diff --git a/.planning/phases/01-foundation/01-VALIDATION.md b/.planning/phases/01-foundation/01-VALIDATION.md
new file mode 100644
index 0000000..46d65fe
--- /dev/null
+++ b/.planning/phases/01-foundation/01-VALIDATION.md
@@ -0,0 +1,83 @@
+---
+phase: 1
+slug: foundation
+status: draft
+nyquist_compliant: false
+wave_0_complete: false
+created: 2026-04-10
+---
+
+# Phase 1 — Validation Strategy
+
+> Per-phase validation contract for feedback sampling during execution.
+
+---
+
+## Test Infrastructure
+
+| Property | Value |
+|----------|-------|
+| **Framework** | pytest 8.x |
+| **Config file** | none — Wave 0 installs |
+| **Quick run command** | `pytest tests/ -x -q` |
+| **Full suite command** | `pytest tests/ -v` |
+| **Estimated runtime** | ~5 seconds |
+
+---
+
+## Sampling Rate
+
+- **After every task commit:** Run `pytest tests/ -x -q`
+- **After every plan wave:** Run `pytest tests/ -v`
+- **Before `/gsd:verify-work`:** Full suite must be green
+- **Max feedback latency:** 10 seconds
+
+---
+
+## Per-Task Verification Map
+
+| Task ID | Plan | Wave | Requirement | Test Type | Automated Command | File Exists | Status |
+|---------|------|------|-------------|-----------|-------------------|-------------|--------|
+| 01-01-01 | 01 | 1 | INFRA-01 | smoke | `pytest tests/test_health.py -x` | ❌ W0 | ⬜ pending |
+| 01-01-02 | 01 | 1 | INFRA-02 | unit | `pytest tests/test_static.py::test_no_cdn_urls -x` | ❌ W0 | ⬜ pending |
+| 01-02-01 | 02 | 1 | INFRA-01 | unit | `pytest tests/test_db.py::test_create_tables -x` | ❌ W0 | ⬜ pending |
+| 01-03-01 | 03 | 1 | INFRA-02 | unit | `pytest tests/test_intunewin.py::test_byte_layout -x` | ❌ W0 | ⬜ pending |
+| 01-03-02 | 03 | 1 | (spike) | manual | Upload to real Intune tenant | N/A | ⬜ pending |
+
+*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*
+
+---
+
+## Wave 0 Requirements
+
+- [ ] `tests/__init__.py` — package marker
+- [ ] `tests/conftest.py` — shared fixtures (temp dir, test DB path)
+- [ ] `tests/test_health.py` — covers INFRA-01 HTTP health check
+- [ ] `tests/test_db.py` — covers INFRA-01 schema init (all tables created, WAL mode)
+- [ ] `tests/test_static.py` — covers INFRA-02 no-CDN-URLs assertion
+- [ ] `tests/test_intunewin.py` — covers spike byte layout validation
+- [ ] Framework install: `pip install pytest httpx` — add to `requirements-dev.txt`
+
+*Existing infrastructure covers: None (greenfield project)*
+
+---
+
+## Manual-Only Verifications
+
+| Behavior | Requirement | Why Manual | Test Instructions |
+|----------|-------------|------------|-------------------|
+| No Node.js in container | INFRA-02 | Requires running container inspection | `docker exec imptune which node` — should return nothing |
+| .intunewin uploads to real Intune | (spike) | Requires Intune tenant access | Upload generated .intunewin via Intune portal, verify "successfully uploaded" status |
+
+---
+
+## Validation Sign-Off
+
+- [ ] All tasks have `<automated>` verify or Wave 0 dependencies
+- [ ] Sampling continuity: no 3 consecutive tasks without automated verify
+- [ ] Wave 0 covers all MISSING references
+- [ ] No watch-mode flags
+- [ ] Feedback latency < 10s
+- [ ] `nyquist_compliant: true` set in frontmatter
+
+**Approval:** pending