---
phase: 65.1
slug: phase-65-code-review-remediation
status: draft
nyquist_compliant: false
wave_0_complete: false
created: 2026-05-25
---

# Phase 65.1 — Validation Strategy

> Per-phase validation contract for feedback sampling during execution. Source: `65.1-RESEARCH.md` Validation Architecture section.

---

## Test Infrastructure

| Property | Value |
|----------|-------|
| **Frameworks** | `cargo test` (unit + doc + AST guard) + `proptest` + `sqllogictest` (via `just test-sql`) + Python integration (via `uv run`) |
| **Config files** | `Cargo.toml` (dev-deps); `test/sql/TEST_LIST` (sqllogictest registration) |
| **Quick run command** | `cargo test <name>` for a single test; `just test-sql` for SQL surface changes |
| **Full suite command** | `just test-all` (quality gate per CLAUDE.md) |
| **Estimated runtime** | ~60-120 seconds for `just test-all` (cold), ~20-40 seconds (warm) |

---

## Sampling Rate

- **After every task commit:** Run `cargo test <changed_area>` for unit-level changes; `just test-sql` for SQL surface changes
- **After every plan wave:** Run `just test-all`
- **Before `/gsd-verify-work`:** `just test-all` AND `just ci` (clippy pedantic + fmt + cargo-deny + fuzz target compile) must be green
- **Max feedback latency:** ~30 seconds for unit tests, ~120 seconds for full suite

---

## Per-Task Verification Map

> Per-task rows populated by `gsd-planner` from PLAN.md tasks. See `65.1-RESEARCH.md` "Remediation Area → Test Map" for the area-level template.

| Task ID | Plan | Wave | Requirement | Threat Ref | Secure Behavior | Test Type | Automated Command | File Exists | Status |
|---------|------|------|-------------|------------|-----------------|-----------|-------------------|-------------|--------|
| _to be filled by planner_ | | | | | | | | | ⬜ pending |

*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*

---

## Wave 0 Requirements

New test files / fixtures that must exist before tasks under them can verify (from `65.1-RESEARCH.md` Wave 0 Gaps):

- [ ] `test/integration/test_drop_on_fresh_readonly_clear_error.py` — stub for D-18 (WR-03 RO-DROP wording)
- [ ] `test/integration/test_concurrent_writes_per_call_conn.py` — stub for D-19/D-20 (WR-04 concurrent writes + PK-violation tolerance)
- [ ] `test/integration/test_load_extension_twice_idempotent.py` — stub for D-21 (WR-09 idempotent register-if-absent)
- [ ] `test/sql/phase651_yaml_filesystem_access_gating.test` — stub for CR-01 `enable_external_access=false` rejection
- [ ] `test/sql/phase651_null_name_inputs.test` — stub for D-25 (IN-05 null name vector inputs)
- [ ] `test/sql/phase651_bind_probe_hard_errors.test` — stub for D-16 (WR-07/WR-08 new error wording)
- [ ] `tests/registration_error_surfaces.rs` — stub for WR-02 (force-failure surfacing test)
- [ ] Doc-test `compile_fail` block inside `BorrowedConnection` impl OR `trybuild` test — stub for D-10 (negative compile for `duckdb_disconnect(borrowed)`)
- [ ] All new `.test` files added to `test/sql/TEST_LIST` (per CLAUDE.md project rule)
- [ ] Optional: extend `tests/no_long_lived_conn.rs` to walk all of `src/` for `duckdb_disconnect` (D-11 — defence in depth)

---

## Manual-Only Verifications

| Behavior | Requirement | Why Manual | Test Instructions |
|----------|-------------|------------|-------------------|
| WR-06 runtime probe fires on ABI break | (no REQ ID yet) | Cannot synthesize a DuckDB ABI break in CI without a fork build. Static_assert catches the layout change at compile time; runtime probe is defence in depth. | Reviewer inspects `sv_register_parser_hooks` probe block; confirms it round-trips `SELECT 1` through `reinterpret_cast<duckdb_connection>(&probe)`. |

---

## Validation Sign-Off

- [ ] All tasks have `<automated>` verify or Wave 0 dependencies (populated by planner)
- [ ] Sampling continuity: no 3 consecutive tasks without automated verify
- [ ] Wave 0 covers all MISSING references (8 stub files listed above)
- [ ] No watch-mode flags in test commands
- [ ] Feedback latency < 120s for full suite
- [ ] `nyquist_compliant: true` set in frontmatter (flipped by Nyquist auditor after task map is filled)

**Approval:** pending
