xtablo-source/.planning/phases/10-events/10-VALIDATION.md

phase	slug	status	nyquist_compliant	wave_0_complete	created
10	events	complete	true	true	2026-05-16

Phase 10 - Validation Strategy

Per-phase validation contract for feedback sampling during execution.

Test Infrastructure

Property	Value
Framework	Go testing with existing DB-backed web handler tests
Config file	backend/internal/web/*_test.go, backend/internal/db/queries/*.sql, backend/migrations/*.sql
Quick run command	`cd backend && TEST_DATABASE_URL='postgres://xtablo:xtablo@localhost:5432/xtablo?sslmode=disable' go test ./internal/web -run 'TestEvent
Full suite command	cd backend && just generate && TEST_DATABASE_URL='postgres://xtablo:xtablo@localhost:5432/xtablo?sslmode=disable' go test ./... -count=1
Estimated runtime	~20-60 seconds depending on database startup/state

Sampling Rate

• After every task commit: Run cd backend && TEST_DATABASE_URL='postgres://xtablo:xtablo@localhost:5432/xtablo?sslmode=disable' go test ./internal/web -run 'TestEvent|TestEvents|TestListUserEventsRange|TestTabloDetailEventsTabFullPageFallback' -count=1
• After every plan wave: Run cd backend && TEST_DATABASE_URL='postgres://xtablo:xtablo@localhost:5432/xtablo?sslmode=disable' go test ./... -count=1
• Before $gsd-verify-work: Full suite must be green
• Max feedback latency: 60 seconds

Per-Task Verification Map

Task ID	Plan	Wave	Requirement	Threat Ref	Secure Behavior	Test Type	Automated Command	File Exists	Status
10-01-01	01	0	EVENT-01, EVENT-05	T-10-01 / T-10-02	Event data is scoped through owned tablos and user-scoped aggregation filters by tablos.user_id	DB/integration	`cd backend && TEST_DATABASE_URL='postgres://xtablo:xtablo@localhost:5432/xtablo?sslmode=disable' go test ./internal/web -run 'TestEventCreateRendersTitleInCalendar	TestEventsTabRendersMonthGrid	TestListUserEventsRangeReturnsOnlyOwnedTablos' -count=1`
10-01-02	01	0	EVENT-01, EVENT-04	T-10-04	Invalid end times are rejected before persistence and by DB constraint	handler/DB	`cd backend && TEST_DATABASE_URL='postgres://xtablo:xtablo@localhost:5432/xtablo?sslmode=disable' go test ./internal/web -run 'TestEventCreateRejectsEndTimeBeforeOrEqualStart	TestEventUpdateRejectsInvalidEndTime' -count=1`	Yes
10-02-01	02	1	EVENT-01, EVENT-02, EVENT-03, EVENT-05	T-10-01 / T-10-03	Create/edit/delete forms require CSRF and ownership checks	handler	`cd backend && TEST_DATABASE_URL='postgres://xtablo:xtablo@localhost:5432/xtablo?sslmode=disable' go test ./internal/web -run 'TestEventEditRendersInlineForm	TestEventUpdateChangesCalendarPlacement	TestEventDeleteRemovesFromCalendarAndDatabase
10-02-02	02	1	EVENT-02, EVENT-03	T-10-05	Calendar output is escaped and HTMX fragments remain scoped to the Events tab	handler/template	`cd backend && TEST_DATABASE_URL='postgres://xtablo:xtablo@localhost:5432/xtablo?sslmode=disable' go test ./internal/web -run 'TestEventContentIsEscaped	TestTabloDetailEventsTabFullPageFallback	TestEventsTabRendersMonthGrid' -count=1`
10-03-01	03	2	EVENT-04, EVENT-05	T-10-02	Planning query returns only accessible events and includes tablo metadata	DB/integration	`cd backend && TEST_DATABASE_URL='postgres://xtablo:xtablo@localhost:5432/xtablo?sslmode=disable' go test ./internal/web -run 'TestListUserEventsRangeReturnsOnlyOwnedTablos	TestEventsMonthNavigationPushesMonthParam	TestEventNewFromDayPrefillsDate

Status: audited after execution; all automated checks map to current tests in backend/internal/web/handlers_events_test.go.

Wave 0 Requirements

• Add focused SQLC/query coverage for create/list/update/delete and user-scoped date-range aggregation.
• Add focused handler coverage for Events tab rendering, create validation, update, delete, and cross-user 404 behavior.
• Add helper coverage indirectly through handler tests for month parsing, date prefill, and submitted-value precedence.

Manual-Only Verifications

Behavior	Requirement	Why Manual	Test Instructions
Month calendar scanability and HTMX interactions	EVENT-02, EVENT-03	Layout and perceived interaction quality are browser-sensitive	Open a tablo, switch to Events, navigate months, create from New event, create from a day cell, edit an event title, delete it, and confirm the tab refreshes without leaving stale content.

Validation Sign-Off

• All tasks have automated verify or Wave 0 dependencies
• Sampling continuity: no 3 consecutive tasks without automated verify
• Wave 0 covers all missing references
• No watch-mode flags
• Feedback latency < 60s
• nyquist_compliant: true set in frontmatter

Approval: audited 2026-05-16

Validation Audit 2026-05-16

Metric	Count
Gaps found	0
Resolved	0
Escalated	0

Coverage Confirmed

• EVENT-01 is covered by creation, form submission, submitted-date precedence, no-end-time display, and ordering tests.
• EVENT-02 is covered by inline edit, update calendar refresh, hard delete, and mutation ownership tests.
• EVENT-03 is covered by the Events tab month grid, full-page fallback, HTMX month navigation, day prefill, overflow indicator, escaping, and ordering tests.
• EVENT-04 is covered by create and update invalid end-time tests plus the events_end_after_start database constraint.
• EVENT-05 is covered by tab ownership, mutation ownership, and user-scoped date-range aggregation tests.

Final Verification

Passed:

cd backend && TEST_DATABASE_URL='postgres://xtablo:xtablo@localhost:5432/xtablo?sslmode=disable' go test ./internal/web -run 'TestEvent|TestEvents|TestListUserEventsRange|TestTabloDetailEventsTabFullPageFallback' -count=1

Previously recorded as passed in 10-VERIFICATION.md:

cd backend && just generate && TEST_DATABASE_URL='postgres://xtablo:xtablo@localhost:5432/xtablo?sslmode=disable' go test ./... -count=1 && git diff --check