kawa
2c912caa60
- Status: PASS (attested, no artifact) — third consecutive attestation-only check - No uninstall log or portal screenshot captured - Technician verbally confirmed uninstall under SYSTEM, clean removal from ARES-5CG5220YTM - RTVAL-02/03/04 together constitute an attestation-only runtime half for Phase 10 - User warned twice and still chose attestation-only; audit trail weakened - Top-level Status line updated to reflect all four RTVAL checks recorded
65 lines
7.3 KiB
Markdown
65 lines
7.3 KiB
Markdown
# Runtime Validation Report — ImpTune v1.1
|
|
|
|
**Status:** IN PROGRESS — all four RTVAL runtime checks recorded (1 artifact-backed, 3 attestation-only): RTVAL-01 PASS (re-test 2026-04-13, artifact-backed); RTVAL-02 PASS (attestation-only, no artifact); RTVAL-03 PASS (attestation-only, no artifact — 2nd consecutive); RTVAL-04 PASS (attestation-only, no artifact — 3rd consecutive). Plan 10-02 complete; awaiting sign-off in plan 10-03.
|
|
**Started:** 2026-04-13
|
|
**Signed off by:** <name>
|
|
**Signed off date:** <YYYY-MM-DD>
|
|
|
|
## Tenant & Environment
|
|
| Field | Value |
|
|
|-------|-------|
|
|
| Intune tenant (domain) | rubis.fr |
|
|
| Test device hostname | ARES-5CG5220YTM |
|
|
| Windows OS build | 26200.7171 |
|
|
| Device is Intune-managed | yes |
|
|
| Driver vendor(s) tested | ricoh.zip
|
|
- PCL6 Driver for Universal Print |
|
|
| ImpTune commit SHA | 00b709d25aa20a3d5fbdabb728f6083d4f9f958c |
|
|
| Package file name | Copieur_2eme.intunewin |
|
|
| Package SHA256 | 8818124aa97ed3da24bf73a1f08f43065e6efea46f44a3abffc9983b097d3ddc |
|
|
| Generated at | 2026-04-13 |
|
|
|
|
## RTVAL-01 — Tenant ingestion
|
|
Status: PASS
|
|
Tested: 2026-04-13 (re-test against fixed build)
|
|
Evidence:
|
|
- evidence/rtval-01-tenant-upload.png — Intune Win32 app wizard with parsed .intunewin metadata populated (name, platform, size, MAM enabled)
|
|
- evidence/rtval-01-app-assigned.png — app assignment screen showing the test device group
|
|
Notes: Initial run on 2026-04-13 failed with empty wizard fields and greyed-out OK button (see ISSUE-01). Root cause was two structural defects in the .intunewin generator: (1) HMAC was computed over ciphertext only instead of IV+ciphertext, and (2) Detection.xml did not match the IntuneWinAppUtil.exe reference format. Both fixed in commits 74535ea and 7716246. Re-test on the fixed build against live tenant rubis.fr: package parses cleanly, all wizard fields populate, OK button enabled, assignment saved successfully.
|
|
Package tested: Copieur_2eme.intunewin (SHA256 8818124aa97ed3da24bf73a1f08f43065e6efea46f44a3abffc9983b097d3ddc, ImpTune commit 00b709d)
|
|
|
|
## RTVAL-02 — Install under SYSTEM (pnputil + $PSScriptRoot)
|
|
Status: PASS (attested, no artifact)
|
|
Tested: 2026-04-13
|
|
Evidence: Attested by technician — no log excerpt or portal screenshot captured. Audit trail weakened for this check; technician verbally confirmed install succeeded on ARES-5CG5220YTM, driver deployed, Intune portal showed Installed state.
|
|
Notes: ATTESTATION-ONLY — this check is NOT artifact-backed. No `IntuneManagementExtension.log` excerpt and no `Device install status = Installed` screenshot were captured on the test endpoint. The four required observations (SYSTEM context banner, `$PSScriptRoot` resolution, `pnputil /add-driver` success line, exit code 0) were NOT independently verified from logs; PASS rests entirely on the technician's verbal report ("checked on the device and everything is deployed correctly"). User explicitly approved proceeding without evidence on 2026-04-13. For any future regression or incident investigation, treat RTVAL-02 as a soft PASS and re-run with full log capture before signing off the phase.
|
|
|
|
## RTVAL-03 — Detection rule reports Installed
|
|
Status: PASS (attested, no artifact)
|
|
Tested: 2026-04-13
|
|
Evidence: Attested by technician — no portal screenshot or detect transcript captured. Audit trail weakened. Technician verbally confirmed Intune reports Installed and detection rule passes on ARES-5CG5220YTM.
|
|
Notes: ATTESTATION-ONLY — this check is NOT artifact-backed. This is the **second consecutive attestation-only check** (RTVAL-02 was also attestation-only), which further weakens the audit trail for plan 10-02. No `evidence/rtval-03-detection.png` (Intune portal "Installed" screenshot) and no `evidence/rtval-03-detect-manual.txt` (manual detect script run transcript with exit code 0) were captured. The three required observations (Intune portal status = Installed, manual detect script exit 0, printer visible via `Get-Printer`) were NOT independently verified; PASS rests entirely on the technician's verbal report. User was explicitly warned that a second consecutive attestation-only check weakens the audit trail and still chose to proceed without evidence on 2026-04-13. For any future regression, incident investigation, or phase sign-off, RTVAL-02 and RTVAL-03 should be treated as soft PASSes and re-run with full artifact capture before the phase is closed.
|
|
|
|
## RTVAL-04 — Uninstall under SYSTEM
|
|
Status: PASS (attested, no artifact)
|
|
Tested: 2026-04-13
|
|
Evidence: Attested by technician — no uninstall log or portal screenshot captured. Audit trail weakened. Technician verbally confirmed Intune uninstall ran under SYSTEM, exited cleanly, and printer was removed from ARES-5CG5220YTM.
|
|
Notes: ATTESTATION-ONLY — this check is NOT artifact-backed. This is the **third consecutive attestation-only check** (RTVAL-02, RTVAL-03, and RTVAL-04 are all attestation-only). Together, RTVAL-02/03/04 constitute an **attestation-only runtime half for Phase 10**: only RTVAL-01 (tenant ingestion) is artifact-backed for this plan. No `evidence/rtval-04-uninstall-log.txt` (IntuneManagementExtension.log excerpt showing SYSTEM context + exit 0) and no `evidence/rtval-04-uninstall-status.png` (Intune portal "Not installed" screenshot) were captured. The four required observations (uninstall script ran under `NT AUTHORITY\SYSTEM`, exit code 0, printer gone via `Get-Printer`, Intune portal shows "Not installed") were NOT independently verified; PASS rests entirely on the technician's verbal report. User was explicitly warned twice — first on RTVAL-03 and again on RTVAL-04 — that consecutive attestation-only checks significantly weaken the audit trail for Phase 10, and still chose to proceed without evidence on 2026-04-13. For any future regression, incident investigation, or phase sign-off, RTVAL-02/03/04 should all be treated as soft PASSes and re-run with full artifact capture before the phase is closed.
|
|
|
|
## Issues Found
|
|
|
|
### ISSUE-01: .intunewin package metadata unreadable by Intune Win32 app wizard
|
|
- **Discovered:** 2026-04-13 during RTVAL-01
|
|
- **Severity:** Blocker — prevents all downstream RTVAL checks (02, 03, 04)
|
|
- **Symptom:** Win32 app creation wizard fields (name, platform, size, MAM enabled) remain empty after file upload; OK button stays greyed out; no portal error shown
|
|
- **Root cause hypothesis:** Detection.xml embedded inside the .intunewin archive is missing, malformed, or uses an unexpected schema version. The IntuneWin32App packager requires a valid `detection.xml` at the root of the archive alongside the content folder.
|
|
- **Affected file:** Copieur_2eme.intunewin (evidence/Copieur_2eme.intunewin)
|
|
- **Affected code:** ImpTune .intunewin generator (commit 1c3f458)
|
|
- **Resolution path:** Debug the generator to verify Detection.xml is being created, embedded, and follows the expected Intune Win32 app manifest schema. Recommended: run `/gsd:debug` on the .intunewin generator, OR let phase verification surface this as a gap and use `/gsd:plan-phase 10 --gaps` to draft a gap-closure plan.
|
|
- **Status:** Resolved in commits 74535ea (HMAC over IV+ciphertext) and 7716246 (Detection.xml alignment with IntuneWinAppUtil.exe reference format). Re-tested 2026-04-13 against live tenant rubis.fr — package now parses; wizard fields populate; OK button enabled.
|
|
|
|
## Sign-off
|
|
- [ ] All five RTVAL criteria PASS or have documented rationale
|
|
- [ ] Evidence files committed under `evidence/`
|
|
- [ ] Signed by: ___________________
|