kite/.planning/phases/07.3-security-es256-algorithm-upgrade-inserted/07.3-VALIDATION.md

phase, slug, status, nyquist_compliant, wave_0_complete, created

phase	slug	status	nyquist_compliant	wave_0_complete	created
7.3	07.3-security-es256-algorithm-upgrade-inserted	draft	false	false	2026-06-05

Phase 7.3 — Validation Strategy

Per-phase validation contract for feedback sampling during execution.

---

Test Infrastructure

Property	Value
Framework	pytest + pytest-asyncio
Config file	backend/pytest.ini
Quick run command	cd backend && pytest tests/test_auth_es256.py tests/test_task1_models_config.py -x -v
Full suite command	cd backend && pytest -v
Estimated runtime	~30 seconds

---

Sampling Rate

• After every task commit: Run cd backend && pytest tests/test_auth_es256.py tests/test_task1_models_config.py -x -v
• After every plan wave: Run cd backend && pytest -v
• Before /gsd:verify-work: Full suite must be green
• Max feedback latency: 30 seconds

---

Per-Task Verification Map

Task ID	Plan	Wave	Requirement	Threat Ref	Secure Behavior	Test Type	Automated Command	File Exists	Status
7.3-01-01	01	0	ES256-01..RM-03	T-7.3-01	Wave 0 xfail stubs for all 9 test cases	unit/integration	pytest tests/test_auth_es256.py -x	❌ Wave 0	⬜ pending
7.3-01-02	01	1	CFG-01	—	settings.jwt_private_key, settings.jwt_public_key, settings.refresh_token_expire_hours all present	unit	pytest tests/test_task1_models_config.py -x	✅ (extend)	⬜ pending
7.3-01-03	01	1	ES256-01	T-7.3-01	create_access_token returns token with alg=ES256 in header	unit	pytest tests/test_auth_es256.py::test_access_token_uses_es256 -x	❌ Wave 0	⬜ pending
7.3-01-04	01	1	ES256-02	T-7.3-02	HS256 token presented to ES256 verifier raises 401	unit	pytest tests/test_auth_es256.py::test_hs256_token_rejected -x	❌ Wave 0	⬜ pending
7.3-01-05	01	1	ES256-03	T-7.3-01	create_password_reset_token uses ES256	unit	pytest tests/test_auth_es256.py::test_reset_token_uses_es256 -x	❌ Wave 0	⬜ pending
7.3-01-06	01	1	ES256-04	T-7.3-03	Startup rotation bulk-revokes all refresh tokens when algorithm changes	integration	pytest tests/test_auth_es256.py::test_startup_rotation_revokes_tokens -x	❌ Wave 0	⬜ pending
7.3-01-07	01	1	ES256-05	T-7.3-03	Startup rotation skips revocation on second boot (idempotent)	integration	pytest tests/test_auth_es256.py::test_startup_rotation_idempotent -x	❌ Wave 0	⬜ pending
7.3-02-01	02	2	RM-01	T-7.3-04	Default login (no remember_me) issues 16-hour refresh token	integration	pytest tests/test_auth_es256.py::test_default_ttl_16_hours -x	❌ Wave 0	⬜ pending
7.3-02-02	02	2	RM-02	T-7.3-04	remember_me=True issues 30-day refresh token	integration	pytest tests/test_auth_es256.py::test_remember_me_ttl_30_days -x	❌ Wave 0	⬜ pending
7.3-02-03	02	2	RM-03	T-7.3-04	remember_me=True sets Set-Cookie: Max-Age=2592000	integration	pytest tests/test_auth_es256.py::test_remember_me_cookie_max_age -x	❌ Wave 0	⬜ pending

Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky

---

Wave 0 Requirements

• backend/tests/test_auth_es256.py — 9 xfail stubs covering ES256-01 through RM-03
• backend/tests/test_task1_models_config.py — extend test_settings_has_jwt_config to assert refresh_token_expire_hours == 16

---

Manual-Only Verifications

Behavior	Requirement	Why Manual	Test Instructions
"Stay signed in for 30 days" checkbox visible on login form	D-12	Frontend visual verification	Load http://localhost:5173/login; checkbox appears below password field; unchecked by default
Login without checkbox issues ~16h cookie	RM-03	Browser cookie inspection	Login without checkbox; open DevTools → Application → Cookies; refresh_token Max-Age ≈ 57600
Login with checkbox issues 30-day cookie	RM-03	Browser cookie inspection	Login with checkbox checked; refresh_token Max-Age = 2592000

---

Validation Sign-Off

• All tasks have <automated> verify or Wave 0 dependencies
• Sampling continuity: no 3 consecutive tasks without automated verify
• Wave 0 covers all MISSING references
• No watch-mode flags
• Feedback latency < 30s
• nyquist_compliant: true set in frontmatter

Approval: pending