docs(09): validation strategy + demo-deadline constraint for BotFights phase

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.planning/phases/09-botfights-platform-upgrade/09-CONTEXT.md

@@ -29,6 +29,10 @@ BotFights is a standalone app (separate repo) distributed to Archipelago nodes a
 - IN: botfights repo changes (server + frontend + docs/prompt), VPS2 public arena deployment, archy manifest/catalog update, dev-pair verification.
 - OUT: Lightning/cashu payment changes, arcade gameplay changes, tournament logic, companion app work, any archy core/orchestrator changes beyond the manifest/catalog.
 
+## Hard Deadline / Demo Constraint (added 2026-07-30)
+
+**The user demos this TOMORROW (2026-07-31) from archi-dev-box.** Everything must be deployed and verified working on archi-dev-box before end of this phase. Real bot testing will be done with a **cloud-hosted "openclaw" bot** — meaning: the VPS2 public arena must be internet-reachable with TLS, the unified AI bot-setup prompt must be sufficient for a cloud agent to register and fight using only that prompt, and webhook/polling must work from outside the LAN (cloud bot → public arena). Prioritize the demo-critical path over nice-to-haves.
+
 ## Constraints & Process Rules
 
 - Rootless podman invariants on nodes; VPS2 uses docker + nginx-proxy-manager (this is host infra, not a node app).

.planning/phases/09-botfights-platform-upgrade/09-VALIDATION.md

@@ -0,0 +1,67 @@
+---
+phase: 9
+slug: botfights-platform-upgrade
+# status lifecycle: draft (seeded by plan-phase) → validated (set by validate-phase §6)
+status: draft
+nyquist_compliant: false
+wave_0_complete: false
+created: 2026-07-30
+---
+
+# Phase 9 — Validation Strategy
+
+> Per-phase validation contract for feedback sampling during execution.
+
+---
+
+## Test Infrastructure
+
+| Property | Value |
+|----------|-------|
+| **Framework** | Vitest (server + frontend projects) + Playwright e2e — in the `botfight` repo, NOT archy |
+| **Config file** | `botfight/vitest.workspace.ts`, `botfight/frontend/vitest.config.ts`, `botfight/e2e/playwright.config.ts` |
+| **Quick run command** | `cd /home/archipelago/Projects/botfight && pnpm test -- --run` |
+| **Full suite command** | `cd /home/archipelago/Projects/botfight && pnpm test -- --run && pnpm test:e2e` |
+| **Estimated runtime** | ~60s unit, ~3–5 min with e2e |
+
+---
+
+## Sampling Rate
+
+- **After every task commit:** `pnpm test -- --run` (botfight repo, unit only)
+- **After every plan wave:** full suite + `cargo test` for archy manifest change where relevant
+- **Before `/gsd-verify-work`:** Full suite green + manual real-path checks below
+- **Max feedback latency:** ~120 seconds
+
+---
+
+## Per-Task Verification Map
+
+| Task ID | Plan | Wave | Requirement | Threat Ref | Secure Behavior | Test Type | Automated Command | File Exists | Status |
+|---------|------|------|-------------|------------|-----------------|-----------|-------------------|-------------|--------|
+| TBD by planner | — | — | BOT-01 | NIP-98 forgery/replay | signature+window+path verified server-side | unit | `pnpm vitest run server/src/middleware/nip98.test.ts` | ✅ | ⬜ pending |
+| TBD by planner | — | — | BOT-01 | session theft | JWT issue/verify/blacklist | unit | `pnpm vitest run server/src/middleware/jwt.test.ts` | ✅ | ⬜ pending |
+| TBD by planner | — | — | BOT-01 | legacy bypass | no bare-pubkey login path remains | unit | `pnpm vitest run server/src/routes/auth.test.ts server/src/routes/auth-edge.test.ts server/src/routes/auth-audit.test.ts` | ✅ | ⬜ pending |
+| TBD by planner | — | — | BOT-02 | N/A | prompt-documented flow works exactly as written | e2e | `pnpm test:e2e -- e2e/signup-bot.spec.ts` (extended) | ✅ extend | ⬜ pending |
+| TBD by planner | — | — | BOT-03 | SSRF/leak via proxy | REST + SSE forwarding correct, no header leak | integration | `pnpm vitest run server/src/middleware/arena-proxy.test.ts` | ❌ W0 | ⬜ pending |
+| TBD by planner | — | — | BOT-04 | crash-loop | manifest declares JWT_SECRET via generated_secrets | unit (archy) | `cd core && cargo test -p container manifest` | partial | ⬜ pending |
+
+*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*
+
+---
+
+## Wave 0 Requirements
+
+- [ ] `server/src/routes/auth-me.test.ts` — new `GET /api/auth/me` route coverage (BOT-01)
+- [ ] `server/src/middleware/arena-proxy.test.ts` — REST + SSE forwarding correctness (BOT-03)
+- [ ] Manual demo-checklist doc (execution-phase artifact) — real NIP-07 extension login, Amber NIP-55 login, real cross-node fight visibility
+- [ ] No framework install needed — Vitest/Playwright already configured
+
+---
+
+## Manual-Only Verifications
+
+- Real NIP-07 signer login in a real browser (nos2x/Alby) on archi-dev-box — no `window.nostr` mock exists in Playwright.
+- Amber (NIP-55) login from Android against the archi-dev-box instance.
+- Cross-node fighter visibility: bot registered via VPS2 public arena appears on archi-dev-box instance and can fight.
+- Cloud openclaw bot registers + fights using ONLY the unified prompt against the public arena (demo rehearsal, 2026-07-31).