chore: archive v1.0 milestone — MVP shipped

4 phases, 18 plans, 24/24 requirements, 98 tests GREEN. Archived ROADMAP + REQUIREMENTS to milestones/. ROADMAP collapsed. PROJECT.md evolved with validated requirements and key decisions. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-27 15:36:40 +01:00
parent 2d5f8f4a81
commit ef0cd94eb7
8 changed files with 457 additions and 121 deletions
@@ -0,0 +1,25 @@
 # Milestones
 ## v1.0 MVP (Shipped: 2026-03-27)
 **Phases completed:** 4 phases, 18 plans
 **Timeline:** 2026-03-26 → 2026-03-27 (2 days)
 **Stats:** ~2,746 LOC TypeScript/TSX, 101 files, 73 commits
 **Key accomplishments:**
 1. Vite 6 + React 18 + TypeScript scaffold with Tailwind v4, Vitest, and zero-error dev server
 2. Backend Schema Registry as single source of truth — drives form rendering, Zod validation, and config generation for Azure Blob, S3, S3-compatible
 3. 4 pure generator functions (rclone.conf, Intune install/detection, RMM script) — 61 tests, UTF-8 no-BOM, SYSTEM-context safe
 4. Multi-step wizard (backend selection → config → deployment options) with full back-navigation and no data loss — 87 tests GREEN
 5. Review + download + security layer — live preview, security gate, individual downloads, ZIP bundle, clipboard copy — 98 tests GREEN
 6. Pure client-side: no backend, no localStorage writes, credentials never leave the browser
 **Tech debt deferred to v1.1:**
 - `scriptTargets` collected in DeploymentStep but ignored by ReviewStep (all output blocks render unconditionally)
 - ReviewStep missing explicit Back button (UX inconsistency)
 - Backend list hardcoded in BackendSelectionStep, not driven by BACKEND_REGISTRY keys
 - `BackendFormValues<T>` dead export in src/schemas/index.ts
 - `act()` warnings in BackendSelectionStep tests
 ---
@@ -2,7 +2,7 @@
 ## What This Is
-Ready2Blob is a pure frontend web app that helps IT professionals deploy rclone onto end-user PCs. It provides a step-by-step configuration wizard that generates rclone config files and deployment scripts (PowerShell for Intune and/or RMM tools) ready to push via enterprise deployment platforms.
+Ready2Blob is a pure-frontend web app that helps IT professionals deploy rclone onto end-user Windows PCs. A step-by-step wizard collects backend credentials (Azure Blob, S3, S3-compatible) and deployment preferences, then generates rclone config files and PowerShell scripts ready to push via Intune or any RMM tool — all client-side, no server required.
 ## Core Value
@@ -12,34 +12,47 @@ An IT pro can go from zero to a deployable rclone setup in minutes — without n
 ### Validated
-(None yet — ship to validate)
+- ✓ Multi-step wizard guides user through rclone backend selection and configuration — v1.0
 - ✓ Supports Azure Blob, S3, and S3-compatible backends — v1.0
 - ✓ Generates a valid rclone.conf file with live preview — v1.0
 - ✓ Generates PowerShell deployment script for MS Intune (Intune install + detection scripts) — v1.0
 - ✓ Generates PowerShell deployment script for RMM tools (generic SYSTEM-context) — v1.0
 - ✓ User can download each output file individually or as a ZIP bundle — v1.0
 - ✓ Includes rclone installation step in scripts (toggleable) — v1.0
 - ✓ All config generation runs client-side (no backend, static site) — v1.0
 - ✓ Security warning gate before any download — v1.0
 - ✓ Wizard state never written to localStorage or sessionStorage — v1.0
 ### Active
- [ ] Multi-step wizard guides user through rclone backend selection and configuration
+- [ ] `scriptTargets` filtering: only render output blocks for selected Intune/RMM targets (tech debt TD-1)
- [ ] Supports any rclone-compatible storage backend (Azure Blob, S3, OneDrive, etc.)
+- [ ] ReviewStep Back button (UX consistency with other steps — tech debt TD-2)
- [ ] Generates a valid rclone.conf file
+- [ ] Backend list in BackendSelectionStep driven by BACKEND_REGISTRY keys (maintainability — tech debt TD-4)
- [ ] Generates PowerShell deployment script for MS Intune (with optional rclone install)
+- [ ] Additional backends: OneDrive, SFTP, Google Cloud Storage, Backblaze B2
- [ ] Generates PowerShell deployment script for RMM tools (with optional rclone install)
+- [ ] Field-level format validation per backend (Azure account name format, S3 region codes)
- [ ] User can choose which output files to download
+- [ ] Explanatory tooltips on sensitive fields (SAS token vs access key, region codes)
 - [ ] Optionally includes rclone installation in the deployment script
 - [ ] All config generation runs client-side (no backend, static site)
 - [ ] Credentials/secrets are written plain text into the config (with a security notice)
 ### Out of Scope
 - User accounts / saved templates — no backend, no persistence
 - Server-side generation — everything runs in the browser
- rclone version management / auto-update logic — out of scope for v1
+- Test connection / validate credentials — requires backend proxy (CORS blocks direct cloud API calls)
- Non-Windows targets — scripts target Windows endpoints only for v1
+- rclone version management / auto-update on endpoints — separate lifecycle problem
 - Non-Windows targets — scripts target Windows endpoints only
 - Auto-push to Intune via Graph API — requires Azure AD app registration, massive scope increase
 - Config credential encryption — rclone encrypted configs require interactive unlock, incompatible with unattended deployment
 ## Context
- Project name "Ready2Blob" hints at Azure Blob as a primary use case, but the tool is designed to support all rclone backends
+**Shipped:** v1.0 — 2026-03-26/27, 2 days, 4 phases, 18 plans, ~2,746 LOC TypeScript/TSX
- Target audience: any IT professional (sysadmins, MSP techs, internal IT)
+**Tech stack:** Vite 6, React 18, TypeScript 5, Tailwind v4, react-hook-form 7, Zod 4, Vitest 4, JSZip
- Deployment platforms: MS Intune (Win32 app or PS script) and generic RMM tools (NinjaRMM, Datto, etc.)
+**Test coverage:** 98 tests across 12 test files — all GREEN
- rclone config files are INI-like text files; generation is purely string manipulation, no server needed
+
- Secrets (storage account keys, SAS tokens, OAuth tokens) go directly into the config — user is responsible for handling securely post-download
+**Known issues / tech debt:**
 - `scriptTargets` disconnect: user can deselect Intune or RMM in DeploymentStep but all blocks still appear in ReviewStep
 - ReviewStep lacks a Back button; users navigate back via StepIndicator breadcrumb only
 - BackendSelectionStep BACKENDS constant is hardcoded — adding to BACKEND_REGISTRY does not auto-surface in UI
 - 6 browser verifications still pending (live preview reactivity, real file writes, ZIP content, clipboard, DevTools storage check)
 ## Constraints
@@ -51,9 +64,17 @@ An IT pro can go from zero to a deployable rclone setup in minutes — without n
 | Decision | Rationale | Outcome |
 |----------|-----------|---------|
-| Pure frontend (no backend) | Simpler hosting, no data retention risk with credentials | — Pending |
+| Pure frontend (no backend) | Simpler hosting, no data retention risk with credentials | ✓ Good — static site deployable anywhere |
-| Support all rclone backends | Not Azure-only despite project name — broader utility | — Pending |
+| BACKEND_REGISTRY as single source of truth | Drives form rendering, Zod schemas, and config generation from one definition | ✓ Good — zero duplication across phases |
-| Optional rclone install in scripts | Different orgs have different baseline images | — Pending |
+| useReducer + Context API (no external state lib) | Zero dependencies, sufficient for 4-step wizard | ✓ Good — kept bundle lean |
 | Wave 0 TDD (stubs RED before implementation) | Forces API contract before code, catches integration mismatches early | ✓ Good — caught several issues upfront |
 | Support all rclone backends (not Azure-only) | Broader utility despite "Blob" in project name | ✓ Good — S3-compatible covers Wasabi/MinIO/R2 |
 | Optional rclone install in scripts | Different orgs have different baseline images | ✓ Good — no friction for orgs that pre-install |
 | Tailwind v4 via @tailwindcss/vite plugin | No postcss.config.js, no tailwind.config.js needed | ✓ Good — cleaner config |
 | Zod v4 + @hookform/resolvers v5 together | v5 resolvers required for Zod v4 compatibility | ✓ Good — noted for future upgrades |
 | AzureAuthToggle uses CSS hidden (not conditional render) | Preserves both sas_url and key in react-hook-form state when toggling | ✓ Good — avoids field reset on toggle |
 | scriptTargets defaults to both ['intune','rmm'] | Users deselect rather than discover — less friction | — Pending (deferred filtering to v1.1) |
 | BACKEND_REGISTRY keys not wired to UI list | Hardcoded BACKENDS constant in BackendSelectionStep | ⚠️ Revisit — maintainability gap for v1.1 |
 ---
-*Last updated: 2026-03-26 after initialization*
+*Last updated: 2026-03-27 after v1.0 milestone*
@@ -0,0 +1,61 @@
 # Project Retrospective
 *A living document updated after each milestone. Lessons feed forward into future planning.*
 ## Milestone: v1.0 — MVP
 **Shipped:** 2026-03-27
 **Phases:** 4 | **Plans:** 18 | **Timeline:** 2 days
 ### What Was Built
 - Backend Schema Registry as single source of truth driving form rendering, Zod validation, and config generation for 3 backends
 - 4 pure generator functions (rclone.conf, Intune install/detection, RMM script) with 61 tests and strict PowerShell encoding/path requirements
 - 4-step multi-step wizard (backend selection → config → deployment options → review/download) with full back-navigation
 - Review and download layer: live preview, security gate, individual file downloads, ZIP bundle, clipboard copy
 ### What Worked
 - **Inside-out build order** (foundation → generators → wizard UI → download layer): front-loaded high-risk correctness work (PowerShell encoding, SYSTEM-context paths, credential handling) before any UI existed — each phase was independently verifiable
 - **Wave 0 TDD with `expect.fail` stubs**: defining the API contract in RED before implementation forced explicit interface design and caught integration issues upfront; named failure messages made debugging fast
 - **BACKEND_REGISTRY as single source of truth**: zero field-name duplication between form rendering, Zod schemas, and config generation — no drift possible across phases
 - **useReducer + Context API with no external state lib**: sufficient for a 4-step wizard, kept bundle lean
 ### What Was Inefficient
 - **scriptTargets collected but never consumed**: `DeploymentStep` dispatches `scriptTargets` but `ReviewStep` ignores it — all output blocks render unconditionally. This was knowable at Phase 2 design time but deferred to v1.1 as tech debt
 - **BACKENDS constant hardcoded in BackendSelectionStep**: adding to BACKEND_REGISTRY does not surface in UI — a maintainability gap that was an obvious fix but left unaddressed
 - **ReviewStep missing Back button**: UX inconsistency with all other steps — a trivial add that was missed
 ### Patterns Established
 - Wave 0 TDD pattern: stub all requirement behaviors RED before any implementation — use `expect.fail('not yet implemented')` not import errors
 - Embed requirement IDs in test describe blocks (WIZD-01, BACK-02, etc.) for direct test-to-requirement traceability
 - Generator functions self-contained: `buildRcloneConfContent` duplicated inline in rmm-script.ts to avoid circular dependency risk
 - INITIAL_STATE defaults to both targets selected — users deselect rather than discover
 ### Key Lessons
 1. **Define data flow end-to-end before implementing any step**: the `scriptTargets` disconnect would have been caught if the full data flow (DeploymentStep → state → ReviewStep) had been traced before Phase 4 started
 2. **Registry-driven UI is strictly better than hardcoded lists**: the BACKEND_REGISTRY pattern proved its value — extending it for the UI selector should have been done at the same time
 3. **Inside-out build order works well for correctness-heavy tools**: generator correctness (PowerShell encoding edge cases) was much easier to verify without UI noise
 ### Cost Observations
 - Sessions: ~6 (4 execution phases + planning + verification)
 - Notable: Pure frontend with no external API calls kept the scope tight — all phases parallelized within themselves
 ---
 ## Cross-Milestone Trends
 ### Process Evolution
 | Milestone | Phases | Plans | Key Change |
 |-----------|--------|-------|------------|
 | v1.0 | 4 | 18 | Wave 0 TDD pattern established; inside-out build order validated |
 ### Cumulative Quality
 | Milestone | Tests | Notes |
 |-----------|-------|-------|
 | v1.0 | 98 (12 files) | 24/24 requirements satisfied, 5/5 E2E flows |
 ### Top Lessons (Verified Across Milestones)
 1. Single source of truth (BACKEND_REGISTRY) eliminates entire classes of drift bugs
 2. Wave 0 TDD stubs are worth the upfront cost — they define the contract and make RED→GREEN progress visible
@@ -1,98 +1,28 @@
 # Roadmap: Ready2Blob
-## Overview
+## Milestones
-Ready2Blob is built inside-out: architectural foundation first, then pure generator functions, then wizard UI, then the download and security layer. This order front-loads the highest-risk correctness requirements (PowerShell encoding, SYSTEM-context paths, credential handling) before any user-facing code exists, and keeps all four phases independently verifiable.
+- ✅ **v1.0 MVP** — Phases 1–4 (shipped 2026-03-27)
 ## Phases
-**Phase Numbering:**
+<details>
- Integer phases (1, 2, 3): Planned milestone work
+<summary>✅ v1.0 MVP (Phases 1–4) — SHIPPED 2026-03-27</summary>
 - Decimal phases (2.1, 2.2): Urgent insertions (marked with INSERTED)
-Decimal phases appear between their surrounding integers in numeric order.
+- [x] Phase 1: Foundation (4/4 plans) — completed 2026-03-26
 - [x] Phase 2: Generators (4/4 plans) — completed 2026-03-26
 - [x] Phase 3: Wizard UI (5/5 plans) — completed 2026-03-27
 - [x] Phase 4: Review, Download & Security (5/5 plans) — completed 2026-03-27
- [x] **Phase 1: Foundation** - Project scaffold, TypeScript types, Backend Schema Registry, Zod schemas, and wizard state store (completed 2026-03-26)
+Full phase details: [.planning/milestones/v1.0-ROADMAP.md](milestones/v1.0-ROADMAP.md)
 - [x] **Phase 2: Generators** - Pure builder functions for rclone.conf and PowerShell deployment scripts, plus download manager (completed 2026-03-26)
 - [x] **Phase 3: Wizard UI** - Multi-step wizard with backend selector, dynamic backend forms, and deployment options (completed 2026-03-27)
 - [x] **Phase 4: Review, Download & Security** - Live config preview, security warning gate, all download buttons, clipboard copy, and ZIP bundle (completed 2026-03-27)
-## Phase Details
+</details>
 ### Phase 1: Foundation
 **Goal**: The architectural skeleton exists and all downstream phases can build on it without rework
 **Depends on**: Nothing (first phase)
 **Requirements**: None directly — this phase creates the infrastructure that all v1 requirements depend on
 **Success Criteria** (what must be TRUE):
  1. Vite dev server starts and serves a React + TypeScript app with no console errors
  2. The Backend Schema Registry defines at least Azure Blob, S3, and S3-compatible backends with typed field definitions
  3. Zod validation schemas can be derived from the registry and validate correct/incorrect input correctly
  4. The WizardState useReducer store initializes, accepts dispatch actions, and state is accessible via Context
 **Plans**: 4 plans
 Plans:
 - [x] 01-01-PLAN.md — Scaffold Vite 6 + React 18 + TypeScript 5, install all Phase 1 deps, configure Tailwind v4, set up Vitest
 - [ ] 01-02-PLAN.md — Create Backend Schema Registry (registry.ts) and Wave 0 test stubs for SC-2, SC-3, SC-4
 - [ ] 01-03-PLAN.md — Implement Zod schemas derived from registry (index.ts), all schema tests green
 - [ ] 01-04-PLAN.md — Implement WizardState types, pure reducer, Context provider, and wire into App
 ### Phase 2: Generators
 **Goal**: Given a completed wizard state, the app can produce correct, deployment-ready file content for all output types
 **Depends on**: Phase 1
 **Requirements**: CONF-01, DEPL-01, DEPL-02, DEPL-03, DEPL-04, DEPL-05
 **Success Criteria** (what must be TRUE):
  1. `buildRcloneConf()` produces a valid INI-format rclone.conf string with correct key/value pairs for each supported backend
  2. The Intune install script writes config using UTF-8 no-BOM encoding, places it at the correct path, and never echoes credential values
  3. The Intune detection script exits 0 when both rclone.exe and the config file are present, and non-zero otherwise
  4. The RMM script is self-contained, idempotent, and runs correctly in a generic SYSTEM context
  5. Toggling "include rclone installation" adds a download step to all generated scripts; disabling it removes it
 **Plans**: 4 plans
 Plans:
 - [ ] 02-01-PLAN.md — Wave 0 test stubs for all four generators + index.ts barrel
 - [ ] 02-02-PLAN.md — Implement buildRcloneConf (CONF-01)
 - [ ] 02-03-PLAN.md — Implement buildIntuneInstall + buildIntuneDetection + ps-helpers (DEPL-01, DEPL-02, DEPL-04, DEPL-05)
 - [ ] 02-04-PLAN.md — Implement buildRmmScript (DEPL-03, DEPL-04, DEPL-05)
 ### Phase 3: Wizard UI
 **Goal**: An IT admin can navigate the full wizard from backend selection through deployment options without losing data
 **Depends on**: Phase 1
 **Requirements**: WIZD-01, WIZD-02, WIZD-03, WIZD-04, BACK-01, BACK-02, BACK-03
 **Success Criteria** (what must be TRUE):
  1. User can select a storage backend from a list where Azure Blob and S3 appear first
  2. User can navigate forward through all wizard steps (backend selection → backend config → deployment options) and back without losing entered values
  3. User can configure an Azure Blob remote by entering a storage account name and choosing SAS token or access key authentication
  4. User can configure an Amazon S3 or S3-compatible remote (access key, secret, region, optional endpoint override)
  5. User can set a custom remote name and the field rejects names with invalid characters
 **Plans**: TBD
 ### Phase 4: Review, Download & Security
 **Goal**: An IT admin can see exactly what will be deployed, acknowledge the security implications, and download any combination of generated files
 **Depends on**: Phases 2, 3
 **Requirements**: CONF-02, CONF-03, DOWN-01, DOWN-02, DOWN-03, DOWN-04, DOWN-05, DOWN-06, SECU-01, SECU-02, SECU-03
 **Success Criteria** (what must be TRUE):
  1. A live preview of the rclone.conf content updates in real time as the user fills in the wizard forms
  2. Before any download is enabled, the user must acknowledge a security warning that credentials are stored in plain text
  3. The app prominently displays that no data is sent to any server, and wizard state is never written to localStorage or sessionStorage
  4. User can download each artifact individually (rclone.conf, Intune install script, Intune detection script, RMM script) or all together as a ZIP bundle
  5. User can copy any output block to clipboard without downloading
 **Plans**: 5 plans
 Plans:
 - [ ] 04-01-PLAN.md — Wave 0 TDD stubs: ReviewStep.test.tsx (all requirement stubs RED) + SECU-03 assertion in reducer.test.ts
 - [ ] 04-02-PLAN.md — Utilities and OutputBlock: downloadFile.ts, downloadZip.ts (install jszip), OutputBlock.tsx component
 - [ ] 04-03-PLAN.md — Implement ReviewStep.tsx: live preview, security gate, all downloads and clipboard — all stubs turn GREEN
 - [ ] 04-04-PLAN.md — Wire ReviewStep into App.tsx (step 3) and add 'Review' to StepIndicator STEP_LABELS
 - [ ] 04-05-PLAN.md — Human verification: full 4-step wizard end-to-end, all downloads, ZIP, clipboard, SECU-03 DevTools check
 ## Progress
-**Execution Order:**
+| Phase | Milestone | Plans Complete | Status | Completed |
-Phases execute in numeric order: 1 → 2 → 3 → 4
+|-------|-----------|----------------|--------|-----------|
-
+| 1. Foundation | v1.0 | 4/4 | Complete | 2026-03-26 |
-| Phase | Plans Complete | Status | Completed |
+| 2. Generators | v1.0 | 4/4 | Complete | 2026-03-26 |
-|-------|----------------|--------|-----------|
+| 3. Wizard UI | v1.0 | 5/5 | Complete | 2026-03-27 |
-| 1. Foundation | 4/4 | Complete   | 2026-03-26 |
+| 4. Review, Download & Security | v1.0 | 5/5 | Complete | 2026-03-27 |
 | 2. Generators | 4/4 | Complete   | 2026-03-26 |
 | 3. Wizard UI | 5/5 | Complete   | 2026-03-27 |
 | 4. Review, Download & Security | 5/5 | Complete   | 2026-03-27 |
@@ -1,27 +1,27 @@
 ---
 gsd_state_version: 1.0
-milestone: v1.0
+milestone: v1.1
-milestone_name: milestone
+milestone_name: ""
-status: executing
+status: milestone_complete
-stopped_at: Completed 04-05-PLAN.md — Phase 4 human verification approved, all 18 checks passed
+stopped_at: v1.0 MVP milestone archived — ready for next milestone
-last_updated: "2026-03-27T14:02:52.665Z"
+last_updated: "2026-03-27T00:00:00.000Z"
-last_activity: 2026-03-26 — Completed plan 01-02 (Backend Schema Registry)
+last_activity: 2026-03-27 — v1.0 milestone complete
 progress:
-  total_phases: 4
+  total_phases: 0
-  completed_phases: 4
+  completed_phases: 0
-  total_plans: 18
+  total_plans: 0
-  completed_plans: 18
+  completed_plans: 0
-  percent: 50
+  percent: 0
 ---
 # Project State
 ## Project Reference
-See: .planning/PROJECT.md (updated 2026-03-26)
+See: .planning/PROJECT.md (updated 2026-03-27)
 **Core value:** An IT pro can go from zero to a deployable rclone setup in minutes — without needing to know rclone's config syntax or PowerShell deployment conventions.
-**Current focus:** Phase 1 — Foundation
+**Current focus:** Planning next milestone (v1.1)
 ## Current Position
@@ -0,0 +1,192 @@
 ---
 milestone: v1.0
 audited: 2026-03-27T16:00:00Z
 status: tech_debt
 scores:
  requirements: 24/24
  phases: 4/4
  integration: 20/24
  flows: 5/5
 gaps: {}
 tech_debt:
  - phase: 04-review-download-security
    items:
      - "scriptTargets field (DeploymentStep) collected but never consumed by ReviewStep — all 4 output blocks always render unconditionally regardless of Intune/RMM selection. Affects: DEPL-01, DEPL-02, DEPL-03, DOWN-02, DOWN-03, DOWN-04, DOWN-05 (misleading UX but no explicit v1 requirement violated)."
      - "ReviewStep has no Back button — users must navigate back via StepIndicator breadcrumb only. All other step components have explicit Back buttons (UX inconsistency)."
      - "6 human verification items pending browser confirmation: CONF-02 live preview reactivity, SECU-01 visual disabled styling, DOWN-01–04 real file writes, DOWN-05 ZIP archive content, CONF-03/DOWN-06 clipboard paste, SECU-03 DevTools storage check."
  - phase: 01-foundation
    items:
      - "BackendFormValues<T> utility type (src/schemas/index.ts line 27) exported but never imported anywhere in production code — dead code from day 1."
  - phase: 03-wizard-ui
    items:
      - "act() warnings in BackendSelectionStep tests — async state updates not fully wrapped in act(). Tests pass but test hygiene issue."
      - "Backend selection list in BackendSelectionStep.tsx is a hardcoded BACKENDS constant, not driven by BACKEND_REGISTRY keys. Adding a backend to the registry does not automatically surface it in the UI — maintainability gap."
 nyquist:
  compliant_phases: []
  partial_phases:
    - 01-foundation
    - 02-generators
    - 03-wizard-ui
    - 04-review-download-security
  missing_phases: []
  overall: partial
 ---
 # v1.0 Milestone Audit — Ready2Blob
 **Audited:** 2026-03-27T16:00:00Z
 **Status:** TECH_DEBT — all 24 requirements satisfied, no critical blockers, accumulated deferred items need review
 **Milestone:** v1.0 — Full wizard: foundation → generators → wizard UI → review/download/security
 ---
 ## Score Summary
 | Dimension | Score | Notes |
 |-----------|-------|-------|
 | Requirements | 24/24 | All v1 requirements satisfied (3-source verified) |
 | Phases | 4/4 | All phases passed verification |
 | Integration | 20/24 | scriptTargets disconnect affects 4 wiring paths |
 | E2E Flows | 5/5 | All flows complete end-to-end |
 ---
 ## Phase Verification Status
 | Phase | Status | Score | Human Items |
 |-------|--------|-------|-------------|
 | 01-foundation | PASSED | 12/12 | 1 (browser console errors — routine) |
 | 02-generators | PASSED | 17/17 | 0 |
 | 03-wizard-ui | PASSED | 6/6 | 4 (human-approved during execution) |
 | 04-review-download-security | human_needed | 11/11 automated | 6 pending browser confirmation |
 No phase is missing a VERIFICATION.md.
 ---
 ## Requirements Coverage (3-Source Cross-Reference)
 Cross-referenced against: (1) phase VERIFICATION.md status, (2) SUMMARY.md `requirements-completed` frontmatter, (3) REQUIREMENTS.md traceability table.
 | Req | Description | Phase | VERIFICATION | SUMMARY | REQUIREMENTS | Final |
 |-----|-------------|-------|-------------|---------|-------------|-------|
 | WIZD-01 | Backend selection, popularity-sorted | 3 | SATISFIED | 03-01 | [x] | **satisfied** |
 | WIZD-02 | Multi-step wizard navigation | 3 | SATISFIED | 03-01, 03-05 | [x] | **satisfied** |
 | WIZD-03 | Back navigation without data loss | 3 | SATISFIED | 03-01, 03-05 | [x] | **satisfied** |
 | WIZD-04 | Custom remote name with validation | 3 | SATISFIED | 03-01 | [x] | **satisfied** |
 | BACK-01 | Azure Blob remote config | 3 | SATISFIED | 03-01, 03-04 | [x] | **satisfied** |
 | BACK-02 | Amazon S3 remote config | 3 | SATISFIED | 03-01, 03-04 | [x] | **satisfied** |
 | BACK-03 | S3-compatible remote (endpoint override) | 3 | SATISFIED | 03-01, 03-04 | [x] | **satisfied** |
 | CONF-01 | Generate valid rclone.conf (INI) | 2 | SATISFIED | 02-01, 02-02 | [x] | **satisfied** |
 | CONF-02 | Live rclone.conf preview | 4 | SATISFIED | 04-01, 04-03–05 | [x] | **satisfied** |
 | CONF-03 | Copy rclone.conf to clipboard | 4 | SATISFIED | 04-01–05 | [x] | **satisfied** |
 | DEPL-01 | Intune PowerShell install script | 2 | SATISFIED | 02-01, 02-03 | [x] | **satisfied** |
 | DEPL-02 | Intune detection script | 2 | SATISFIED | 02-01, 02-03 | [x] | **satisfied** |
 | DEPL-03 | RMM PowerShell script | 2 | SATISFIED | 02-01, 02-04 | [x] | **satisfied** |
 | DEPL-04 | Toggle "Include rclone installation" | 2 | SATISFIED | 02-01, 02-03, 02-04 | [x] | **satisfied** |
 | DEPL-05 | Config deployment path choice | 2 | SATISFIED | 02-01, 02-03, 02-04 | [x] | **satisfied** |
 | DOWN-01 | Download rclone.conf individually | 4 | SATISFIED | 04-01–05 | [x] | **satisfied** |
 | DOWN-02 | Download Intune install individually | 4 | SATISFIED | 04-01–05 | [x] | **satisfied** |
 | DOWN-03 | Download Intune detection individually | 4 | SATISFIED | 04-01–05 | [x] | **satisfied** |
 | DOWN-04 | Download RMM script individually | 4 | SATISFIED | 04-01–05 | [x] | **satisfied** |
 | DOWN-05 | Download all as ZIP bundle | 4 | SATISFIED | 04-01–05 | [x] | **satisfied** |
 | DOWN-06 | Copy any output block to clipboard | 4 | SATISFIED | 04-01–05 | [x] | **satisfied** |
 | SECU-01 | Security warning gate before downloads | 4 | SATISFIED | 04-01, 04-03–05 | [x] | **satisfied** |
 | SECU-02 | "No data sent to server" notice | 4 | SATISFIED | 04-01, 04-03–05 | [x] | **satisfied** |
 | SECU-03 | No localStorage/sessionStorage writes | 4 | SATISFIED | 04-01, 04-04–05 | [x] | **satisfied** |
 **Orphaned requirements:** None. All 24 REQ-IDs present in REQUIREMENTS.md traceability table are claimed by phase plans and verified in VERIFICATION.md files.
 ---
 ## Cross-Phase Integration Report
 ### E2E Flow Results
 | Flow | Verdict | Notes |
 |------|---------|-------|
 | 1. Select Azure Blob → fill config → deployment → live preview → acknowledge → download all | COMPLETE | End-to-end path works; scriptTargets caveat (see tech debt) |
 | 2. WizardState types → Phase 2 generators → Phase 4 output | COMPLETE | Type-safe; CONFIG_DIR locked to WizardState union literal |
 | 3. Config path consistency (ps-helpers.ts ↔ DeploymentStep) | COMPLETE | All 3 scripts use same CONFIG_DIR; 'machine-wide' and 'user-profile' keys match exactly |
 | 4. SECU-03 isolation (reducer → no storage writes) | COMPLETE | Pure reducer, no useEffect writes, 0 localStorage/sessionStorage calls in production code |
 | 5. Step count consistency (3 wizard steps + 1 review step) | COMPLETE | App.tsx steps[0..3], StepIndicator STEP_LABELS[0..3], clamp guard in place |
 ### Integration Issues (Tech Debt — No Blockers)
 **TD-1: `scriptTargets` disconnected (affects DEPL-01/02/03, DOWN-02/03/04/05)**
 - `WizardState.deployment.scriptTargets: ('intune' | 'rmm')[]` is dispatched by `DeploymentStep.tsx` but never read by `ReviewStep.tsx`
 - All 4 `OutputBlock` components render unconditionally — user can uncheck Intune or RMM in DeploymentStep but all blocks still appear in ReviewStep
 - No v1 requirement explicitly mandates conditional output filtering by scriptTargets, so this does not violate any stated requirement
 - Fix location: `src/components/wizard/ReviewStep.tsx` — read `state.deployment.scriptTargets` and conditionally render/include each block
 - Severity: **UX misleading, not a requirement violation**
 **TD-2: ReviewStep missing Back button**
 - All other step components (BackendSelectionStep, RemoteConfigStep, DeploymentStep) have explicit Back buttons
 - WIZD-03 is satisfied through StepIndicator breadcrumb, but UX is inconsistent
 - Fix location: `src/components/wizard/ReviewStep.tsx` — add a Back button dispatching `SET_STEP(2)`
 **TD-3: `BackendFormValues<T>` dead export**
 - `src/schemas/index.ts` line 27 — never imported anywhere in production code
 - RemoteConfigStep uses `useForm` without this type
 - Fix: remove the unused export or wire it into RemoteConfigStep form typing
 **TD-4: Backend selection list hardcoded (not registry-driven)**
 - `BackendSelectionStep.tsx` `BACKENDS` constant lists 3 entries manually
 - Adding a backend to `BACKEND_REGISTRY` does not surface it in the selection UI
 - Fix: derive the `BACKENDS` display array from `Object.keys(BACKEND_REGISTRY)` with a display-name map
 ---
 ## Tech Debt Summary
 | Phase | Items | Severity |
 |-------|-------|---------|
 | 04-review-download-security | scriptTargets disconnect, missing Back button, 6 pending browser verifications | Medium/Info |
 | 01-foundation | BackendFormValues dead export | Info |
 | 03-wizard-ui | act() test warnings, hardcoded backend list | Info |
 **Total:** 8 items across 3 phases. No blockers.
 ---
 ## Nyquist Compliance
 | Phase | VALIDATION.md | nyquist_compliant | wave_0_complete | Status |
 |-------|---------------|-------------------|-----------------|--------|
 | 01-foundation | exists | false | false | PARTIAL |
 | 02-generators | exists | false | false | PARTIAL |
 | 03-wizard-ui | exists | false | false | PARTIAL |
 | 04-review-download-security | exists | false | false | PARTIAL |
 All 4 phases have VALIDATION.md files but none have been updated to `nyquist_compliant: true`. VALIDATION.md files were auto-generated as drafts but not finalized during execution.
 To address: run `/gsd:validate-phase N` for each phase needing Nyquist audit.
 ---
 ## Definition of Done Assessment
 From ROADMAP.md milestone success criteria:
 | Criterion | Status |
 |-----------|--------|
 | Vite dev server starts, React + TS app with no console errors | Human-verified (Phase 1) |
 | Backend Schema Registry defines Azure Blob, S3, S3-compatible | Verified (Phase 1) |
 | Zod schemas derived from registry, validate correct/incorrect input | Verified (Phase 1) |
 | WizardState reducer initializes, accepts dispatch, accessible via Context | Verified (Phase 1) |
 | buildRcloneConf() produces valid INI for all backends | Verified (Phase 2, 61 tests) |
 | Intune install: UTF-8 no-BOM, correct path, no credential logging | Verified (Phase 2) |
 | Intune detection: exits 0 when rclone.exe + config present | Verified (Phase 2) |
 | RMM script: self-contained, idempotent, SYSTEM-context safe | Verified (Phase 2) |
 | includeInstall toggle affects all generated scripts | Verified (Phase 2) |
 | Full wizard navigation (backend → config → deployment) end-to-end | Human-verified (Phase 3) |
 | Live rclone.conf preview, security gate, all downloads, ZIP, clipboard | Automated + human-pending (Phase 4) |
 ---
 _Audited: 2026-03-27T16:00:00Z_
 _Auditor: Claude (gsd-audit-milestone orchestrator + gsd-integration-checker)_
@@ -1,3 +1,12 @@
 # Requirements Archive: v1.0 MVP
 **Archived:** 2026-03-27
 **Status:** SHIPPED
 For current requirements, see `.planning/REQUIREMENTS.md`.
 ---
 # Requirements: Ready2Blob
 **Defined:** 2026-03-26
@@ -0,0 +1,98 @@
 # Roadmap: Ready2Blob
 ## Overview
 Ready2Blob is built inside-out: architectural foundation first, then pure generator functions, then wizard UI, then the download and security layer. This order front-loads the highest-risk correctness requirements (PowerShell encoding, SYSTEM-context paths, credential handling) before any user-facing code exists, and keeps all four phases independently verifiable.
 ## Phases
 **Phase Numbering:**
 - Integer phases (1, 2, 3): Planned milestone work
 - Decimal phases (2.1, 2.2): Urgent insertions (marked with INSERTED)
 Decimal phases appear between their surrounding integers in numeric order.
 - [x] **Phase 1: Foundation** - Project scaffold, TypeScript types, Backend Schema Registry, Zod schemas, and wizard state store (completed 2026-03-26)
 - [x] **Phase 2: Generators** - Pure builder functions for rclone.conf and PowerShell deployment scripts, plus download manager (completed 2026-03-26)
 - [x] **Phase 3: Wizard UI** - Multi-step wizard with backend selector, dynamic backend forms, and deployment options (completed 2026-03-27)
 - [x] **Phase 4: Review, Download & Security** - Live config preview, security warning gate, all download buttons, clipboard copy, and ZIP bundle (completed 2026-03-27)
 ## Phase Details
 ### Phase 1: Foundation
 **Goal**: The architectural skeleton exists and all downstream phases can build on it without rework
 **Depends on**: Nothing (first phase)
 **Requirements**: None directly — this phase creates the infrastructure that all v1 requirements depend on
 **Success Criteria** (what must be TRUE):
  1. Vite dev server starts and serves a React + TypeScript app with no console errors
  2. The Backend Schema Registry defines at least Azure Blob, S3, and S3-compatible backends with typed field definitions
  3. Zod validation schemas can be derived from the registry and validate correct/incorrect input correctly
  4. The WizardState useReducer store initializes, accepts dispatch actions, and state is accessible via Context
 **Plans**: 4 plans
 Plans:
 - [x] 01-01-PLAN.md — Scaffold Vite 6 + React 18 + TypeScript 5, install all Phase 1 deps, configure Tailwind v4, set up Vitest
 - [ ] 01-02-PLAN.md — Create Backend Schema Registry (registry.ts) and Wave 0 test stubs for SC-2, SC-3, SC-4
 - [ ] 01-03-PLAN.md — Implement Zod schemas derived from registry (index.ts), all schema tests green
 - [ ] 01-04-PLAN.md — Implement WizardState types, pure reducer, Context provider, and wire into App
 ### Phase 2: Generators
 **Goal**: Given a completed wizard state, the app can produce correct, deployment-ready file content for all output types
 **Depends on**: Phase 1
 **Requirements**: CONF-01, DEPL-01, DEPL-02, DEPL-03, DEPL-04, DEPL-05
 **Success Criteria** (what must be TRUE):
  1. `buildRcloneConf()` produces a valid INI-format rclone.conf string with correct key/value pairs for each supported backend
  2. The Intune install script writes config using UTF-8 no-BOM encoding, places it at the correct path, and never echoes credential values
  3. The Intune detection script exits 0 when both rclone.exe and the config file are present, and non-zero otherwise
  4. The RMM script is self-contained, idempotent, and runs correctly in a generic SYSTEM context
  5. Toggling "include rclone installation" adds a download step to all generated scripts; disabling it removes it
 **Plans**: 4 plans
 Plans:
 - [ ] 02-01-PLAN.md — Wave 0 test stubs for all four generators + index.ts barrel
 - [ ] 02-02-PLAN.md — Implement buildRcloneConf (CONF-01)
 - [ ] 02-03-PLAN.md — Implement buildIntuneInstall + buildIntuneDetection + ps-helpers (DEPL-01, DEPL-02, DEPL-04, DEPL-05)
 - [ ] 02-04-PLAN.md — Implement buildRmmScript (DEPL-03, DEPL-04, DEPL-05)
 ### Phase 3: Wizard UI
 **Goal**: An IT admin can navigate the full wizard from backend selection through deployment options without losing data
 **Depends on**: Phase 1
 **Requirements**: WIZD-01, WIZD-02, WIZD-03, WIZD-04, BACK-01, BACK-02, BACK-03
 **Success Criteria** (what must be TRUE):
  1. User can select a storage backend from a list where Azure Blob and S3 appear first
  2. User can navigate forward through all wizard steps (backend selection → backend config → deployment options) and back without losing entered values
  3. User can configure an Azure Blob remote by entering a storage account name and choosing SAS token or access key authentication
  4. User can configure an Amazon S3 or S3-compatible remote (access key, secret, region, optional endpoint override)
  5. User can set a custom remote name and the field rejects names with invalid characters
 **Plans**: TBD
 ### Phase 4: Review, Download & Security
 **Goal**: An IT admin can see exactly what will be deployed, acknowledge the security implications, and download any combination of generated files
 **Depends on**: Phases 2, 3
 **Requirements**: CONF-02, CONF-03, DOWN-01, DOWN-02, DOWN-03, DOWN-04, DOWN-05, DOWN-06, SECU-01, SECU-02, SECU-03
 **Success Criteria** (what must be TRUE):
  1. A live preview of the rclone.conf content updates in real time as the user fills in the wizard forms
  2. Before any download is enabled, the user must acknowledge a security warning that credentials are stored in plain text
  3. The app prominently displays that no data is sent to any server, and wizard state is never written to localStorage or sessionStorage
  4. User can download each artifact individually (rclone.conf, Intune install script, Intune detection script, RMM script) or all together as a ZIP bundle
  5. User can copy any output block to clipboard without downloading
 **Plans**: 5 plans
 Plans:
 - [ ] 04-01-PLAN.md — Wave 0 TDD stubs: ReviewStep.test.tsx (all requirement stubs RED) + SECU-03 assertion in reducer.test.ts
 - [ ] 04-02-PLAN.md — Utilities and OutputBlock: downloadFile.ts, downloadZip.ts (install jszip), OutputBlock.tsx component
 - [ ] 04-03-PLAN.md — Implement ReviewStep.tsx: live preview, security gate, all downloads and clipboard — all stubs turn GREEN
 - [ ] 04-04-PLAN.md — Wire ReviewStep into App.tsx (step 3) and add 'Review' to StepIndicator STEP_LABELS
 - [ ] 04-05-PLAN.md — Human verification: full 4-step wizard end-to-end, all downloads, ZIP, clipboard, SECU-03 DevTools check
 ## Progress
 **Execution Order:**
 Phases execute in numeric order: 1 → 2 → 3 → 4
 | Phase | Plans Complete | Status | Completed |
 |-------|----------------|--------|-----------|
 | 1. Foundation | 4/4 | Complete   | 2026-03-26 |
 | 2. Generators | 4/4 | Complete   | 2026-03-26 |
 | 3. Wizard UI | 5/5 | Complete   | 2026-03-27 |
 | 4. Review, Download & Security | 5/5 | Complete   | 2026-03-27 |