5.7 KiB
5.7 KiB
phase, slug, status, nyquist_compliant, wave_0_complete, created
| phase | slug | status | nyquist_compliant | wave_0_complete | created |
|---|---|---|---|---|---|
| 09 | backend-admin-authentication-and-schema-pipeline | approved | true | false | 2026-09-24 |
Phase 09 — Validation Strategy
Per-phase validation contract for feedback sampling during execution.
Test Infrastructure
| Property | Value |
|---|---|
| Framework | Go 1.27 standard testing; existing Testcontainers-backed PostgreSQL integration harness |
| Config file | none — package-local *_test.go files and repository go.work workspaces |
| Quick run command | go test ./bouncer ./pact ./lagoon ./party ./surf |
| Full suite command | go test ./... && (cd ../fonoteka.go && go test ./...) |
| Estimated runtime | Focused package checks should complete within 60 seconds; full two-repository and Testcontainers runs may take several minutes |
Sampling Rate
- After every task commit: Run the narrowest affected package tests plus
go vet ./...in the modified workspace. - After every plan wave: Run
go test ./...in bothsummercms.goandfonoteka.go. - Before
$gsd-verify-work: Full suites and the assembled admin authorization matrix must be green. - Max feedback latency: 60 seconds for task-level checks; multi-minute integration runs are reserved for wave and phase gates.
Per-Task Verification Map
| Task ID | Plan | Wave | Requirement | Threat Ref | Secure Behavior | Test Type | Automated Command | File Exists | Status |
|---|---|---|---|---|---|---|---|---|---|
| 09-01-T2 | 09-01 | 1 | AUTH-08 | T-09-01, T-09-02 | Backend/frontend token crossover and permission-order denial both fail before schema/database work | unit + assembled integration | go test ./bouncer ./cabana -run 'Test.*(Audience|Permission|AuthorizationOrder|Secret)' -count=1 && (cd ../fonoteka.go && go test ./plugins/golem15/fonoteka -run '^TestAdminTracer(AuthBoundary|PermissionBoundary)$' -count=1) |
🧭 planned | ⬜ pending |
| 09-03-T1 | 09-03 | 3 | ADMIN-01 | T-09-05 | Strict schema compilation covers every field type and rejects unknown keys/types/partials/providers with empty/single/order/type semantics | unit + golden contract | go test ./cabana -run '^TestFormSchema(Compile|Empty|Single|Ordering|Rejects)' -count=1 |
🧭 planned | ⬜ pending |
| 09-04-T3 | 09-04 | 4 | ADMIN-02 | T-09-07, T-09-08 | Search/sort/filter/scope selectors are compiled allowlists, values are bound, and adjacent pages are deterministic | unit + query integration | go test ./cabana -run '^TestListQuery(Contract|Empty|Single|Adjacent|Filters|RejectsInjection)$' -count=1 |
🧭 planned | ⬜ pending |
| 09-10-T3 | 09-10 | 7 | ADMIN-03 | T-09-16, T-09-17 | Relation permission/scope and plugin-owned pivot metadata protect idempotent link/unlink against forged/cross-scope input | PostgreSQL assembled integration | (cd ../fonoteka.go && go test ./plugins/golem15/fonoteka -run '^TestCollectionsAdmin(RelationPermissions|Link|Unlink|Idempotent|ForgedPivot|CrossScope|Concurrent)$' -count=1) |
🧭 planned | ⬜ pending |
| 09-05-T3 | 09-05 | 5 | ADMIN-04 | T-09-09, T-09-10 | Bulk CRUD normalizes duplicates, rejects empty selection, locks stable order, runs hooks, rolls back atomically, and is replay-safe | PostgreSQL integration | go test ./cabana -run '^TestBulkDelete(Empty|Duplicates|Order|Idempotent|Rollback|Concurrent)$' -count=1 |
🧭 planned | ⬜ pending |
| 09-11-T3 | 09-11 | 8 | ADMIN-05 | T-09-18, T-09-19 | Settings schema/read/write is permission-first, singleton-scoped, fillable-only, validated, rollback-safe, and explicit for missing/create/repeat | PostgreSQL assembled integration | (cd ../fonoteka.go && go test ./plugins/golem15/fonoteka -run '^TestAdminSettings(Schema|PermissionOrder|MissingRead|Create|IdempotentUpdate|Projection|Validation|Rollback)$' -count=1) |
🧭 planned | ⬜ pending |
| 09-12-T2 | 09-12 | 9 | AUTH-08, ADMIN-01, ADMIN-02, ADMIN-03, ADMIN-04, ADMIN-05 | T-09-20, T-09-21 | Fail-closed full route/PostgreSQL/OpenAPI gate detects skipped stages, zero tests, contract drift, and incomplete assembled behavior | phase gate | scripts/check-phase9.sh --self-test && scripts/check-phase9.sh --postgres && scripts/check-phase9.sh --openapi |
🧭 planned | ⬜ pending |
Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky
Wave 0 Requirements
- Framework schema compiler tests are assigned to 09-03 and expanded by controller plans.
- Backend guard tests are assigned to 09-01/09-02 and swept by 09-12.
- The assembled raw-route authorization matrix is assigned to 09-12.
- Real-PostgreSQL bulk, relation, scoping, settings, migration, rollback, and concurrency tests are assigned to 09-05/09-10/09-11/09-12.
- Focused test names and commands are concrete in every PLAN task; no separate pre-execution scaffold is required.
Manual-Only Verifications
All Phase 9 backend behaviors are expected to have automated verification. Phase 10 owns browser rendering and interaction UAT for the generated schemas.
Validation Sign-Off
- All tasks have
<automated>verification and an immediate observable failure direction. - Sampling continuity: every task has automated verification.
- All previously missing references are assigned to owning TDD tasks and the final gate.
- No watch-mode flags appear in validation commands.
- Focused task-level commands target the 60-second feedback budget; multi-minute PostgreSQL/full-suite checks are phase gates.
nyquist_compliant: trueis set after final plan/task IDs and commands are validated.
Approval: approved for execution; implementation results remain pending.