diff --git a/.planning/REQUIREMENTS.md b/.planning/REQUIREMENTS.md
new file mode 100644
index 0000000..6285fae
--- /dev/null
+++ b/.planning/REQUIREMENTS.md
@@ -0,0 +1,124 @@
+# Requirements: Ready2Blob
+
+**Defined:** 2026-03-26
+**Core Value:** An IT pro can go from zero to a deployable rclone setup in minutes — without needing to know rclone's config syntax or PowerShell deployment conventions.
+
+## v1 Requirements
+
+### Wizard & Navigation
+
+- [ ] **WIZD-01**: User can select a storage backend from a popularity-sorted list (Azure Blob and S3 shown first)
+- [ ] **WIZD-02**: User navigates a multi-step wizard: backend selection → backend config → deployment options → review/download
+- [ ] **WIZD-03**: User can go back to previous steps without losing entered data
+- [ ] **WIZD-04**: User can set a custom remote name (validated: alphanumeric, dash, underscore only)
+
+### Backends
+
+- [ ] **BACK-01**: User can configure an Azure Blob Storage remote (storage account name, authentication method: SAS token or access key)
+- [ ] **BACK-02**: User can configure an Amazon S3 remote (access key ID, secret access key, region)
+- [ ] **BACK-03**: User can configure an S3-compatible remote via endpoint override (same form as S3 with optional endpoint field — covers Wasabi, MinIO, Cloudflare R2)
+
+### Config Generation
+
+- [ ] **CONF-01**: App generates a valid rclone.conf file (INI format, correct key/value pairs per backend type)
+- [ ] **CONF-02**: User sees a live preview of the generated rclone.conf content as they fill the form
+- [ ] **CONF-03**: User can copy the rclone.conf content to clipboard
+
+### Deployment Scripts
+
+- [ ] **DEPL-01**: App generates a PowerShell install script for MS Intune (runs as SYSTEM, places config at machine-wide path, idempotent, correct exit codes)
+- [ ] **DEPL-02**: App generates a separate Intune detection script (checks rclone.exe presence at install path AND config file presence; exits 0 if both found)
+- [ ] **DEPL-03**: App generates a PowerShell script for RMM tools (generic SYSTEM-context, idempotent, works across NinjaRMM/Datto/ConnectWise)
+- [ ] **DEPL-04**: User can toggle "Include rclone installation" to add rclone binary download step to generated scripts
+- [ ] **DEPL-05**: User can choose config deployment path: machine-wide (`C:\ProgramData\rclone\`) vs user profile (`%APPDATA%\rclone\`)
+
+### Download
+
+- [ ] **DOWN-01**: User can download the rclone.conf file individually
+- [ ] **DOWN-02**: User can download the Intune install script individually
+- [ ] **DOWN-03**: User can download the Intune detection script individually
+- [ ] **DOWN-04**: User can download the RMM script individually
+- [ ] **DOWN-05**: User can download all artifacts as a single ZIP bundle
+- [ ] **DOWN-06**: User can copy any output block to clipboard directly (for RMM paste-in-field workflows)
+
+### Security & Trust
+
+- [ ] **SECU-01**: App displays a security warning (credentials are plaintext in generated files) that user must acknowledge before any download is enabled
+- [ ] **SECU-02**: App prominently states that no data is sent to any server (client-side generation only)
+- [ ] **SECU-03**: Wizard state is never persisted to localStorage, sessionStorage, or any external service
+
+## v2 Requirements
+
+### Additional Backends
+
+- **BACK-04**: Microsoft OneDrive (requires pre-obtained OAuth token — headless auth not possible)
+- **BACK-05**: SFTP (host, user, password or key path)
+- **BACK-06**: Google Cloud Storage
+- **BACK-07**: Backblaze B2
+- **BACK-08**: Google Drive
+- **BACK-09**: Dropbox / SharePoint
+
+### Enhanced Config
+
+- **CONF-04**: User can add multiple remotes to a single rclone.conf (multi-remote wizard)
+- **CONF-05**: Field-level format validation per backend (e.g., Azure account name: 3–24 lowercase alphanumeric)
+- **CONF-06**: Explanatory tooltips on sensitive/confusing fields (SAS token vs access key, region codes)
+
+### Enhanced Deployment
+
+- **DEPL-06**: User can pin a specific rclone version for reproducible deployments (instead of always latest)
+- **DEPL-07**: Named RMM script variants (NinjaRMM-specific, Datto-specific execution context adjustments)
+- **DEPL-08**: IntuneWinAppUtil packaging instructions displayed alongside Intune scripts
+
+## Out of Scope
+
+| Feature | Reason |
+|---------|--------|
+| Test connection / validate credentials | Requires backend proxy — CORS blocks direct cloud API calls from browser |
+| Save / load configurations | No backend; credentials must not be stored in localStorage |
+| User accounts / authentication | No backend — would require full architecture rethink |
+| rclone mount / sync scheduling | Different problem domain (task scheduler, Windows service) |
+| Auto-push to Intune via Graph API | Requires Azure AD app registration + OAuth — massive scope increase |
+| macOS / Linux endpoint support | Scripts are PowerShell for Windows only in v1 |
+| rclone version auto-update on endpoints | Separate lifecycle management problem |
+| Config credential encryption | rclone encrypted configs require interactive unlock — incompatible with unattended deployment |
+
+## Traceability
+
+Which phases cover which requirements. Updated during roadmap creation.
+
+| Requirement | Phase | Status |
+|-------------|-------|--------|
+| WIZD-01 | — | Pending |
+| WIZD-02 | — | Pending |
+| WIZD-03 | — | Pending |
+| WIZD-04 | — | Pending |
+| BACK-01 | — | Pending |
+| BACK-02 | — | Pending |
+| BACK-03 | — | Pending |
+| CONF-01 | — | Pending |
+| CONF-02 | — | Pending |
+| CONF-03 | — | Pending |
+| DEPL-01 | — | Pending |
+| DEPL-02 | — | Pending |
+| DEPL-03 | — | Pending |
+| DEPL-04 | — | Pending |
+| DEPL-05 | — | Pending |
+| DOWN-01 | — | Pending |
+| DOWN-02 | — | Pending |
+| DOWN-03 | — | Pending |
+| DOWN-04 | — | Pending |
+| DOWN-05 | — | Pending |
+| DOWN-06 | — | Pending |
+| SECU-01 | — | Pending |
+| SECU-02 | — | Pending |
+| SECU-03 | — | Pending |
+
+**Coverage:**
+- v1 requirements: 24 total
+- Mapped to phases: 0
+- Unmapped: 24 ⚠️
+
+---
+*Requirements defined: 2026-03-26*
+*Last updated: 2026-03-26 after initial definition*