summercms/.planning/phases/12-p-ytarium-api-collections-and-albums/12-VALIDATION.md

phase, slug, status, nyquist_compliant, wave_0_complete, created

phase	slug	status	nyquist_compliant	wave_0_complete	created
12	p-ytarium-api-collections-and-albums	draft	false	false	2026-10-02

Phase 12 — Validation Strategy

Per-phase validation contract for feedback sampling during execution.

---

Test Infrastructure

Property	Value
Framework	Go testing (+ testify assert/require, Go fuzzing), testcontainers Postgres
Config file	none (parity/parity_test.go TestMain starts Postgres)
Quick run command	cd fonoteka.go && go test ./plugins/golem15/fonoteka/... -short -count=1
Full suite command	cd fonoteka.go && go vet ./... && go test ./... -count=1, plus cd summercms.go && go vet ./... && go test ./... -count=1 for framework changes
Parity command	`cd fonoteka.go && go test ./parity -run 'TestParityCorpus
Estimated runtime	~180 seconds (full suite, both repos, with containers)

---

Sampling Rate

• After every task commit: quick run command plus go vet in the touched repo
• After every plan wave: full suite in both repos plus the parity command
• Before /gsd-verify-work: full suite green in both repos; parity corpus with the new routes flipped to ported and passing; check_corpus.go --require-recorded --check-secrets green; go test ./cmd/summer -run TestDocsTree green
• Max feedback latency: 60 seconds (quick run)

---

Per-Task Verification Map

Task IDs are <plan>-T<task>. Framework commands run from summercms.go; application commands use go -C ../fonoteka.go. Plan 12-05 Task 3 replaces the Status and File Exists columns with run evidence and scripts/check-phase12.sh --named runs every named test by exact name.

Task ID	Plan	Wave	Requirement	Threat Ref	Secure Behavior	Test Type	Automated Command	File Exists	Status
12-01-T1	12-01	1	API-01, API-02	T-12-14, T-12-15	Laravel 9 request validation (implicit stop, wildcards, size-typed messages, pl/en catalogs); lagoon.Validate min/between fix keeps user-api bodies	unit	go test ./modules/lagoon -run '^(TestValidateRequest.*|TestValidate.*Message.*)$' -count=1 -v	❌ W0	⬜ pending
12-01-T2	12-01	1	API-01, API-02	T-12-16, T-12-17	Winter upload URLs (URL, PublicURL), webp decode, tide multipart parts with sha256, upload URL and publication date masks	unit	go test ./modules/lagoon/attach ./modules/tide -run '^(TestFileURLWinterLayout|TestThumbWebP|TestMultipart.*|TestNormalizeUploadURL.*|TestNormalizePublication.*)$' -count=1 -v	❌ W0	⬜ pending
12-01-T3	12-01	1	API-01, API-02	T-12-28, T-12-18	beachcomber SearchPage found and query_by_weights; user groups additive (user-api payload unchanged)	unit + integration	go test ./modules/beachcomber/... -run '^(TestSearchPage.*|TestTypesenseSearchPage.*)$' -count=1 -v && go -C ../fonoteka.go test ./plugins/golem15/user/updates -run '^(TestUserGroups.*)$' -count=1 -v	❌ W0	⬜ pending
12-01-T4	12-01	1	API-01, API-02	—	ROADMAP/REQUIREMENTS reworded per D-03, D-04, D-06, D-19, D-20	docs check	grep -q 'realtime/channels' .planning/ROADMAP.md && grep -q 'realtime/channels' .planning/REQUIREMENTS.md	✅	⬜ pending
12-02-T1	12-02	2	API-01	T-12-01, T-12-03, T-12-12	Token-aware resolver, AccessibleBy narrowing, one-time provisioning under locks, collections list on both groups, per-route scopes (D-26)	integration + parity	go -C ../fonoteka.go test ./plugins/golem15/fonoteka -run '^(TestCollectionsIndexBothGroups|TestResolveProvisionsOnce)$' -count=1 -race -v	❌ W0	⬜ pending
12-02-T2	12-02	2	API-01	T-12-05, T-12-29, T-12-30, T-12-19	Collection CRUD, per-album delete (D-26), photos and image uploads, switch with Winter 404 page	integration + parity	go -C ../fonoteka.go test ./plugins/golem15/fonoteka -run '^(TestCollectionDeleteRemovesAlbumsOneByOne|TestCollectionPhotoUpload|TestCollectionSwitchRefusals)$' -count=1 -race -v	❌ W0	⬜ pending
12-02-T3	12-02	2	API-01	T-12-04, T-12-08, T-12-13	me/context flags (site admin via groups), realtime/channels, owner-only share with crypto/rand token	integration + parity	go -C ../fonoteka.go test ./plugins/golem15/fonoteka -run '^(TestMeContextFlags|TestRealtimeChannelsName|TestShareTokenAlphabet|TestShareOwnerOnly)$' -count=1 -race -v	❌ W0	⬜ pending
12-03-T1	12-03	3	API-01	T-12-06, T-12-07, T-12-22	Invite mail job enqueued in tx with encrypted token, absent on rollback; accept adds editor and notification	integration + parity	go -C ../fonoteka.go test ./plugins/golem15/fonoteka -run '^(TestInvitationMailEnqueuedInTx|TestInvitationAcceptAddsEditor)$' -count=1 -race -v	❌ W0	⬜ pending
12-03-T2	12-03	3	API-01	T-12-31, T-12-32, T-12-21	Owner-only household management, member removal repairs context, pending-invitation 409 guard, single accept under concurrency	integration + parity	go -C ../fonoteka.go test ./plugins/golem15/fonoteka -run '^(TestRemoveEditorRepairsContext|TestPendingInvitationGuard|TestConcurrentAcceptSingleEditor)$' -count=1 -race -v	❌ W0	⬜ pending
12-03-T3	12-03	3	API-01	T-12-20	nuxt-collections flow replay; ValidationException envelopes; no raw invitation token in the corpus	parity flow	go -C ../fonoteka.go test ./parity -run '^(TestFonotekaNuxtFlows|TestParityCorpus|TestCheckCorpus.*)$' -count=1 -v	❌ W0	⬜ pending
12-04-T1	12-04	4	API-02	T-12-11, T-12-23	Album create on both groups, single created event, album_added notifications, created golden asserted	integration + parity	go -C ../fonoteka.go test ./plugins/golem15/fonoteka -run '^(TestAlbumStoreSingleCreatedEvent|TestAlbumAddedNotifiesHousehold|TestAlbumWriteHelpersMatchPHP)$' -count=1 -race -v	❌ W0	⬜ pending
12-04-T2	12-04	4	API-02	T-12-33, T-12-09, T-12-10, T-12-24	Album CRUD, ratings, uploads with image guard, SSRF-guarded cover fetches after commit, bulk single summary, stats/value/missing/sync	integration + parity	go -C ../fonoteka.go test ./plugins/golem15/fonoteka -run '^(TestCoverImportAfterCommit|TestManualCoverReasons|TestAlbumPhotoUpload|TestBulkSingleSummaryEvent|TestRatingUpsertConcurrent|TestAlbumValueFormatting)$' -count=1 -race -v	❌ W0	⬜ pending
12-04-T3	12-04	4	API-02	T-12-02, T-12-34	Search SQL escaping and Scout-exact recount, lookups, nuxt-albums flow, 99 ported routes	integration + parity	go -C ../fonoteka.go test ./plugins/golem15/fonoteka -run '^(TestAlbumSearchSQLEscaping|TestAlbumSearchTypesenseRecount)$' -count=1 -race -v && go -C ../fonoteka.go test ./parity -run '^(TestFonotekaNuxtFlows|TestParityCorpus|TestBroadcastGoldens)$' -count=1 -v	❌ W0	⬜ pending
12-05-T1	12-05	5	API-02	T-12-02, T-12-28	D-18 leak test (5 cases) with D-19 total and cap on both groups	security	go -C ../fonoteka.go test ./plugins/golem15/fonoteka -run '^TestSearchLeak$' -count=1 -race -v	❌ W0	⬜ pending
12-05-T2	12-05	5	API-01, API-02	T-12-01..T-12-34	Route-table one-scope test (D-10, D-26), request-DTO fuzz over every write endpoint (C-02), one subtest per threat	security + fuzz	go -C ../fonoteka.go test ./plugins/golem15/fonoteka -run '^(TestRouteTablePhase12|FuzzWriteEndpoints|TestPhase12Threats)$' -count=1 -race -v	❌ W0	⬜ pending
12-05-T3	12-05	5	API-01, API-02	T-12-25, T-12-26, T-12-27	Full unit coverage (80% floor per package), fail-closed gate with removal mutations, security review and validation sign-off	unit + gate	scripts/check-phase12.sh --self-test && scripts/check-phase12.sh --all	❌ W0	⬜ pending

Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky

---

Wave 0 Requirements

• Re-record the HttpException cases under APP_DEBUG=false (accept 410, switch 404, household/members 404, invitations 404, guard 409) — D-21 (12-02-T2, 12-03-T1, 12-03-T2)
• tide request multipart parts + url/thumb_url disk-name normalizer + publication date masking (framework) — 12-01-T2
• Seed hook fonoteka with alice, bob (editor), an outsider and personal tokens (reuse the id:outsider recipe from Phase 11) — 12-02-T1
• Fake beachcomber engine with scripted ids and found for D-18/D-19 — smoke in 12-04-T3, full suite in 12-05-T1

---

Manual-Only Verifications

Behavior	Requirement	Why Manual	Test Instructions
Recording new PHP fixtures against the isolated PHP instance	API-01, API-02	Needs the running PHP reference instance and capture tooling	Follow the Phase 2 tide capture rules (private 0600 vars, no live tokens in git), then run check_corpus.go --require-recorded --check-secrets

---

Validation Sign-Off

• All tasks have <automated> verify or Wave 0 dependencies
• Sampling continuity: no 3 consecutive tasks without automated verify
• Wave 0 covers all MISSING references
• No watch-mode flags
• Feedback latency < 60s
• nyquist_compliant: true set in frontmatter

Approval: pending