docs(phase-17): add validation strategy

.planning/phases/17-mimecast-blast-radius-lookup/17-VALIDATION.md

@@ -0,0 +1,76 @@
+---
+phase: 17
+slug: mimecast-blast-radius-lookup
+status: draft
+nyquist_compliant: false
+wave_0_complete: false
+created: 2026-07-15
+---
+
+# Phase 17 — Validation Strategy
+
+> Per-phase validation contract for feedback sampling during execution.
+
+---
+
+## Test Infrastructure
+
+| Property | Value |
+|----------|-------|
+| **Framework** | vitest 4.1.5 |
+| **Config file** | `vitest.config.ts` — `include: ['lib/**/*.test.ts']`, `environment: 'node'` |
+| **Quick run command** | `npx vitest run lib/services/mimecast-blast-radius.test.ts lib/services/mimecast-client.test.ts` |
+| **Full suite command** | `npm test` |
+| **Estimated runtime** | ~2 seconds (all mocked, no real network/DB) |
+
+---
+
+## Sampling Rate
+
+- **After every task commit:** `npx vitest run lib/services/mimecast-blast-radius.test.ts lib/services/mimecast-client.test.ts`
+- **After every plan wave:** `npm test` (full suite)
+- **Before `/gsd:verify-work`:** Full suite must be green
+- **Max feedback latency:** ~2 seconds
+
+---
+
+## Per-Task Verification Map
+
+| Task ID | Plan | Wave | Requirement | Threat Ref | Secure Behavior | Test Type | Automated Command | File Exists | Status |
+|---------|------|------|-------------|------------|-----------------|-----------|-------------------|-------------|--------|
+| 17-01-0x | 01 | 1 | BLAST-01/02 | V5 | `isMimecastConfigured()` reflects env var presence; never throws | unit | `npx vitest run lib/services/mimecast-client.test.ts` | ❌ W0 | ⬜ pending |
+| 17-01-0x | 01 | 1 | BLAST-01 | — | Fan-out (searchDeliveredMessages + getHeldMessages + getThreatEvents) merges to normalized matched/delivered/held/rejected/clicked + perRecipient | unit | `npx vitest run lib/services/mimecast-blast-radius.test.ts` | ❌ W0 | ⬜ pending |
+| 17-01-0x | 01 | 1 | BLAST-02 | — | Not configured → synchronous `status: 'unavailable'`, no throw | unit | `npx vitest run lib/services/mimecast-blast-radius.test.ts` | ❌ W0 | ⬜ pending |
+| 17-01-0x | 01 | 1 | BLAST-02 | — | Unexpected fan-out error degrades to `unavailable`, does not throw | unit | `npx vitest run lib/services/mimecast-blast-radius.test.ts` | ❌ W0 | ⬜ pending |
+| 17-01-0x | 01 | 1 | D-04 | — | Cached lookup returns without re-calling MimecastClient methods | unit | `npx vitest run lib/services/mimecast-blast-radius.test.ts` | ❌ W0 | ⬜ pending |
+
+*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*
+*Exact task IDs finalized by the planner — this table's requirement/behavior mapping is fixed by research; row numbering will be updated once PLAN.md exists.*
+
+---
+
+## Wave 0 Requirements
+
+- [ ] `lib/services/mimecast-client.test.ts` — new file, covers `isMimecastConfigured()` (BLAST-01/02 config gate)
+- [ ] `lib/services/mimecast-blast-radius.test.ts` — new file, covers BLAST-01/02 and D-01 through D-05
+- [ ] No shared fixture file needed — synthetic inline mock objects (matching `MimecastDeliveredMessage`/`MimecastHeldMessage`/`MimecastThreatEvent` shapes) are sufficient
+- [ ] Framework install: none — vitest already installed and configured
+
+---
+
+## Manual-Only Verifications
+
+*None — all phase behaviors have automated verification (this is a pure internal composition layer with no HTTP route, no UI, no external network required for tests).*
+
+---
+
+## Validation Sign-Off
+
+- [ ] All tasks have `<automated>` verify or Wave 0 dependencies
+- [ ] Sampling continuity: no 3 consecutive tasks without automated verify
+- [ ] Wave 0 covers all MISSING references
+- [ ] No watch-mode flags
+- [ ] Feedback latency < 5s
+- [ ] `nyquist_compliant: true` set in frontmatter
+
+**Approval:** pending