docs(phase-17): add validation strategy

.planning/phases/17-blog-companions/17-VALIDATION.md

@@ -0,0 +1,90 @@
+---
+phase: "17"
+slug: "blog-companions"
+# status lifecycle: draft (seeded by plan-phase) → validated (set by validate-phase §6)
+# audit-milestone §5.5 distinguishes NOT-VALIDATED (draft) from PARTIAL (validated + nyquist_compliant: false) (#2117)
+status: draft
+nyquist_compliant: false
+wave_0_complete: false
+created: "2026-10-11"
+---
+
+# Phase 17 — Validation Strategy
+
+> Per-phase validation contract for feedback sampling during execution. Source: `17-RESEARCH.md` § Validation Architecture.
+
+---
+
+## Test Infrastructure
+
+| Property | Value |
+|----------|-------|
+| **Framework** | Go `testing` (+ testcontainers Postgres), vitest (admin SPA), `node --test` (Nuxt layers) |
+| **Config file** | none for Go; `admin/vite.config` (vitest); layer `package.json` `test` script |
+| **Quick run command** | `go test -short ./modules/pact ./modules/cabana/... ./modules/<registry>/... ./modules/<sanitizer>/...` (plus the touched plugin repo's `go test -short ./...`) |
+| **Full suite command** | `bash scripts/check-phase17.sh --all` (new; staged like `check-phase16.2.sh`) |
+| **Estimated runtime** | ~180 seconds (full, with Docker) |
+
+---
+
+## Sampling Rate
+
+- **After every task commit:** the quick command for the touched repo, plus `go vet ./...`
+- **After every plan wave:** full Go suites per repo with Docker, plus `npm --prefix admin run test`
+- **Before `/msd-verify-work`:** `scripts/check-phase17.sh --all` must be green
+- **Max feedback latency:** 60 seconds (quick loop)
+
+---
+
+## Per-Task Verification Map
+
+Filled in by the planner once task IDs exist. Planned coverage by decision:
+
+| Ref | Behavior | Test Type | Automated Command | File Exists | Status |
+|-----|----------|-----------|-------------------|-------------|--------|
+| SC-2/D-01 | Duplicate type key fails boot; registry lookup; pattern layers | unit | `go test -short ./modules/<registry> -run 'TestRegistry'` | ❌ W0 | ⬜ pending |
+| D-04 | Journal 5 types: references, resolve, alternates order, published filters | unit+pg | `cd ../sm-journal-plugin && go test ./... -run TestMenuItemTypes` | ❌ W0 | ⬜ pending |
+| D-07 | Repeater compile refusals, decode, row errors | unit | `go test -short ./modules/cabana -run TestRepeater` | ❌ W0 | ⬜ pending |
+| D-08 | dependsOn compile, options route, save recheck 422 | unit+conformance | `go test -short ./modules/cabana -run 'TestDependentDropdown\|TestPhase10ConformanceInventory'` | ❌ W0 | ⬜ pending |
+| D-09 | Reorder: exact-set rule, cycle/foreign parent refusal, both columns written | pg | `go test ./modules/cabana -run TestReorder` | ❌ W0 | ⬜ pending |
+| D-10 | richeditor sanitizes and reports; byte-stable when clean | unit | `go test -short ./modules/<sanitizer> ./modules/cabana -run 'TestSanitize\|TestRichEditor'` | ❌ W0 | ⬜ pending |
+| SC-3 | Sitemap golden parity with PHP output | unit (goldens) | `cd ../sm-sitemap-plugin && go test -short ./... -run 'TestSitemapGolden\|TestURLTo\|TestTiers\|TestRewrite'` | ❌ W0 | ⬜ pending |
+| D-14 | XmlEscaping/MassAssignment spec ports; add-item hooks | unit | `cd ../sm-sitemap-plugin && go test -short ./... -run 'TestXMLEscaping\|TestFillable\|TestHooks'` | ❌ W0 | ⬜ pending |
+| D-16 | Menu API tree, published filter, URL scheme filter, expansion | pg | `cd ../sm-menu-plugin && go test ./...` | ❌ W0 | ⬜ pending |
+| D-17 | FAQ API locale default, active only, sanitized output | pg | `cd ../sm-faq-plugin && go test ./...` | ❌ W0 | ⬜ pending |
+| Admin SPA | Repeater, RichEditor, dependent dropdown, ReorderView | vitest | `npm --prefix admin run test` | ❌ W0 | ⬜ pending |
+| D-18 | Layer clients and components, SSR smoke | node test | `pnpm -C ../vue-menu-layer test && pnpm -C ../vue-faq-layer test` | ❌ W0 | ⬜ pending |
+| SC-4 | Host boot with three plugins; import commands; `/sitemap.xml` from host | pg/host | `cd ../sm-grzybyfunkcjonalne-app && go test ./...` | partial | ⬜ pending |
+
+*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*
+
+---
+
+## Wave 0 Requirements
+
+- [ ] `scripts/check-phase17.sh` — staged gate (copy the 16.2 structure, named-test PASS checks)
+- [ ] PHP golden generator (e.g. `../sm-sitemap-plugin/tests/php/gen-goldens.php`) plus committed `testdata/*.golden`
+- [ ] `go.work` per new plugin repo (`use .` + replaces to `../summercms.go`, `../sm-translate-plugin`)
+- [ ] Test harness per plugin (`TestMain` with `flag.Parse()` + `testing.Short()`)
+
+---
+
+## Manual-Only Verifications
+
+| Behavior | Requirement | Why Manual | Test Instructions |
+|----------|-------------|------------|-------------------|
+| Menu and FAQ render from the API on grzybyfunkcjonalne.pl | SC-4 | Needs the deployed site and nginx routing | Load the homepage and FAQ page, compare with the PHP rendering |
+| `/sitemap.xml` via nginx equals the expected golden; robots.txt Sitemap line | SC-3/SC-4 | Needs the on-server route | Extend `scripts/smoke.sh`, diff against the golden |
+
+---
+
+## Validation Sign-Off
+
+- [ ] All tasks have `<automated>` verify or Wave 0 dependencies
+- [ ] Sampling continuity: no 3 consecutive tasks without automated verify
+- [ ] Wave 0 covers all MISSING references
+- [ ] No watch-mode flags
+- [ ] Feedback latency < 60s
+- [ ] `nyquist_compliant: true` set in frontmatter
+
+**Approval:** pending