forked from c-fu/arah2

Files

T

2026-10-23 22:37:55 +08:00

phase, slug, status, nyquist_compliant, wave_0_complete, created

phase	slug	status	nyquist_compliant	wave_0_complete	created
2	bot-skeleton-initdata-security	ready	true	false	2026-10-22

Phase 2 — Validation Strategy

Per-phase validation contract for feedback sampling during execution.

Test Infrastructure

Property	Value
Framework	Hand-rolled node runner (D-12) — `node:assert`, zero extra deps, `theme/scripts/audit.test.mjs` shape
Config file	none — plain `.mjs` (Wave 0 creates)
Quick run command	`npm test -w bot`
Full suite command	`npm test -w bot` (single runner covers vectors + privacy gates)
Estimated runtime	~2 seconds (pure crypto + mocks, no network)

After every task commit: Run npm test -w bot
After every plan wave: Run npm test -w bot + tsc --noEmit (bot workspace)
Before /gsd-verify-work: Full suite must be green
Max feedback latency: 5 seconds

task ID	Plan	Wave	Requirement	Threat Ref	Secure Behavior	Test Type	Automated Command	File Exists	Status
{N}-01-01	01	1	PRIV-02, D-08/D-11/D-12/D-15/D-17	T-02-03 / T-02-04	no committed secrets; TTL-only type surface scaffold	unit (harness + vector stubs live)	`npm test -w bot`	❌ W0	⬜ pending
{N}-01-02	01	1	Security (SC3), ONBD-03-adjacent	T-02-01 / T-02-02	tampered/stale/replayed/malformed rejected; known-good HMAC passes	unit (vectors)	`npm test -w bot`	❌ W0 (stubbed in 01-01, filled here)	⬜ pending
{N}-02-01	02	2	PRIV-01/D-05	T-02-04	strings module has en + ms, no violation classes; TTL-only log categories (D-14)	unit	`npm test -w bot`	❌ W0	⬜ pending
{N}-02-02	02	2	ONBD-01, D-01..D-05	—	handlers lean, no keyboards (D-02); alias co-routing (D-04); setMyCommands default+ms (D-03/D-04)	unit	`npm test -w bot`	✅ (from 02-01 forward)	⬜ pending
{N}-02-02-manual	02	2	ONBD-01	—	real Telegram client: /start, /help, /privacy, aliases	manual checkpoint	—	—	⬜ pending
{N}-03-01	03	3	D-06/D-07/D-08, PRIV-02	T-02-05 / T-02-06	mint requires validated initData; rotate-on-new; claim is D-08-minimal; expirationTtl on every put	unit (mock KV)	`npm test -w bot`	✅	⬜ pending
{N}-03-02	03	3	D-16 deploy gate	T-02-03	wrangler dry-run clean; .dev.vars ignored; secrets not in git	integration (dry-run) + manual checklist	`npx wrangler deploy --dry-run && npm test -w bot`	✅	⬜ pending

Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky

bot/test/runner.mjs — minimal hand-rolled harness (theme/scripts/audit.test.mjs shape, node:assert)
bot/test/initdata.test.mjs — vector suite skeleton (known-good + tampered + stale + replay cases)
bot/.gitignore (+ .dev.vars.example) — ships in the same commit as the workspace init (D-17)
npm i -w bot — workspace package install (grammy, wrangler, typescript, workers-types, @types/node)

Behavior	Requirement	Why Manual	Test Instructions
/start /help /privacy + /mula /privasi reply correctly in real Telegram	ONBD-01, PRIV-01	Requires a live Telegram client + deployed bot token; Bot UI cannot be driven from the runner	1) `npm run deploy` (D-16) 2) /start the real bot → intro + menu 3) /help → menu matches D-03 4) /privacy → truthful copy 5) /mula /privasi → same flows 6) non-en client → ms menu (covers setMyCommands scope)
Webhook 401 on bad secret-token header	V4/V2 security gate	grammY's verified constant-time check is library behavior, not our code	`curl -X POST $URL/telegram/webhook -d '{}'` (no header) → 401; with wrong value → 401
Deploy smoke + KV spot-check	PRIV-02, D-16	Live storage inspection	after deploy: `npx wrangler kv key list --namespace chat_sessions` (via dev session) — only TTL-bounded keys; no coordinate values; keys expire after 900s

Approval: pending