# Upload Checklist Configuration Implementation Plan

> **For Hermes:** Implement task-by-task with TDD and verify the Docker deployment contract.

**Goal:** Bổ sung tại trang quản lý công cụ chức năng admin upload/thay thế cặp file checklist `.xlsx` và rule config `.json` cho từng OS.

**Architecture:** Dùng mapping `OS_CONFIG` hiện có làm allowlist tên đích; không cho client tự chọn đường dẫn/tên file. Backend validate role admin, extension, JSON, tạo `.bak`, rồi ghi file vào `config/`. Đổi bind mount `config` sang read-write để chức năng hoạt động trong Docker.

**Tech Stack:** FastAPI, Jinja2, Docker Compose, Python stdlib JSON/file I/O.

---

### Task 1: Add regression tests
- Create `tests/test_checklist_config_upload.py`.
- Assert route exists, admin authorization is required, safe OS mapping is used, JSON is validated, and Compose config mount is writable.
- Run test and confirm RED.

### Task 2: Implement secure upload endpoint
- Modify `app/web_app_fastapi.py`.
- Add `POST /admin/checklists/upload`.
- Require admin session.
- Accept `os_type`, optional checklist `.xlsx`, optional config `.json`; require at least one.
- Resolve destination only from `OS_CONFIG`.
- Validate JSON before write; write temporary file then atomic replace; back up existing files.
- Redirect with PRG status message.

### Task 3: Add admin UI
- Modify `app/templates/admin_tools.html`.
- Add admin-only card showing current file names/status and multipart upload form.
- Analyzer remains limited to tool upload and cannot change checklist/rules.

### Task 4: Enable persistence in Docker
- Modify `docker-compose.yml` from `./config:/app/config:ro` to `./config:/app/config`.
- Keep `config/` as the only writable configuration directory required by this feature.

### Task 5: Verify
- Run regression tests, Python compile/AST, Jinja parse, JSON checks, `docker compose config`, and `git diff --check`.
- Grok execution review; fix any blocking findings.