arah2/.planning/phases/02-bot-skeleton-initdata-security/02-VALIDATION.md

phase, slug, status, nyquist_compliant, wave_0_complete, created

phase	slug	status	nyquist_compliant	wave_0_complete	created
2	bot-skeleton-initdata-security	ready	true	false	2026-10-22

Phase 2 — Validation Strategy

Per-phase validation contract for feedback sampling during execution.

---

Test Infrastructure

Property	Value
Framework	Hand-rolled node runner (D-12) — node:assert, zero extra deps, theme/scripts/audit.test.mjs shape
Config file	none — plain .mjs (Wave 0 creates)
Quick run command	npm test -w bot
Full suite command	npm test -w bot (single runner covers vectors + privacy gates)
Estimated runtime	~2 seconds (pure crypto + mocks, no network)

---

Sampling Rate

• After every task commit: Run npm test -w bot
• After every plan wave: Run npm test -w bot + tsc --noEmit (bot workspace)
• Before /gsd-verify-work: Full suite must be green
• Max feedback latency: 5 seconds

---

Per-task Verification Map

task ID	Plan	Wave	Requirement	Threat Ref	Secure Behavior	Test Type	Automated Command	File Exists	Status
{N}-01-01	01	1	PRIV-02, D-08/D-11/D-12/D-15/D-17	T-02-03 / T-02-04	no committed secrets; TTL-only type surface scaffold	unit (harness + vector stubs live)	npm test -w bot	❌ W0	⬜ pending
{N}-01-02	01	1	Security (SC3), ONBD-03-adjacent	T-02-01 / T-02-02	tampered/stale/replayed/malformed rejected; known-good HMAC passes	unit (vectors)	npm test -w bot	❌ W0 (stubbed in 01-01, filled here)	⬜ pending
{N}-02-01	02	2	PRIV-01/D-05	T-02-04	strings module has en + ms, no violation classes; TTL-only log categories (D-14)	unit	npm test -w bot	❌ W0	⬜ pending
{N}-02-02	02	2	ONBD-01, D-01..D-05	—	handlers lean, no keyboards (D-02); alias co-routing (D-04); setMyCommands default+ms (D-03/D-04)	unit	npm test -w bot	✅ (from 02-01 forward)	⬜ pending
{N}-02-02-manual	02	2	ONBD-01	—	real Telegram client: /start, /help, /privacy, aliases	manual checkpoint	—	—	⬜ pending
{N}-03-01	03	3	D-06/D-07/D-08, PRIV-02	T-02-05 / T-02-06	mint requires validated initData; rotate-on-new; claim is D-08-minimal; expirationTtl on every put	unit (mock KV)	npm test -w bot	✅	⬜ pending
{N}-03-02	03	3	D-16 deploy gate	T-02-03	wrangler dry-run clean; .dev.vars ignored; secrets not in git	integration (dry-run) + manual checklist	npx wrangler deploy --dry-run && npm test -w bot	✅	⬜ pending

Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky

---

Wave 0 Requirements

• bot/test/runner.mjs — minimal hand-rolled harness (theme/scripts/audit.test.mjs shape, node:assert)
• bot/test/initdata.test.mjs — vector suite skeleton (known-good + tampered + stale + replay cases)
• bot/.gitignore (+ .dev.vars.example) — ships in the same commit as the workspace init (D-17)
• npm i -w bot — workspace package install (grammy, wrangler, typescript, workers-types, @types/node)

---

Manual-Only Verifications

Behavior	Requirement	Why Manual	Test Instructions
/start /help /privacy + /mula /privasi reply correctly in real Telegram	ONBD-01, PRIV-01	Requires a live Telegram client + deployed bot token; Bot UI cannot be driven from the runner	1) npm run deploy (D-16) 2) /start the real bot → intro + menu 3) /help → menu matches D-03 4) /privacy → truthful copy 5) /mula /privasi → same flows 6) non-en client → ms menu (covers setMyCommands scope)
Webhook 401 on bad secret-token header	V4/V2 security gate	grammY's verified constant-time check is library behavior, not our code	curl -X POST $URL/telegram/webhook -d '{}' (no header) → 401; with wrong value → 401
Deploy smoke + KV spot-check	PRIV-02, D-16	Live storage inspection	after deploy: npx wrangler kv key list --namespace chat_sessions (via dev session) — only TTL-bounded keys; no coordinate values; keys expire after 900s

---

Validation Sign-Off

• All tasks have <automated> verify or Wave 0 dependencies
• Sampling continuity: no 3 consecutive tasks without automated verify
• Wave 0 covers all MISSING references
• No watch-mode flags
• Feedback latency < 5s
• nyquist_compliant: true set in frontmatter

Approval: pending