diff --git a/.planning/phases/10-real-world-runtime-validation/RUNTIME-VALIDATION.md b/.planning/phases/10-real-world-runtime-validation/RUNTIME-VALIDATION.md index f1b8a0a..96ea3eb 100644 --- a/.planning/phases/10-real-world-runtime-validation/RUNTIME-VALIDATION.md +++ b/.planning/phases/10-real-world-runtime-validation/RUNTIME-VALIDATION.md @@ -1,9 +1,8 @@ # Runtime Validation Report — ImpTune v1.1 -**Status:** IN PROGRESS — all four RTVAL runtime checks recorded (1 artifact-backed, 3 attestation-only): RTVAL-01 PASS (re-test 2026-04-13, artifact-backed); RTVAL-02 PASS (attestation-only, no artifact); RTVAL-03 PASS (attestation-only, no artifact — 2nd consecutive); RTVAL-04 PASS (attestation-only, no artifact — 3rd consecutive). Plan 10-02 complete; awaiting sign-off in plan 10-03. +**Status:** READY FOR SIGN-OFF — all four RTVAL runtime checks recorded (1 artifact-backed, 3 attestation-only): RTVAL-01 PASS (re-test 2026-04-13, artifact-backed); RTVAL-02 PASS (attestation-only, no artifact); RTVAL-03 PASS (attestation-only, no artifact — 2nd consecutive); RTVAL-04 PASS (attestation-only, no artifact — 3rd consecutive). Plan 10-02 complete; awaiting human sign-off in plan 10-03. **Started:** 2026-04-13 -**Signed off by:** -**Signed off date:** +*(Sign-off name and date are populated in the Sign-off section at the bottom of this file.)* ## Tenant & Environment | Field | Value | @@ -23,8 +22,9 @@ Status: PASS Tested: 2026-04-13 (re-test against fixed build) Evidence: -- evidence/rtval-01-tenant-upload.png — Intune Win32 app wizard with parsed .intunewin metadata populated (name, platform, size, MAM enabled) -- evidence/rtval-01-app-assigned.png — app assignment screen showing the test device group +- [tenant-upload screenshot](evidence/rtval-01-tenant-upload.png) — Intune Win32 app wizard with parsed .intunewin metadata populated (name, platform, size, MAM enabled) +- [app-assigned screenshot](evidence/rtval-01-app-assigned.png) — app assignment screen showing the test device group +- [Copieur_2eme.intunewin package under test](evidence/Copieur_2eme.intunewin) — the exact artifact uploaded to tenant rubis.fr Notes: Initial run on 2026-04-13 failed with empty wizard fields and greyed-out OK button (see ISSUE-01). Root cause was two structural defects in the .intunewin generator: (1) HMAC was computed over ciphertext only instead of IV+ciphertext, and (2) Detection.xml did not match the IntuneWinAppUtil.exe reference format. Both fixed in commits 74535ea and 7716246. Re-test on the fixed build against live tenant rubis.fr: package parses cleanly, all wizard fields populate, OK button enabled, assignment saved successfully. Package tested: Copieur_2eme.intunewin (SHA256 8818124aa97ed3da24bf73a1f08f43065e6efea46f44a3abffc9983b097d3ddc, ImpTune commit 00b709d) @@ -59,6 +59,29 @@ Notes: ATTESTATION-ONLY — this check is NOT artifact-backed. This is the **thi - **Status:** Resolved in commits 74535ea (HMAC over IV+ciphertext) and 7716246 (Detection.xml alignment with IntuneWinAppUtil.exe reference format). Re-tested 2026-04-13 against live tenant rubis.fr — package now parses; wizard fields populate; OK button enabled. ## Sign-off -- [ ] All five RTVAL criteria PASS or have documented rationale -- [ ] Evidence files committed under `evidence/` -- [ ] Signed by: ___________________ + +**Reviewer acknowledgement required — DO NOT tick silently.** + +Before ticking the checkboxes below, the reviewer MUST read the "Attestation-only audit trail" warning in this section and in `10-02-live-intune-runtime-validation-SUMMARY.md` ("CRITICAL: Attestation-Only Audit Trail Damage"). Only RTVAL-01 (tenant ingestion) is artifact-backed. RTVAL-02, RTVAL-03, and RTVAL-04 are verbal attestations from the technician, and the user was warned twice (on RTVAL-03 and again on RTVAL-04) that this weakens the audit trail. Signing off here means either (a) accepting the attestation-only runtime half with the compensating controls listed below, or (b) re-running RTVAL-02/03/04 with full artifact capture before ticking. + +### Attestation-only audit trail (reviewer must acknowledge) + +- **RTVAL-02:** PASS (attestation-only) — no `IntuneManagementExtension.log` excerpt, no portal screenshot +- **RTVAL-03:** PASS (attestation-only, 2nd consecutive) — no `rtval-03-detection.png`, no `rtval-03-detect-manual.txt` +- **RTVAL-04:** PASS (attestation-only, 3rd consecutive) — no `rtval-04-uninstall-log.txt`, no `rtval-04-uninstall-status.png` + +Compensating controls (if accepting attestation-only): +- Known test device: `ARES-5CG5220YTM` (Windows build 26200.7171) +- Known tenant: `rubis.fr` +- Single session (technician was on the device while attesting) +- Known-good .intunewin generator (RTVAL-01 artifact-backed after ISSUE-01 fix) +- Technician name: _to be filled in at sign-off_ + +### Sign-off checklist + +- [ ] All four RTVAL runtime checks (RTVAL-01..04) have a PASS/FAIL status with documented rationale, and the attestation-only nature of RTVAL-02/03/04 has been explicitly read and acknowledged (not silently ticked) +- [ ] All available evidence files are committed under `evidence/` (RTVAL-01 screenshots + package); RTVAL-02/03/04 evidence gaps are explicitly accepted OR a re-run is scheduled before phase closure +- [ ] RTVAL-05 report is reviewer-grade: tenant, device, OS build, driver vendor, evidence links, and issues found are all populated + +**Signed off by:** +**Signed off date:**