18 KiB
18 KiB
milestone, type, audit_date, auditor, status, signed_off_by, signed_off_date
| milestone | type | audit_date | auditor | status | signed_off_by | signed_off_date |
|---|---|---|---|---|---|---|
| v1.0 | validation-index | 2026-04-13 | Sébastien QUEROL | signed-off | Sébastien QUEROL | 2026-04-13 |
v1.0 Validation Index — Nyquist Rollup
Audit date: 2026-04-13 Auditor: Sébastien QUEROL (signed off 2026-04-13) Compiled by: Claude (gsd-executor, plan 08-08)
Tally: 45/45 pass, 0 deferred-v1.2, 0 fail-fix-v1.1, 0 wont-do
Single flat pass/fail roll-up of every v1.0 success criterion across Phases 1–7. Source of truth for NYQ-02 and NYQ-03. Per-phase Nyquist Records are embedded in each NN-VALIDATION.md and enumerated one row per criterion below. Row counts per phase (14, 6, 10, 5, 5, 1, 4) are a function of scope — single-criterion gap-closure phases legitimately produce single-row audits.
Key roll-up facts (for downstream verifier):
- Phase 5 row 2 (PKG-02) is the only artifact-backed live-tenant runtime row in the entire track — cites RTVAL-01 PASS on tenant rubis.fr (2026-04-13) after structural fixes in commits
74535ea+7716246. - Phase 4 rows 1–5 (SCRPT-01..05) rest on attestation-only runtime proof (RTVAL-02/03/04, three consecutive attestation-only PASSes per STATE.md 2026-04-13). User was warned twice about cumulative audit-trail damage and explicitly approved proceeding. Phase 10 plan 10-03 signed off with written acknowledgement. Re-capture with full artifacts owned by Phase 11 rollout.
- Phase 1 row 14, Phase 2 row 6, Phase 3 row 3, Phase 5 row 4, Phase 7 row 4 are historical-gap closure rows — all resolved in place via fixing phases (Phase 9 UX-01/02/03, Phase 6 icon embedding, Phase 10 RTVAL-01) with direct commit citations, not flipped to fail-fix-v1.1.
- Phase 7 is the only REQUIREMENTS-free phase, anchored to
07-VERIFICATION.mdtruths rather thanREQUIREMENTS.mdIDs. Legitimate alternate anchoring pattern. - Bidirectional citation loop: 05-VALIDATION row 4 ↔ 06-VALIDATION row 1 both cite
TestIntunewinIconInclusion— closed-loop gap-closure pattern worth replicating for future gap-closure phases.
Flat Pass/Fail Table
| Phase | # | Criterion | Status | Evidence | Gap Link |
|---|---|---|---|---|---|
| 1-Foundation | 1 | docker compose up serves HTTP 200 on GET /health |
pass | 01-VALIDATION.md#nyquist-record row 1 (test_health + 01-VERIFICATION row 1) | |
| 1-Foundation | 2 | No Node.js dependency; single python:3.12-slim-bookworm base image |
pass | 01-VALIDATION.md row 2 (Dockerfile line 1, commit 34c7cb3) |
|
| 1-Foundation | 3 | All static assets served from /static/ with zero CDN refs |
pass | 01-VALIDATION.md row 3 (test_no_cdn_urls_in_templates) | |
| 1-Foundation | 4 | Sidebar shows Dashboard / Drivers / Printers / Clients / Packages | pass | 01-VALIDATION.md row 4 (base.html nav + Phase 7 /packages closure) | |
| 1-Foundation | 5 | App follows OS dark/light theme | pass | 01-VALIDATION.md row 5 (base.html data-theme="auto") |
|
| 1-Foundation | 6 | SQLite initializes with all 4 tables on first run | pass | 01-VALIDATION.md row 6 (test_create_tables, commit 88d9c5f) |
|
| 1-Foundation | 7 | DB uses WAL journal + foreign keys enabled | pass | 01-VALIDATION.md row 7 (test_wal_mode + test_foreign_keys) | |
| 1-Foundation | 8 | DB file lives in DATA_DIR volume, not container FS |
pass | 01-VALIDATION.md row 8 (docker-compose volume + cfg.DB_PATH) | |
| 1-Foundation | 9 | Schema creation is idempotent across restarts | pass | 01-VALIDATION.md row 9 (test_idempotent, safe=True) |
|
| 1-Foundation | 10 | Python function produces valid .intunewin from source dir + setup file |
pass | 01-VALIDATION.md row 10 (test_output_is_valid_zip, commit 25f82e6) |
|
| 1-Foundation | 11 | .intunewin outer ZIP has correct IntuneWinPackage/ structure |
pass | 01-VALIDATION.md row 11 (test_outer_zip_structure) | |
| 1-Foundation | 12 | Encrypted blob byte layout: HMAC(32) + IV(16) + AES-256-CBC ciphertext | pass | 01-VALIDATION.md row 12 (3 byte-layout tests) | |
| 1-Foundation | 13 | Detection.xml cryptographic fields match actual encryption | pass | 01-VALIDATION.md row 13 (5 crypto-field tests) | |
| 1-Foundation | 14 | .intunewin accepted by real Intune tenant end-to-end |
pass | 01-VALIDATION.md row 14 → Phase 10 RUNTIME-VALIDATION.md RTVAL-01 PASS 2026-04-13 on rubis.fr (commits 74535ea + 7716246) |
|
| 2-Drivers | 1 | DRV-01 User uploads driver package (ZIP+INF) via web UI | pass | 02-VALIDATION.md row 1 (test_upload_valid_zip/non_zip/no_inf, commit c648fc5) |
|
| 2-Drivers | 2 | DRV-02 INF parser extracts DriverDesc with encoding + token handling | pass | 02-VALIDATION.md row 2 (16 tests in test_inf_parser.py) | |
| 2-Drivers | 3 | DRV-03 User selects driver name from parsed-INF dropdown (no free-text) | pass | 02-VALIDATION.md row 3 (test_drivers_page + test_upload_returns_select) | |
| 2-Drivers | 4 | DRV-04 Uploaded driver ZIP persisted content-addressed; dedupes on re-upload | pass | 02-VALIDATION.md row 4 (test_driver_persisted + test_dedup_upload) | |
| 2-Drivers | 5 | DRV-05 System flags unused files not referenced by INF | pass | 02-VALIDATION.md row 5 (test_unused_files + test_unused_files_in_response) | |
| 2-Drivers | 6 | DRV-01 runtime gap: POST /drivers/upload must not return 500 on real ZIPs |
pass | 02-VALIDATION.md row 6 → Phase 9 UX-01 commits d1de839 + 10ee09a + 72c6a98 |
Historical gap closed in place via Phase 9 UX-01 (REQUIREMENTS.md UX-01 Complete). Resolved 2026-04-13. |
| 3-Printer | 1 | PRNT-01 User sets printer display name | pass | 03-VALIDATION.md row 1 (test_create_printer_persisted, commit 356c2ee) |
|
| 3-Printer | 2 | PRNT-02 User sets printer IP address or hostname | pass | 03-VALIDATION.md row 2 (test_create_printer_persisted ip_address field) | |
| 3-Printer | 3 | PRNT-03 System auto-suggests port name from IP; manual edits preserved | pass | 03-VALIDATION.md row 3 → Phase 9 UX-02 Playwright commits 322fc20 + 37a06da |
Historical gap closed in place via Phase 9 UX-02 (Playwright headless chromium e2e). Sole NEEDS HUMAN truth from 03-VERIFICATION.md 2026-04-10. |
| 3-Printer | 4 | PRNT-04 User sets duplex mode (OneSided/LongEdge/ShortEdge) | pass | 03-VALIDATION.md row 4 (test_create_printer_duplex) | |
| 3-Printer | 5 | PRNT-05 User sets color vs. grayscale default | pass | 03-VALIDATION.md row 5 (test_create_printer_color_mode) | |
| 3-Printer | 6 | PRNT-06 User sets paper size (A4/Letter/Legal) | pass | 03-VALIDATION.md row 6 (test_create_printer_paper_size) | |
| 3-Printer | 7 | PRNT-07 User sets collate on/off | pass | 03-VALIDATION.md row 7 (test_create_printer_collate) | |
| 3-Printer | 8 | PRNT-08 User assigns printer to a client/tenant label | pass | 03-VALIDATION.md row 8 (test_printer_grouped_by_client, LEFT OUTER join) | |
| 3-Printer | 9 | PRNT-09 Printer configurations persist across SQLite sessions | pass | 03-VALIDATION.md row 9 (test_printer_survives_page_refresh) | |
| 3-Printer | 10 | PRNT-10 Detail page loads full config with driver FK intact (Phase-3 scope) | pass | 03-VALIDATION.md row 10 (test_printer_detail_shows_driver + no_driver) | |
| 4-Scripts | 1 | SCRPT-01 Install script: pnputil + Add-Printer* + Set-PrintConfiguration | pass | 04-VALIDATION.md row 1 (test_render_install_* + RTVAL-02 attestation-only) | Runtime half is attestation-only per STATE.md 2026-04-13 — no IntuneManagementExtension.log excerpt or portal screenshot. Phase 11 rollout owns artifact re-capture. Template correctness fully pytest-automated. |
| 4-Scripts | 2 | SCRPT-02 Uninstall script: Remove-Printer → Remove-PrinterDriver → Remove-PrinterPort | pass | 04-VALIDATION.md row 2 (test_render_uninstall + RTVAL-04 attestation-only) | Third consecutive attestation-only check; no rtval-04-uninstall-log.txt or rtval-04-uninstall-status.png captured. Phase 10 plan 10-03 signed off with written acknowledgement. Phase 11 owns re-capture. |
| 4-Scripts | 3 | SCRPT-03 Detect script: exit 0 when present / exit 1 when absent | pass | 04-VALIDATION.md row 3 (test_render_detect + RTVAL-03 attestation-only) | Second consecutive attestation-only check; no rtval-03-detection.png captured. REQUIREMENTS.md wording ("registry check") superseded by 04-RESEARCH.md decision to use Get-Printer cmdlet. Phase 11 owns re-capture. |
| 4-Scripts | 4 | SCRPT-04 Install script detects SYSTEM vs user and self-elevates via UAC | pass | 04-VALIDATION.md row 4 (test_render_install_uac_guard + RTVAL-02 SYSTEM branch) | SYSTEM branch exercised attestation-only in RTVAL-02; user-interactive UAC dialog branch was NOT exercised in Phase 10 at all — remains a Manual-Only Verification. |
| 4-Scripts | 5 | SCRPT-05 Install script includes 64-bit WOW64 SysNative relaunch guard | pass | 04-VALIDATION.md row 5 (test_render_install_wow64_guard + RTVAL-02 attestation-only) | WOW64 relaunch path not directly observable from RTVAL-02 attestation; template-level positional correctness (guard before pnputil) is fully pytest-automated. Full WOW64 trace is a Phase 11 rollout concern. |
| 5-Package | 1 | PKG-01 User exports full .intunewin package in one click |
pass | 05-VALIDATION.md row 1 (TestIntunewinDownload 4 tests + RTVAL-01 artifact-backed PASS on rubis.fr) | |
| 5-Package | 2 | PKG-02 .intunewin generated natively in Python (no IntuneWinAppUtil.exe); byte-level conformant |
pass | 05-VALIDATION.md row 2 (14 byte-level tests in test_intunewin.py + artifact-backed RTVAL-01 PASS after fix commits 74535ea + 7716246) |
Strongest row in the entire 7-phase track — only artifact-backed live-tenant runtime evidence. Initial RTVAL-01 FAILED; root cause was two structural defects fixed in commits 74535ea (HMAC over IV+ciphertext) + 7716246 (Detection.xml alignment with IntuneWinAppUtil.exe reference format); re-test PASSED on tenant rubis.fr with committed screenshots + package. |
| 5-Package | 3 | PKG-03 User exports NinjaRMM ZIP package in one click | pass | 05-VALIDATION.md row 3 (TestNinjaDownload 5 tests) | |
| 5-Package | 4 | PKG-04 User uploads custom PNG icon; embedded into .intunewin |
pass | 05-VALIDATION.md row 4 → Phase 6 TestIntunewinIconInclusion (commits 2723cc8 + 6310be5) |
Historical gap closed in place via Phase 6 (Wire Icon into .intunewin Export). Upload half shipped in Phase 5 plan 02; embedding half added in Phase 6. Bidirectional citation loop with 06-VALIDATION row 1. |
| 5-Package | 5 | PKG-05 User previews and copies Intune install/uninstall command strings before export | pass | 05-VALIDATION.md row 5 (TestCommandPreview 4 tests) | |
| 6-Icon-Wire | 1 | PKG-04 embedding: Uploaded PNG icon embedded in .intunewin output |
pass | 06-VALIDATION.md row 1 (TestIntunewinIconInclusion 2 tests, shutil.copy2 staging at packages.py:153 before build_intunewin at :157; commits 2723cc8 + 6310be5; RTVAL-01 transitive) |
Bidirectional closure loop with 05-VALIDATION row 4. Icon-tile visual rendering on Intune portal is Manual-Only polish owned by Phase 11 rollout. |
| 7-Dashboard | 1 | GET /packages returns 200 and lists driver-assigned printers (closes milestone-audit /packages 404) |
pass | 07-VALIDATION.md row 1 (test_packages_returns_200, pages.py:142-158, commits 8cf47f5 + 91910ad) |
|
| 7-Dashboard | 2 | Dashboard shows 5 most recent printers via live query | pass | 07-VALIDATION.md row 2 (test_dashboard_shows_recent_printers, pages.py:20-22) | |
| 7-Dashboard | 3 | Dashboard shows 5 most recent packages (driver-filtered) via live query | pass | 07-VALIDATION.md row 3 (test_dashboard_shows_recent_packages, pages.py:23-28 with Printer.driver.is_null(False) filter) |
|
| 7-Dashboard | 4 | UX-03 carry-over (Phase 5 origin): Individual script download links on printer detail page | pass | 07-VALIDATION.md row 4 → Phase 9 plan 09-03 commits d359001 + 68a2935 |
Historical gap closed in place via Phase 9 UX-03 (.ps1 route aliases + printer_detail Scripts section). Provenance note: v1.0-ROADMAP.md lists UX-03 as Phase 5 deferral, not Phase 7 — STATE.md restatement imprecise; resolution unaffected. |
Gap Validation Block
All five historical-gap rows cite fixing phases/commits. Each citation has been cross-checked against REQUIREMENTS.md and the fixing phase's SUMMARY.md:
| # | Row | Recorded as | Citation target | Fix owner | Confirmed? |
|---|---|---|---|---|---|
| 1 | Phase 1 row 14 (real Intune tenant ingestion) | pass | Phase 10 RTVAL-01 commits 74535ea + 7716246 |
Phase 10 plan 10-02 | ✓ (REQUIREMENTS.md RTVAL-01 Complete; plan 10-03 sign-off commit cd2df1e) |
| 2 | Phase 2 row 6 (POST /drivers/upload 500) | pass | Phase 9 UX-01 commits d1de839 + 10ee09a + 72c6a98 |
Phase 9 plan 09-01 | ✓ (REQUIREMENTS.md UX-01 Complete; 09-01-SUMMARY.md) |
| 3 | Phase 3 row 3 (PRNT-03 Alpine.js IP→port live-browser) | pass | Phase 9 UX-02 commits 322fc20 + 37a06da |
Phase 9 plan 09-02 | ✓ (REQUIREMENTS.md UX-02 Complete; 09-02-SUMMARY.md) |
| 4 | Phase 5 row 4 / Phase 6 row 1 (PKG-04 icon embedding) | pass | Phase 6 TestIntunewinIconInclusion commits 2723cc8 + 6310be5 |
Phase 6 plan 06-01 | ✓ (bidirectional closure loop confirmed between 05-VALIDATION row 4 and 06-VALIDATION row 1) |
| 5 | Phase 7 row 4 (UX-03 individual script downloads) | pass | Phase 9 plan 09-03 commits d359001 + 68a2935 |
Phase 9 plan 09-03 | ✓ (REQUIREMENTS.md UX-03 Complete; 09-03-SUMMARY.md; provenance note flagged — Phase 5 origin per v1.0-ROADMAP.md) |
Result: All 5 fail-fix-equivalent rows point to real fixing phases with shipped commits. No roadmap-mismatch detected. Zero rows inflated to fail-fix-v1.1 because every historical gap is already closed in the tree.
Attestation-Gap Residual Risk (recorded for rollout)
Phase 4 rows 1–5 (SCRPT-01..05) carry attestation-only runtime proof via RTVAL-02/03/04 per STATE.md 2026-04-13. This is NOT a fail-fix row (Phase 10 plan 10-03 explicitly signed off the gap with written acknowledgement; the user was warned twice and approved). It is documented here as a known weakness in the v1.0 runtime audit trail and is owned by Phase 11 Real-World Rollout for artifact re-capture (IntuneManagementExtension.log excerpt, portal screenshots, status captures) before broad deployment. Not in the above gap table because there is no "fix commit" — the fix is to re-run with full evidence capture, which is a rollout-phase action, not a code change.
Tally Summary
| Source | Row count |
|---|---|
| Phase 1 — Foundation | 14 |
| Phase 2 — Driver Management | 6 |
| Phase 3 — Printer Configuration | 10 |
| Phase 4 — Script Generation | 5 |
| Phase 5 — Package Export | 5 |
| Phase 6 — Wire Icon into .intunewin | 1 |
| Phase 7 — Dashboard & Nav Polish | 4 |
| Total | 45 |
| Status | Count |
|---|---|
| pass | 45 |
| fail-fix-v1.1 | 0 |
| deferred-v1.2 | 0 |
| wont-do | 0 |
NYQ-01 coverage: 7/7 v1.0 phases have Nyquist-compliant VALIDATION.md files with one observable check per success criterion, evidence cited, no hand-wavy "code looks right" entries. Ticked in REQUIREMENTS.md after 08-01 / 08-05 / 08-06 / 08-07 executions.
NYQ-02 coverage: This document is the single flat pass/fail rollup. Will be ticked in REQUIREMENTS.md upon sign-off.
NYQ-03 coverage: Every non-pass row has a rationale. No rows are non-pass — all 45 rows are pass, all historical gaps closed in place with fixing-phase citations, all cross-checked against REQUIREMENTS.md and fixing-phase SUMMARY.md files. Will be ticked in REQUIREMENTS.md upon sign-off.
Sign-Off
- Nyquist audit complete — 2026-04-13 — Sébastien QUEROL