docs(10): research admin Vue SPA phase

.planning/phases/10-admin-vue-spa/10-VALIDATION.md

@@ -0,0 +1,88 @@
+---
+phase: "10"
+slug: "admin-vue-spa"
+# status lifecycle: draft (seeded by plan-phase) → validated (set by validate-phase §6)
+# audit-milestone §5.5 distinguishes NOT-VALIDATED (draft) from PARTIAL (validated + nyquist_compliant: false) (#2117)
+status: draft
+nyquist_compliant: false
+wave_0_complete: false
+created: "2026-09-27"
+---
+
+# Phase 10 — Validation Strategy
+
+> Per-phase validation contract for feedback sampling during execution.
+
+---
+
+## Test Infrastructure
+
+| Property | Value |
+|----------|-------|
+| **Framework** | Go 1.27 `testing` + testify (Testcontainers Postgres harness); Vitest ^3.2 + @vue/test-utils + happy-dom for the SPA |
+| **Config file** | none for Go; `admin/vitest.config.ts` (Wave 0 installs) |
+| **Quick run command** | `go test ./cabana ./bouncer ./phrasebook ./boardwalk -count=1` / `(cd admin && npx vitest run --reporter=dot)` |
+| **Full suite command** | `go vet ./... && go test ./... && (cd ../fonoteka.go && go vet ./... && go test ./...) && (cd admin && npm run typecheck && npm test)` |
+| **Estimated runtime** | ~180 seconds (Postgres-backed suites dominate) |
+
+---
+
+## Sampling Rate
+
+- **After every task commit:** narrowest Go package test + `go vet ./...` in the touched repo; for SPA tasks `npx vitest run <dir>` + `npm run typecheck`
+- **After every plan wave:** full suite in both repos + `cd admin && npm run build` + `scripts/check-admin-dist.sh` + `scripts/check-admin-openapi.sh`
+- **Before `/gsd-verify-work`:** `scripts/check-phase10.sh --all` must be green
+- **Max feedback latency:** 180 seconds
+
+---
+
+## Per-Task Verification Map
+
+Filled by the planner from each PLAN.md `<verify>` block. Requirement → test map from RESEARCH.md:
+
+| Behavior | Requirement | Test Type | Automated Command | File Exists | Status |
+|----------|-------------|-----------|-------------------|-------------|--------|
+| Cookie login, CSRF header, no token in body, logout clears cookie, prefix mount | ADMIN-06 SC1 | unit + assembled | `go test ./cabana -run '^TestPhase10(CookieAuth\|CSRF\|Prefix)' -count=1` | ❌ W0 | ⬜ pending |
+| Server-filtered navigation; rail hides empty plugins | ADMIN-06 SC1 | unit + component | `go test ./cabana -run '^TestPhase09PermissionMatrix$' -count=1`; `(cd admin && npx vitest run tests/shell)` | Go ✅ / SPA ❌ W0 | ⬜ pending |
+| Five controllers list/form via prefix | ADMIN-06 SC2 | assembled Postgres | `(cd ../fonoteka.go && go test ./plugins/golem15/fonoteka -run '^TestPhase10Controllers' -count=1)` | ❌ W0 | ⬜ pending |
+| DataTable/Form render from schema fixtures | ADMIN-06 SC2 | component | `(cd admin && npx vitest run tests/list tests/form)` | ❌ W0 | ⬜ pending |
+| Collections editors search/link/unlink | ADMIN-06 SC3 | assembled + component | `(cd ../fonoteka.go && go test ./plugins/golem15/fonoteka -run '^TestCollectionsAdmin' -count=1)`; `(cd admin && npx vitest run tests/relation)` | Go ✅ (update) / SPA ❌ W0 | ⬜ pending |
+| OpenAPI doc + TS types regenerate identically; doc matches wire | ADMIN-06 SC4 | script + unit | `scripts/check-admin-openapi.sh`; `go test ./cabana -run '^TestPhase10OpenAPIConformance$' -count=1` | ❌ W0 | ⬜ pending |
+| Embedded dist serving, fallback, api 404, MIME, dist drift | D-02/D-04 | unit + script | `go test ./boardwalk -count=1`; `scripts/check-admin-dist.sh` | ❌ W0 | ⬜ pending |
+| messages / toolbar / string bundle / lang override | D-13/D-14/D-20 | unit | `go test ./cabana ./phrasebook -run '^TestPhase10(Messages\|Toolbar\|Bundle\|LangOverride)' -count=1` | ❌ W0 | ⬜ pending |
+| Relation options + relation save + forged ids 422 | D-17/D-18 | unit + Postgres | `go test ./cabana -run '^TestPhase10Relation' -count=1` | ❌ W0 | ⬜ pending |
+
+*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*
+
+---
+
+## Wave 0 Requirements
+
+- [ ] `admin/package.json` scripts: `dev`, `build`, `typecheck`, `test`, `gen:api`
+- [ ] `admin/vitest.config.ts` + `admin/tests/setup.ts` (fetch mock for openapi-fetch)
+- [ ] `admin/tests/fixtures/` — neutral schema fixtures (tabs, all field types, unsupported type, three filter shapes)
+- [ ] `boardwalk/boardwalk_test.go`
+- [ ] `scripts/check-admin-openapi.sh`, `scripts/check-admin-dist.sh`, `scripts/check-phase10.sh`
+- [ ] Go test helper for prefix-relative admin API paths in cabana and fonoteka admin tests
+
+---
+
+## Manual-Only Verifications
+
+| Behavior | Requirement | Why Manual | Test Instructions |
+|----------|-------------|------------|-------------------|
+| Visual fidelity to Direction C v2 (tokens, dark mode, collapse below ~1100px) | ADMIN-06 (D-06) | No browser e2e in Phase 10 (D-23) | Run `summer serve` for fonoteka, open `{backend.uri}`, compare screens against `design/Direction C v2.dc.html` in light and dark mode at desktop and tablet widths |
+| Full login → navigate → edit → relation link flow in a real browser | ADMIN-06 SC1–SC3 | Playwright deferred | Log in as a limited admin and a superuser; confirm rail items differ; edit an Album, link/unlink a Collections editor |
+
+---
+
+## Validation Sign-Off
+
+- [ ] All tasks have `<automated>` verify or Wave 0 dependencies
+- [ ] Sampling continuity: no 3 consecutive tasks without automated verify
+- [ ] Wave 0 covers all MISSING references
+- [ ] No watch-mode flags
+- [ ] Feedback latency < 180s
+- [ ] `nyquist_compliant: true` set in frontmatter
+
+**Approval:** pending