ImpTune/.planning/phases/10-real-world-runtime-validation/10-02-live-intune-runtime-validation-PLAN.md

phase, plan, type, wave, depends_on, files_modified, autonomous, requirements, must_haves

phase	plan	type	wave	depends_on	files_modified	autonomous	requirements	must_haves
10-real-world-runtime-validation	02	execute	2	10-01	.planning/phases/10-real-world-runtime-validation/RUNTIME-VALIDATION.md .planning/phases/10-real-world-runtime-validation/evidence/	false	RTVAL-01 RTVAL-02 RTVAL-03 RTVAL-04	truths artifacts key_links A real Intune tenant accepted the generated .intunewin without format errors (RTVAL-01) A real Intune-managed Windows endpoint ran the install script under SYSTEM with pnputil staging drivers and $PSScriptRoot resolving (RTVAL-02) Intune detection rule reports 'Installed' on the endpoint after install (RTVAL-03) Intune uninstall removes the printer cleanly under SYSTEM context (RTVAL-04) path provides .planning/phases/10-real-world-runtime-validation/evidence/rtval-01-tenant-upload.png Screenshot of Intune showing successful package upload path provides .planning/phases/10-real-world-runtime-validation/evidence/rtval-02-install-log.txt IntuneManagementExtension.log excerpt showing install success + pnputil + $PSScriptRoot path provides .planning/phases/10-real-world-runtime-validation/evidence/rtval-03-detection.png Screenshot of Intune device install status = Installed path provides .planning/phases/10-real-world-runtime-validation/evidence/rtval-04-uninstall-log.txt Log + printer-list verification showing printer removed under SYSTEM from to via pattern Intune tenant generated .intunewin from plan 10-01 Win32 app upload Package (uploaded|accepted) from to via pattern install script ($PSScriptRoot) bundled driver folder inside .intunewin pnputil /add-driver staging under SYSTEM pnputil.*Published Name|Driver package added successfully

Drive the four real-world RTVAL behavioral checks end-to-end on a live Intune tenant against a real Windows endpoint, and capture hard evidence (screenshots + device logs) for each.

Purpose: This is the phase's whole reason for existing. Every check here is a behavior no unit test can prove — it has to happen on real hardware with a real tenant. Output: evidence/ folder populated with RTVAL-01..04 artifacts and RUNTIME-VALIDATION.md status lines flipped from PENDING to PASS/FAIL.

<execution_context> @C:/Users/SebastienQUEROL/.claude/get-shit-done/workflows/execute-plan.md @C:/Users/SebastienQUEROL/.claude/get-shit-done/templates/summary.md </execution_context>

@.planning/phases/10-real-world-runtime-validation/RUNTIME-VALIDATION.md @.planning/REQUIREMENTS.md Task 1: RTVAL-01 — Upload .intunewin to real Intune tenant .planning/phases/10-real-world-runtime-validation/RUNTIME-VALIDATION.md, .planning/phases/10-real-world-runtime-validation/evidence/rtval-01-tenant-upload.png, .planning/phases/10-real-world-runtime-validation/evidence/rtval-01-app-assigned.png PAUSE for human technician. Requires Intune tenant admin credentials — no complete free CLI path exists.

Technician MUST:

1. Sign in to https://intune.microsoft.com with tenant admin.
2. Go to Apps → Windows → Add → App type: Windows app (Win32).
3. Upload the .intunewin file from plan 10-01.
4. OBSERVE: Intune parses the file and presents the app metadata form without format errors.
5. Fill in minimal app info (name = "ImpTune RTVAL Test - "), install command, uninstall command, detection rule (use the generated detect script: File exists / custom script as produced by ImpTune), requirement = Windows 10/11 x64, assignment = the single test device only.
6. Save the app. OBSERVE: app appears in the apps list with "Waiting for install status" or similar.
7. Capture screenshots:
   • evidence/rtval-01-tenant-upload.png — upload success page showing the parsed .intunewin metadata
   • evidence/rtval-01-app-assigned.png — app assignment screen showing the test device group
8. Update RUNTIME-VALIDATION.md section "RTVAL-01 — Tenant ingestion":
   • Status: PASS if tenant accepted the package with NO format errors. FAIL otherwise.
   • Evidence: paths to the two screenshots.
   • Notes: any warnings Intune surfaced.

PASS: Intune accepted the upload and allowed assignment WITHOUT a format/extraction error. FAIL: tenant rejected the file, surfaced a parse error, or could not load detection metadata — record the exact error text verbatim in Notes.

Resume signal: reply "RTVAL-01 PASS" + screenshot paths, or "RTVAL-01 FAIL" with exact tenant error text. test -f .planning/phases/10-real-world-runtime-validation/evidence/rtval-01-tenant-upload.png && ! grep -A1 "RTVAL-01 — Tenant ingestion" .planning/phases/10-real-world-runtime-validation/RUNTIME-VALIDATION.md | grep -q "Status: PENDING" RTVAL-01 status is PASS or FAIL in the report; tenant upload screenshot committed; any FAIL has verbatim error text in Notes.

Task 2: RTVAL-02 — Install on device under SYSTEM; verify pnputil + $PSScriptRoot .planning/phases/10-real-world-runtime-validation/RUNTIME-VALIDATION.md, .planning/phases/10-real-world-runtime-validation/evidence/rtval-02-install-log.txt, .planning/phases/10-real-world-runtime-validation/evidence/rtval-02-install-status.png PAUSE for human technician. Requires physical/virtual access to the test Intune-managed Windows endpoint.

Technician MUST:

1. On the test device, force Intune sync: Settings → Accounts → Access work or school → Info → Sync (or restart IntuneManagementExtension).
2. Wait for Intune to push the assignment. Typical latency 5–30 minutes.
3. While install runs, open C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log and AgentExecutor.log.
4. After install completes, extract the block covering this app's install run and save as evidence/rtval-02-install-log.txt.
5. OBSERVE in the log — every item below MUST be visible: a. The install script ran under NT AUTHORITY\SYSTEM (script banner or process token). b. $PSScriptRoot resolved to the Intune app staging directory (not empty, not C:\Windows\system32). c. pnputil /add-driver (or equivalent) executed against the bundled driver folder and reported success (Driver package added successfully or Published Name:). d. Final script exit code is 0.
6. Also capture Intune portal view: Apps → the test app → Device install status → test device → Install status = "Installed". Screenshot as evidence/rtval-02-install-status.png.
7. Update RUNTIME-VALIDATION.md section "RTVAL-02":
   • Status: PASS only if ALL four observations hold. Otherwise FAIL with which observation failed.
   • Evidence: both file paths.

PASS: SYSTEM context + $PSScriptRoot resolved + pnputil staged drivers + exit 0. FAIL: ANY of the above missing. Record the exact log excerpt showing the failure in Notes; open a defect ticket in "Issues Found".

Resume signal: reply "RTVAL-02 PASS" + log path, or "RTVAL-02 FAIL" with failing observation and excerpt. test -f .planning/phases/10-real-world-runtime-validation/evidence/rtval-02-install-log.txt && ! grep -A1 "RTVAL-02 — Install under SYSTEM" .planning/phases/10-real-world-runtime-validation/RUNTIME-VALIDATION.md | grep -q "Status: PENDING" RTVAL-02 status is PASS or FAIL in the report; install log committed; for PASS the log shows SYSTEM, pnputil success, $PSScriptRoot resolved, and exit 0.

Task 3: RTVAL-03 — Confirm Intune detection rule reports Installed .planning/phases/10-real-world-runtime-validation/RUNTIME-VALIDATION.md, .planning/phases/10-real-world-runtime-validation/evidence/rtval-03-detection.png, .planning/phases/10-real-world-runtime-validation/evidence/rtval-03-detect-manual.txt PAUSE for human technician.

Technician MUST:

1. In Intune portal: Apps → the test app → Device install status → test device row → confirm "Installation status" = Installed (this is driven by the generated detect script).
2. On the endpoint itself, confirm the printer is present:
   • PowerShell (user context OK for verification only): Get-Printer | Where-Object Name -eq "<printer name>" returns a row.
   • OR open Settings → Bluetooth & devices → Printers & scanners → confirm printer visible.
3. Run the generated detect script manually once to cross-check:
   • Open admin PowerShell and execute the detect script; confirm exit code 0.
4. Screenshot Intune "Installed" status as evidence/rtval-03-detection.png.
5. Save detect script manual run transcript as evidence/rtval-03-detect-manual.txt.
6. Update RUNTIME-VALIDATION.md section "RTVAL-03":
   • Status: PASS if Intune shows Installed AND manual detect script exits 0 AND printer is visible. Otherwise FAIL.

PASS: Intune "Installed" + printer visible + detect script exit 0. FAIL: Intune shows "Not detected", manual detect non-zero, or printer missing. Record in Notes.

Resume signal: reply "RTVAL-03 PASS" + evidence paths, or "RTVAL-03 FAIL" with observed status. test -f .planning/phases/10-real-world-runtime-validation/evidence/rtval-03-detection.png && ! grep -A1 "RTVAL-03 — Detection rule" .planning/phases/10-real-world-runtime-validation/RUNTIME-VALIDATION.md | grep -q "Status: PENDING" RTVAL-03 status is PASS or FAIL; detection screenshot and manual-run transcript committed.

Task 4: RTVAL-04 — Intune uninstall removes printer cleanly under SYSTEM .planning/phases/10-real-world-runtime-validation/RUNTIME-VALIDATION.md, .planning/phases/10-real-world-runtime-validation/evidence/rtval-04-uninstall-log.txt, .planning/phases/10-real-world-runtime-validation/evidence/rtval-04-uninstall-status.png PAUSE for human technician.

Technician MUST:

1. In Intune portal: change the app assignment for the test device from Required to Uninstall (or remove assignment and add as Uninstall).
2. Force Intune sync on the device again. Wait for the uninstall to run.
3. Extract the uninstall run from IntuneManagementExtension.log and save as evidence/rtval-04-uninstall-log.txt.
4. OBSERVE in the log: a. Uninstall script ran under NT AUTHORITY\SYSTEM. b. Final script exit code 0.
5. On the endpoint, confirm the printer is GONE:
   • Get-Printer | Where-Object Name -eq "<printer name>" returns nothing.
   • OR Settings → Printers & scanners → printer no longer listed.
6. Confirm Intune portal shows "Not installed" for the test device.
7. Screenshot as evidence/rtval-04-uninstall-status.png.
8. Update RUNTIME-VALIDATION.md section "RTVAL-04":
   • Status: PASS if SYSTEM context + exit 0 + printer gone + Intune "Not installed". Otherwise FAIL with which check failed.

PASS: clean removal under SYSTEM, zero leftover printer artifacts. FAIL: printer still present, non-zero exit, or tenant shows install failure. Record in Notes.

Resume signal: reply "RTVAL-04 PASS" + evidence paths, or "RTVAL-04 FAIL" with failing check. test -f .planning/phases/10-real-world-runtime-validation/evidence/rtval-04-uninstall-log.txt && ! grep -A1 "RTVAL-04 — Uninstall under SYSTEM" .planning/phases/10-real-world-runtime-validation/RUNTIME-VALIDATION.md | grep -q "Status: PENDING" RTVAL-04 status is PASS or FAIL; uninstall log and status screenshot committed; printer confirmed removed on the device for PASS.

- evidence/rtval-01-tenant-upload.png exists - evidence/rtval-02-install-log.txt exists and shows SYSTEM + pnputil + $PSScriptRoot - evidence/rtval-03-detection.png exists and shows Installed - evidence/rtval-04-uninstall-log.txt exists and shows clean removal - RUNTIME-VALIDATION.md status lines for RTVAL-01..04 are PASS or FAIL (no PENDING)

<success_criteria> All four RTVAL checkpoint tasks have signaled a final status (PASS or FAIL) with evidence files committed to evidence/. Any FAIL has a corresponding "Issues Found" entry in the report with defect ticket or deferral rationale. </success_criteria>

After completion, create `.planning/phases/10-real-world-runtime-validation/10-02-live-intune-runtime-validation-SUMMARY.md`