[P1][validation] Define and execute the full validation matrix from a clean checkout

[psam21]

Migrated from docs/pending-work-plan.md §8 + docs/Shugur-Migration-Plan.md §Validation contract.

Goal

Capture the validation contract as an executable checklist. Each row must pass from a clean checkout before any production push.

Validation matrix

Validation	Scope	Completion condition
Shell syntax	Installers, deployment scripts, NIP scripts	bash -n passes for every script
YAML structure	Compose files, CI workflow, service-adjacent config	Parser succeeds and required keys exist
Go unit tests	Relay and NIP tools	go test ./... passes
Go static checks	Relay	go vet ./... and configured linters pass
ARM64 build	Production relay artifact	CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build passes
Blossom build	Server and admin assets	pnpm install --frozen-lockfile && pnpm build passes
Blossom upload tests	Auth, hash binding, MIME, size, storage	Functional matrix passes (#103)
Relay endpoint checks	NIP-11, stats, event totals, grouped telemetry	Direct totals ready; grouped state explicit (#105)
NIP harness	Automated NIPs and manual/service review rows	Static coverage and live tests pass where configured
Security checks	Headers, auth parsing, dependency state	No regression and no secret exposure
Deployment rollback	Relay and Blossom artifacts/services	Failed restart restores prior working release (#108)
Public smoke tests	Correct hostnames and proxy paths	nostr.ltd relay and blossom.nostr.ltd Blossom respond as documented

Constraints

• Commands must be run from a clean checkout.
• Commands must never print secret environment values.
• Each row has a clear pass/fail condition.

Acceptance criteria

• All 12 rows pass from a clean checkout.
• Results recorded in the issue comment with command output snippets (no secrets).

Dependencies

• Depends on [P0][blossom] Add functional upload test matrix (auth, hash, MIME, size, storage) #103, [P0][relay] Decouple direct event totals from grouped breakdown readiness #105, [P0][deploy] Tighten deployment safeguards (clean checkout, atomic rollback, separate status reporting) #108 (the matrix references these).
• Blocks no other issues.

Source

Migrated from docs/pending-work-plan.md §8 and docs/Shugur-Migration-Plan.md Validation contract.

[psam21]

Dependency map:

• Blocked by [P0][blossom] Add functional upload test matrix (auth, hash, MIME, size, storage) #103 (upload tests).
• Blocked by [P0][relay] Decouple direct event totals from grouped breakdown readiness #105 (relay endpoint checks).
• Blocked by [P0][deploy] Tighten deployment safeguards (clean checkout, atomic rollback, separate status reporting) #108 (deployment rollback).