kite/.planning/phases/07.1-security-session-revocation-on-privilege-change/07.1-VALIDATION.md

phase, slug, status, nyquist_compliant, wave_0_complete, created

phase	slug	status	nyquist_compliant	wave_0_complete	created
07.1	security-session-revocation-on-privilege-change	complete	true	false	2026-06-05

Phase 07.1 — Validation Strategy

Per-phase validation contract for session-revocation on privilege change.

---

Test Infrastructure

Property	Value
Framework (backend)	pytest 7.x + pytest-asyncio
Config file (backend)	backend/pytest.ini
Framework (frontend)	Vitest + @vue/test-utils
Config file (frontend)	frontend/vitest.config.js
Backend quick run	cd backend && python3 -m pytest tests/test_auth_api.py -k "revokes_other_sessions" -v
Backend full suite	cd backend && python3 -m pytest -x -q --ignore=tests/test_extractor.py
Frontend quick run	cd frontend && npx vitest run src/components/settings/__tests__/SettingsAccountTab.test.js src/components/auth/__tests__/TotpEnrollment.test.js --reporter=verbose
Frontend full suite	cd frontend && npx vitest run --reporter=verbose
Estimated runtime	~5 s backend · ~10 s frontend

---

Sampling Rate

• After every task commit: Run backend quick run + frontend quick run
• After every plan wave: Run full backend + frontend suites
• Before /gsd:verify-work: Both full suites must be green
• Max feedback latency: ~15 seconds

---

Per-Task Verification Map

Task ID	Plan	Wave	Requirement	Threat Ref	Secure Behavior	Test Type	Automated Command	File Exists	Status
07.1-01-01	01	1	CR-01	T-7.1-01	skip_token_hash excludes current session from revocation	integration	cd backend && python3 -m pytest tests/test_auth_api.py -k "test_change_password_revokes_other_sessions" -v	✅	✅ green
07.1-01-02	01	1	CR-02	T-7.1-01	enable_totp revokes other sessions, keeps current alive	integration	cd backend && python3 -m pytest tests/test_auth_api.py -k "test_enable_totp_revokes_other_sessions" -v	✅	✅ green
07.1-01-03	01	1	CR-03	T-7.1-01	disable_totp revokes other sessions, keeps current alive	integration	cd backend && python3 -m pytest tests/test_auth_api.py -k "test_disable_totp_revokes_other_sessions" -v	✅	✅ green
07.1-02-01	02	2	CR-01	T-7.1-04	SettingsAccountTab shows toast when changePassword returns sessions_revoked > 0	unit	cd frontend && npx vitest run src/components/settings/__tests__/SettingsAccountTab.test.js --reporter=verbose	✅	✅ green
07.1-02-02	02	2	CR-03	T-7.1-04	SettingsAccountTab shows toast when disableTotp returns sessions_revoked > 0	unit	cd frontend && npx vitest run src/components/settings/__tests__/SettingsAccountTab.test.js --reporter=verbose	✅	✅ green
07.1-02-03	02	2	CR-02	T-7.1-04	TotpEnrollment shows inline alert when enable_totp returns sessions_revoked > 0	unit	cd frontend && npx vitest run src/components/auth/__tests__/TotpEnrollment.test.js --reporter=verbose	✅	✅ green

Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky

---

Wave 0 Requirements

Existing infrastructure covers all phase requirements. No Wave 0 installs needed.

---

Manual-Only Verifications

All phase behaviors have automated verification.

---

Validation Audit 2026-06-05

Metric	Count
Gaps found	3
Resolved	3
Escalated	0

Auditor: gsd-nyquist-auditor — 5 new Vitest tests added (+3 positive, +2 negative), all green. Backend suite previously green (3 passing integration tests). No regressions.

---

Validation Sign-Off

• All tasks have <automated> verify
• Sampling continuity: no 3 consecutive tasks without automated verify
• Wave 0 covers all MISSING references (N/A — infra pre-existing)
• No watch-mode flags
• Feedback latency < 15s
• nyquist_compliant: true set in frontmatter

Approval: approved 2026-06-05