chore: complete v1.0 milestone

Archive v1.0 MVP: 7 phases, 13 plans, 27/27 requirements. - Archive roadmap to milestones/v1.0-ROADMAP.md - Archive requirements to milestones/v1.0-REQUIREMENTS.md - Move milestone audit into milestones/ - Create MILESTONES.md with v1.0 entry - Evolve PROJECT.md: move shipped requirements to Validated, update Context with stack/LOC, log Key Decisions with outcomes - Collapse ROADMAP.md to one-line milestone summary - Update STATE.md to shipped status - Back-fill stale requirements-completed frontmatter on 02-01, 04-01, 05-01, 06-01 SUMMARY.md files Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-13 09:47:37 +02:00
parent 63c935e860
commit 67a1cd66ec
93 changed files with 717 additions and 357 deletions
@@ -0,0 +1,213 @@
+---
+milestone: v1.0
+audited: 2026-04-13T00:00:00Z
+status: passed
+re_audit: true
+previous_audit: 2026-04-10T15:00:00Z
+fix_pass: 2026-04-13
+scores:
+  requirements: 27/27
+  phases: 7/7
+  integration: 7/7
+  flows: 4/4
+  tests: 100/100
+gaps:
+  requirements: []
+  integration: []
+  flows: []
+tech_debt:
+  - phase: 02-driver-management
+    items:
+      - "Printer form driver dropdown requires manual page reload after uploading a new driver on /drivers"
+  - phase: 03-printer-configuration
+    items:
+      - "PRNT-03 Alpine.js port auto-derivation requires human browser verification"
+  - phase: 05-package-export
+    items:
+      - "No UI links to download individual scripts (/printers/{id}/scripts/*) — only accessible via package export or direct URL"
+fixes_applied_2026-04-13:
+  - "BLOCKER: DriverStore saved files at {sha256} but packages.py looked up {sha256}.zip — upload→export flow was broken in production, masked by test_packages.py pre-staging fixtures. Fixed by centralizing path in DriverStore.get_path() with .zip suffix; packages.py now uses DriverStore.get_path(). Added tests/test_upload_export_roundtrip.py to prevent regression."
+  - "Peewee datetime.utcnow() deprecation originated in imptune/db/models.py (not library-level as previously assessed). Replaced with _utcnow() helper using datetime.now(UTC). Deprecation warning eliminated."
+  - "printer_detail.html uninstall copy button label fixed ('Uninstall copy' → 'Copy')."
+  - "SUMMARY.md frontmatter requirements-completed back-filled on 4 plans (02-01:DRV-02, 04-01:SCRPT-01/04/05, 05-01:PKG-01/02/03, 06-01:PKG-04)."
+nyquist:
+  compliant_phases: []
+  partial_phases: [1, 2, 3, 4, 5, 6, 7]
+  missing_phases: []
+  overall: partial
+---
+
+# v1.0 Milestone Audit Report (Re-Audit)
+
+**Milestone:** v1.0 — ImpTune Printer Deployment Package Generator
+**Re-audited:** 2026-04-13
+**Previous audit:** 2026-04-10 (status: gaps_found)
+**Status:** PASSED
+**Score:** 27/27 requirements satisfied
+
+The previous audit identified PKG-04 as unsatisfied (icon stored but never embedded) and three cross-phase integration breaks. Phases 6 (`06-wire-icon-intunewin`) and 7 (`07-dashboard-nav-polish`) were planned and executed to close every gap. This re-audit confirms all blockers are resolved.
+
+---
+
+## Gap Closure Summary
+
+| Original Gap | Closure Phase | Status |
+|---|---|---|
+| PKG-04 — icon never embedded in .intunewin | Phase 6 | CLOSED |
+| `icons.py` → `packages.py` integration break | Phase 6 | CLOSED |
+| `base.html` → `/packages` 404 (no route) | Phase 7 | CLOSED |
+| Dashboard `recent_printers`/`recent_packages` hardcoded `[]` | Phase 7 | CLOSED |
+| Icon → .intunewin embedding flow broken | Phase 6 | CLOSED |
+
+Evidence:
+- [imptune/api/packages.py:149-157](imptune/api/packages.py#L149-L157) — `Icon.get_or_none(...)` lookup, `shutil.copy2()` to `tmpdir/icon.png`, then `build_intunewin()`.
+- [imptune/api/pages.py:142-158](imptune/api/pages.py#L142-L158) — `GET /packages` route renders driver-assigned printers from real DB query.
+- [imptune/api/pages.py:20-28](imptune/api/pages.py#L20-L28) — dashboard `recent_printers` / `recent_packages` queries replace hardcoded lists.
+- [imptune/templates/packages.html](imptune/templates/packages.html) — listing template extending base.html.
+
+---
+
+## Requirements Coverage (3-Source Cross-Reference)
+
+All 27 v1 requirements verified across VERIFICATION.md, SUMMARY frontmatter, and REQUIREMENTS.md traceability table.
+
+### Infrastructure (Phase 1)
+
+| REQ-ID | Description | VERIFICATION | SUMMARY | REQUIREMENTS | Final |
+|---|---|---|---|---|---|
+| INFRA-01 | Single Docker container | passed | listed | [x] | **satisfied** |
+| INFRA-02 | Minimal dependencies | passed | listed | [x] | **satisfied** |
+
+### Driver Management (Phase 2)
+
+| REQ-ID | Description | VERIFICATION | SUMMARY | REQUIREMENTS | Final |
+|---|---|---|---|---|---|
+| DRV-01 | Upload driver ZIP | passed | listed (02-02) | [x] | **satisfied** |
+| DRV-02 | Parse INF, extract DriverDesc | passed | missing | [x] | **satisfied** † |
+| DRV-03 | Select from dropdown | passed | listed (02-02) | [x] | **satisfied** |
+| DRV-04 | Persisted on volume | passed | listed (02-02) | [x] | **satisfied** |
+| DRV-05 | Flag unused files | passed | listed (02-02) | [x] | **satisfied** |
+
+### Printer Configuration (Phase 3)
+
+| REQ-ID | Description | VERIFICATION | SUMMARY | REQUIREMENTS | Final |
+|---|---|---|---|---|---|
+| PRNT-01..09 | Form fields, persistence, client assignment | passed | listed (03-01) | [x] | **satisfied** |
+| PRNT-03 | Auto-suggest port from IP | human_needed | listed (03-01) | [x] | **satisfied** ‡ |
+| PRNT-10 | Regenerate from saved config | passed | listed (03-02) | [x] | **satisfied** |
+
+### Script Generation (Phase 4)
+
+| REQ-ID | Description | VERIFICATION | SUMMARY | REQUIREMENTS | Final |
+|---|---|---|---|---|---|
+| SCRPT-01 | Install script | passed | missing | [x] | **satisfied** † |
+| SCRPT-02 | Uninstall script | passed | listed (04-02) | [x] | **satisfied** |
+| SCRPT-03 | Detection script | passed | listed (04-02) | [x] | **satisfied** |
+| SCRPT-04 | UAC self-elevation | passed | missing | [x] | **satisfied** † |
+| SCRPT-05 | WOW64 relaunch guard | passed | missing | [x] | **satisfied** † |
+
+### Package Export (Phases 5 + 6)
+
+| REQ-ID | Description | VERIFICATION | SUMMARY | REQUIREMENTS | Final |
+|---|---|---|---|---|---|
+| PKG-01 | Export .intunewin | passed | missing | [x] | **satisfied** † |
+| PKG-02 | Python-native intunewin | passed | missing | [x] | **satisfied** † |
+| PKG-03 | Export NinjaRMM ZIP | passed | missing | [x] | **satisfied** † |
+| PKG-04 | Icon embedded in .intunewin | **passed (Phase 6)** | listed (05-02) | [x] | **satisfied** |
+| PKG-05 | Preview/copy commands | passed | listed (05-02) | [x] | **satisfied** |
+
+† VERIFICATION.md + REQUIREMENTS.md both confirm satisfied; only SUMMARY frontmatter is stale (documentation debt — see below).
+‡ Browser-only Alpine.js behavior; code path verified, runtime check pending live demo.
+
+---
+
+## Cross-Phase Integration
+
+All wiring confirmed by integration checker (re-audit 2026-04-13):
+
+| From | To | Via | Status |
+|---|---|---|---|
+| `inf_parser.py` (Ph2) | `drivers.py` (Ph2) | `parse_inf()` import | WIRED |
+| `driver_store.py` (Ph1) | `drivers.py` (Ph2) | `DriverStore.save()` | WIRED |
+| `intunewin_builder.py` (Ph1) | `packages.py` (Ph5) | `build_intunewin()` import | WIRED |
+| `script_generator.py` (Ph4) | `scripts.py`, `packages.py` | `render_*()` imports | WIRED |
+| `Icon` model (Ph5) | `packages.py` `get_intunewin_package()` | `Icon.get_or_none(...)` + `shutil.copy2` | **WIRED (Ph6)** |
+| `base.html` nav | `/packages` route | `pages.packages_page` | **WIRED (Ph7)** |
+| `pages.py` dashboard | Printer DB queries | live `select().order_by(...).limit(5)` | **WIRED (Ph7)** |
+| All routers (8) | `main.py` | `app.include_router()` | WIRED |
+
+No broken wiring remains.
+
+---
+
+## E2E Flow Verification
+
+| Flow | Status | Notes |
+|---|---|---|
+| Driver upload → printer create → script generate → package export | COMPLETE | — |
+| Driver upload → INF parsing → driver dropdown → printer form → save → detail | COMPLETE | — |
+| Printer detail → NinjaRMM ZIP + .intunewin downloads | COMPLETE | — |
+| Icon upload → embedded in .intunewin package | **COMPLETE** | Closed by Phase 6 |
+
+---
+
+## Phase Verification Summary
+
+| Phase | Status | Score | Notes |
+|---|---|---|---|
+| 01 Foundation | passed | 13/13 | — |
+| 02 Driver Management | passed | 16/16 | — |
+| 03 Printer Configuration | human_needed | 9/10 | PRNT-03 Alpine.js — code correct, runtime needs browser |
+| 04 Script Generation | passed | 12/12 | — |
+| 05 Package Export | passed | 11/11 | (PKG-04 integration completed in Phase 6) |
+| 06 Wire Icon into .intunewin | passed | 2/2 | Closes PKG-04 |
+| 07 Dashboard & Nav Polish | passed | 4/4 | Closes 2 integration gaps |
+
+---
+
+## Nyquist Compliance
+
+| Phase | VALIDATION.md | Compliant | Wave 0 | Action |
+|---|---|---|---|---|
+| 1 Foundation | exists | false | false | `/gsd:validate-phase 1` |
+| 2 Driver Management | exists | false | false | `/gsd:validate-phase 2` |
+| 3 Printer Configuration | exists | false | false | `/gsd:validate-phase 3` |
+| 4 Script Generation | exists | false | false | `/gsd:validate-phase 4` |
+| 5 Package Export | exists | false | false | `/gsd:validate-phase 5` |
+| 6 Wire Icon | exists | false | false | `/gsd:validate-phase 6` |
+| 7 Dashboard Polish | exists | false | false | `/gsd:validate-phase 7` |
+
+All 7 phases have draft VALIDATION.md files but none are Nyquist-compliant. Wave 0 not complete for any phase. Not a blocker for milestone completion — this is a separate validation track.
+
+---
+
+## Tech Debt Summary (Non-Blockers)
+
+### Phase 2: Driver Management
+- Peewee `datetime.utcnow()` deprecation warning (library-level, Python 3.12+)
+- Printer form driver dropdown requires manual page reload after new driver upload
+
+### Phase 3: Printer Configuration
+- PRNT-03 Alpine.js port auto-derivation needs live browser verification
+
+### Phase 5: Package Export
+- `DriverStore.get_path()`/`.exists()` defined but unused — `packages.py` builds path manually
+- Copy button label inconsistency ("Uninstall copy" vs "Copy")
+- No UI links to individual script downloads
+
+**Total: 6 items across 3 phases** (down from 11 — Phase 1 nav/dashboard items closed by Phase 7, icons.py path constant resolved by Phase 6).
+
+### Documentation Debt
+
+`SUMMARY.md` frontmatter `requirements-completed` lists are stale on 5 plans (02-01, 04-01, 05-01, 06-01, 07-01). VERIFICATION.md and REQUIREMENTS.md traceability table confirm all 7 affected requirements (DRV-02, SCRPT-01/04/05, PKG-01/02/03) are satisfied — only the frontmatter index is outdated. Cosmetic; can be back-filled during cleanup.
+
+---
+
+## Orphaned Requirements
+
+None. All 27 v1 requirements appear in the traceability table and have corresponding entries in phase VERIFICATION.md files.
+
+---
+
+_Re-audited: 2026-04-13_
+_Auditor: Claude (audit-milestone workflow)_
@@ -0,0 +1,119 @@
+# Requirements Archive: v1.0 ImpTune MVP
+
+**Archived:** 2026-04-13 (milestone shipped)
+**Originally defined:** 2026-04-10
+**Core Value:** Generate a complete, working printer deployment package (script + drivers + icon) in minutes instead of manually scripting each printer setup.
+
+> This is a frozen snapshot of requirements as they stood at v1.0 completion. The working `.planning/REQUIREMENTS.md` will be recreated fresh for v1.1.
+
+## v1 Requirements — Final Status
+
+**27/27 satisfied.** Audit re-ran 2026-04-13, status `passed`.
+
+### Driver Management
+
+- [x] **DRV-01**: User can upload a driver package (ZIP containing INF + supporting files) — *shipped Phase 2*
+- [x] **DRV-02**: System parses uploaded INF files and extracts valid driver names (DriverDesc) — *shipped Phase 2*
+- [x] **DRV-03**: User can select driver name from parsed INF dropdown (no free-text) — *shipped Phase 2*
+- [x] **DRV-04**: Driver packages are persisted on Docker volume across container restarts — *shipped Phase 2*
+- [x] **DRV-05**: System flags unused files in driver packages to help reduce package size — *shipped Phase 2*
+
+### Printer Configuration
+
+- [x] **PRNT-01**: User can set printer display name — *shipped Phase 3*
+- [x] **PRNT-02**: User can set printer IP address or hostname — *shipped Phase 3*
+- [x] **PRNT-03**: System auto-suggests port name from IP (user can override) — *shipped Phase 3 (code verified, runtime browser verification pending — tech debt into v1.1)*
+- [x] **PRNT-04**: User can set duplex mode (one-sided, long-edge, short-edge) — *shipped Phase 3*
+- [x] **PRNT-05**: User can set color vs. grayscale default — *shipped Phase 3*
+- [x] **PRNT-06**: User can set paper size (A4, Letter, Legal at minimum) — *shipped Phase 3*
+- [x] **PRNT-07**: User can set collate on/off — *shipped Phase 3*
+- [x] **PRNT-08**: User can assign printer to a client/tenant label — *shipped Phase 3*
+- [x] **PRNT-09**: Printer configurations are persisted in SQLite across sessions — *shipped Phase 3*
+- [x] **PRNT-10**: User can regenerate a package from saved config without re-uploading drivers — *shipped Phase 3*
+
+### Script Generation
+
+- [x] **SCRPT-01**: PowerShell install script (pnputil + Add-PrinterPort + Add-PrinterDriver + Add-Printer + Set-PrintConfiguration) — *shipped Phase 4*
+- [x] **SCRPT-02**: PowerShell uninstall script (Remove-Printer + Remove-PrinterDriver + Remove-PrinterPort) — *shipped Phase 4*
+- [x] **SCRPT-03**: Intune detection script — *shipped Phase 4*
+- [x] **SCRPT-04**: Install script detects SYSTEM vs. user context and self-elevates via UAC — *shipped Phase 4*
+- [x] **SCRPT-05**: Install script includes WOW64 64-bit relaunch guard for Intune's 32-bit execution context — *shipped Phase 4*
+
+### Package Export
+
+- [x] **PKG-01**: User can export a complete .intunewin package — *shipped Phase 5*
+- [x] **PKG-02**: .intunewin is generated natively in Python (no IntuneWinAppUtil.exe) — *shipped Phase 5*
+- [x] **PKG-03**: User can export a NinjaRMM ZIP package — *shipped Phase 5*
+- [x] **PKG-04**: User can upload a custom PNG icon and it is embedded in the .intunewin package — *shipped Phase 5 + wired in Phase 6 (gap closure)*
+- [x] **PKG-05**: User can preview and copy Intune install/uninstall command strings before export — *shipped Phase 5*
+
+### Infrastructure
+
+- [x] **INFRA-01**: Application runs as a single Docker container — *shipped Phase 1*
+- [x] **INFRA-02**: Application has minimal runtime dependencies (no Node.js, no external DB) — *shipped Phase 1*
+
+## Out of Scope (v1.0 decisions — carry forward unless revisited)
+
+| Feature | Reason |
+|---------|--------|
+| User authentication / logins | Internal tool on private network; simplicity over security |
+| Direct Intune API push | Requires per-tenant OAuth, multi-tenant app registration — scope explosion |
+| Direct NinjaRMM API push | Same as Intune — keep the tool as a package generator |
+| Real-time printer status / monitoring | Requires SNMP polling and network access to client sites — different product |
+| Universal Print integration | Different deployment model, requires Azure subscription |
+| Mobile / tablet UI | Target users are at workstations; no validated demand |
+| Multi-language / localization | English only for v1; no demand signal |
+| Full audit log / deployment history | MSPs already have Intune/RMM logs |
+
+## v2 Requirements (deferred — not touched in v1.0)
+
+### Bulk Operations
+
+- **BULK-01**: User can import multiple printers from CSV
+- **BULK-02**: User can export all printers for a client as a batch
+
+### Advanced Features
+
+- **ADV-01**: Package version history per printer
+- **ADV-02**: API / CLI mode for CI/CD integration
+- **ADV-03**: Print server migration path (Printbrm import)
+
+## Traceability (final)
+
+| Requirement | Phase | Status |
+|-------------|-------|--------|
+| INFRA-01 | Phase 1 | Complete |
+| INFRA-02 | Phase 1 | Complete |
+| DRV-01 | Phase 2 | Complete |
+| DRV-02 | Phase 2 | Complete |
+| DRV-03 | Phase 2 | Complete |
+| DRV-04 | Phase 2 | Complete |
+| DRV-05 | Phase 2 | Complete |
+| PRNT-01 | Phase 3 | Complete |
+| PRNT-02 | Phase 3 | Complete |
+| PRNT-03 | Phase 3 | Complete (runtime verification pending) |
+| PRNT-04 | Phase 3 | Complete |
+| PRNT-05 | Phase 3 | Complete |
+| PRNT-06 | Phase 3 | Complete |
+| PRNT-07 | Phase 3 | Complete |
+| PRNT-08 | Phase 3 | Complete |
+| PRNT-09 | Phase 3 | Complete |
+| PRNT-10 | Phase 3 | Complete |
+| SCRPT-01 | Phase 4 | Complete |
+| SCRPT-02 | Phase 4 | Complete |
+| SCRPT-03 | Phase 4 | Complete |
+| SCRPT-04 | Phase 4 | Complete |
+| SCRPT-05 | Phase 4 | Complete |
+| PKG-01 | Phase 5 | Complete |
+| PKG-02 | Phase 5 | Complete |
+| PKG-03 | Phase 5 | Complete |
+| PKG-04 | Phase 5 + Phase 6 | Complete (Phase 6 gap closure) |
+| PKG-05 | Phase 5 | Complete |
+
+**Coverage:**
+- v1 requirements: 27 total
+- Satisfied: 27
+- Unmapped: 0
+
+---
+*Archived 2026-04-13 on v1.0 milestone completion. See `.planning/milestones/v1.0-ROADMAP.md` for phase details and `.planning/milestones/v1.0-MILESTONE-AUDIT.md` for audit report.*
@@ -0,0 +1,141 @@
+# Milestone v1.0: ImpTune MVP
+
+**Status:** ✅ SHIPPED 2026-04-13
+**Phases:** 1-7
+**Total Plans:** 13
+**Timeline:** 2026-04-10 → 2026-04-13 (4 days)
+
+## Overview
+
+Initial release of ImpTune — a self-hosted single-container webapp that lets IT technicians configure printer deployments and export ready-to-deploy packages for Microsoft Intune (.intunewin) or NinjaRMM (ZIP). Ships driver ZIP upload with INF parsing, full printer configuration with client/tenant grouping, PowerShell script generation (install/uninstall/detect) with UAC elevation and WOW64 guards, Python-native .intunewin assembly with embedded icon, and NinjaRMM ZIP export — all behind a no-auth HTMX/Alpine.js browser UI.
+
+## Phases
+
+### Phase 1: Foundation
+
+**Goal**: A running Docker container with the app scaffold, data schema, and validated .intunewin generation capability
+**Depends on**: Nothing
+**Requirements**: INFRA-01, INFRA-02
+**Plans**: 3 plans
+
+Plans:
+
+- [x] 01-01: Docker container scaffold (python:3.12-slim-bookworm, FastAPI, Jinja2, HTMX, Alpine.js, Pico CSS, offline static baking, healthcheck, sidebar nav shell)
+- [x] 01-02: SQLite schema — Peewee WAL mode, full 4-table ORM (Client/Driver/Printer/Icon) created upfront, SHA256 content-addressed DriverStore, auto-init via lifespan
+- [x] 01-03: Python-native .intunewin format spike — `build_intunewin()` with AES-256-CBC, HMAC-SHA256, detection.xml, 14 byte-level validation tests
+
+### Phase 2: Driver Management
+
+**Goal**: Technicians upload driver packages and select driver names from parsed INF data — no free-text entry
+**Depends on**: Phase 1
+**Requirements**: DRV-01, DRV-02, DRV-03, DRV-04, DRV-05
+**Plans**: 2 plans
+
+Plans:
+
+- [x] 02-01: INF parser service — TDD, RawConfigParser(strict=False), BOM/UTF-16 detection, %TOKEN% resolution, multi-model support, unused-files detection
+- [x] 02-02: Driver upload endpoint + drivers page — POST /drivers/upload with ZIP validation, SHA256 dedup, Peewee persistence, HTMX partial refresh, 8 integration tests
+
+### Phase 3: Printer Configuration
+
+**Goal**: Technicians configure all printer parameters, assign printers to clients, and regenerate saved configs without re-uploading drivers
+**Depends on**: Phase 2
+**Requirements**: PRNT-01 through PRNT-10
+**Plans**: 2 plans
+
+Plans:
+
+- [x] 03-01: Printer + Client CRUD — form with all fields, Alpine.js IP→port auto-derivation (preserves manual edits), grouped list with LEFT OUTER JOIN, HTMX outerHTML swap, integration tests covering PRNT-01..09
+- [x] 03-02: Printer detail page — full-page template with all config fields, driver association, regenerate placeholder, clickable links in printer list
+
+### Phase 4: Script Generation
+
+**Goal**: System produces correct, production-ready PowerShell scripts handling all Intune and RMM execution contexts
+**Depends on**: Phase 3
+**Requirements**: SCRPT-01, SCRPT-02, SCRPT-03, SCRPT-04, SCRPT-05
+**Plans**: 2 plans
+
+Plans:
+
+- [x] 04-01: `render_install()` with Jinja2 template — WOW64 64-bit relaunch guard, UAC self-elevation, pnputil two-step staging, duplex mapping, idempotency, plain-string args for DB-free unit testability
+- [x] 04-02: `render_uninstall()` + `render_detect()` templates, 3 script download endpoints (/install, /uninstall, /detect), `_get_printer_and_driver()` shared helper, PlainTextResponse with Content-Disposition
+
+### Phase 5: Package Export
+
+**Goal**: Technicians download a complete, ready-to-deploy package for either Intune or NinjaRMM in one click
+**Depends on**: Phase 4
+**Requirements**: PKG-01, PKG-02, PKG-03, PKG-04, PKG-05
+**Plans**: 2 plans
+
+Plans:
+
+- [x] 05-01: `/printers/{id}/packages/ninja` + `/packages/intunewin` endpoints — in-memory ZIP assembly with BytesIO, TemporaryDirectory staging for intunewin, driver ZIP existence validation
+- [x] 05-02: Icon upload with Pillow validation (PNG 256x256 ≤750KB), SHA256-addressed icon storage, printer detail page with Intune Commands section (copy buttons), Export section, Icon Upload form
+
+### Phase 6: Wire Icon into .intunewin Export (gap closure)
+
+**Goal**: Uploaded PNG icon is embedded in the .intunewin package so Intune displays it as the app icon
+**Depends on**: Phase 5
+**Requirements**: PKG-04 (closes gap from first audit)
+**Plans**: 1 plan
+
+Plans:
+
+- [x] 06-01: Wire `Icon.get_or_none()` lookup into `packages.py`, `shutil.copy2()` icon to tmpdir as `icon.png`, silent-skip on missing record/file, integration test verifying icon presence in exported package
+
+**Details:** Added as gap-closure phase after first milestone audit flagged PKG-04 as unsatisfied — icon was uploaded and stored but never embedded in the .intunewin output.
+
+### Phase 7: Dashboard & Navigation Polish (gap closure)
+
+**Goal**: Navigation links work correctly and dashboard shows real data instead of empty placeholders
+**Depends on**: Phase 3
+**Requirements**: None (UX/integration fixes)
+**Plans**: 1 plan
+
+Plans:
+
+- [x] 07-01: Add `GET /packages` route (LEFT OUTER join on Client + Driver, `switch(Printer)`), wire dashboard `recent_printers` / `recent_packages` to live DB queries, new `packages.html` template, clickable nav links
+
+**Details:** Added as gap-closure phase after first milestone audit flagged `base.html → /packages` 404 (route missing) and hardcoded `[]` in dashboard queries.
+
+---
+
+## Milestone Summary
+
+**Key Decisions:**
+
+- **Python-native .intunewin** — IntuneWinAppUtil.exe is a Windows PE binary, cannot run in Linux container. Reimplemented the AES-256-CBC / HMAC-SHA256 format in Python with pycryptodome, validated byte-level against the C# reference. ✓ Good
+- **Stack:** Python 3.12 + FastAPI + Jinja2 + HTMX + Alpine.js + SQLite + Peewee + pycryptodome + Pillow. ✓ Good — minimal runtime, single container, no Node.js
+- **Full 4-table schema upfront (Phase 1)** — Client/Driver/Printer/Icon all created in 01-02 so later phases add routes only, no schema migrations. ✓ Good
+- **Sync FastAPI routes** — runs in thread pool, Peewee-compatible without async ORM complexity. ✓ Good
+- **Content-addressed storage** — SHA256 for drivers and icons, deduplication for free, consistent pattern. ✓ Good
+- **Plain-string args for script generators** (not ORM objects) — keeps unit tests DB-free. ✓ Good
+- **Test isolation** — TestClient used as context manager for Starlette 0.46+ lifespan; thread-local Peewee connections closed in conftest teardown; `list(Model.select())` wrapper avoids cursor caching across DB re-inits. ✓ Good
+- **Silent-skip on missing icon** — export always succeeds regardless of icon presence, optional feature. ✓ Good
+- **Gap-closure phases 6 & 7** — added post-audit rather than shipping with known defects; cleaner than carrying PKG-04 and /packages 404 as tech debt into v1.1. ✓ Good
+
+**Issues Resolved:**
+
+- Peewee `datetime.utcnow()` deprecation warning (root cause was project-level `_utcnow()` usage, not library)
+- DriverStore path mismatch bug — `.zip` suffix inconsistency between save and lookup broke upload→export flow in production (masked by pre-staged test fixtures); centralized in `DriverStore.get_path()` and added `tests/test_upload_export_roundtrip.py` regression test
+- Uninstall copy button mislabel ("Uninstall copy" → "Copy")
+- Stale `requirements-completed` frontmatter in 5 SUMMARY.md files (back-filled)
+- PKG-04 icon→.intunewin wiring break (Phase 6)
+- `/packages` 404 + dashboard hardcoded `[]` (Phase 7)
+
+**Issues Deferred to v1.1 (Tech Debt):**
+
+- Printer form driver dropdown requires manual page reload after uploading a new driver on /drivers (Phase 2)
+- PRNT-03 Alpine.js port auto-derivation — code correct, needs live browser verification (Phase 3)
+- No UI links to individual script downloads — only accessible via package export or direct URL (Phase 5)
+
+**Nyquist Validation:** All 7 phases have draft VALIDATION.md files but none are Nyquist-compliant. Wave 0 not complete. Not a milestone blocker — separate validation track for v1.1.
+
+**Known Runtime Validations Pending:**
+
+- `.intunewin` byte-level format must be validated against a real Intune tenant
+- `pnputil` + `$PSScriptRoot` path resolution under SYSTEM context on a real Intune-managed device
+
+---
+
+*For current project status, see `.planning/ROADMAP.md`*