feat(038): Phase 3 — US2 validator safety matrix

- T013-T017b: ScenarioGraph.Validator.Validate with deterministic findings —
  duplicate steps, missing deps, cycles (with path), duplicate/missing refs,
  tool/action registry, SQL/code/path-traversal bans, raw baseline literals,
  unresolved params/selectors/baselines, coverage classification
- Decomposed to 8 helpers (C901 fixed: _validate_core 36→5 complexity)
- Property tests: chain DAGs of any length valid, self-dep cycle, dup refs
- Belief runtime: REASON/REFLECT in validate + validate_core; audit 0 errors
- 47 scenario tests pass; ruff clean

backend/tests/services/dashboard_testing/scenario/test_validator.py

@@ -0,0 +1,77 @@
+# #region Test.Scenario.Validator [C:3] [TYPE Module] [SEMANTICS testing,scenario,validator,safety]
+# @defgroup Test.Scenario Validator safety matrix tests — cycles, refs, baselines, SQL, paths.
+# @LAYER Test
+# @RELATION BINDS_TO -> [ScenarioGraph.Validator.Validate]
+# @RATIONALE The validator is the hard safety boundary between agent intent and artifact generation.
+# @REJECTED Testing only happy paths — would let unsafe graphs reach the pack compiler.
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+from src.services.dashboard_testing.scenario.models import DashboardTestScenario
+from src.services.dashboard_testing.scenario.validator import validate_scenario
+
+_FIXTURES = Path(__file__).resolve().parents[3] / "fixtures" / "dashboard_scenarios"
+
+
+def _load(name: str) -> DashboardTestScenario:
+    data = json.loads((_FIXTURES / name).read_text(encoding="utf-8"))
+    return DashboardTestScenario.model_validate(data)
+
+
+def _codes(result) -> set[str]:
+    return {f.code for f in result.errors} | {f.code for f in result.blockers}
+
+
+def test_valid_fixture_passes() -> None:
+    result = validate_scenario(_load("scenario_valid.json"))
+    assert result.valid is True
+    assert not result.errors
+    assert not result.blockers
+
+
+def test_cycle_detected_with_path() -> None:
+    result = validate_scenario(_load("scenario_cycle.json"))
+    assert result.valid is False
+    assert "CYCLE" in _codes(result)
+    assert any("step-a" in f.message and "step-b" in f.message for f in result.errors)
+
+
+def test_missing_ref_detected() -> None:
+    result = validate_scenario(_load("scenario_missing_ref.json"))
+    assert result.valid is False
+    assert "MISSING_REF" in _codes(result)
+
+
+def test_duplicate_output_detected() -> None:
+    result = validate_scenario(_load("scenario_duplicate_output.json"))
+    assert result.valid is False
+    assert "DUPLICATE_OUTPUT" in _codes(result)
+    assert any("phase-3-B01-execute_metric" in f.message for f in result.errors)
+
+
+def test_raw_baseline_literal_rejected() -> None:
+    result = validate_scenario(_load("scenario_raw_baseline.json"))
+    assert result.valid is False
+    assert "RAW_METRIC_TRUTH" in _codes(result)
+
+
+def test_sql_rejected() -> None:
+    result = validate_scenario(_load("scenario_sql_injection.json"))
+    assert result.valid is False
+    assert "FORBIDDEN_SQL" in _codes(result)
+
+
+def test_unreachable_step_warned() -> None:
+    result = validate_scenario(_load("scenario_valid.json"))
+    # valid fixture has all steps reachable; unknown tool/action is caught elsewhere
+    assert result.valid is True
+
+
+def test_findings_deterministic_order() -> None:
+    a = validate_scenario(_load("scenario_cycle.json"))
+    b = validate_scenario(_load("scenario_cycle.json"))
+    assert [f.code for f in a.errors] == [f.code for f in b.errors]
+    assert [f.code for f in a.blockers] == [f.code for f in b.blockers]

backend/tests/services/dashboard_testing/scenario/test_validator_belief.py

@@ -0,0 +1,42 @@
+# #region Test.Scenario.ValidatorBelief [C:3] [TYPE Module] [SEMANTICS testing,scenario,validator,belief]
+# @defgroup Test.Scenario Belief runtime instrumentation tests for ScenarioGraph.Validator.Validate.
+# @LAYER Test
+# @RELATION BINDS_TO -> [ScenarioGraph.Validator.Validate]
+# @RATIONALE C4/C5 contracts must emit REASON/REFLECT/EXPLORE markers; tests prove the instrumentation.
+# @REJECTED Testing only outputs — would let uninstrumented C5 code pass the belief gate.
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+import pytest
+
+from src.services.dashboard_testing.scenario.models import DashboardTestScenario
+from src.services.dashboard_testing.scenario.validator import validate_scenario
+
+_FIXTURES = Path(__file__).resolve().parents[3] / "fixtures" / "dashboard_scenarios"
+
+
+def _load(name: str) -> DashboardTestScenario:
+    return DashboardTestScenario.model_validate(json.loads((_FIXTURES / name).read_text(encoding="utf-8")))
+
+
+def test_validator_emits_reason_and_reflect(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Validator must log REASON (before) and REFLECT (after) markers."""
+    calls: list[tuple[str, str, str]] = []
+
+    def _fake_log(src: str, marker: str, intent: str, payload: dict | None = None, **_kwargs) -> None:
+        calls.append((src, marker, intent))
+        _ = payload  # captured; intent + marker are the asserted contract
+
+    import src.services.dashboard_testing.scenario.validator as validator_mod
+
+    monkeypatch.setattr(validator_mod, "log", _fake_log)
+    validate_scenario(_load("scenario_valid.json"))
+
+    reasons = [i for (s, m, i) in calls if m == "REASON" and "Validator" in s]
+    reflects = [i for (s, m, i) in calls if m == "REFLECT" and "Validator" in s]
+    assert reasons, "validator must emit REASON"
+    assert reflects, "validator must emit REFLECT"
+    assert any("Validating scenario" in i for i in reasons)
+    assert any("Validation complete" in i for i in reflects)

backend/tests/services/dashboard_testing/scenario/test_validator_properties.py

@@ -0,0 +1,67 @@
+# #region Test.Scenario.ValidatorProperties [C:3] [TYPE Module] [SEMANTICS testing,scenario,validator,property]
+# @defgroup Test.Scenario Property tests for validator invariants (DAG/cycle/ref variations).
+# @LAYER Test
+# @RELATION BINDS_TO -> [ScenarioGraph.Validator.Validate]
+# @RATIONALE Property tests explore graph shapes without mirroring the validator logic.
+# @REJECTED Testing by re-implementing validation in the test — would be a logic mirror.
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+import pytest
+
+from src.services.dashboard_testing.scenario.models import DashboardTestScenario
+from src.services.dashboard_testing.scenario.validator import validate_scenario
+
+_FIXTURES = Path(__file__).resolve().parents[3] / "fixtures" / "dashboard_scenarios"
+
+
+def _base() -> DashboardTestScenario:
+    data = json.loads((_FIXTURES / "scenario_valid.json").read_text(encoding="utf-8"))
+    return DashboardTestScenario.model_validate(data)
+
+
+def test_valid_graph_always_valid() -> None:
+    sc = _base()
+    assert validate_scenario(sc).valid is True
+
+
+@pytest.mark.parametrize("chain_len", [3, 5, 10])
+def test_chain_dag_valid_for_any_length(chain_len: int) -> None:
+    """A pure chain of steps is always a valid DAG regardless of length."""
+    sc = _base()
+    steps = sc.model_dump()["steps"]
+    # rebuild a simple chain on top of the first step
+    chain = steps[:1]
+    for i in range(1, chain_len):
+        prev = chain[-1]["id"]
+        step = {
+            **steps[0],
+            "id": f"chain-{i}",
+            "depends_on": [prev],
+            "outputs": [{"name": f"step.chain-{i}.out", "kind": "step_output", "value_type": "boolean"}],
+        }
+        chain.append(step)
+    sc2 = DashboardTestScenario.model_validate({**sc.model_dump(), "steps": chain})
+    result = validate_scenario(sc2)
+    assert "CYCLE" not in {f.code for f in result.errors}
+
+
+@pytest.mark.parametrize("n", [1, 2, 3])
+def test_self_dependency_is_cycle(n: int) -> None:
+    sc = _base()
+    steps = sc.model_dump()["steps"]
+    step = {**steps[0], "id": f"self-{n}", "depends_on": [f"self-{n}"]}
+    sc2 = DashboardTestScenario.model_validate({**sc.model_dump(), "steps": [step]})
+    result = validate_scenario(sc2)
+    assert "CYCLE" in {f.code for f in result.errors}
+
+
+def test_duplicate_ref_always_rejected() -> None:
+    sc = _base()
+    data = sc.model_dump()
+    step_a = {**data["steps"][0], "id": "dup-a", "outputs": [{"name": "step.shared.out", "kind": "step_output", "value_type": "boolean"}]}
+    step_b = {**data["steps"][1], "id": "dup-b", "outputs": [{"name": "step.shared.out", "kind": "step_output", "value_type": "boolean"}]}
+    sc2 = DashboardTestScenario.model_validate({**data, "steps": [step_a, step_b]})
+    assert "DUPLICATE_OUTPUT" in {f.code for f in validate_scenario(sc2).errors}