---
phase: 1
slug: foundation
status: draft
nyquist_compliant: false
wave_0_complete: false
created: 2026-04-04
---

# Phase 1 — Validation Strategy

> Per-phase validation contract for feedback sampling during execution.

---

## Test Infrastructure

| Property | Value |
|----------|-------|
| **Framework** | go test (stdlib) + testify v1.x assertions |
| **Config file** | none — Wave 0 installs |
| **Quick run command** | `go test ./... -short` |
| **Full suite command** | `go test ./... -v -count=1` |
| **Estimated runtime** | ~5 seconds |

---

## Sampling Rate

- **After every task commit:** Run `go test ./... -short`
- **After every plan wave:** Run `go test ./... -v -count=1`
- **Before `/gsd:verify-work`:** Full suite must be green
- **Max feedback latency:** 10 seconds

---

## Per-Task Verification Map

| Task ID | Plan | Wave | Requirement | Test Type | Automated Command | File Exists | Status |
|---------|------|------|-------------|-----------|-------------------|-------------|--------|
| 01-01-01 | 01 | 0 | CORE-02 | unit | `go test ./pkg/provider/...` | ❌ W0 | ⬜ pending |
| 01-01-02 | 01 | 1 | CORE-02,PROV-10 | unit | `go test ./pkg/provider/...` | ❌ W0 | ⬜ pending |
| 01-02-01 | 02 | 1 | STOR-01,STOR-02,STOR-03 | unit | `go test ./pkg/storage/...` | ❌ W0 | ⬜ pending |
| 01-03-01 | 03 | 1 | CORE-01,CORE-06 | unit | `go test ./pkg/engine/...` | ❌ W0 | ⬜ pending |
| 01-03-02 | 03 | 1 | CORE-04 | unit | `go test ./pkg/engine/...` | ❌ W0 | ⬜ pending |
| 01-03-03 | 03 | 1 | CORE-05 | unit | `go test ./pkg/engine/...` | ❌ W0 | ⬜ pending |
| 01-04-01 | 04 | 2 | CLI-01..05 | integration | `go test ./cmd/...` | ❌ W0 | ⬜ pending |
| 01-04-02 | 04 | 2 | INPUT-01 | integration | `go build ./... && ./keyhunter scan path testdata/` | ❌ W0 | ⬜ pending |

*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*

---

## Wave 0 Requirements

- [ ] `go.mod` + `go.sum` — module initialization with all Phase 1 dependencies
- [ ] `pkg/provider/registry_test.go` — stubs for YAML loading, validation, pattern matching
- [ ] `pkg/storage/db_test.go` — stubs for SQLite CRUD, AES-256 encryption roundtrip
- [ ] `pkg/engine/scanner_test.go` — stubs for pipeline stages (keyword, regex, entropy)
- [ ] `cmd/keyhunter/main_test.go` — stubs for CLI command tree
- [ ] `testdata/` directory with sample files containing known test patterns
- [ ] `testify` assertion library — `go get github.com/stretchr/testify`

*If none: "Existing infrastructure covers all phase requirements."*

---

## Manual-Only Verifications

| Behavior | Requirement | Why Manual | Test Instructions |
|----------|-------------|------------|-------------------|
| Config persists across sessions | CLI-02,CLI-03 | Requires filesystem state between runs | Run `keyhunter config init`, restart, verify `~/.keyhunter.yaml` exists |

---

## Validation Sign-Off

- [ ] All tasks have `<automated>` verify or Wave 0 dependencies
- [ ] Sampling continuity: no 3 consecutive tasks without automated verify
- [ ] Wave 0 covers all MISSING references
- [ ] No watch-mode flags
- [ ] Feedback latency < 10s
- [ ] `nyquist_compliant: true` set in frontmatter

**Approval:** pending