- Flip RTVAL-01 from FAIL to PASS after re-test against live tenant rubis.fr
- Reference evidence screenshots (tenant-upload, app-assigned)
- Fix Package SHA256 (strip trailing garbage) to 8818124aa97ed3da24bf73a1f08f43065e6efea46f44a3abffc9983b097d3ddc
- Update top-level Status to IN PROGRESS; plan 10-02 resumed at Task 2
- Resolve ISSUE-01 (fixed in 74535ea HMAC scope + 7716246 Detection.xml alignment)
- Lock package to ImpTune commit 00b709d
Session now records the second root cause (HMAC over ciphertext-only vs
IV+ciphertext) and the fix applied in commit 74535ea. Status moved back
to awaiting_human_verify for next Intune upload retry.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The reference implementation (svrooij/ContentPrep Zipper.cs DecryptFileAsync)
reads the first 32 bytes as the stored HMAC, then hashes the *remaining* bytes
— i.e. IV (16 bytes) || ciphertext — to verify integrity. ImpTune was computing
HMAC(mac_key, ciphertext) which omits the IV. Intune's server-side HMAC check
would therefore always fail, manifesting as the same silent symptom as the
Detection.xml bug: empty wizard fields, greyed OK button, no error banner.
The blob layout is unchanged: [HMAC(32)] + [IV(16)] + [ciphertext].
Only the hash input is corrected: iv + ciphertext instead of ciphertext.
The Mac field in Detection.xml is also updated accordingly (it stores the same
HMAC value that is prepended to the blob).
Tests updated: test_hmac_matches now verifies HMAC over blob[32:] (= IV+ciphertext),
which is exactly what the reference decryption algorithm verifies against.
All 114 tests pass.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Four structural defects in the generated Detection.xml caused Intune's upload
wizard to silently fail metadata parsing (empty form, OK button greyed):
1. Missing ToolVersion="1.8.6.0" XML attribute on ApplicationInfo — the wizard
uses this to validate the package was produced by a compatible tool.
2. Spurious xmlns="http://schemas.microsoft.com/IntuneWin" namespace — changes
element identity for Intune's XML parser (reference emits no namespace).
3. <?xml version="1.0" ?> declaration header — reference uses OmitXmlDeclaration=true.
4. Extra <MacAlgorithm> child element inside EncryptionInfo — not present in
the reference FileEncryptionInfo model (svrooij/ContentPrep verified).
Fix: switched from toprettyxml() to tostring(xml_declaration=False)+indent(),
added ToolVersion attribute, removed xmlns and MacAlgorithm.
Tests updated to assert the corrected reference format; all 114 pass.
Root cause verified against svrooij/ContentPrep Packager.cs + ApplicationInfo.cs
(open-source C# reference implementation of IntuneWinAppUtil.exe).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Status set to BLOCKED with .intunewin structure defect as blocker
- BLOCKER-01 raised: Detection.xml missing/malformed in generated package
- Decision recorded: stop plan 10-02, gap-closure via /gsd:debug or /gsd:plan-phase 10 --gaps
- Session continuity updated to reflect RTVAL-01 FAIL stop point
- RTVAL-01 status set to FAIL: Win32 app wizard fields stayed empty, OK greyed out
- Verbatim technician symptom quoted verbatim in report
- Interpretation: Detection.xml / package metadata malformed or missing in .intunewin archive
- RTVAL-02, RTVAL-03, RTVAL-04 marked BLOCKED (all depend on RTVAL-01 PASS)
- ISSUE-01 raised in Issues Found with root cause hypothesis and resolution path
- Plan 10-02 stopped; gap-closure cycle required before retesting
- Add 10-01-preflight-package-and-scaffold-SUMMARY.md
- Update STATE.md: position moved to Phase 10 plan 01 complete
- Update ROADMAP.md: Phase 10 shows 1/3 summaries (In Progress)
- Mark RTVAL-05 complete in REQUIREMENTS.md
- Create RUNTIME-VALIDATION.md with Tenant & Environment metadata table
- Add RTVAL-01 through RTVAL-04 sections with PENDING status
- Add Issues Found and Sign-off checklist sections
- Create evidence/.gitkeep so git tracks the evidence directory
Real INFs (e.g. Ricoh oemsetup.inf) include [SourceDisksFiles] entries
with bare filename lines (no '='), which strict configparser rejects
with ParsingError, surfacing as a 500 on /drivers/upload.
Pre-process the INF text to rewrite bare lines into synthetic
__bare_N = <line> entries before parsing, and filter those synthetic
keys out of DriverDesc extraction so they cannot leak into driver_names.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Create tests/e2e/test_port_autofill.py - headless chromium test for PRNT-03
- Verifies IP->port_name auto-derivation via Alpine @input handler at /printers
- Update 09-VALIDATION.md: mark UX-02 tasks green, cite test file as evidence
- Import Form from fastapi for mixed multipart + form field support
- Add caller: str = Form('') parameter to upload_driver handler
- Capture new_driver from Driver.get_or_create() return tuple
- Branch on caller == 'printer_form' to emit OOB-enabled response
- Create partials/driver_upload_with_oob.html with primary driver_list
include + hx-swap-oob select targeting id=printer-form-driver-select
- New driver is auto-selected via new_driver_id context variable
All 13 driver upload tests pass including 4 new OOB contract tests.
Full non-e2e suite: 111 passed.
- Create tests/test_script_download.py with 5 tests for .ps1 routes (install/uninstall/detect, 404, 422)
- Add test_detail_page_shows_script_links to TestCommandPreview in tests/test_packages.py
- All 6 new tests go RED (routes and template links do not exist yet)
Three plans covering UX-01 (driver upload 500 fix + inline HTMX OOB
refresh on printer form), UX-02 (Playwright headless test for PRNT-03
IP->port auto-fill), and UX-03 (.ps1 script download routes + detail
page links). VALIDATION.md finalized with real task IDs and
nyquist_compliant=true. ROADMAP Phase 9 plan list filled in.
- SUMMARY.md documents /packages route, dashboard live queries, 99 tests green
- STATE.md advanced to 7/7 phases complete (100%)
- ROADMAP.md marks Phase 7 and plan 07-01 complete
- Dashboard queries 5 most recent Printer records and 5 most recent driver-assigned ones
- New /packages route lists printers with drivers, with intunewin/ninja download links
- packages.html template extends base.html with Pico grid table
- Dashboard printer/package items now link to detail pages
- Quick action buttons wired to real routes (removed aria-disabled)
- Add shutil import and Icon import to packages.py
- After driver extraction, look up Icon record for printer
- If found and file exists on disk, copy to tmpdir/icon.png
- Missing icon (no DB record or missing file) silently skipped — export still succeeds
- PKG-04 requirement satisfied
Phase 6 wires icon into .intunewin export (closes PKG-04).
Phase 7 fixes dashboard empty state and /packages 404 nav link.
PKG-04 reset to Pending in REQUIREMENTS.md traceability table.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
kawa
