---
phase: 4
slug: review-download-security
status: draft
nyquist_compliant: false
wave_0_complete: false
created: 2026-03-27
---

# Phase 4 — Validation Strategy

> Per-phase validation contract for feedback sampling during execution.

---

## Test Infrastructure

| Property | Value |
|----------|-------|
| **Framework** | Vitest ^4.1.1 |
| **Config file** | `vite.config.ts` (test block, environment: jsdom) |
| **Quick run command** | `npm test` |
| **Full suite command** | `npm test` |
| **Estimated runtime** | ~10 seconds |

---

## Sampling Rate

- **After every task commit:** Run `npm test`
- **After every plan wave:** Run `npm test`
- **Before `/gsd:verify-work`:** Full suite must be green
- **Max feedback latency:** ~10 seconds

---

## Per-Task Verification Map

| Task ID | Plan | Wave | Requirement | Test Type | Automated Command | File Exists | Status |
|---------|------|------|-------------|-----------|-------------------|-------------|--------|
| 4-01-01 | 01 | 0 | CONF-02, CONF-03, DOWN-01–DOWN-06, SECU-01, SECU-02 | unit | `npm test -- src/components/wizard/ReviewStep.test.tsx` | ❌ W0 | ⬜ pending |
| 4-01-02 | 01 | 0 | SECU-03 | unit | `npm test -- src/store/reducer.test.ts` | ✅ | ⬜ pending |
| 4-02-01 | 02 | 1 | CONF-02 | unit | `npm test -- src/components/wizard/ReviewStep.test.tsx` | ❌ W0 | ⬜ pending |
| 4-02-02 | 02 | 1 | SECU-01, SECU-02 | unit | `npm test -- src/components/wizard/ReviewStep.test.tsx` | ❌ W0 | ⬜ pending |
| 4-03-01 | 03 | 2 | DOWN-01, DOWN-02, DOWN-03, DOWN-04 | unit | `npm test -- src/components/wizard/ReviewStep.test.tsx` | ❌ W0 | ⬜ pending |
| 4-03-02 | 03 | 2 | CONF-03, DOWN-06 | unit | `npm test -- src/components/wizard/ReviewStep.test.tsx` | ❌ W0 | ⬜ pending |
| 4-04-01 | 04 | 3 | DOWN-05 | unit | `npm test -- src/components/wizard/ReviewStep.test.tsx` | ❌ W0 | ⬜ pending |
| 4-05-01 | 05 | 4 | CONF-02, CONF-03, DOWN-01–DOWN-06, SECU-01, SECU-02, SECU-03 | unit | `npm test` | ❌ W0 | ⬜ pending |

*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*

---

## Wave 0 Requirements

- [ ] `src/components/wizard/ReviewStep.test.tsx` — stubs for CONF-02, CONF-03, DOWN-01–DOWN-06, SECU-01, SECU-02
- [ ] Mock setup for `URL.createObjectURL`, `URL.revokeObjectURL`, `navigator.clipboard.writeText` in test file setup
- [ ] SECU-03 assertion added to existing `src/store/reducer.test.ts`

*Note: `src/utils/downloadFile.ts` (referenced by tests) is created in the implementation wave, not Wave 0. Wave 0 stubs the test file with correct import paths.*

---

## Manual-Only Verifications

| Behavior | Requirement | Why Manual | Test Instructions |
|----------|-------------|------------|-------------------|
| ZIP file opens correctly with all 4 files inside | DOWN-05 | jsdom cannot verify actual ZIP binary content | Download ZIP in browser, open with OS ZIP tool, verify 4 files present |
| File actually downloads in browser | DOWN-01–DOWN-04 | jsdom lacks real download behavior | Click each download button in Chromium/Firefox dev build, verify file saved |
| Clipboard paste works end-to-end | CONF-03, DOWN-06 | jsdom clipboard mock doesn't paste | Click copy, paste into text editor, verify content matches displayed preview |

---

## Validation Sign-Off

- [ ] All tasks have `<automated>` verify or Wave 0 dependencies
- [ ] Sampling continuity: no 3 consecutive tasks without automated verify
- [ ] Wave 0 covers all MISSING references
- [ ] No watch-mode flags
- [ ] Feedback latency < 15s
- [ ] `nyquist_compliant: true` set in frontmatter

**Approval:** pending