---
phase: 13
slug: virtual-local-cloud-operations
status: complete
nyquist_compliant: true
wave_0_complete: true
created: 2026-06-22
audited: 2026-06-23
---

# Phase 13 — Validation Strategy

> Per-phase validation contract for feedback sampling during execution.

## Test Infrastructure

| Property | Value |
|----------|-------|
| **Framework** | Backend: pytest 9.0.3 + pytest-asyncio 1.4.0; frontend: Vitest 4.1.7 |
| **Config file** | `backend/pytest.ini`; frontend test script in `frontend/package.json` |
| **Quick run command** | `docker compose run --rm backend pytest -v tests/test_cloud.py tests/test_cloud_security.py -x` plus `cd frontend && npm run test -- src/views/__tests__/CloudFolderView.test.js src/views/__tests__/CloudFolderRenderedFlow.test.js src/components/storage/__tests__/StorageBrowser.capabilities.test.js` |
| **Full suite command** | `docker compose run --rm backend pytest -v` plus `cd frontend && npm run test` |
| **Estimated runtime** | Targeted suites under 120 seconds; full-suite duration measured during execution |

## Sampling Rate

- **After every task commit:** Run the targeted backend or frontend suite named by the task.
- **After every plan wave:** Run `docker compose run --rm backend pytest -v tests/test_cloud.py tests/test_cloud_backends.py tests/test_cloud_provider_contract.py tests/test_cloud_security.py tests/test_cloud_items.py` and `cd frontend && npm run test`.
- **Before `$gsd-verify-work`:** Full backend and frontend suites must be green, followed by the security/dependency gates required by `AGENTS.md`.
- **Max feedback latency:** 120 seconds for targeted verification; split commands when a target exceeds this budget.

## Per-Task Verification Map

| Task ID | Plan | Wave | Requirement | Threat Ref | Secure Behavior | Test Type | Automated Command | File Exists | Status |
|---------|------|------|-------------|------------|-----------------|-----------|-------------------|-------------|--------|
| 13-W0-01 | 01/03 | 0 | CLOUD-02..07, CLOUD-09 | T-13-01..08 | Provider-neutral results contain no credentials or raw provider URLs | contract/integration | `docker compose run --rm backend pytest -v tests/test_cloud_mutations.py` | ✅ | ✅ green |
| 13-W0-02 | 01/04 | 0 | CONN-01..03 | T-13-04, T-13-08 | Reconnect persists refreshed credentials, invalidates caches, and preserves metadata | integration/security | `docker compose run --rm backend pytest -v tests/test_cloud_reconnect.py tests/test_cloud_security.py` | ✅ | ✅ green |
| 13-W0-03 | 01/06/09 | 0 | CLOUD-09 | T-13-07 | Audit rows remain metadata-only for every successful mutation | integration | `docker compose run --rm backend pytest -v tests/test_cloud_audit.py` | ✅ | ✅ green |
| 13-W0-04 | 02/07 | 0 | CLOUD-03 | T-13-06 | Queue pauses on conflict/error and never silently overwrites | component | `cd frontend && npm run test -- src/components/storage/__tests__/StorageBrowser.cloud-queue.test.js` | ✅ | ✅ green |
| 13-W0-05 | 02/07 | 0 | CLOUD-02 | T-13-02 | Open/preview/download remains DocuVault-authorized | rendered flow | `cd frontend && npm run test -- src/views/__tests__/CloudFolderOpenPreview.test.js` | ✅ | ✅ green |
| 13-W0-06 | 02/10 | 0 | CONN-01..03 | T-13-08 | UI distinguishes transient outage from reauthentication and destructive disconnect | component | `cd frontend && npm run test -- src/components/settings/__tests__/SettingsCloudTab.health.test.js` | ✅ | ✅ green |
| 13-REQ-01 | 03/04 | TBD | CONN-01..03 | T-13-01, T-13-04, T-13-08 | Connection operations are owner-scoped and credential-free | integration/component | `docker compose run --rm backend pytest -v tests/test_cloud.py tests/test_cloud_reconnect.py tests/test_cloud_security.py -k "connect or disconnect or reconnect or health or credential"` | ✅ | ✅ green |
| 13-REQ-02 | 04 | TBD | CLOUD-02 | T-13-01, T-13-02 | Content endpoints reject foreign ownership and never expose provider links | integration/security/rendered | `docker compose run --rm backend pytest -v tests/test_cloud_mutations.py tests/test_cloud_security.py -k "open or preview or content"` | ✅ | ✅ green |
| 13-REQ-03 | 05/06/08/09 | TBD | CLOUD-03..07 | T-13-01, T-13-03, T-13-05, T-13-06 | Mutations enforce stale/conflict/cross-connection rules | contract/integration/component | `docker compose run --rm backend pytest -v tests/test_cloud_mutations.py tests/test_cloud_security.py -k "upload or create or rename or move or delete"` | ✅ | ✅ green |
| 13-REQ-04 | 06/09/nyquist | TBD | CLOUD-09 | T-13-07 | Reconciliation/freshness update and metadata-only audit occur before success returns | integration/rendered | `docker compose run --rm backend pytest -v tests/test_cloud_audit.py tests/test_cloud_items.py` | ✅ | ✅ green |

*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*

## Wave 0 Requirements

- [x] `backend/tests/test_cloud_mutations.py` — provider-neutral create/rename/move/delete/upload/open/preview contracts.
- [x] `backend/tests/test_cloud_reconnect.py` — connection-ID reconnect, token persistence, cache invalidation, and metadata retention.
- [x] `backend/tests/test_cloud_audit.py` — metadata-only audit assertions for every successful mutation (open, upload, create-folder, rename, move, delete; all 11 tests pass, 0 xfail).
- [x] `frontend/src/components/storage/__tests__/StorageBrowser.cloud-queue.test.js` — sequential queue, conflict/error pause, resume, skip, and cancel-all.
- [x] `frontend/src/views/__tests__/CloudFolderOpenPreview.test.js` — authorized open/preview/download behavior through the shared browser.
- [x] `frontend/src/components/settings/__tests__/SettingsCloudTab.health.test.js` — Test/Reconnect controls and transient-outage versus reauth states.

## Manual-Only Verifications

All phase behaviors receive automated coverage. No manual-only items.

## Validation Sign-Off

- [x] All tasks have automated verification.
- [x] Sampling continuity: no three consecutive tasks without automated verification.
- [x] Wave 0 covers every missing test reference.
- [x] No watch-mode flags.
- [x] Targeted feedback latency remains below 120 seconds.
- [x] `nyquist_compliant: true` set in frontmatter.

**Approval:** 2026-06-23 — Nyquist audit complete. 3 xfail gaps (open/create-folder/rename audit writes) resolved by implementing `write_audit_log` calls in `backend/api/cloud/operations.py`. All 11 `test_cloud_audit.py` tests pass green. Full cloud suite: 360 backend tests pass.

## Validation Audit 2026-06-23

| Metric | Count |
|--------|-------|
| Gaps found | 3 |
| Resolved | 3 |
| Escalated | 0 |

Gaps resolved: `test_open_file_writes_metadata_only_audit_row`, `test_create_folder_writes_metadata_only_audit_row`, `test_rename_success_writes_audit_row` — all xfail markers removed; audit writes added to `open_cloud_file`, `create_cloud_folder`, and `rename_cloud_item` routes.