ImpTune/.planning/phases/10-real-world-runtime-validation/RUNTIME-VALIDATION.md

Runtime Validation Report — ImpTune v1.1

Status: SIGNED OFF — all four RTVAL runtime checks recorded (1 artifact-backed, 3 attestation-only): RTVAL-01 PASS (re-test 2026-04-13, artifact-backed); RTVAL-02 PASS (attestation-only, no artifact); RTVAL-03 PASS (attestation-only, no artifact — 2nd consecutive); RTVAL-04 PASS (attestation-only, no artifact — 3rd consecutive). Signed off 2026-04-13 with explicit acknowledgement of the attestation-only audit-trail gap. Started: 2026-04-13 (Sign-off name and date are populated in the Sign-off section at the bottom of this file.)

Tenant & Environment

Field	Value
Intune tenant (domain)	rubis.fr
Test device hostname	ARES-5CG5220YTM
Windows OS build	26200.7171
Device is Intune-managed	yes
Driver vendor(s) tested	ricoh.zip

• PCL6 Driver for Universal Print | | ImpTune commit SHA | 00b709d25a | | Package file name | Copieur_2eme.intunewin | | Package SHA256 | 8818124aa97ed3da24bf73a1f08f43065e6efea46f44a3abffc9983b097d3ddc | | Generated at | 2026-04-13 |

RTVAL-01 — Tenant ingestion

Status: PASS Tested: 2026-04-13 (re-test against fixed build) Evidence:

• tenant-upload screenshot — Intune Win32 app wizard with parsed .intunewin metadata populated (name, platform, size, MAM enabled)
• app-assigned screenshot — app assignment screen showing the test device group
• Copieur_2eme.intunewin package under test — the exact artifact uploaded to tenant rubis.fr Notes: Initial run on 2026-04-13 failed with empty wizard fields and greyed-out OK button (see ISSUE-01). Root cause was two structural defects in the .intunewin generator: (1) HMAC was computed over ciphertext only instead of IV+ciphertext, and (2) Detection.xml did not match the IntuneWinAppUtil.exe reference format. Both fixed in commits 74535ea and 7716246. Re-test on the fixed build against live tenant rubis.fr: package parses cleanly, all wizard fields populate, OK button enabled, assignment saved successfully. Package tested: Copieur_2eme.intunewin (SHA256 8818124aa97ed3da24bf73a1f08f43065e6efea46f44a3abffc9983b097d3ddc, ImpTune commit 00b709d)

RTVAL-02 — Install under SYSTEM (pnputil + $PSScriptRoot)

Status: PASS (attested, no artifact) Tested: 2026-04-13 Evidence: Attested by technician — no log excerpt or portal screenshot captured. Audit trail weakened for this check; technician verbally confirmed install succeeded on ARES-5CG5220YTM, driver deployed, Intune portal showed Installed state. Notes: ATTESTATION-ONLY — this check is NOT artifact-backed. No IntuneManagementExtension.log excerpt and no Device install status = Installed screenshot were captured on the test endpoint. The four required observations (SYSTEM context banner, $PSScriptRoot resolution, pnputil /add-driver success line, exit code 0) were NOT independently verified from logs; PASS rests entirely on the technician's verbal report ("checked on the device and everything is deployed correctly"). User explicitly approved proceeding without evidence on 2026-04-13. For any future regression or incident investigation, treat RTVAL-02 as a soft PASS and re-run with full log capture before signing off the phase.

RTVAL-03 — Detection rule reports Installed

Status: PASS (attested, no artifact) Tested: 2026-04-13 Evidence: Attested by technician — no portal screenshot or detect transcript captured. Audit trail weakened. Technician verbally confirmed Intune reports Installed and detection rule passes on ARES-5CG5220YTM. Notes: ATTESTATION-ONLY — this check is NOT artifact-backed. This is the second consecutive attestation-only check (RTVAL-02 was also attestation-only), which further weakens the audit trail for plan 10-02. No evidence/rtval-03-detection.png (Intune portal "Installed" screenshot) and no evidence/rtval-03-detect-manual.txt (manual detect script run transcript with exit code 0) were captured. The three required observations (Intune portal status = Installed, manual detect script exit 0, printer visible via Get-Printer) were NOT independently verified; PASS rests entirely on the technician's verbal report. User was explicitly warned that a second consecutive attestation-only check weakens the audit trail and still chose to proceed without evidence on 2026-04-13. For any future regression, incident investigation, or phase sign-off, RTVAL-02 and RTVAL-03 should be treated as soft PASSes and re-run with full artifact capture before the phase is closed.

RTVAL-04 — Uninstall under SYSTEM

Status: PASS (attested, no artifact) Tested: 2026-04-13 Evidence: Attested by technician — no uninstall log or portal screenshot captured. Audit trail weakened. Technician verbally confirmed Intune uninstall ran under SYSTEM, exited cleanly, and printer was removed from ARES-5CG5220YTM. Notes: ATTESTATION-ONLY — this check is NOT artifact-backed. This is the third consecutive attestation-only check (RTVAL-02, RTVAL-03, and RTVAL-04 are all attestation-only). Together, RTVAL-02/03/04 constitute an attestation-only runtime half for Phase 10: only RTVAL-01 (tenant ingestion) is artifact-backed for this plan. No evidence/rtval-04-uninstall-log.txt (IntuneManagementExtension.log excerpt showing SYSTEM context + exit 0) and no evidence/rtval-04-uninstall-status.png (Intune portal "Not installed" screenshot) were captured. The four required observations (uninstall script ran under NT AUTHORITY\SYSTEM, exit code 0, printer gone via Get-Printer, Intune portal shows "Not installed") were NOT independently verified; PASS rests entirely on the technician's verbal report. User was explicitly warned twice — first on RTVAL-03 and again on RTVAL-04 — that consecutive attestation-only checks significantly weaken the audit trail for Phase 10, and still chose to proceed without evidence on 2026-04-13. For any future regression, incident investigation, or phase sign-off, RTVAL-02/03/04 should all be treated as soft PASSes and re-run with full artifact capture before the phase is closed.

Issues Found

ISSUE-01: .intunewin package metadata unreadable by Intune Win32 app wizard

• Discovered: 2026-04-13 during RTVAL-01
• Severity: Blocker — prevents all downstream RTVAL checks (02, 03, 04)
• Symptom: Win32 app creation wizard fields (name, platform, size, MAM enabled) remain empty after file upload; OK button stays greyed out; no portal error shown
• Root cause hypothesis: Detection.xml embedded inside the .intunewin archive is missing, malformed, or uses an unexpected schema version. The IntuneWin32App packager requires a valid detection.xml at the root of the archive alongside the content folder.
• Affected file: Copieur_2eme.intunewin (evidence/Copieur_2eme.intunewin)
• Affected code: ImpTune .intunewin generator (commit 1c3f458)
• Resolution path: Debug the generator to verify Detection.xml is being created, embedded, and follows the expected Intune Win32 app manifest schema. Recommended: run /gsd:debug on the .intunewin generator, OR let phase verification surface this as a gap and use /gsd:plan-phase 10 --gaps to draft a gap-closure plan.
• Status: Resolved in commits 74535ea (HMAC over IV+ciphertext) and 7716246 (Detection.xml alignment with IntuneWinAppUtil.exe reference format). Re-tested 2026-04-13 against live tenant rubis.fr — package now parses; wizard fields populate; OK button enabled.

Sign-off

Reviewer acknowledgement required — DO NOT tick silently.

Before ticking the checkboxes below, the reviewer MUST read the "Attestation-only audit trail" warning in this section and in 10-02-live-intune-runtime-validation-SUMMARY.md ("CRITICAL: Attestation-Only Audit Trail Damage"). Only RTVAL-01 (tenant ingestion) is artifact-backed. RTVAL-02, RTVAL-03, and RTVAL-04 are verbal attestations from the technician, and the user was warned twice (on RTVAL-03 and again on RTVAL-04) that this weakens the audit trail. Signing off here means either (a) accepting the attestation-only runtime half with the compensating controls listed below, or (b) re-running RTVAL-02/03/04 with full artifact capture before ticking.

Attestation-only audit trail (reviewer must acknowledge)

• RTVAL-02: PASS (attestation-only) — no IntuneManagementExtension.log excerpt, no portal screenshot
• RTVAL-03: PASS (attestation-only, 2nd consecutive) — no rtval-03-detection.png, no rtval-03-detect-manual.txt
• RTVAL-04: PASS (attestation-only, 3rd consecutive) — no rtval-04-uninstall-log.txt, no rtval-04-uninstall-status.png

Compensating controls (if accepting attestation-only):

• Known test device: ARES-5CG5220YTM (Windows build 26200.7171)
• Known tenant: rubis.fr
• Single session (technician was on the device while attesting)
• Known-good .intunewin generator (RTVAL-01 artifact-backed after ISSUE-01 fix)
• Technician name: to be filled in at sign-off

Sign-off checklist

• All four RTVAL runtime checks (RTVAL-01..04) have a PASS/FAIL status with documented rationale, and the attestation-only nature of RTVAL-02/03/04 has been explicitly read and acknowledged (not silently ticked)
• All available evidence files are committed under evidence/ (RTVAL-01 screenshots + package); RTVAL-02/03/04 evidence gaps are explicitly accepted OR a re-run is scheduled before phase closure
• RTVAL-05 report is reviewer-grade: tenant, device, OS build, driver vendor, evidence links, and issues found are all populated

Signed off by: Sébastien QUEROL Signed off date: 2026-04-13