---
phase: "14"
plan: "01"
type: execute
wave: 0
depends_on: []
files_modified:
  - backend/tests/test_cloud_analysis_contract.py
  - backend/tests/test_cloud_cache.py
  - backend/tests/test_cloud_analysis_api.py
  - frontend/src/components/storage/__tests__/StorageBrowser.analysis-queue.test.js
  - frontend/src/stores/__tests__/cloudConnections.analysis.test.js
autonomous: true
requirements:
  - ANALYZE-01
  - ANALYZE-02
  - ANALYZE-03
  - ANALYZE-04
  - ANALYZE-05
  - ANALYZE-06
  - ANALYZE-07
  - CACHE-03
  - CACHE-04
  - CACHE-05
---

<objective>
Create the Phase 14 executable test contract before implementation. Establish red backend and frontend tests for analysis scope selection, estimates, duplicate-version skips, cache ownership/quota semantics, cancellation/retry controls, and the shared-browser queue surface.

Scope fence: add tests and fixtures only. Do not implement production code in this plan except minimal test helpers/fakes.
</objective>

<context>
@.planning/ROADMAP.md
@.planning/REQUIREMENTS.md
@.planning/phases/14-selective-analysis-and-byte-cache/14-CONTEXT.md
@.planning/phases/14-selective-analysis-and-byte-cache/14-RESEARCH.md
@.planning/phases/14-selective-analysis-and-byte-cache/14-PATTERNS.md
@backend/tests/test_cloud_items.py
@backend/tests/test_cloud_security.py
@frontend/src/components/storage/__tests__/StorageBrowser.cloud-queue.test.js
</context>

<tasks>

<task type="auto">
  <name>Task 1: Add backend red tests for analysis and cache contracts</name>
  <files>backend/tests/test_cloud_analysis_contract.py, backend/tests/test_cloud_cache.py, backend/tests/test_cloud_analysis_api.py</files>
  <read_first>
    - backend/tests/test_cloud_items.py
    - backend/tests/test_cloud_security.py
    - backend/tests/test_cloud_mutations.py
    - backend/db/models.py
  </read_first>
  <action>
    Add focused tests using fake cloud items/connections and fake provider adapters. Cover individual-file, selection, folder, and connection estimate/enqueue requests; whole-connection estimate requirement; recursive folder choice; unsupported item reporting; duplicate unchanged version skip without provider byte fetch; owner/admin-negative access; cache entry ownership; cache object key secrecy; quota increment/decrement expectations; active pin eviction protection; retry and cancel status transitions. Mark these tests red against missing modules/endpoints rather than weakening assertions.
  </action>
  <acceptance_criteria>
    - Tests name the exact ANALYZE/CACHE requirements they protect.
    - Tests assert provider bytes are not downloaded during estimate or duplicate-current checks.
    - Tests assert provider mutation methods are never invoked by analysis paths.
    - Running the new backend tests fails for missing Phase 14 implementation, not syntax/import errors in the tests themselves once modules exist.
  </acceptance_criteria>
  <verify><automated>cd backend && pytest -q tests/test_cloud_analysis_contract.py tests/test_cloud_cache.py tests/test_cloud_analysis_api.py</automated></verify>
</task>

<task type="auto">
  <name>Task 2: Add frontend red tests for shared-browser analysis UX</name>
  <files>frontend/src/components/storage/__tests__/StorageBrowser.analysis-queue.test.js, frontend/src/stores/__tests__/cloudConnections.analysis.test.js</files>
  <read_first>
    - frontend/src/components/storage/StorageBrowser.vue
    - frontend/src/views/CloudFolderView.vue
    - frontend/src/stores/cloudConnections.js
    - frontend/src/components/storage/__tests__/StorageBrowser.cloud-queue.test.js
  </read_first>
  <action>
    Add tests proving row-level file analysis action, toolbar analysis for multi-select/folder/current connection, estimate modal thresholds, aggregate progress, expandable item list, simplified vs detailed labels, retry/skip/cancel controls, and Settings-backed default failure behavior. Tests must assert that `CloudFolderView` passes props and handles emits without owning layout, and that no parallel file grid is introduced.
  </action>
  <acceptance_criteria>
    - Tests fail because analysis UI/store code is absent, not because of brittle selectors.
    - Shared browser remains the component under test for browser layout and controls.
    - Store tests cover status translation and API client calls without using localStorage/sessionStorage for credentials.
  </acceptance_criteria>
  <verify><automated>cd frontend && npm run test -- StorageBrowser.analysis-queue.test.js cloudConnections.analysis.test.js</automated></verify>
</task>

</tasks>

<threat_model>
| Threat ID | Threat | Required test evidence |
|-----------|--------|------------------------|
| T-14-01 | Analysis IDOR | Foreign user cannot estimate/enqueue/status/cancel/retry another user's connection or item |
| T-14-02 | Credential/object-key disclosure | API/audit responses never include credentials, raw provider URLs, or MinIO object keys |
| T-14-03 | Hidden provider mutation | Fake adapter mutation method counters remain zero during analysis |
| T-14-04 | Hidden byte download | Estimate and already-current checks do not call provider byte fetch |
| T-14-05 | Cache quota corruption | Tests require atomic quota increment on retain and decrement on eviction |
</threat_model>

<verification>
1. `cd backend && pytest -q tests/test_cloud_analysis_contract.py tests/test_cloud_cache.py tests/test_cloud_analysis_api.py`
2. `cd frontend && npm run test -- StorageBrowser.analysis-queue.test.js cloudConnections.analysis.test.js`
3. Confirm failures are expected missing-implementation failures only.
</verification>

<output>Create `.planning/phases/14-selective-analysis-and-byte-cache/14-01-SUMMARY.md` when complete.</output>