docs(phase-14): plan selective analysis and byte cache

.planning/phases/14-selective-analysis-and-byte-cache/14-01-PLAN.md

@@ -0,0 +1,106 @@
+---
+phase: "14"
+plan: "01"
+type: execute
+wave: 0
+depends_on: []
+files_modified:
+  - backend/tests/test_cloud_analysis_contract.py
+  - backend/tests/test_cloud_cache.py
+  - backend/tests/test_cloud_analysis_api.py
+  - frontend/src/components/storage/__tests__/StorageBrowser.analysis-queue.test.js
+  - frontend/src/stores/__tests__/cloudConnections.analysis.test.js
+autonomous: true
+requirements:
+  - ANALYZE-01
+  - ANALYZE-02
+  - ANALYZE-03
+  - ANALYZE-04
+  - ANALYZE-05
+  - ANALYZE-06
+  - ANALYZE-07
+  - CACHE-03
+  - CACHE-04
+  - CACHE-05
+---
+
+<objective>
+Create the Phase 14 executable test contract before implementation. Establish red backend and frontend tests for analysis scope selection, estimates, duplicate-version skips, cache ownership/quota semantics, cancellation/retry controls, and the shared-browser queue surface.
+
+Scope fence: add tests and fixtures only. Do not implement production code in this plan except minimal test helpers/fakes.
+</objective>
+
+<context>
+@.planning/ROADMAP.md
+@.planning/REQUIREMENTS.md
+@.planning/phases/14-selective-analysis-and-byte-cache/14-CONTEXT.md
+@.planning/phases/14-selective-analysis-and-byte-cache/14-RESEARCH.md
+@.planning/phases/14-selective-analysis-and-byte-cache/14-PATTERNS.md
+@backend/tests/test_cloud_items.py
+@backend/tests/test_cloud_security.py
+@frontend/src/components/storage/__tests__/StorageBrowser.cloud-queue.test.js
+</context>
+
+<tasks>
+
+<task type="auto">
+  <name>Task 1: Add backend red tests for analysis and cache contracts</name>
+  <files>backend/tests/test_cloud_analysis_contract.py, backend/tests/test_cloud_cache.py, backend/tests/test_cloud_analysis_api.py</files>
+  <read_first>
+    - backend/tests/test_cloud_items.py
+    - backend/tests/test_cloud_security.py
+    - backend/tests/test_cloud_mutations.py
+    - backend/db/models.py
+  </read_first>
+  <action>
+    Add focused tests using fake cloud items/connections and fake provider adapters. Cover individual-file, selection, folder, and connection estimate/enqueue requests; whole-connection estimate requirement; recursive folder choice; unsupported item reporting; duplicate unchanged version skip without provider byte fetch; owner/admin-negative access; cache entry ownership; cache object key secrecy; quota increment/decrement expectations; active pin eviction protection; retry and cancel status transitions. Mark these tests red against missing modules/endpoints rather than weakening assertions.
+  </action>
+  <acceptance_criteria>
+    - Tests name the exact ANALYZE/CACHE requirements they protect.
+    - Tests assert provider bytes are not downloaded during estimate or duplicate-current checks.
+    - Tests assert provider mutation methods are never invoked by analysis paths.
+    - Running the new backend tests fails for missing Phase 14 implementation, not syntax/import errors in the tests themselves once modules exist.
+  </acceptance_criteria>
+  <verify><automated>cd backend && pytest -q tests/test_cloud_analysis_contract.py tests/test_cloud_cache.py tests/test_cloud_analysis_api.py</automated></verify>
+</task>
+
+<task type="auto">
+  <name>Task 2: Add frontend red tests for shared-browser analysis UX</name>
+  <files>frontend/src/components/storage/__tests__/StorageBrowser.analysis-queue.test.js, frontend/src/stores/__tests__/cloudConnections.analysis.test.js</files>
+  <read_first>
+    - frontend/src/components/storage/StorageBrowser.vue
+    - frontend/src/views/CloudFolderView.vue
+    - frontend/src/stores/cloudConnections.js
+    - frontend/src/components/storage/__tests__/StorageBrowser.cloud-queue.test.js
+  </read_first>
+  <action>
+    Add tests proving row-level file analysis action, toolbar analysis for multi-select/folder/current connection, estimate modal thresholds, aggregate progress, expandable item list, simplified vs detailed labels, retry/skip/cancel controls, and Settings-backed default failure behavior. Tests must assert that `CloudFolderView` passes props and handles emits without owning layout, and that no parallel file grid is introduced.
+  </action>
+  <acceptance_criteria>
+    - Tests fail because analysis UI/store code is absent, not because of brittle selectors.
+    - Shared browser remains the component under test for browser layout and controls.
+    - Store tests cover status translation and API client calls without using localStorage/sessionStorage for credentials.
+  </acceptance_criteria>
+  <verify><automated>cd frontend && npm run test -- StorageBrowser.analysis-queue.test.js cloudConnections.analysis.test.js</automated></verify>
+</task>
+
+</tasks>
+
+<threat_model>
+| Threat ID | Threat | Required test evidence |
+|-----------|--------|------------------------|
+| T-14-01 | Analysis IDOR | Foreign user cannot estimate/enqueue/status/cancel/retry another user's connection or item |
+| T-14-02 | Credential/object-key disclosure | API/audit responses never include credentials, raw provider URLs, or MinIO object keys |
+| T-14-03 | Hidden provider mutation | Fake adapter mutation method counters remain zero during analysis |
+| T-14-04 | Hidden byte download | Estimate and already-current checks do not call provider byte fetch |
+| T-14-05 | Cache quota corruption | Tests require atomic quota increment on retain and decrement on eviction |
+</threat_model>
+
+<verification>
+1. `cd backend && pytest -q tests/test_cloud_analysis_contract.py tests/test_cloud_cache.py tests/test_cloud_analysis_api.py`
+2. `cd frontend && npm run test -- StorageBrowser.analysis-queue.test.js cloudConnections.analysis.test.js`
+3. Confirm failures are expected missing-implementation failures only.
+</verification>
+
+<output>Create `.planning/phases/14-selective-analysis-and-byte-cache/14-01-SUMMARY.md` when complete.</output>
+