- AES-256-CBC encryption with PKCS7 padding using pycryptodome
- HMAC-SHA256 of ciphertext prepended to blob (mac_key, 32 bytes)
- Encrypted blob layout: HMAC(32) + IV(16) + ciphertext
- IV is 16 bytes (corrected from STACK.md documentation error of 32 bytes)
- Detection.xml with all 8 EncryptionInfo sub-elements and correct namespace
- Inner ZIP uses DEFLATE compression; outer ZIP uses STORED compression
- All 14 byte-level tests pass including crypto roundtrip verification
- Dockerfile with python:3.12-slim-bookworm, curl downloads Pico CSS, HTMX, Alpine.js at build time
- docker-compose.yml with imptune_data:/data named volume and restart policy
- requirements.txt with all phase 1-5 dependencies
- imptune/config.py loading DATA_DIR/PORT from env with DB_PATH and DRIVERS_DIR derived paths
- imptune/main.py: FastAPI app with StaticFiles mount, health+pages routers, startup dir creation
- imptune/api/health.py: GET /health returning {"status": "ok"}
- imptune/api/pages.py: GET / returning dashboard.html with sync def handler
- imptune/templates/base.html: data-theme="auto", sidebar with 5 nav sections, /static/ paths only
- imptune/templates/dashboard.html: quick actions + empty state recent activity
- imptune/static/app.css: sidebar layout, active link highlight, quick action buttons
- 14 tests covering outer ZIP structure, Detection.xml schema, key sizes
- Cryptographic roundtrip: HMAC-SHA256, AES-256-CBC decryption, file digest
- IV size assertion: must be 16 bytes (critical correction from RESEARCH.md)
- Tests serve as format specification for build_intunewin() implementation
kawa