---
status: awaiting_human_verify
trigger: "phase-10-rtval-01-intunewin-parse-fail"
created: 2026-04-13T00:00:00Z
updated: 2026-04-13T09:30:00Z
---

## Current Focus

hypothesis: CONFIRMED — Detection.xml had four structural defects vs IntuneWinAppUtil.exe reference.
test: Fixed intunewin_builder.py, updated tests, 114/114 pass.
expecting: Rebuilt package will parse correctly in Intune wizard.
next_action: Rebuild package in ImpTune UI and retry upload to Intune tenant to confirm fix end-to-end.

## Symptoms

expected: Uploading the .intunewin to Intune parses metadata, populates Name/Platform/Size/MAM-enabled fields, enables OK button.
actual: Intune accepts upload but never populates the metadata form. All fields stay empty. OK button stays greyed out. No error banner.
errors: Silent metadata-parse failure inside the wizard.
reproduction: Build with ImpTune, upload to Intune Apps > Windows > Add > Windows app (Win32).
started: First time the generator has been tested against a real Intune tenant. Never worked in production.

## Eliminated

- hypothesis: archive layout is wrong (different folder structure)
  evidence: python -m zipfile -l confirms correct IntuneWinPackage/Contents/ and IntuneWinPackage/Metadata/ layout
  timestamp: 2026-04-13T00:00:00Z

- hypothesis: encryption algorithm is wrong
  evidence: code uses AES-256-CBC with PKCS7 padding, 16-byte IV, HMAC-SHA256 — matches reference
  timestamp: 2026-04-13T00:00:00Z

## Evidence

- timestamp: 2026-04-13T00:00:00Z
  checked: Copieur_2eme.intunewin archive layout
  found: Correct paths — IntuneWinPackage/Contents/IntunePackage.intunewin + IntuneWinPackage/Metadata/Detection.xml
  implication: Archive layout is not the issue

- timestamp: 2026-04-13T00:00:00Z
  checked: Detection.xml from Copieur_2eme.intunewin
  found: Has xmlns="http://schemas.microsoft.com/IntuneWin", has <?xml version="1.0" ?> declaration, missing ToolVersion attribute, has MacAlgorithm child element
  implication: Multiple structural deviations from reference

- timestamp: 2026-04-13T00:00:00Z
  checked: svrooij/ContentPrep reference implementation (Packager.cs + ApplicationInfo.cs)
  found: (1) ToolVersion="1.8.6.0" is an XML ATTRIBUTE on ApplicationInfo, (2) NO xmlns namespace ([XmlRoot("ApplicationInfo")] with no Namespace param + empty XmlSerializerNamespaces), (3) OmitXmlDeclaration=true so no <?xml?> header, (4) FileEncryptionInfo model has NO MacAlgorithm field
  implication: ImpTune's Detection.xml deviates in 4 ways from the reference. The missing ToolVersion and wrong namespace are the most likely causes of Intune wizard silence.

## Resolution

root_cause: intunewin_builder.py builds Detection.xml with four structural errors vs the IntuneWinAppUtil.exe reference (svrooij/ContentPrep Packager.cs + ApplicationInfo.cs verified): (1) missing required ToolVersion="1.8.6.0" XML attribute on ApplicationInfo, (2) spurious xmlns="http://schemas.microsoft.com/IntuneWin" namespace that changes element identity for Intune's XML parser, (3) XML declaration header <?xml version="1.0" ?> which the reference omits (OmitXmlDeclaration=true), and (4) extra MacAlgorithm child element not present in reference FileEncryptionInfo model.
fix: Rewrote Detection.xml generation in intunewin_builder.py — added ToolVersion attribute, removed xmlns, switched to tostring(xml_declaration=False) + indent() instead of toprettyxml(), removed MacAlgorithm. Updated tests to match reference format.
verification: 114/114 tests pass. Awaiting human confirmation from Intune upload retry.
files_changed:
  - imptune/generators/intunewin_builder.py
  - tests/test_intunewin.py