diff --git a/.planning/phases/01-foundation/01-VALIDATION.md b/.planning/phases/01-foundation/01-VALIDATION.md
new file mode 100644
index 0000000..3eaf06d
--- /dev/null
+++ b/.planning/phases/01-foundation/01-VALIDATION.md
@@ -0,0 +1,95 @@
+---
+phase: 1
+slug: foundation
+status: draft
+nyquist_compliant: false
+wave_0_complete: false
+created: 2026-03-23
+---
+
+# Phase 1 — Validation Strategy
+
+> Per-phase validation contract for feedback sampling during execution.
+
+---
+
+## Test Infrastructure
+
+| Property | Value |
+|----------|-------|
+| **Framework** | pytest 8.x + pytest-asyncio 0.24+ |
+| **Config file** | `pyproject.toml` — `[tool.pytest.ini_options]` section (Wave 0) |
+| **Quick run command** | `pytest tests/unit -x -q` |
+| **Full suite command** | `pytest tests/ -x` |
+| **Estimated runtime** | ~30 seconds |
+
+---
+
+## Sampling Rate
+
+- **After every task commit:** Run `pytest tests/unit -x -q`
+- **After every plan wave:** Run `pytest tests/ -x`
+- **Before `/gsd:verify-work`:** Full suite must be green
+- **Max feedback latency:** 30 seconds
+
+---
+
+## Per-Task Verification Map
+
+| Task ID | Plan | Wave | Requirement | Test Type | Automated Command | File Exists | Status |
+|---------|------|------|-------------|-----------|-------------------|-------------|--------|
+| 01-01-xx | 01 | 1 | CHAN-01 | unit | `pytest tests/unit/test_normalize.py -x` | ❌ W0 | ⬜ pending |
+| 01-01-xx | 01 | 1 | TNNT-01 | integration | `pytest tests/integration/test_tenant_isolation.py -x` | ❌ W0 | ⬜ pending |
+| 01-01-xx | 01 | 1 | TNNT-02 | unit | `pytest tests/unit/test_tenant_resolution.py -x` | ❌ W0 | ⬜ pending |
+| 01-01-xx | 01 | 1 | TNNT-03 | unit | `pytest tests/unit/test_redis_namespacing.py -x` | ❌ W0 | ⬜ pending |
+| 01-02-xx | 02 | 1 | LLM-01 | integration | `pytest tests/integration/test_llm_fallback.py -x` | ❌ W0 | ⬜ pending |
+| 01-02-xx | 02 | 1 | LLM-02 | integration | `pytest tests/integration/test_llm_providers.py -x` | ❌ W0 | ⬜ pending |
+| 01-03-xx | 03 | 2 | CHAN-02 | integration | `pytest tests/integration/test_slack_flow.py -x` | ❌ W0 | ⬜ pending |
+| 01-03-xx | 03 | 2 | CHAN-05 | unit+integ | `pytest tests/unit/test_ratelimit.py tests/integration/test_ratelimit.py -x` | ❌ W0 | ⬜ pending |
+| 01-03-xx | 03 | 2 | AGNT-01 | integration | `pytest tests/integration/test_agent_persona.py -x` | ❌ W0 | ⬜ pending |
+| 01-04-xx | 04 | 2 | PRTA-01 | integration | `pytest tests/integration/test_portal_tenants.py -x` | ❌ W0 | ⬜ pending |
+| 01-04-xx | 04 | 2 | PRTA-02 | integration | `pytest tests/integration/test_portal_agents.py -x` | ❌ W0 | ⬜ pending |
+
+*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*
+
+---
+
+## Wave 0 Requirements
+
+- [ ] `pyproject.toml` — add `[tool.pytest.ini_options]` with `asyncio_mode = "auto"` and `testpaths = ["tests"]`
+- [ ] `tests/conftest.py` — shared fixtures: async DB session, two-tenant fixture (tenant_a, tenant_b), Redis mock, LiteLLM mock
+- [ ] `tests/unit/test_normalize.py` — CHAN-01: Slack payload → KonstructMessage
+- [ ] `tests/unit/test_tenant_resolution.py` — TNNT-02: workspace_id lookup
+- [ ] `tests/unit/test_ratelimit.py` — CHAN-05: token bucket behavior
+- [ ] `tests/unit/test_redis_namespacing.py` — TNNT-03: key prefix enforcement
+- [ ] `tests/integration/test_tenant_isolation.py` — TNNT-01: two-tenant RLS fixture (most critical test in phase)
+- [ ] `tests/integration/test_slack_flow.py` — CHAN-02: end-to-end Slack → LLM → reply
+- [ ] `tests/integration/test_llm_fallback.py` — LLM-01: LiteLLM fallback behavior
+- [ ] `tests/integration/test_llm_providers.py` — LLM-02: Ollama + Anthropic routing
+- [ ] `tests/integration/test_agent_persona.py` — AGNT-01: persona reflected in LLM prompt
+- [ ] `tests/integration/test_portal_tenants.py` — PRTA-01: tenant CRUD API
+- [ ] `tests/integration/test_portal_agents.py` — PRTA-02: Agent Designer API
+- [ ] Framework install: `uv add --dev pytest pytest-asyncio pytest-httpx`
+
+*Greenfield project — all test files are new.*
+
+---
+
+## Manual-Only Verifications
+
+| Behavior | Requirement | Why Manual | Test Instructions |
+|----------|-------------|------------|-------------------|
+| TLS enforced on all inter-service communication | TNNT-04 | Docker Compose network config; no in-process test | Verify docker-compose.yml uses TLS between services; inspect with `openssl s_client` |
+
+---
+
+## Validation Sign-Off
+
+- [ ] All tasks have `<automated>` verify or Wave 0 dependencies
+- [ ] Sampling continuity: no 3 consecutive tasks without automated verify
+- [ ] Wave 0 covers all MISSING references
+- [ ] No watch-mode flags
+- [ ] Feedback latency < 30s
+- [ ] `nyquist_compliant: true` set in frontmatter
+
+**Approval:** pending