docs(phase-5): add validation strategy

.planning/phases/05-web-push-notifications/05-VALIDATION.md

@@ -0,0 +1,79 @@
+---
+phase: 5
+slug: web-push-notifications
+status: draft
+nyquist_compliant: false
+wave_0_complete: false
+created: 2026-06-09
+---
+
+# Phase 5 — Validation Strategy
+
+> Per-phase validation contract for feedback sampling during execution.
+
+---
+
+## Test Infrastructure
+
+| Property | Value |
+|----------|-------|
+| **Framework** | vitest 4.x (API + PWA) |
+| **Config file** | `apps/api/vitest.config.*` / `apps/pwa/vitest.config.*` (existing) |
+| **Quick run command** | `pnpm --filter @familysync/api test` |
+| **Full suite command** | `pnpm --filter @familysync/api test && pnpm --filter @familysync/pwa test` |
+| **Estimated runtime** | ~30 seconds |
+
+---
+
+## Sampling Rate
+
+- **After every task commit:** Run quick run command for the touched workspace
+- **After every plan wave:** Run full suite command
+- **Before `/gsd-verify-work`:** Full suite must be green
+- **Max feedback latency:** 30 seconds
+
+---
+
+## Per-Task Verification Map
+
+> Populated by the planner from PLAN.md tasks. Each task with `<automated>` verify maps to a row.
+
+| Task ID | Plan | Wave | Requirement | Threat Ref | Secure Behavior | Test Type | Automated Command | File Exists | Status |
+|---------|------|------|-------------|------------|-----------------|-----------|-------------------|-------------|--------|
+| TBD | — | — | NOTIF-01/02/03 | — | — | unit | `pnpm --filter @familysync/api test` | ❌ W0 | ⬜ pending |
+
+*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*
+
+---
+
+## Wave 0 Requirements
+
+- [ ] `web-push` + `@types/web-push` installed in `apps/api` before any push-dispatch task
+- [ ] Test stubs for reminder scheduler, push-dispatch (VAPID sign + send), and subscription pruning (410/404)
+- [ ] VAPID test keypair fixture for unit tests (no network)
+
+*Existing vitest infrastructure covers the rest.*
+
+---
+
+## Manual-Only Verifications
+
+| Behavior | Requirement | Why Manual | Test Instructions |
+|----------|-------------|------------|-------------------|
+| iOS standalone-PWA push delivery + visible notification | NOTIF-01/02/03 | iOS Safari standalone push cannot be driven by playwright-cli (device-only) | Install PWA on iPhone (Home Screen), grant permission, trigger event reminder + list change, confirm visible notification |
+| iOS subscription survives inactivity (health-check) | NOTIF (success criterion 4) | Requires real APNs + elapsed time on device | Leave PWA idle, fire push after extended inactivity, confirm still delivered |
+
+*Desktop/Chromium push flows (permission prompt, subscribe, dispatch, notificationclick deep-link) ARE automatable via playwright-cli.*
+
+---
+
+## Validation Sign-Off
+
+- [ ] All tasks have `<automated>` verify or Wave 0 dependencies
+- [ ] Sampling continuity: no 3 consecutive tasks without automated verify
+- [ ] Wave 0 covers all MISSING references
+- [ ] No watch-mode flags
+- [ ] Feedback latency < 30s
+- [ ] `nyquist_compliant: true` set in frontmatter
+
+**Approval:** pending