---
phase: 11-real-world-rollout-feedback
plan: 02
type: execute
wave: 2
depends_on:
  - 11-01
files_modified:
  - .planning/phases/11-real-world-rollout-feedback/deploy/ROLLOUT-RUN.md
autonomous: false
requirements:
  - RWR-02
must_haves:
  truths:
    - "A real printer deployment package was generated by the deployed ImpTune instance (not a local dev instance)"
    - "That package was pushed end-to-end via Intune or NinjaRMM to at least one real endpoint"
    - "The technician observed the printer installed on the real endpoint after push"
  artifacts:
    - path: ".planning/phases/11-real-world-rollout-feedback/deploy/ROLLOUT-RUN.md"
      provides: "Rollout run record: package name, printer model, source ImpTune URL, delivery channel (Intune/Ninja), target endpoint, install result"
      contains: "delivery_channel:"
  key_links:
    - from: "Deployed ImpTune instance (from 11-01)"
      to: "Real endpoint"
      via: "Intune or NinjaRMM package assignment"
      pattern: "delivery_channel: (intune|ninjarmm)"
---

<objective>
Use the ImpTune instance deployed in Plan 11-01 to generate a real printer deployment package and push it end-to-end to at least one real endpoint via Intune or NinjaRMM. Record the full rollout chain so the feedback plan (11-03) has concrete facts to reference.

Purpose: RWR-02 requires that the deployed instance actually produces value — not just that it runs. "Package reached real endpoints" is the core proof.

Output: A real printer visible on a real endpoint, plus `.planning/phases/11-real-world-rollout-feedback/deploy/ROLLOUT-RUN.md` recording the rollout.
</objective>

<execution_context>
@C:/Users/SebastienQUEROL/.claude/get-shit-done/workflows/execute-plan.md
@C:/Users/SebastienQUEROL/.claude/get-shit-done/templates/summary.md
</execution_context>

<context>
@.planning/phases/11-real-world-rollout-feedback/deploy/DEPLOYMENT.md
@.planning/phases/11-real-world-rollout-feedback/11-01-deploy-container-to-msp-SUMMARY.md
@.planning/phases/10-real-world-runtime-validation/RUNTIME-VALIDATION.md
</context>

<tasks>

<task type="auto">
  <name>Task 1: Scaffold ROLLOUT-RUN.md</name>
  <files>.planning/phases/11-real-world-rollout-feedback/deploy/ROLLOUT-RUN.md</files>
  <action>
    Create `.planning/phases/11-real-world-rollout-feedback/deploy/ROLLOUT-RUN.md` with the following fields (placeholders the human will fill in Task 2):

    - Title: `# ImpTune v1.1 Rollout — First Real Package Run`
    - Source instance:
      - `imptune_url:` (copy from DEPLOYMENT.md)
      - `imptune_commit_sha:` (copy from DEPLOYMENT.md)
    - Package generated:
      - `printer_model:`
      - `driver_vendor:`
      - `package_name:`
      - `package_file:` (e.g. `FloorPrinter_A.intunewin`)
      - `generated_at:` (ISO8601)
    - Delivery channel (exactly one):
      - `delivery_channel:` — `intune` OR `ninjarmm`
      - If intune: `tenant:`, `app_id:`, `assigned_group:`
      - If ninjarmm: `org:`, `policy_or_script_id:`, `target_device_group:`
    - Target endpoint:
      - `device_name:`
      - `os_build:`
      - `push_started_at:`
      - `install_observed_at:`
    - Outcome:
      - `printer_visible_on_endpoint:` (yes/no)
      - `evidence:` (path to screenshot or log excerpt, or short attestation line if human-only)
      - `issues_encountered:` (free text, bullet list)

    Pre-fill `imptune_url:` and `imptune_commit_sha:` by reading DEPLOYMENT.md. Do NOT attempt to call Intune/NinjaRMM APIs — delivery is human-driven in Task 2.
  </action>
  <verify>
    <automated>test -f .planning/phases/11-real-world-rollout-feedback/deploy/ROLLOUT-RUN.md && grep -q "delivery_channel:" .planning/phases/11-real-world-rollout-feedback/deploy/ROLLOUT-RUN.md && grep -q "imptune_url: http" .planning/phases/11-real-world-rollout-feedback/deploy/ROLLOUT-RUN.md</automated>
  </verify>
  <done>ROLLOUT-RUN.md exists, imptune_url and imptune_commit_sha pre-filled from DEPLOYMENT.md, all other fields are explicit placeholders.</done>
</task>

<task type="checkpoint:human-action" gate="blocking">
  <name>Task 2: Human — generate real package via deployed instance and push to real endpoint</name>
  <files>(human-driven — no files written directly by agent; updates DEPLOYMENT.md / ROLLOUT-RUN.md / v1.1-rollout.md as specified in the action)</files>
  <action>
    CHECKPOINT — human action required. Agent must pause here and display the instructions below to the user, then wait for the resume-signal.

    Built so far: ROLLOUT-RUN.md scaffold with source instance facts pre-filled.

    Steps for the human operator:
Human-only steps (requires Intune/NinjaRMM tenant + real target endpoint — no CLI the agent owns can perform these):

    1. Open the deployed ImpTune URL (`imptune_url:` from DEPLOYMENT.md) in a browser.
    2. Upload the real printer driver (any real printer model in the MSP fleet — not the Phase 10 test printer unless that's still the target).
    3. Create a printer in the form (name, IP, driver, model). Confirm port auto-fill works (UX-02 already validated, but spot-check).
    4. Export the package from the printer detail page — download the `.intunewin`.
    5. Push via ONE of the two channels:
       - **Intune**: Upload `.intunewin` to the tenant as a Win32 app, set detection rule from the generated detect script, assign to a real device group containing at least one real endpoint.
       - **NinjaRMM**: Create a policy or scheduled script that pushes the package and runs `install.ps1`, target at least one real endpoint.
    6. Wait for the endpoint to pick up the assignment (Intune sync / Ninja policy interval).
    7. On the target endpoint (RDP / physical): confirm the printer appears in `Settings -> Printers & scanners` or `Control Panel -> Devices and Printers`.
    8. Capture evidence (screenshot preferred; log excerpt acceptable). Save under `.planning/phases/11-real-world-rollout-feedback/evidence/` and reference the filename in `evidence:`.
    9. Fill in every blank field in ROLLOUT-RUN.md, including `printer_visible_on_endpoint:` and `issues_encountered:`.
    10. Commit ROLLOUT-RUN.md (+ evidence files).

    Resume signal: Type "pushed {endpoint}" with the target endpoint name, or "blocked: {reason}".
  </action>
  <verify>
    <automated>MISSING — checkpoint is human-gated; verification is operator attestation captured via the resume-signal. Agent should confirm the referenced artifact file was updated (e.g. grep for the newly-filled field in the target doc) before accepting the resume signal.</automated>
  </verify>
  <done>Human operator has performed the steps above, updated the referenced artifact, and replied with the resume signal.</done>
</task>

<task type="checkpoint:human-verify" gate="blocking">
  <name>Task 3: Verify ROLLOUT-RUN.md is complete and the printer is live on the endpoint</name>
  <files>(human-driven — no files written directly by agent; updates DEPLOYMENT.md / ROLLOUT-RUN.md / v1.1-rollout.md as specified in the action)</files>
  <action>
    CHECKPOINT — human action required. Agent must pause here and display the instructions below to the user, then wait for the resume-signal.

    Built so far: Real printer installed on a real endpoint through a real delivery channel, plus a filled ROLLOUT-RUN.md.

    Steps for the human operator:
1. Open ROLLOUT-RUN.md — no blank placeholder fields remain.
    2. `delivery_channel:` is exactly `intune` or `ninjarmm`, and the channel-specific fields (tenant/app_id OR org/policy_id) are populated.
    3. `printer_visible_on_endpoint:` is `yes`.
    4. `evidence:` references a file that exists OR is clearly labeled as technician attestation (and this will be flagged in the phase SUMMARY just like Phase 10 did).
    5. Re-confirm on the target endpoint that the printer still prints a test page (optional but strongly recommended — catches "installed but broken" gap).

    Resume signal: Type "verified" or list the gaps.
  </action>
  <verify>
    <automated>MISSING — checkpoint is human-gated; verification is operator attestation captured via the resume-signal. Agent should confirm the referenced artifact file was updated (e.g. grep for the newly-filled field in the target doc) before accepting the resume signal.</automated>
  </verify>
  <done>Human operator has performed the steps above, updated the referenced artifact, and replied with the resume signal.</done>
</task>

</tasks>

<verification>
- ROLLOUT-RUN.md is fully filled
- delivery_channel is one of {intune, ninjarmm} with the corresponding subfields populated
- Printer is confirmed visible on the real endpoint
</verification>

<success_criteria>
A package generated by the deployed ImpTune instance (not a local dev build) was pushed to a real endpoint via Intune or NinjaRMM and the printer is installed and visible on that endpoint, with the full chain recorded in ROLLOUT-RUN.md.
</success_criteria>

<output>
After completion, create `.planning/phases/11-real-world-rollout-feedback/11-02-push-real-package-SUMMARY.md`
</output>
