docs(10-03): finalize RUNTIME-VALIDATION.md report body for sign-off

- Status moved from IN PROGRESS to READY FOR SIGN-OFF
- RTVAL-01 evidence converted to markdown relative links (tenant-upload, app-assigned, .intunewin package)
- Sign-off section rewritten to surface attestation-only audit trail damage prominently
- Three sign-off checkboxes restructured to force explicit reviewer acknowledgement of RTVAL-02/03/04 attestation-only nature
- Compensating controls block added (known device, known tenant, single session, known-good generator)
- Duplicate Signed off by header removed from top; consolidated in Sign-off section

.planning/phases/10-real-world-runtime-validation/RUNTIME-VALIDATION.md

@@ -1,9 +1,8 @@
 # Runtime Validation Report — ImpTune v1.1
 
-**Status:** IN PROGRESS — all four RTVAL runtime checks recorded (1 artifact-backed, 3 attestation-only): RTVAL-01 PASS (re-test 2026-04-13, artifact-backed); RTVAL-02 PASS (attestation-only, no artifact); RTVAL-03 PASS (attestation-only, no artifact — 2nd consecutive); RTVAL-04 PASS (attestation-only, no artifact — 3rd consecutive). Plan 10-02 complete; awaiting sign-off in plan 10-03.
+**Status:** READY FOR SIGN-OFF — all four RTVAL runtime checks recorded (1 artifact-backed, 3 attestation-only): RTVAL-01 PASS (re-test 2026-04-13, artifact-backed); RTVAL-02 PASS (attestation-only, no artifact); RTVAL-03 PASS (attestation-only, no artifact — 2nd consecutive); RTVAL-04 PASS (attestation-only, no artifact — 3rd consecutive). Plan 10-02 complete; awaiting human sign-off in plan 10-03.
 **Started:** 2026-04-13
-**Signed off by:** <name>
-**Signed off date:** <YYYY-MM-DD>
+*(Sign-off name and date are populated in the Sign-off section at the bottom of this file.)*
 
 ## Tenant & Environment
 | Field | Value |
@@ -23,8 +22,9 @@
 Status: PASS
 Tested: 2026-04-13 (re-test against fixed build)
 Evidence:
-- evidence/rtval-01-tenant-upload.png — Intune Win32 app wizard with parsed .intunewin metadata populated (name, platform, size, MAM enabled)
-- evidence/rtval-01-app-assigned.png — app assignment screen showing the test device group
+- [tenant-upload screenshot](evidence/rtval-01-tenant-upload.png) — Intune Win32 app wizard with parsed .intunewin metadata populated (name, platform, size, MAM enabled)
+- [app-assigned screenshot](evidence/rtval-01-app-assigned.png) — app assignment screen showing the test device group
+- [Copieur_2eme.intunewin package under test](evidence/Copieur_2eme.intunewin) — the exact artifact uploaded to tenant rubis.fr
 Notes: Initial run on 2026-04-13 failed with empty wizard fields and greyed-out OK button (see ISSUE-01). Root cause was two structural defects in the .intunewin generator: (1) HMAC was computed over ciphertext only instead of IV+ciphertext, and (2) Detection.xml did not match the IntuneWinAppUtil.exe reference format. Both fixed in commits 74535ea and 7716246. Re-test on the fixed build against live tenant rubis.fr: package parses cleanly, all wizard fields populate, OK button enabled, assignment saved successfully.
 Package tested: Copieur_2eme.intunewin (SHA256 8818124aa97ed3da24bf73a1f08f43065e6efea46f44a3abffc9983b097d3ddc, ImpTune commit 00b709d)
 
@@ -59,6 +59,29 @@ Notes: ATTESTATION-ONLY — this check is NOT artifact-backed. This is the **thi
 - **Status:** Resolved in commits 74535ea (HMAC over IV+ciphertext) and 7716246 (Detection.xml alignment with IntuneWinAppUtil.exe reference format). Re-tested 2026-04-13 against live tenant rubis.fr — package now parses; wizard fields populate; OK button enabled.
 
 ## Sign-off
-- [ ] All five RTVAL criteria PASS or have documented rationale
-- [ ] Evidence files committed under `evidence/`
-- [ ] Signed by: ___________________
+
+**Reviewer acknowledgement required — DO NOT tick silently.**
+
+Before ticking the checkboxes below, the reviewer MUST read the "Attestation-only audit trail" warning in this section and in `10-02-live-intune-runtime-validation-SUMMARY.md` ("CRITICAL: Attestation-Only Audit Trail Damage"). Only RTVAL-01 (tenant ingestion) is artifact-backed. RTVAL-02, RTVAL-03, and RTVAL-04 are verbal attestations from the technician, and the user was warned twice (on RTVAL-03 and again on RTVAL-04) that this weakens the audit trail. Signing off here means either (a) accepting the attestation-only runtime half with the compensating controls listed below, or (b) re-running RTVAL-02/03/04 with full artifact capture before ticking.
+
+### Attestation-only audit trail (reviewer must acknowledge)
+
+- **RTVAL-02:** PASS (attestation-only) — no `IntuneManagementExtension.log` excerpt, no portal screenshot
+- **RTVAL-03:** PASS (attestation-only, 2nd consecutive) — no `rtval-03-detection.png`, no `rtval-03-detect-manual.txt`
+- **RTVAL-04:** PASS (attestation-only, 3rd consecutive) — no `rtval-04-uninstall-log.txt`, no `rtval-04-uninstall-status.png`
+
+Compensating controls (if accepting attestation-only):
+- Known test device: `ARES-5CG5220YTM` (Windows build 26200.7171)
+- Known tenant: `rubis.fr`
+- Single session (technician was on the device while attesting)
+- Known-good .intunewin generator (RTVAL-01 artifact-backed after ISSUE-01 fix)
+- Technician name: _to be filled in at sign-off_
+
+### Sign-off checklist
+
+- [ ] All four RTVAL runtime checks (RTVAL-01..04) have a PASS/FAIL status with documented rationale, and the attestation-only nature of RTVAL-02/03/04 has been explicitly read and acknowledged (not silently ticked)
+- [ ] All available evidence files are committed under `evidence/` (RTVAL-01 screenshots + package); RTVAL-02/03/04 evidence gaps are explicitly accepted OR a re-run is scheduled before phase closure
+- [ ] RTVAL-05 report is reviewer-grade: tenant, device, OS build, driver vendor, evidence links, and issues found are all populated
+
+**Signed off by:** <name>
+**Signed off date:** <YYYY-MM-DD>