docs(phase-07.1): add Nyquist VALIDATION.md — nyquist_compliant: true

All 6 tasks covered: 3 backend integration tests (pytest, green) + 3 frontend unit tests (vitest, green). 0 manual-only. Gap audit resolved 3/3 missing gaps. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-05 12:54:19 +02:00
parent 8f8bfa5539
commit c9fe69db3a
1 changed files with 89 additions and 0 deletions
@@ -0,0 +1,89 @@
+---
+phase: "07.1"
+slug: security-session-revocation-on-privilege-change
+status: complete
+nyquist_compliant: true
+wave_0_complete: false
+created: 2026-06-05
+---
+
+# Phase 07.1 — Validation Strategy
+
+> Per-phase validation contract for session-revocation on privilege change.
+
+---
+
+## Test Infrastructure
+
+| Property | Value |
+|----------|-------|
+| **Framework (backend)** | pytest 7.x + pytest-asyncio |
+| **Config file (backend)** | `backend/pytest.ini` |
+| **Framework (frontend)** | Vitest + @vue/test-utils |
+| **Config file (frontend)** | `frontend/vitest.config.js` |
+| **Backend quick run** | `cd backend && python3 -m pytest tests/test_auth_api.py -k "revokes_other_sessions" -v` |
+| **Backend full suite** | `cd backend && python3 -m pytest -x -q --ignore=tests/test_extractor.py` |
+| **Frontend quick run** | `cd frontend && npx vitest run src/components/settings/__tests__/SettingsAccountTab.test.js src/components/auth/__tests__/TotpEnrollment.test.js --reporter=verbose` |
+| **Frontend full suite** | `cd frontend && npx vitest run --reporter=verbose` |
+| **Estimated runtime** | ~5 s backend · ~10 s frontend |
+
+---
+
+## Sampling Rate
+
+- **After every task commit:** Run backend quick run + frontend quick run
+- **After every plan wave:** Run full backend + frontend suites
+- **Before `/gsd:verify-work`:** Both full suites must be green
+- **Max feedback latency:** ~15 seconds
+
+---
+
+## Per-Task Verification Map
+
+| Task ID | Plan | Wave | Requirement | Threat Ref | Secure Behavior | Test Type | Automated Command | File Exists | Status |
+|---------|------|------|-------------|------------|-----------------|-----------|-------------------|-------------|--------|
+| 07.1-01-01 | 01 | 1 | CR-01 | T-7.1-01 | `skip_token_hash` excludes current session from revocation | integration | `cd backend && python3 -m pytest tests/test_auth_api.py -k "test_change_password_revokes_other_sessions" -v` | ✅ | ✅ green |
+| 07.1-01-02 | 01 | 1 | CR-02 | T-7.1-01 | `enable_totp` revokes other sessions, keeps current alive | integration | `cd backend && python3 -m pytest tests/test_auth_api.py -k "test_enable_totp_revokes_other_sessions" -v` | ✅ | ✅ green |
+| 07.1-01-03 | 01 | 1 | CR-03 | T-7.1-01 | `disable_totp` revokes other sessions, keeps current alive | integration | `cd backend && python3 -m pytest tests/test_auth_api.py -k "test_disable_totp_revokes_other_sessions" -v` | ✅ | ✅ green |
+| 07.1-02-01 | 02 | 2 | CR-01 | T-7.1-04 | SettingsAccountTab shows toast when `changePassword` returns `sessions_revoked > 0` | unit | `cd frontend && npx vitest run src/components/settings/__tests__/SettingsAccountTab.test.js --reporter=verbose` | ✅ | ✅ green |
+| 07.1-02-02 | 02 | 2 | CR-03 | T-7.1-04 | SettingsAccountTab shows toast when `disableTotp` returns `sessions_revoked > 0` | unit | `cd frontend && npx vitest run src/components/settings/__tests__/SettingsAccountTab.test.js --reporter=verbose` | ✅ | ✅ green |
+| 07.1-02-03 | 02 | 2 | CR-02 | T-7.1-04 | TotpEnrollment shows inline alert when `enable_totp` returns `sessions_revoked > 0` | unit | `cd frontend && npx vitest run src/components/auth/__tests__/TotpEnrollment.test.js --reporter=verbose` | ✅ | ✅ green |
+
+*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*
+
+---
+
+## Wave 0 Requirements
+
+Existing infrastructure covers all phase requirements. No Wave 0 installs needed.
+
+---
+
+## Manual-Only Verifications
+
+All phase behaviors have automated verification.
+
+---
+
+## Validation Audit 2026-06-05
+
+| Metric | Count |
+|--------|-------|
+| Gaps found | 3 |
+| Resolved | 3 |
+| Escalated | 0 |
+
+Auditor: gsd-nyquist-auditor — 5 new Vitest tests added (+3 positive, +2 negative), all green. Backend suite previously green (3 passing integration tests). No regressions.
+
+---
+
+## Validation Sign-Off
+
+- [x] All tasks have `<automated>` verify
+- [x] Sampling continuity: no 3 consecutive tasks without automated verify
+- [x] Wave 0 covers all MISSING references (N/A — infra pre-existing)
+- [x] No watch-mode flags
+- [x] Feedback latency < 15s
+- [x] `nyquist_compliant: true` set in frontmatter
+
+**Approval:** approved 2026-06-05