curo/kite
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(phase-07.2): mark VALIDATION.md complete — nyquist_compliant: true

Browse Source 
Audited post-execution state: all 11 tasks (9 original + CR-02 gap fix +
activate anti-pattern guard) have green automated tests. 84/84 passing.
Zero xfail stubs remaining. Sign-off approved.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
curo1305
2026-06-06 11:54:57 +02:00
co-authored by Claude Sonnet 4.6
parent b8e0e3adec
commit 2265aaaba4
1 changed files with 41 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.planning/phases/07.2-security-jti-claim-redis-access-token-revocation-inserted/07.2-VALIDATION.md
+41 -32
View File
@@ -1,10 +1,11 @@
--- ---
phase: 7.2 phase: 7.2
slug: security-jti-claim-redis-access-token-revocation-inserted slug: security-jti-claim-redis-access-token-revocation-inserted
status: draft status: complete
nyquist_compliant: false nyquist_compliant: true
wave_0_complete: false wave_0_complete: true
created: 2026-06-05 created: 2026-06-05
audited: 2026-06-06
--- ---
# Phase 7.2 — Validation Strategy # Phase 7.2 — Validation Strategy
@@ -36,33 +37,24 @@ created: 2026-06-05
## Per-Task Verification Map ## Per-Task Verification Map
| Task ID | Plan | Wave | Requirement | Threat Ref | Secure Behavior | Test Type | Automated Command | File Exists | Status | | Task ID | Plan | Wave | Requirement | Threat Ref | Secure Behavior | Test Type | Test Function | File Exists | Status |
|---------|------|------|-------------|------------|-----------------|-----------|-------------------|-------------|--------| |---------|------|------|-------------|------------|-----------------|-----------|---------------|-------------|--------|
| jti-claim | 01 | 0 | SEC (JTI) | — | Every access token contains a `jti` UUID key | unit | `pytest tests/test_task2_auth_service.py -k jti -v` | ❌ W0 | ⬜ pending | | jti-claim | 01 | 0 | SEC (JTI) | D-01 | Every access token contains a `jti` UUID claim | unit | `test_create_access_token_includes_jti_claim`, `test_create_access_token_jti_is_unique_per_call` | ✅ `tests/test_task2_auth_service.py` | ✅ green |
| test-fakeredis | 01 | 0 | SEC (infra) | — | `test_auth_deps.py` test app has `app.state.redis` set | unit | `pytest tests/test_auth_deps.py -v` | ❌ W0 | ⬜ pending | | test-fakeredis | 01 | 0 | SEC (infra) | — | `test_auth_deps.py` test app has `app.state.redis = FakeRedis()` set | unit | FakeRedis mounted in `make_test_app()` fixture | ✅ `tests/test_auth_deps.py` | ✅ green |
| nbf-write-change-password | 02 | 1 | SEC (NBF-write) | T-7.2-01 | `change_password` writes `user_nbf:{user_id}` to Redis | integration | `pytest tests/test_auth_api.py -k nbf -v` | ❌ W0 | ⬜ pending | | nbf-write-change-password | 03 | 2 | SEC (NBF-write) | T-7.2-01 | `change_password` writes `user_nbf:{user_id}` to Redis | integration | `test_change_password_writes_user_nbf_to_redis` | ✅ `tests/test_auth_api.py` | ✅ green |
| nbf-write-enable-totp | 02 | 1 | SEC (NBF-write) | T-7.2-01 | `enable_totp` writes `user_nbf:{user_id}` to Redis | integration | `pytest tests/test_auth_api.py -k nbf -v` | ❌ W0 | ⬜ pending | | nbf-write-enable-totp | 03 | 2 | SEC (NBF-write) | T-7.2-01 | `enable_totp` writes `user_nbf:{user_id}` to Redis | integration | `test_enable_totp_writes_user_nbf_to_redis` | ✅ `tests/test_auth_api.py` | ✅ green |
| nbf-write-disable-totp | 02 | 1 | SEC (NBF-write) | T-7.2-01 | `disable_totp` writes `user_nbf:{user_id}` to Redis | integration | `pytest tests/test_auth_api.py -k nbf -v` | ❌ W0 | ⬜ pending | | nbf-write-disable-totp | 03 | 2 | SEC (NBF-write) | T-7.2-01 | `disable_totp` writes `user_nbf:{user_id}` to Redis | integration | `test_disable_totp_writes_user_nbf_to_redis` | ✅ `tests/test_auth_api.py` | ✅ green |
| nbf-write-deactivation | 03 | 1 | SEC (NBF-write) | T-7.2-01 | admin deactivation writes `user_nbf:{user_id}` to Redis | integration | `pytest tests/test_admin_api.py -k nbf -v` | ❌ W0 | ⬜ pending | | nbf-write-password-reset-confirm | 03 | 2 | SEC (NBF-write) | CR-02 | `password_reset_confirm` writes `user_nbf:{user_id}` to Redis | integration | `test_password_reset_confirm_writes_user_nbf_to_redis` | ✅ `tests/test_auth_api.py` | ✅ green |
| nbf-check-reject | 04 | 1 | SEC (NBF-check) | T-7.2-02 | Token with `iat < user_nbf` returns HTTP 401 | integration | `pytest tests/test_auth_deps.py -k nbf -v` | ❌ W0 | ⬜ pending | | nbf-write-deactivation | 03 | 2 | SEC (NBF-write) | T-7.2-01, D-05 | admin deactivation writes `user_nbf:{user_id}` to Redis | integration | `test_deactivate_user_writes_user_nbf_to_redis` | ✅ `tests/test_admin_api.py` | ✅ green |
| nbf-check-allow | 04 | 1 | SEC (NBF-check) | T-7.2-03 | Token with `iat > user_nbf` is accepted | integration | `pytest tests/test_auth_deps.py -k nbf_after -v` | ❌ W0 | ⬜ pending | | activate-no-nbf | 03 | 2 | SEC (anti-pattern) | D-05 | admin activation does NOT write `user_nbf` | integration | `test_activate_user_does_not_write_user_nbf` | ✅ `tests/test_admin_api.py` | ✅ green |
| nbf-fail-open | 04 | 1 | SEC (fail-open) | T-7.2-04 | Redis error in NBF check does not block request | unit | `pytest tests/test_auth_deps.py -k failopen -v` | ❌ W0 | ⬜ pending | | nbf-check-reject | 02 | 1 | SEC (NBF-check) | T-7.2-02 | Token with `iat < user_nbf` returns HTTP 401 "Session invalidated" | integration | `test_get_current_user_rejects_token_when_iat_before_user_nbf` | ✅ `tests/test_auth_deps.py` | ✅ green |
| nbf-check-allow | 02 | 1 | SEC (NBF-check) | T-7.2-03 | Token with `iat > user_nbf` is accepted (HTTP 200) | integration | `test_get_current_user_allows_token_when_iat_after_user_nbf` | ✅ `tests/test_auth_deps.py` | ✅ green |
| nbf-fail-open | 02 | 1 | SEC (fail-open) | T-7.2-04, D-04 | Redis error in NBF check does not block request (HTTP 200) | unit | `test_get_current_user_failopen_on_redis_error` | ✅ `tests/test_auth_deps.py` | ✅ green |
*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky* *Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*
--- ---
## Wave 0 Requirements
- [ ] `backend/tests/test_task2_auth_service.py` — add JTI presence test for `create_access_token`
- [ ] `backend/tests/test_auth_deps.py` — add `app.state.redis = FakeRedis()` to `make_test_app()` or auth_client fixture; add NBF-check tests (iat < nbf → 401, iat > nbf → pass, Redis error → pass)
- [ ] `backend/tests/test_auth_api.py` — add NBF-write stub tests for `change_password`, `enable_totp`, `disable_totp`
- [ ] `backend/tests/test_admin_api.py` — add NBF-write stub test for deactivation handler
*Existing 34+ auth tests in `test_auth_deps.py` and `test_auth_api.py` must remain green with zero regressions.*
---
## Manual-Only Verifications ## Manual-Only Verifications
| Behavior | Requirement | Why Manual | Test Instructions | | Behavior | Requirement | Why Manual | Test Instructions |
@@ -82,13 +74,30 @@ created: 2026-06-05
--- ---
## Validation Audit 2026-06-06
| Metric | Count |
|--------|-------|
| Tasks in original map | 9 |
| Extra tasks added (CR-02 gap + anti-pattern guard) | 2 |
| Total tasks audited | 11 |
| Gaps found | 0 |
| Resolved | 0 |
| Escalated to manual-only | 0 |
| Tests passing (full suite) | 84/84 |
| xfail stubs remaining | 0 |
All Wave 0 xfail stubs were promoted to passing assertions during Phase 7.2 execution. The CR-02 gap (`password_reset_confirm` missing `user_nbf` write) was closed in the phase and has full test coverage.
---
## Validation Sign-Off ## Validation Sign-Off
- [ ] All tasks have `<automated>` verify or Wave 0 dependencies - [x] All tasks have automated verify commands
- [ ] Sampling continuity: no 3 consecutive tasks without automated verify - [x] Sampling continuity: no 3 consecutive tasks without automated verify
- [ ] Wave 0 covers all MISSING references - [x] Wave 0 covers all MISSING references (stubs promoted to green)
- [ ] No watch-mode flags - [x] No watch-mode flags
- [ ] Feedback latency < 30s - [x] Feedback latency < 30s
- [ ] `nyquist_compliant: true` set in frontmatter - [x] `nyquist_compliant: true` set in frontmatter
**Approval:** pending **Approval:** 2026-06-06 — 84/84 tests passing, 0 gaps, nyquist-compliant