docs(08-01): complete Phase 1 Nyquist audit plan

- Add 08-01-SUMMARY.md (14/14 pass, NYQ-01 ticked)
- STATE.md advanced to Phase 08 plan 02/8
- ROADMAP.md phase 08 progress updated via gsd-tools
- REQUIREMENTS.md NYQ-01 marked complete

.planning/REQUIREMENTS.md

@@ -24,7 +24,7 @@
 
 ### Nyquist Validation Track (NYQ)
 
-- [ ] **NYQ-01**: All 7 v1.0 phases have a Nyquist-compliant `VALIDATION.md` (one observable check per success criterion, evidence cited, no hand-wavy "code looks right" entries)
+- [x] **NYQ-01**: All 7 v1.0 phases have a Nyquist-compliant `VALIDATION.md` (one observable check per success criterion, evidence cited, no hand-wavy "code looks right" entries)
 - [ ] **NYQ-02**: A `.planning/milestones/v1.0-VALIDATION-INDEX.md` aggregates per-phase validation status with pass/fail and links to evidence
 - [ ] **NYQ-03**: Any validation gaps surfaced during the Nyquist pass that block real usage are tracked as defects and either fixed in v1.1 or explicitly deferred with rationale
 
@@ -60,7 +60,7 @@ Carried forward from v1.0 Out of Scope — no change.
 | UX-01    | Phase 9  | Complete |
 | UX-02    | Phase 9  | Complete |
 | UX-03    | Phase 9  | Complete |
-| NYQ-01   | Phase 8  | Pending |
+| NYQ-01   | Phase 8  | Complete |
 | NYQ-02   | Phase 8  | Pending |
 | NYQ-03   | Phase 8  | Pending |
 | RWR-01   | Phase 11 | Complete |

.planning/STATE.md

@@ -2,15 +2,15 @@
 gsd_state_version: 1.0
 milestone: v1.1
 milestone_name: Hardening & Validation
-status: in-progress — Phase 10 COMPLETE (signed off 2026-04-13 with explicit attestation-only audit-trail acknowledgement for RTVAL-02/03/04); ready for Phase 8 (Nyquist) or Phase 11 (rollout) planning
+status: planning
-stopped_at: Phase 10 complete — next is /gsd:plan-phase 8 or /gsd:plan-phase 11
+stopped_at: Completed 08-01-PLAN.md (Phase 1 Nyquist audit)
-last_updated: "2026-04-13T00:00:00.000Z"
+last_updated: "2026-04-13T13:56:03.033Z"
-last_activity: 2026-04-13 — Plan 10-03 completed. RUNTIME-VALIDATION.md signed off by Sébastien QUEROL; REQUIREMENTS.md RTVAL-01..05 ticked; ROADMAP.md Phase 10 marked 3/3 Complete. Phase 10 closed with RTVAL-02/03/04 as accepted attestation-only PASSes.
+last_activity: 2026-04-13 — Plan 10-03 completed; Phase 10 closed; commit 5685fd9 (sign-off) plus 10-03 SUMMARY + ROADMAP/STATE update commit
 progress:
   total_phases: 4
   completed_phases: 2
-  total_plans: 4
+  total_plans: 17
-  completed_plans: 5
+  completed_plans: 7
 ---
 
 # Project State
@@ -25,11 +25,12 @@ See: .planning/PROJECT.md (updated 2026-04-13 after v1.0 milestone)
 ## Current Position
 
 Milestone: v1.1 Hardening & Validation
-Phase: 10 — Real-World Runtime Validation — **COMPLETE (2026-04-13)**
+Phase: 08 — Nyquist Validation Track — IN PROGRESS (1/8 plans complete)
-Plan: 03 COMPLETE — RUNTIME-VALIDATION.md signed off by Sébastien QUEROL; REQUIREMENTS.md RTVAL-01..05 ticked; ROADMAP.md Phase 10 marked 3/3 Complete. Next: Phase 8 (Nyquist) or Phase 11 (rollout).
+Current Plan: 02 of 8 (next — Phase 2 Driver Management audit)
-Status: phase 10 closed — ready for next phase planning
+Total Plans in Phase: 8
-Decision: Phase 10 closed with a structurally weakened runtime audit trail. Only RTVAL-01 is artifact-backed; RTVAL-02/03/04 stand on technician attestation. Reviewer explicitly acknowledged the gap at sign-off and accepted closure on that basis. If a regression, incident, or customer escalation touches SYSTEM-context install/detect/uninstall, RTVAL-02/03/04 must be re-run with full artifact capture before the finding can be trusted.
+Status: Phase 08 active — 08-01 complete, NYQ-01 ticked
-Last activity: 2026-04-13 — Plan 10-03 completed; Phase 10 closed; commit 5685fd9 (sign-off) plus 10-03 SUMMARY + ROADMAP/STATE update commit
+Decision: 08-01 closed Phase 1 Nyquist audit with 14/14 pass rows; prior real-Intune spike (row 14) resolved PASS by citing Phase 10 RTVAL-01 sign-off rather than fail-fix-v1.1.
+Last activity: 2026-04-13 — Plan 08-01 completed; 01-VALIDATION.md upgraded with Nyquist Record; commit d37a196
 
 ## Milestone History
 
@@ -75,6 +76,7 @@ Full decision log in PROJECT.md Key Decisions table. Milestone v1.0 decisions ar
 - [Phase 10-real-world-runtime-validation]: 10-02: RTVAL-04 accepted as attestation-only PASS (2026-04-13) — **third consecutive attestation-only check**; no rtval-04-uninstall-log.txt and no rtval-04-uninstall-status.png captured; user was warned a SECOND time about cumulative audit trail damage and still chose to proceed. Together, RTVAL-02/03/04 constitute an attestation-only runtime half for Phase 10: only RTVAL-01 (tenant ingestion) is artifact-backed. Plan 10-03 sign-off must explicitly address whether to re-run RTVAL-02/03/04 with full evidence before closing the phase.
 - [Phase 10-real-world-runtime-validation]: 10-02: Plan 10-02 COMPLETE (2026-04-13) — SUMMARY.md created with prominent "Attestation-Only Audit Trail Damage" section for the wave-3 verifier and phase verifier
 - [Phase 10-real-world-runtime-validation]: 10-03: Plan 10-03 COMPLETE (2026-04-13) — RUNTIME-VALIDATION.md signed off by Sébastien QUEROL with explicit attestation-gap acknowledgement; REQUIREMENTS.md RTVAL-01..05 ticked (idempotent, already landed in 10-02 commit 206648c); ROADMAP.md Phase 10 flipped to 3/3 Complete 2026-04-13. Phase 10 officially closed.
+- [Phase 08-nyquist-validation-track]: 08-01: Phase 1 Nyquist Record complete with 14/14 pass rows; row 14 (upload-to-real-Intune spike) resolved PASS citing Phase 10 RTVAL-01 sign-off rather than fail-fix-v1.1
 
 ### Active Blockers
 
@@ -88,6 +90,6 @@ None. BLOCKER-01 resolved 2026-04-13 via commits 74535ea (HMAC over IV+ciphertex
 
 ## Session Continuity
 
-Last session: 2026-04-13T00:00:00.000Z
+Last session: 2026-04-13T13:56:03.025Z
-Stopped at: Completed 10-03-report-signoff-PLAN.md — Phase 10 closed; next is `/gsd:plan-phase 8` (Nyquist) or `/gsd:plan-phase 11` (rollout)
+Stopped at: Completed 08-01-PLAN.md (Phase 1 Nyquist audit)
-Resume file: — (awaiting next phase kickoff)
+Resume file: None

.planning/phases/08-nyquist-validation-track/08-01-SUMMARY.md

@@ -0,0 +1,85 @@
+---
+phase: 08-nyquist-validation-track
+plan: 01
+subsystem: validation-audit
+tags: [nyquist, audit, phase-1, validation]
+requires: []
+provides:
+  - "Phase 1 Nyquist Record (14 rows, all pass) in .planning/phases/01-foundation/01-VALIDATION.md"
+  - "Phase 1 nyquist_compliant=true audited 2026-04-13"
+affects:
+  - .planning/phases/01-foundation/01-VALIDATION.md
+tech_stack:
+  added: []
+  patterns:
+    - "Nyquist Record audit table: # | Criterion | Observable Check | Evidence | Status | Notes"
+key_files:
+  created: []
+  modified:
+    - .planning/phases/01-foundation/01-VALIDATION.md
+decisions:
+  - "Derived 14 success criteria from v1.0-ROADMAP.md Phase 1 goal + plan outcomes (no explicit SC list in ROADMAP). Cross-checked 1:1 against 01-VERIFICATION.md's 13 observable truths and added row 14 for the real-Intune tenant spike."
+  - "Row 14 (upload-to-real-Intune) resolved PASS rather than fail-fix-v1.1: Phase 10 RTVAL-01 was re-tested and signed off 2026-04-13 (artifact evidence), so the spike is closed."
+  - "nyquist_compliant flipped to true because all 14 rows are pass; no deferred/wont-do/fail rows."
+metrics:
+  tasks_completed: 1
+  tasks_total: 1
+  duration_minutes: 5
+  completed_date: 2026-04-13
+requirements_completed: [NYQ-01]
+---
+
+# Phase 08 Plan 01: Phase 1 Nyquist Audit Summary
+
+**One-liner:** Audited Phase 1 (Foundation) against Nyquist rules and upgraded `01-VALIDATION.md` in place with a 14-row Nyquist Record where every success criterion maps to exactly one observable check with committed evidence.
+
+## What Shipped
+
+- `.planning/phases/01-foundation/01-VALIDATION.md` now contains a `## Nyquist Record` section (placed above Validation Sign-Off, below Manual-Only Verifications).
+- 14 rows, one per Phase 1 success criterion derived from `milestones/v1.0-ROADMAP.md` Phase 1 goal + the outcomes of plans 01-01, 01-02, 01-03.
+- Every row has a non-empty Observable Check cell (pytest invocation, grep, or dated VERIFICATION.md reference) and a non-empty Evidence cell citing committed tests, source `file:line`, commit SHAs, or 01-VERIFICATION.md rows.
+- Row 14 is the former "Upload to real Intune tenant" spike that lived in the Manual-Only Verifications table — now closed as `pass` citing Phase 10 RTVAL-01 re-test sign-off (2026-04-13).
+- Frontmatter updated: `nyquist_compliant: true`, `nyquist_audited: 2026-04-13`, `nyquist_auditor: Claude (gsd-executor, plan 08-01)`.
+- All historical sections (Test Infrastructure, Sampling Rate, Per-Task Verification Map, Wave 0 Requirements, Manual-Only Verifications, Validation Sign-Off) preserved verbatim.
+
+## Audit Outcome
+
+| Status | Count |
+|--------|-------|
+| pass | 14 |
+| fail-fix-v1.1 | 0 |
+| deferred-v1.2 | 0 |
+| wont-do | 0 |
+
+Phase 1 is Nyquist-compliant. Zero gaps carry forward into 08-08 (rollup).
+
+## Evidence Strategy Used
+
+Priority order from the plan was honored:
+1. **Test evidence** (preferred): used for 10/14 rows — `tests/test_health.py`, `tests/test_static.py`, `tests/test_db.py` (4 tests), `tests/test_intunewin.py` (8 tests).
+2. **File-line / commit evidence**: used for Dockerfile rows (rows 2, 5), `base.html` nav sidebar (row 4), and `database.py` / `docker-compose.yml` wiring (row 8). Commits cited include 34c7cb3, 88d9c5f, 25f82e6, 74535ea, 7716246.
+3. **Dated manual-check evidence**: row 14 cites Phase 10 `RUNTIME-VALIDATION.md` RTVAL-01 PASS (2026-04-13) and the committed evidence artifact `evidence/Copieur_2eme.intunewin`.
+
+No row relied on "code looks right" — every check is observable.
+
+## Cross-Reference with 01-VERIFICATION.md
+
+`01-VERIFICATION.md` (dated 2026-04-10) already enumerated 13 observable truths grouped by sub-plan. The Nyquist Record adopts those 13 as rows 1–13 with their exact evidence and adds row 14 for the runtime upload gate. This keeps the two documents 1:1 alignable: rows 1–13 of Nyquist Record = truths 1–13 of 01-VERIFICATION.md.
+
+## Deviations from Plan
+
+**None.** Plan 08-01 executed exactly as written. Single task, single file edit.
+
+Minor interpretive choice (within plan latitude): row 14 was originally expected to be `fail-fix-v1.1` at audit time per the plan's Task 1 step 6. However, because Phase 10 RTVAL-01 is already **Complete** in REQUIREMENTS.md (resolved 2026-04-13 with artifact), the plan itself says "this can likely resolve to `pass`". Auditor chose `pass` on that basis, with a Notes cell documenting the would-be-gap and the fixing phase reference.
+
+## Authentication Gates
+
+None.
+
+## Self-Check: PASSED
+
+- `.planning/phases/01-foundation/01-VALIDATION.md` — FOUND (modified)
+- `## Nyquist Record` heading — FOUND in file
+- `nyquist_audited:` frontmatter key — FOUND in file
+- Commit `d37a196` — FOUND in `git log`
+- No source code files touched (plan constraint) — verified via `git show --stat d37a196` (only `01-VALIDATION.md`)