diff --git a/.planning/phases/07-login-auth/07-VALIDATION.md b/.planning/phases/07-login-auth/07-VALIDATION.md
new file mode 100644
index 0000000..b29ca9c
--- /dev/null
+++ b/.planning/phases/07-login-auth/07-VALIDATION.md
@@ -0,0 +1,85 @@
+---
+phase: 7
+slug: login-auth
+status: draft
+nyquist_compliant: false
+wave_0_complete: false
+created: 2026-03-17
+---
+
+# Phase 7 — Validation Strategy
+
+> Per-phase validation contract for feedback sampling during execution.
+
+---
+
+## Test Infrastructure
+
+| Property | Value |
+|----------|-------|
+| **Framework** | pytest |
+| **Config file** | pytest.ini |
+| **Quick run command** | `pytest tests/test_auth/ -x -v` |
+| **Full suite command** | `pytest tests/ -v` |
+| **Estimated runtime** | ~15 seconds |
+
+---
+
+## Sampling Rate
+
+- **After every task commit:** Run `pytest tests/test_auth/ -x`
+- **After every plan wave:** Run `pytest tests/ -v`
+- **Before `/gsd:verify-work`:** Full suite must be green
+- **Max feedback latency:** 15 seconds
+
+---
+
+## Per-Task Verification Map
+
+| Task ID | Plan | Wave | Requirement | Test Type | Automated Command | File Exists | Status |
+|---------|------|------|-------------|-----------|-------------------|-------------|--------|
+| 7-01-01 | 01 | 1 | AUTH-01 | unit+integration | `pytest tests/test_auth/test_qrcode_login.py -x` | ❌ W0 | ⬜ pending |
+| 7-01-02 | 01 | 1 | AUTH-01 | unit | `pytest tests/test_auth/test_qrcode_login.py -x` | ❌ W0 | ⬜ pending |
+| 7-02-01 | 02 | 1 | AUTH-02 | unit | `pytest tests/test_auth/test_cookie_import.py -x` | ❌ W0 | ⬜ pending |
+| 7-02-02 | 02 | 1 | AUTH-03 | unit | `pytest tests/test_auth/test_cookie_persistence.py -x` | ❌ W0 | ⬜ pending |
+| 7-03-01 | 03 | 2 | AUTH-04 | unit | `pytest tests/test_auth/test_cookie_validation.py -x` | ❌ W0 | ⬜ pending |
+
+*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*
+
+---
+
+## Wave 0 Requirements
+
+- [ ] `tests/test_auth/__init__.py` — 测试模块初始化
+- [ ] `tests/test_auth/conftest.py` — 共享 fixtures (mock browser, mock env file)
+- [ ] `tests/test_auth/test_qrcode_login.py` — AUTH-01 二维码登录测试
+- [ ] `tests/test_auth/test_cookie_import.py` — AUTH-02 Cookie 导入测试
+- [ ] `tests/test_auth/test_cookie_persistence.py` — AUTH-03 Cookie 持久化测试
+- [ ] `tests/test_auth/test_cookie_validation.py` — AUTH-04 Cookie 验证测试
+
+**测试策略:**
+- 使用 `unittest.mock` 模拟 Playwright browser 和 context
+- 使用 `tmp_path` fixture 创建临时 `~/.kb_env` 文件
+- Cookie 验证测试使用 mock HTTP 响应
+
+---
+
+## Manual-Only Verifications
+
+| Behavior | Requirement | Why Manual | Test Instructions |
+|----------|-------------|------------|-------------------|
+| 二维码显示给用户 | AUTH-01 | 需要 GUI 环境和人工扫码 | 1. 运行 `python kb-workflow/kb_workflow.py login` 2. 验证二维码图片生成 3. 扫码确认登录成功 |
+| Cookie 过期后重新扫码 | AUTH-04 | 需要等待 Cookie 真实过期 | 1. 使用过期 Cookie 2. 运行命令 3. 确认自动触发扫码流程 |
+
+---
+
+## Validation Sign-Off
+
+- [ ] All tasks have `<automated>` verify or Wave 0 dependencies
+- [ ] Sampling continuity: no 3 consecutive tasks without automated verify
+- [ ] Wave 0 covers all MISSING references
+- [ ] No watch-mode flags
+- [ ] Feedback latency < 15s
+- [ ] `nyquist_compliant: true` set in frontmatter
+
+**Approval:** pending