---
phase: 04-review-download-security
plan: 05
type: checkpoint
wave: 5
depends_on: [04-04]
files_modified: []
autonomous: false
requirements: [CONF-02, CONF-03, DOWN-01, DOWN-02, DOWN-03, DOWN-04, DOWN-05, DOWN-06, SECU-01, SECU-02, SECU-03]

must_haves:
  truths:
    - "IT admin can navigate the full 4-step wizard end-to-end in a real browser"
    - "Security checkbox gate prevents downloads until acknowledged"
    - "All four individual file downloads work in the browser"
    - "ZIP bundle downloads and contains all 4 files"
    - "Copy-to-clipboard works for each output block"
    - "No data is written to localStorage or sessionStorage at any point"
  artifacts:
    - path: "src/components/wizard/ReviewStep.tsx"
      provides: "Visually verified step 3 component"
    - path: "src/utils/downloadFile.ts"
      provides: "Verified individual download helper"
    - path: "src/utils/downloadZip.ts"
      provides: "Verified ZIP bundle helper"
  key_links:
    - from: "Browser navigation (steps 0→3)"
      to: "ReviewStep rendered at step 3"
      via: "App.tsx step router"
      pattern: "n/a"
---

<objective>
Human verification of the complete Phase 4 feature set in a running browser. All automated tests pass, but ZIP content, actual file downloads, and clipboard paste cannot be verified by jsdom.

Purpose: Confirm the full IT admin workflow — complete wizard, review generated files, acknowledge security warning, download individually and as ZIP, copy to clipboard — works correctly end-to-end.
Output: Human approval that Phase 4 is shippable.
</objective>

<execution_context>
@C:/Users/SebastienQUEROL/.claude/get-shit-done/workflows/execute-plan.md
@C:/Users/SebastienQUEROL/.claude/get-shit-done/templates/summary.md
</execution_context>

<context>
@.planning/ROADMAP.md
</context>

<tasks>

<task type="checkpoint:human-verify" gate="blocking">
  <what-built>
    Complete Phase 4 feature set:
    - ReviewStep (step 3) with live rclone.conf preview
    - Security acknowledgement checkbox gate (all downloads disabled until checked)
    - "No data sent to server" client-side notice
    - Individual download buttons for rclone.conf, intune-install.ps1, intune-detection.ps1, rmm-script.ps1
    - Copy-to-clipboard button per output block
    - "Download All (ZIP)" button producing rclone-deployment.zip with all 4 files
    - 4-label StepIndicator (Backend > Remote Config > Deployment > Review)
    - Full automated test suite GREEN (including SECU-03 localStorage spy)
  </what-built>
  <how-to-verify>
    Run the dev server: `npm run dev` then open http://localhost:5173

    Step 1 — Navigate the full wizard:
    1. Select a backend (e.g., Azure Blob)
    2. Enter a remote name and fill in all required fields (storage account, SAS token or access key)
    3. Proceed to Deployment Options, leave defaults or adjust, click Next
    4. Confirm you reach step 4 "Review" with StepIndicator showing "1. Backend › 2. Remote Config › 3. Deployment › 4. Review"

    Step 2 — Verify the live preview (CONF-02):
    5. The rclone.conf output block shows a populated INI-format config reflecting your entered values
    6. Go back to step 2, change a field value, return to step 4 — verify the preview updated

    Step 3 — Verify security gate (SECU-01, SECU-02):
    7. Before checking the checkbox: confirm all Download and Copy buttons appear disabled/greyed out
    8. Confirm the "No data is sent to any server" notice is visible
    9. Check the acknowledgement checkbox — confirm all buttons become active

    Step 4 — Individual downloads (DOWN-01 through DOWN-04):
    10. Click "Download" on the rclone.conf block — verify rclone.conf file saved to Downloads
    11. Click "Download" on Intune Install Script — verify intune-install.ps1 saved
    12. Click "Download" on Intune Detection Script — verify intune-detection.ps1 saved
    13. Click "Download" on RMM Script — verify rmm-script.ps1 saved

    Step 5 — Clipboard copy (CONF-03, DOWN-06):
    14. Click "Copy" on the rclone.conf block — paste into a text editor, verify content matches displayed preview
    15. Click "Copy" on at least one script block — verify clipboard content matches displayed script

    Step 6 — ZIP bundle (DOWN-05):
    16. Click "Download All (ZIP)" — verify rclone-deployment.zip saved to Downloads
    17. Open the ZIP file with your OS ZIP tool — verify it contains exactly 4 files: rclone.conf, intune-install.ps1, intune-detection.ps1, rmm-script.ps1

    Step 7 — SECU-03 (no storage writes):
    18. Open DevTools → Application → Local Storage and Session Storage
    19. Navigate the full wizard end-to-end — verify both storage areas remain empty at all times
  </how-to-verify>
  <resume-signal>Type "approved" if all checks pass, or describe which checks failed with details</resume-signal>
</task>

</tasks>

<verification>
Human approval received. All 7 verification steps confirmed passing. Phase 4 requirements CONF-02, CONF-03, DOWN-01–DOWN-06, SECU-01, SECU-02, SECU-03 verified in a real browser.
</verification>

<success_criteria>
- Human has confirmed "approved" after completing all 18 verification steps
- No failures reported for any requirement behavior
- Phase 4 declared complete
</success_criteria>

<output>
After approval, create `.planning/phases/04-review-download-security/04-05-SUMMARY.md`
</output>