATION.md row 9](../phases/03-printer-configuration/03-VALIDATION.md#nyquist-record) (test_printer_survives_page_refresh) | |
| 3-Printer | 10 | **PRNT-10** Detail page loads full config with driver FK intact (Phase-3 scope) | pass | [03-VALIDATION.md row 10](../phases/03-printer-configuration/03-VALIDATION.md#nyquist-record) (test_printer_detail_shows_driver + no_driver) | |
| 4-Scripts | 1 | **SCRPT-01** Install script: pnputil + Add-Printer* + Set-PrintConfiguration | pass | [04-VALIDATION.md row 1](../phases/04-script-generation/04-VALIDATION.md#nyquist-record) (test_render_install_* + RTVAL-02 attestation-only) | Runtime half is attestation-only per STATE.md 2026-04-13 — no IntuneManagementExtension.log excerpt or portal screenshot. Phase 11 rollout owns artifact re-capture. Template correctness fully pytest-automated. |
| 4-Scripts | 2 | **SCRPT-02** Uninstall script: Remove-Printer → Remove-PrinterDriver → Remove-PrinterPort | pass | [04-VALIDATION.md row 2](../phases/04-script-generation/04-VALIDATION.md#nyquist-record) (test_render_uninstall + RTVAL-04 attestation-only) | Third consecutive attestation-only check; no rtval-04-uninstall-log.txt or rtval-04-uninstall-status.png captured. Phase 10 plan 10-03 signed off with written acknowledgement. Phase 11 owns re-capture. |
| 4-Scripts | 3 | **SCRPT-03** Detect script: exit 0 when present / exit 1 when absent | pass | [04-VALIDATION.md row 3](../phases/04-script-generation/04-VALIDATION.md#nyquist-record) (test_render_detect + RTVAL-03 attestation-only) | Second consecutive attestation-only check; no rtval-03-detection.png captured. REQUIREMENTS.md wording ("registry check") superseded by 04-RESEARCH.md decision to use `Get-Printer` cmdlet. Phase 11 owns re-capture. |
| 4-Scripts | 4 | **SCRPT-04** Install script detects SYSTEM vs user and self-elevates via UAC | pass | [04-VALIDATION.md row 4](../phases/04-script-generation/04-VALIDATION.md#nyquist-record) (test_render_install_uac_guard + RTVAL-02 SYSTEM branch) | SYSTEM branch exercised attestation-only in RTVAL-02; user-interactive UAC dialog branch was NOT exercised in Phase 10 at all — remains a Manual-Only Verification. |
| 4-Scripts | 5 | **SCRPT-05** Install script includes 64-bit WOW64 SysNative relaunch guard | pass | [04-VALIDATION.md row 5](../phases/04-script-generation/04-VALIDATION.md#nyquist-record) (test_render_install_wow64_guard + RTVAL-02 attestation-only) | WOW64 relaunch path not directly observable from RTVAL-02 attestation; template-level positional correctness (guard before pnputil) is fully pytest-automated. Full WOW64 trace is a Phase 11 rollout concern. |
| 5-Package | 1 | **PKG-01** User exports full `.intunewin` package in one click | pass | [05-VALIDATION.md row 1](../phases/05-package-export/05-VALIDATION.md#nyquist-record) (TestIntunewinDownload 4 tests + RTVAL-01 artifact-backed PASS on rubis.fr) | |
| 5-Package | 2 | **PKG-02** `.intunewin` generated natively in Python (no IntuneWinAppUtil.exe); byte-level conformant | pass | [05-VALIDATION.md row 2](../phases/05-package-export/05-VALIDATION.md#nyquist-record) (14 byte-level tests in test_intunewin.py + **artifact-backed** RTVAL-01 PASS after fix commits 74535ea + 7716246) | **Strongest row in the entire 7-phase track** — only artifact-backed live-tenant runtime evidence. Initial RTVAL-01 FAILED; root cause was two structural defects fixed in commits `74535ea` (HMAC over IV+ciphertext) + `7716246` (Detection.xml alignment with IntuneWinAppUtil.exe reference format); re-test PASSED on tenant rubis.fr with committed screenshots + package. |
| 5-Package | 3 | **PKG-03** User exports NinjaRMM ZIP package in one click | pass | [05-VALIDATION.md row 3](../phases/05-package-export/05-VALIDATION.md#nyquist-record) (TestNinjaDownload 5 tests) | |
| 5-Package | 4 | **PKG-04** User uploads custom PNG icon; embedded into `.intunewin` | pass | [05-VALIDATION.md row 4](../phases/05-package-export/05-VALIDATION.md#nyquist-record) → Phase 6 `TestIntunewinIconInclusion` (commits 2723cc8 + 6310be5) | Historical gap closed in place via Phase 6 (Wire Icon into .intunewin Export). Upload half shipped in Phase 5 plan 02; embedding half added in Phase 6. Bidirectional citation loop with 06-VALIDATION row 1. |
| 5-Package | 5 | **PKG-05** User previews and copies Intune install/uninstall command strings before export | pass | [05-VALIDATION.md row 5](../phases/05-package-export/05-VALIDATION.md#nyquist-record) (TestCommandPreview 4 tests) | |
| 6-Icon-Wire | 1 | **PKG-04 embedding:** Uploaded PNG icon embedded in `.intunewin` output | pass | [06-VALIDATION.md row 1](../phases/06-wire-icon-intunewin/06-VALIDATION.md#nyquist-record) (TestIntunewinIconInclusion 2 tests, `shutil.copy2` staging at packages.py:153 before build_intunewin at :157; commits 2723cc8 + 6310be5; RTVAL-01 transitive) | Bidirectional closure loop with 05-VALIDATION row 4. Icon-tile visual rendering on Intune portal is Manual-Only polish owned by Phase 11 rollout. |
| 7-Dashboard | 1 | `GET /packages` returns 200 and lists driver-assigned printers (closes milestone-audit /packages 404) | pass | [07-VALIDATION.md row 1](../phases/07-dashboard-nav-polish/07-VALIDATION.md#nyquist-record) (test_packages_returns_200, pages.py:142-158, commits 8cf47f5 + 91910ad) | |
| 7-Dashboard | 2 | Dashboard shows 5 most recent printers via live query | pass | [07-VALIDATION.md row 2](../phases/07-dashboard-nav-polish/07-VALIDATION.md#nyquist-record) (test_dashboard_shows_recent_printers, pages.py:20-22) | |
| 7-Dashboard | 3 | Dashboard shows 5 most recent packages (driver-filtered) via live query | pass | [07-VALIDATION.md row 3](../phases/07-dashboard-nav-polish/07-VALIDATION.md#nyquist-record) (test_dashboard_shows_recent_packages, pages.py:23-28 with `Printer.driver.is_null(False)` filter) | |
| 7-Dashboard | 4 | **UX-03 carry-over (Phase 5 origin):** Individual script download links on printer detail page | pass | [07-VALIDATION.md row 4](../phases/07-dashboard-nav-polish/07-VALIDATION.md#nyquist-record) → Phase 9 plan 09-03 commits d359001 + 68a2935 | Historical gap closed in place via Phase 9 UX-03 (.ps1 route aliases + printer_detail Scripts section). Provenance note: v1.0-ROADMAP.md lists UX-03 as Phase 5 deferral, not Phase 7 — STATE.md restatement imprecise; resolution unaffected. |
## Gap Validation Block
All five historical-gap rows cite fixing phases/commits. Each citation has been cross-checked against `REQUIREMENTS.md` and the fixing phase's SUMMARY.md:
| # | Row | Recorded as | Citation target | Fix owner | Confirmed? |
|---|-----|-------------|-----------------|-----------|------------|
| 1 | Phase 1 row 14 (real Intune tenant ingestion) | pass | Phase 10 RTVAL-01 commits 74535ea + 7716246 | Phase 10 plan 10-02 | ✓ (REQUIREMENTS.md RTVAL-01 Complete; plan 10-03 sign-off commit cd2df1e) |
| 2 | Phase 2 row 6 (POST /drivers/upload 500) | pass | Phase 9 UX-01 commits d1de839 + 10ee09a + 72c6a98 | Phase 9 plan 09-01 | ✓ (REQUIREMENTS.md UX-01 Complete; 09-01-SUMMARY.md) |
| 3 | Phase 3 row 3 (PRNT-03 Alpine.js IP→port live-browser) | pass | Phase 9 UX-02 commits 322fc20 + 37a06da | Phase 9 plan 09-02 | ✓ (REQUIREMENTS.md UX-02 Complete; 09-02-SUMMARY.md) |
| 4 | Phase 5 row 4 / Phase 6 row 1 (PKG-04 icon embedding) | pass | Phase 6 TestIntunewinIconInclusion commits 2723cc8 + 6310be5 | Phase 6 plan 06-01 | ✓ (bidirectional closure loop confirmed between 05-VALIDATION row 4 and 06-VALIDATION row 1) |
| 5 | Phase 7 row 4 (UX-03 individual script downloads) | pass | Phase 9 plan 09-03 commits d359001 + 68a2935 | Phase 9 plan 09-03 | ✓ (REQUIREMENTS.md UX-03 Complete; 09-03-SUMMARY.md; provenance note flagged — Phase 5 origin per v1.0-ROADMAP.md) |
**Result:** All 5 fail-fix-equivalent rows point to real fixing phases with shipped commits. **No roadmap-mismatch detected.** Zero rows inflated to `fail-fix-v1.1` because every historical gap is already closed in the tree.
### Attestation-Gap Residual Risk (recorded for rollout)
Phase 4 rows 1–5 (SCRPT-01..05) carry attestation-only runtime proof via RTVAL-02/03/04 per STATE.md 2026-04-13. This is **NOT** a fail-fix row (Phase 10 plan 10-03 explicitly signed off the gap with written acknowledgement; the user was warned twice and approved). It is documented here as a known weakness in the v1.0 runtime audit trail and is owned by **Phase 11 Real-World Rollout** for artifact re-capture (IntuneManagementExtension.log excerpt, portal screenshots, status captures) before broad deployment. Not in the above gap table because there is no "fix commit" — the fix is to re-run with full evidence capture, which is a rollout-phase action, not a code change.
## Tally Summary
| Source | Row count |
|---|---:|
| Phase 1 — Foundation | 14 |
| Phase 2 — Driver Management | 6 |
| Phase 3 — Printer Configuration | 10 |
| Phase 4 — Script Generation | 5 |
| Phase 5 — Package Export | 5 |
| Phase 6 — Wire Icon into .intunewin | 1 |
| Phase 7 — Dashboard & Nav Polish | 4 |
| **Total** | **45** |
| Status | Count |
|---|---:|
| pass | 45 |
| fail-fix-v1.1 | 0 |
| deferred-v1.2 | 0 |
| wont-do | 0 |
**NYQ-01 coverage:** 7/7 v1.0 phases have Nyquist-compliant `VALIDATION.md` files with one observable check per success criterion, evidence cited, no hand-wavy "code looks right" entries. Ticked in REQUIREMENTS.md after 08-01 / 08-05 / 08-06 / 08-07 executions.
**NYQ-02 coverage:** This document is the single flat pass/fail rollup. Will be ticked in REQUIREMENTS.md upon sign-off.
**NYQ-03 coverage:** Every non-pass row has a rationale. No rows are non-pass — all 45 rows are `pass`, all historical gaps closed in place with fixing-phase citations, all cross-checked against REQUIREMENTS.md and fixing-phase SUMMARY.md files. Will be ticked in REQUIREMENTS.md upon sign-off.
## Sign-Off
- [ ] Nyquist audit complete — 2026-04-13 — Sébastien QUEROL